From: Sasha Levin Date: Sun, 17 May 2020 03:54:59 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v4.4.224~50 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=64f0f0b4a784a6fe162fa318bd11c93d9539cd0f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/alsa-hda-hdmi-fix-race-in-monitor-detection-during-p.patch b/queue-4.19/alsa-hda-hdmi-fix-race-in-monitor-detection-during-p.patch new file mode 100644 index 00000000000..9c414623b03 --- /dev/null +++ b/queue-4.19/alsa-hda-hdmi-fix-race-in-monitor-detection-during-p.patch @@ -0,0 +1,49 @@ +From b064fd6ab25e9421fed38e7794cce0fe9fd98e0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Apr 2020 15:38:36 +0300 +Subject: ALSA: hda/hdmi: fix race in monitor detection during probe + +From: Kai Vehmanen + +[ Upstream commit ca76282b6faffc83601c25bd2a95f635c03503ef ] + +A race exists between build_pcms() and build_controls() phases of codec +setup. Build_pcms() sets up notifier for jack events. If a monitor event +is received before build_controls() is run, the initial jack state is +lost and never reported via mixer controls. + +The problem can be hit at least with SOF as the controller driver. SOF +calls snd_hda_codec_build_controls() in its workqueue-based probe and +this can be delayed enough to hit the race condition. + +Fix the issue by invalidating the per-pin ELD information when +build_controls() is called. The existing call to hdmi_present_sense() +will update the ELD contents. This ensures initial monitor state is +correctly reflected via mixer controls. + +BugLink: https://github.com/thesofproject/linux/issues/1687 +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20200428123836.24512-1-kai.vehmanen@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_hdmi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 12a064f994b1a..1d83c3c59e1ac 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2211,7 +2211,9 @@ static int generic_hdmi_build_controls(struct hda_codec *codec) + + for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) { + struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx); ++ struct hdmi_eld *pin_eld = &per_pin->sink_eld; + ++ pin_eld->eld_valid = false; + hdmi_present_sense(per_pin, 0); + } + +-- +2.20.1 + diff --git a/queue-4.19/alsa-hda-realtek-fix-s3-pop-noise-on-dell-wyse.patch b/queue-4.19/alsa-hda-realtek-fix-s3-pop-noise-on-dell-wyse.patch new file mode 100644 index 00000000000..12f0b5b6663 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-fix-s3-pop-noise-on-dell-wyse.patch @@ -0,0 +1,72 @@ +From 5f03f19610d660800c5dc6c7769ffe400f04f808 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 May 2020 23:24:47 +0800 +Subject: ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse + +From: Kai-Heng Feng + +[ Upstream commit 52e4e36807aeac1cdd07b14e509c8a64101e1a09 ] + +Commit 317d9313925c ("ALSA: hda/realtek - Set default power save node to +0") makes the ALC225 have pop noise on S3 resume and cold boot. + +The previous fix enable power save node universally for ALC225, however +it makes some ALC225 systems unable to produce any sound. + +So let's only enable power save node for the affected Dell Wyse +platform. + +Fixes: 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") +BugLink: https://bugs.launchpad.net/bugs/1866357 +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20200503152449.22761-2-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index fc39550f6c5d5..cf2889f3da41f 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5524,6 +5524,15 @@ static void alc233_alc662_fixup_lenovo_dual_codecs(struct hda_codec *codec, + } + } + ++static void alc225_fixup_s3_pop_noise(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action != HDA_FIXUP_ACT_PRE_PROBE) ++ return; ++ ++ codec->power_save_node = 1; ++} ++ + /* Forcibly assign NID 0x03 to HP/LO while NID 0x02 to SPK for EQ */ + static void alc274_fixup_bind_dacs(struct hda_codec *codec, + const struct hda_fixup *fix, int action) +@@ -5690,6 +5699,7 @@ enum { + ALC233_FIXUP_ACER_HEADSET_MIC, + ALC294_FIXUP_LENOVO_MIC_LOCATION, + ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE, ++ ALC225_FIXUP_S3_POP_NOISE, + ALC700_FIXUP_INTEL_REFERENCE, + ALC274_FIXUP_DELL_BIND_DACS, + ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, +@@ -6546,6 +6556,12 @@ static const struct hda_fixup alc269_fixups[] = { + { } + }, + .chained = true, ++ .chain_id = ALC225_FIXUP_S3_POP_NOISE ++ }, ++ [ALC225_FIXUP_S3_POP_NOISE] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc225_fixup_s3_pop_noise, ++ .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC + }, + [ALC700_FIXUP_INTEL_REFERENCE] = { +-- +2.20.1 + diff --git a/queue-4.19/arm64-fix-the-flush_icache_range-arguments-in-machin.patch b/queue-4.19/arm64-fix-the-flush_icache_range-arguments-in-machin.patch new file mode 100644 index 00000000000..7dac4a18816 --- /dev/null +++ b/queue-4.19/arm64-fix-the-flush_icache_range-arguments-in-machin.patch @@ -0,0 +1,35 @@ +From 87a8a94cbb6051c4bfc2af05a54b4458b797385a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 May 2020 09:54:41 +0200 +Subject: arm64: fix the flush_icache_range arguments in machine_kexec + +From: Christoph Hellwig + +[ Upstream commit d51c214541c5154dda3037289ee895ea3ded5ebd ] + +The second argument is the end "pointer", not the length. + +Fixes: d28f6df1305a ("arm64/kexec: Add core kexec support") +Cc: # 4.8.x- +Signed-off-by: Christoph Hellwig +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/machine_kexec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c +index 922add8adb749..5e26ef0078638 100644 +--- a/arch/arm64/kernel/machine_kexec.c ++++ b/arch/arm64/kernel/machine_kexec.c +@@ -192,6 +192,7 @@ void machine_kexec(struct kimage *kimage) + * the offline CPUs. Therefore, we must use the __* variant here. + */ + __flush_icache_range((uintptr_t)reboot_code_buffer, ++ (uintptr_t)reboot_code_buffer + + arm64_relocate_new_kernel_size); + + /* Flush the kimage list and its buffers. */ +-- +2.20.1 + diff --git a/queue-4.19/cpufreq-intel_pstate-only-mention-the-bios-disabling.patch b/queue-4.19/cpufreq-intel_pstate-only-mention-the-bios-disabling.patch new file mode 100644 index 00000000000..9bce8a21739 --- /dev/null +++ b/queue-4.19/cpufreq-intel_pstate-only-mention-the-bios-disabling.patch @@ -0,0 +1,37 @@ +From 3693794b7b49914b72edff9ec909848806b67f45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Apr 2020 20:26:29 +0100 +Subject: cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode + once + +From: Chris Wilson + +[ Upstream commit 8c539776ac83c0857395e1ccc9c6b516521a2d32 ] + +Make a note of the first time we discover the turbo mode has been +disabled by the BIOS, as otherwise we complain every time we try to +update the mode. + +Signed-off-by: Chris Wilson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/intel_pstate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 29f25d5d65e00..e7b3d4ed8eff4 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -957,7 +957,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b, + + update_turbo_state(); + if (global.turbo_disabled) { +- pr_warn("Turbo disabled by BIOS or unavailable on processor\n"); ++ pr_notice_once("Turbo disabled by BIOS or unavailable on processor\n"); + mutex_unlock(&intel_pstate_limits_lock); + mutex_unlock(&intel_pstate_driver_lock); + return -EPERM; +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-mmp_tdma-reset-channel-error-on-release.patch b/queue-4.19/dmaengine-mmp_tdma-reset-channel-error-on-release.patch new file mode 100644 index 00000000000..29a8cd0a400 --- /dev/null +++ b/queue-4.19/dmaengine-mmp_tdma-reset-channel-error-on-release.patch @@ -0,0 +1,41 @@ +From 7b8ca486b1b88b45c027ddf9746efda8407147f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Apr 2020 18:49:09 +0200 +Subject: dmaengine: mmp_tdma: Reset channel error on release + +From: Lubomir Rintel + +[ Upstream commit 0c89446379218698189a47871336cb30286a7197 ] + +When a channel configuration fails, the status of the channel is set to +DEV_ERROR so that an attempt to submit it fails. However, this status +sticks until the heat end of the universe, making it impossible to +recover from the error. + +Let's reset it when the channel is released so that further use of the +channel with correct configuration is not impacted. + +Signed-off-by: Lubomir Rintel +Link: https://lore.kernel.org/r/20200419164912.670973-5-lkundrak@v3.sk +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/mmp_tdma.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/mmp_tdma.c b/drivers/dma/mmp_tdma.c +index 13c68b6434ce2..15b4a44e60069 100644 +--- a/drivers/dma/mmp_tdma.c ++++ b/drivers/dma/mmp_tdma.c +@@ -362,6 +362,8 @@ static void mmp_tdma_free_descriptor(struct mmp_tdma_chan *tdmac) + gen_pool_free(gpool, (unsigned long)tdmac->desc_arr, + size); + tdmac->desc_arr = NULL; ++ if (tdmac->status == DMA_ERROR) ++ tdmac->status = DMA_COMPLETE; + + return; + } +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-pch_dma.c-avoid-data-race-between-probe-an.patch b/queue-4.19/dmaengine-pch_dma.c-avoid-data-race-between-probe-an.patch new file mode 100644 index 00000000000..fbda3ae0cde --- /dev/null +++ b/queue-4.19/dmaengine-pch_dma.c-avoid-data-race-between-probe-an.patch @@ -0,0 +1,47 @@ +From 8d8b44aa16c86cbf4dbaf72332c066e403e120de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Apr 2020 11:53:35 +0530 +Subject: dmaengine: pch_dma.c: Avoid data race between probe and irq handler + +From: Madhuparna Bhowmik + +[ Upstream commit 2e45676a4d33af47259fa186ea039122ce263ba9 ] + +pd->dma.dev is read in irq handler pd_irq(). +However, it is set to pdev->dev after request_irq(). +Therefore, set pd->dma.dev to pdev->dev before request_irq() to +avoid data race between pch_dma_probe() and pd_irq(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Madhuparna Bhowmik +Link: https://lore.kernel.org/r/20200416062335.29223-1-madhuparnabhowmik10@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/pch_dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c +index afd8f27bda969..6e91584c36770 100644 +--- a/drivers/dma/pch_dma.c ++++ b/drivers/dma/pch_dma.c +@@ -873,6 +873,7 @@ static int pch_dma_probe(struct pci_dev *pdev, + } + + pci_set_master(pdev); ++ pd->dma.dev = &pdev->dev; + + err = request_irq(pdev->irq, pd_irq, IRQF_SHARED, DRV_NAME, pd); + if (err) { +@@ -888,7 +889,6 @@ static int pch_dma_probe(struct pci_dev *pdev, + goto err_free_irq; + } + +- pd->dma.dev = &pdev->dev; + + INIT_LIST_HEAD(&pd->dma.channels); + +-- +2.20.1 + diff --git a/queue-4.19/drm-qxl-lost-qxl_bo_kunmap_atomic_page-in-qxl_image_.patch b/queue-4.19/drm-qxl-lost-qxl_bo_kunmap_atomic_page-in-qxl_image_.patch new file mode 100644 index 00000000000..7065e0b38d3 --- /dev/null +++ b/queue-4.19/drm-qxl-lost-qxl_bo_kunmap_atomic_page-in-qxl_image_.patch @@ -0,0 +1,36 @@ +From 9f3b3a8ee30eabb012e934e737254b62e1a9d82a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Apr 2020 12:34:36 +0300 +Subject: drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() + +From: Vasily Averin + +[ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ] + +v2: removed TODO reminder + +Signed-off-by: Vasily Averin +Link: http://patchwork.freedesktop.org/patch/msgid/a4e0ae09-a73c-1c62-04ef-3f990d41bea9@virtuozzo.com +Signed-off-by: Gerd Hoffmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/qxl/qxl_image.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/qxl/qxl_image.c b/drivers/gpu/drm/qxl/qxl_image.c +index 7fbcc35e8ad35..c89c10055641e 100644 +--- a/drivers/gpu/drm/qxl/qxl_image.c ++++ b/drivers/gpu/drm/qxl/qxl_image.c +@@ -210,7 +210,8 @@ qxl_image_init_helper(struct qxl_device *qdev, + break; + default: + DRM_ERROR("unsupported image bit depth\n"); +- return -EINVAL; /* TODO: cleanup */ ++ qxl_bo_kunmap_atomic_page(qdev, image_bo, ptr); ++ return -EINVAL; + } + image->u.bitmap.flags = QXL_BITMAP_TOP_DOWN; + image->u.bitmap.x = width; +-- +2.20.1 + diff --git a/queue-4.19/gfs2-another-gfs2_walk_metadata-fix.patch b/queue-4.19/gfs2-another-gfs2_walk_metadata-fix.patch new file mode 100644 index 00000000000..4a5833ccd3b --- /dev/null +++ b/queue-4.19/gfs2-another-gfs2_walk_metadata-fix.patch @@ -0,0 +1,77 @@ +From 114432dc7c87923b95696344b7cddc960eea7826 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Apr 2020 19:42:04 +0200 +Subject: gfs2: Another gfs2_walk_metadata fix + +From: Andreas Gruenbacher + +[ Upstream commit 566a2ab3c9005f62e784bd39022d58d34ef4365c ] + +Make sure we don't walk past the end of the metadata in gfs2_walk_metadata: the +inode holds fewer pointers than indirect blocks. + +Slightly clean up gfs2_iomap_get. + +Fixes: a27a0c9b6a20 ("gfs2: gfs2_walk_metadata fix") +Cc: stable@vger.kernel.org # v5.3+ +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Bob Peterson +Signed-off-by: Sasha Levin +--- + fs/gfs2/bmap.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index 096b479721395..43f53020553b5 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -530,10 +530,12 @@ static int gfs2_walk_metadata(struct inode *inode, struct metapath *mp, + + /* Advance in metadata tree. */ + (mp->mp_list[hgt])++; +- if (mp->mp_list[hgt] >= sdp->sd_inptrs) { +- if (!hgt) ++ if (hgt) { ++ if (mp->mp_list[hgt] >= sdp->sd_inptrs) ++ goto lower_metapath; ++ } else { ++ if (mp->mp_list[hgt] >= sdp->sd_diptrs) + break; +- goto lower_metapath; + } + + fill_up_metapath: +@@ -879,10 +881,9 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, + ret = -ENOENT; + goto unlock; + } else { +- /* report a hole */ + iomap->offset = pos; + iomap->length = length; +- goto do_alloc; ++ goto hole_found; + } + } + iomap->length = size; +@@ -936,8 +937,6 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, + return ret; + + do_alloc: +- iomap->addr = IOMAP_NULL_ADDR; +- iomap->type = IOMAP_HOLE; + if (flags & IOMAP_REPORT) { + if (pos >= size) + ret = -ENOENT; +@@ -959,6 +958,9 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, + if (pos < size && height == ip->i_height) + ret = gfs2_hole_size(inode, lblock, len, mp, iomap); + } ++hole_found: ++ iomap->addr = IOMAP_NULL_ADDR; ++ iomap->type = IOMAP_HOLE; + goto out; + } + +-- +2.20.1 + diff --git a/queue-4.19/hwmon-da9052-synchronize-access-with-mfd.patch b/queue-4.19/hwmon-da9052-synchronize-access-with-mfd.patch new file mode 100644 index 00000000000..d3972dca520 --- /dev/null +++ b/queue-4.19/hwmon-da9052-synchronize-access-with-mfd.patch @@ -0,0 +1,46 @@ +From 757911b8764abcd090275bcc6bb53309b6089c4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 May 2020 13:02:19 +0200 +Subject: hwmon: (da9052) Synchronize access with mfd + +From: Samu Nuutamo + +[ Upstream commit 333e22db228f0bd0c839553015a6a8d3db4ba569 ] + +When tsi-as-adc is configured it is possible for in7[0123]_input read to +return an incorrect value if a concurrent read to in[456]_input is +performed. This is caused by a concurrent manipulation of the mux +channel without proper locking as hwmon and mfd use different locks for +synchronization. + +Switch hwmon to use the same lock as mfd when accessing the TSI channel. + +Fixes: 4f16cab19a3d5 ("hwmon: da9052: Add support for TSI channel") +Signed-off-by: Samu Nuutamo +[rebase to current master, reword commit message slightly] +Signed-off-by: Sebastian Reichel +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/da9052-hwmon.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c +index a973eb6a28908..9e44d2385e6f9 100644 +--- a/drivers/hwmon/da9052-hwmon.c ++++ b/drivers/hwmon/da9052-hwmon.c +@@ -250,9 +250,9 @@ static ssize_t da9052_read_tsi(struct device *dev, + int channel = to_sensor_dev_attr(devattr)->index; + int ret; + +- mutex_lock(&hwmon->hwmon_lock); ++ mutex_lock(&hwmon->da9052->auxadc_lock); + ret = __da9052_read_tsi(dev, channel); +- mutex_unlock(&hwmon->hwmon_lock); ++ mutex_unlock(&hwmon->da9052->auxadc_lock); + + if (ret < 0) + return ret; +-- +2.20.1 + diff --git a/queue-4.19/i40iw-fix-error-handling-in-i40iw_manage_arp_cache.patch b/queue-4.19/i40iw-fix-error-handling-in-i40iw_manage_arp_cache.patch new file mode 100644 index 00000000000..65bd68e97d6 --- /dev/null +++ b/queue-4.19/i40iw-fix-error-handling-in-i40iw_manage_arp_cache.patch @@ -0,0 +1,38 @@ +From adfdb5c39fd74f7ec26f477b24ba8222f77f4df4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Apr 2020 12:22:11 +0300 +Subject: i40iw: Fix error handling in i40iw_manage_arp_cache() + +From: Dan Carpenter + +[ Upstream commit 37e31d2d26a4124506c24e95434e9baf3405a23a ] + +The i40iw_arp_table() function can return -EOVERFLOW if +i40iw_alloc_resource() fails so we can't just test for "== -1". + +Fixes: 4e9042e647ff ("i40iw: add hw and utils files") +Link: https://lore.kernel.org/r/20200422092211.GA195357@mwanda +Signed-off-by: Dan Carpenter +Acked-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/i40iw/i40iw_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c +index 55a1fbf0e670c..ae8b97c306657 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c +@@ -534,7 +534,7 @@ void i40iw_manage_arp_cache(struct i40iw_device *iwdev, + int arp_index; + + arp_index = i40iw_arp_table(iwdev, ip_addr, ipv4, mac_addr, action); +- if (arp_index == -1) ++ if (arp_index < 0) + return; + cqp_request = i40iw_get_cqp_request(&iwdev->cqp, false); + if (!cqp_request) +-- +2.20.1 + diff --git a/queue-4.19/ib-mlx4-test-return-value-of-calls-to-ib_get_cached_.patch b/queue-4.19/ib-mlx4-test-return-value-of-calls-to-ib_get_cached_.patch new file mode 100644 index 00000000000..e281897a0ea --- /dev/null +++ b/queue-4.19/ib-mlx4-test-return-value-of-calls-to-ib_get_cached_.patch @@ -0,0 +1,68 @@ +From 432c89a91d2a75d25f69699fe4dca71d41aac8fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Apr 2020 10:59:21 +0300 +Subject: IB/mlx4: Test return value of calls to ib_get_cached_pkey + +From: Jack Morgenstein + +[ Upstream commit 6693ca95bd4330a0ad7326967e1f9bcedd6b0800 ] + +In the mlx4_ib_post_send() flow, some functions call ib_get_cached_pkey() +without checking its return value. If ib_get_cached_pkey() returns an +error code, these functions should return failure. + +Fixes: 1ffeb2eb8be9 ("IB/mlx4: SR-IOV IB context objects and proxy/tunnel SQP support") +Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters") +Fixes: e622f2f4ad21 ("IB: split struct ib_send_wr") +Link: https://lore.kernel.org/r/20200426075921.130074-1-leon@kernel.org +Signed-off-by: Jack Morgenstein +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/qp.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 6dd3cd2c2f80e..73bd35d34a257 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -2807,6 +2807,7 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, + int send_size; + int header_size; + int spc; ++ int err; + int i; + + if (wr->wr.opcode != IB_WR_SEND) +@@ -2841,7 +2842,9 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, + + sqp->ud_header.lrh.virtual_lane = 0; + sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); +- ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); ++ if (err) ++ return err; + sqp->ud_header.bth.pkey = cpu_to_be16(pkey); + if (sqp->qp.mlx4_ib_qp_type == MLX4_IB_QPT_TUN_SMI_OWNER) + sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); +@@ -3128,9 +3131,14 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, const struct ib_ud_wr *wr, + } + sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); + if (!sqp->qp.ibqp.qp_num) +- ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, ++ &pkey); + else +- ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, &pkey); ++ err = ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, ++ &pkey); ++ if (err) ++ return err; ++ + sqp->ud_header.bth.pkey = cpu_to_be16(pkey); + sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); + sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1)); +-- +2.20.1 + diff --git a/queue-4.19/ipc-util.c-sysvipc_find_ipc-incorrectly-updates-posi.patch b/queue-4.19/ipc-util.c-sysvipc_find_ipc-incorrectly-updates-posi.patch new file mode 100644 index 00000000000..f63ca09cb9f --- /dev/null +++ b/queue-4.19/ipc-util.c-sysvipc_find_ipc-incorrectly-updates-posi.patch @@ -0,0 +1,125 @@ +From 616e8a0802602c1f2f3e8c5bed81caf21bffb17f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 May 2020 17:50:48 -0700 +Subject: ipc/util.c: sysvipc_find_ipc() incorrectly updates position index + +From: Vasily Averin + +[ Upstream commit 5e698222c70257d13ae0816720dde57c56f81e15 ] + +Commit 89163f93c6f9 ("ipc/util.c: sysvipc_find_ipc() should increase +position index") is causing this bug (seen on 5.6.8): + + # ipcs -q + + ------ Message Queues -------- + key msqid owner perms used-bytes messages + + # ipcmk -Q + Message queue id: 0 + # ipcs -q + + ------ Message Queues -------- + key msqid owner perms used-bytes messages + 0x82db8127 0 root 644 0 0 + + # ipcmk -Q + Message queue id: 1 + # ipcs -q + + ------ Message Queues -------- + key msqid owner perms used-bytes messages + 0x82db8127 0 root 644 0 0 + 0x76d1fb2a 1 root 644 0 0 + + # ipcrm -q 0 + # ipcs -q + + ------ Message Queues -------- + key msqid owner perms used-bytes messages + 0x76d1fb2a 1 root 644 0 0 + 0x76d1fb2a 1 root 644 0 0 + + # ipcmk -Q + Message queue id: 2 + # ipcrm -q 2 + # ipcs -q + + ------ Message Queues -------- + key msqid owner perms used-bytes messages + 0x76d1fb2a 1 root 644 0 0 + 0x76d1fb2a 1 root 644 0 0 + + # ipcmk -Q + Message queue id: 3 + # ipcrm -q 1 + # ipcs -q + + ------ Message Queues -------- + key msqid owner perms used-bytes messages + 0x7c982867 3 root 644 0 0 + 0x7c982867 3 root 644 0 0 + 0x7c982867 3 root 644 0 0 + 0x7c982867 3 root 644 0 0 + +Whenever an IPC item with a low id is deleted, the items with higher ids +are duplicated, as if filling a hole. + +new_pos should jump through hole of unused ids, pos can be updated +inside "for" cycle. + +Fixes: 89163f93c6f9 ("ipc/util.c: sysvipc_find_ipc() should increase position index") +Reported-by: Andreas Schwab +Reported-by: Randy Dunlap +Signed-off-by: Vasily Averin +Signed-off-by: Andrew Morton +Acked-by: Waiman Long +Cc: NeilBrown +Cc: Steven Rostedt +Cc: Ingo Molnar +Cc: Peter Oberparleiter +Cc: Davidlohr Bueso +Cc: Manfred Spraul +Cc: +Link: http://lkml.kernel.org/r/4921fe9b-9385-a2b4-1dc4-1099be6d2e39@virtuozzo.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + ipc/util.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/ipc/util.c b/ipc/util.c +index b111e792b3125..af1b572effb14 100644 +--- a/ipc/util.c ++++ b/ipc/util.c +@@ -735,21 +735,21 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, + total++; + } + +- *new_pos = pos + 1; ++ ipc = NULL; + if (total >= ids->in_use) +- return NULL; ++ goto out; + + for (; pos < IPCMNI; pos++) { + ipc = idr_find(&ids->ipcs_idr, pos); + if (ipc != NULL) { + rcu_read_lock(); + ipc_lock_object(ipc); +- return ipc; ++ break; + } + } +- +- /* Out of range - return NULL to terminate iteration */ +- return NULL; ++out: ++ *new_pos = pos + 1; ++ return ipc; + } + + static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos) +-- +2.20.1 + diff --git a/queue-4.19/mmc-block-fix-request-completion-in-the-cqe-timeout-.patch b/queue-4.19/mmc-block-fix-request-completion-in-the-cqe-timeout-.patch new file mode 100644 index 00000000000..13b018f2b5f --- /dev/null +++ b/queue-4.19/mmc-block-fix-request-completion-in-the-cqe-timeout-.patch @@ -0,0 +1,55 @@ +From dd83fb746b231d3f277c77477180ee0274097762 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 May 2020 09:22:27 +0300 +Subject: mmc: block: Fix request completion in the CQE timeout path + +From: Adrian Hunter + +[ Upstream commit c077dc5e0620508a29497dac63a2822324ece52a ] + +First, it should be noted that the CQE timeout (60 seconds) is substantial +so a CQE request that times out is really stuck, and the race between +timeout and completion is extremely unlikely. Nevertheless this patch +fixes an issue with it. + +Commit ad73d6feadbd7b ("mmc: complete requests from ->timeout") +preserved the existing functionality, to complete the request. +However that had only been necessary because the block layer +timeout handler had been marking the request to prevent it from being +completed normally. That restriction was removed at the same time, the +result being that a request that has gone will have been completed anyway. +That is, the completion was unnecessary. + +At the time, the unnecessary completion was harmless because the block +layer would ignore it, although that changed in kernel v5.0. + +Note for stable, this patch will not apply cleanly without patch "mmc: +core: Fix recursive locking issue in CQE recovery path" + +Signed-off-by: Adrian Hunter +Fixes: ad73d6feadbd7b ("mmc: complete requests from ->timeout") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200508062227.23144-1-adrian.hunter@intel.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/queue.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c +index becc6594a8a47..03f3d9c80fbac 100644 +--- a/drivers/mmc/core/queue.c ++++ b/drivers/mmc/core/queue.c +@@ -111,8 +111,7 @@ static enum blk_eh_timer_return mmc_cqe_timed_out(struct request *req) + __mmc_cqe_recovery_notifier(mq); + return BLK_EH_RESET_TIMER; + } +- /* No timeout (XXX: huh? comment doesn't make much sense) */ +- blk_mq_complete_request(req); ++ /* The request has gone already */ + return BLK_EH_DONE; + default: + /* Timeout is handled by mmc core */ +-- +2.20.1 + diff --git a/queue-4.19/mmc-core-check-request-type-before-completing-the-re.patch b/queue-4.19/mmc-core-check-request-type-before-completing-the-re.patch new file mode 100644 index 00000000000..f458c3eee2c --- /dev/null +++ b/queue-4.19/mmc-core-check-request-type-before-completing-the-re.patch @@ -0,0 +1,56 @@ +From e4fcb0984897bc56d3e6a85e553883762996f62c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 May 2020 20:04:02 +0530 +Subject: mmc: core: Check request type before completing the request + +From: Veerabhadrarao Badiganti + +[ Upstream commit e6bfb1bf00852b55f4c771f47ae67004c04d3c87 ] + +In the request completion path with CQE, request type is being checked +after the request is getting completed. This is resulting in returning +the wrong request type and leading to the IO hang issue. + +ASYNC request type is getting returned for DCMD type requests. +Because of this mismatch, mq->cqe_busy flag is never getting cleared +and the driver is not invoking blk_mq_hw_run_queue. So requests are not +getting dispatched to the LLD from the block layer. + +All these eventually leading to IO hang issues. +So, get the request type before completing the request. + +Cc: +Fixes: 1e8e55b67030 ("mmc: block: Add CQE support") +Signed-off-by: Veerabhadrarao Badiganti +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/1588775643-18037-2-git-send-email-vbadigan@codeaurora.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 60eac66dc9f0b..23bcdbba0cab9 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -1424,6 +1424,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req) + struct mmc_request *mrq = &mqrq->brq.mrq; + struct request_queue *q = req->q; + struct mmc_host *host = mq->card->host; ++ enum mmc_issue_type issue_type = mmc_issue_type(mq, req); + unsigned long flags; + bool put_card; + int err; +@@ -1453,7 +1454,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req) + + spin_lock_irqsave(q->queue_lock, flags); + +- mq->in_flight[mmc_issue_type(mq, req)] -= 1; ++ mq->in_flight[issue_type] -= 1; + + put_card = (mmc_tot_in_flight(mq) == 0); + +-- +2.20.1 + diff --git a/queue-4.19/netfilter-conntrack-avoid-gcc-10-zero-length-bounds-.patch b/queue-4.19/netfilter-conntrack-avoid-gcc-10-zero-length-bounds-.patch new file mode 100644 index 00000000000..7f2817624be --- /dev/null +++ b/queue-4.19/netfilter-conntrack-avoid-gcc-10-zero-length-bounds-.patch @@ -0,0 +1,66 @@ +From 81a29e2184eb24bc468233eacc09e59dadf0c95d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 23:30:48 +0200 +Subject: netfilter: conntrack: avoid gcc-10 zero-length-bounds warning + +From: Arnd Bergmann + +[ Upstream commit 2c407aca64977ede9b9f35158e919773cae2082f ] + +gcc-10 warns around a suspicious access to an empty struct member: + +net/netfilter/nf_conntrack_core.c: In function '__nf_conntrack_alloc': +net/netfilter/nf_conntrack_core.c:1522:9: warning: array subscript 0 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[0]'} [-Wzero-length-bounds] + 1522 | memset(&ct->__nfct_init_offset[0], 0, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from net/netfilter/nf_conntrack_core.c:37: +include/net/netfilter/nf_conntrack.h:90:5: note: while referencing '__nfct_init_offset' + 90 | u8 __nfct_init_offset[0]; + | ^~~~~~~~~~~~~~~~~~ + +The code is correct but a bit unusual. Rework it slightly in a way that +does not trigger the warning, using an empty struct instead of an empty +array. There are probably more elegant ways to do this, but this is the +smallest change. + +Fixes: c41884ce0562 ("netfilter: conntrack: avoid zeroing timer") +Signed-off-by: Arnd Bergmann +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_conntrack.h | 2 +- + net/netfilter/nf_conntrack_core.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h +index f45141bdbb837..ac4d70aeee129 100644 +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -85,7 +85,7 @@ struct nf_conn { + struct hlist_node nat_bysource; + #endif + /* all members below initialized via memset */ +- u8 __nfct_init_offset[0]; ++ struct { } __nfct_init_offset; + + /* If we were expected by an expectation, this will be it */ + struct nf_conn *master; +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index c6073d17c3244..ad1da6b2fb607 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -1352,9 +1352,9 @@ __nf_conntrack_alloc(struct net *net, + *(unsigned long *)(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev) = hash; + ct->status = 0; + write_pnet(&ct->ct_net, net); +- memset(&ct->__nfct_init_offset[0], 0, ++ memset(&ct->__nfct_init_offset, 0, + offsetof(struct nf_conn, proto) - +- offsetof(struct nf_conn, __nfct_init_offset[0])); ++ offsetof(struct nf_conn, __nfct_init_offset)); + + nf_ct_zone_add(ct, zone); + +-- +2.20.1 + diff --git a/queue-4.19/netfilter-nft_set_rbtree-introduce-and-use-nft_rbtre.patch b/queue-4.19/netfilter-nft_set_rbtree-introduce-and-use-nft_rbtre.patch new file mode 100644 index 00000000000..cbf2e41ef11 --- /dev/null +++ b/queue-4.19/netfilter-nft_set_rbtree-introduce-and-use-nft_rbtre.patch @@ -0,0 +1,86 @@ +From fd4391bb5e7cde8af650af7c2f2f4816be2efacc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Mar 2020 03:22:00 +0100 +Subject: netfilter: nft_set_rbtree: Introduce and use + nft_rbtree_interval_start() + +From: Stefano Brivio + +[ Upstream commit 6f7c9caf017be8ab0fe3b99509580d0793bf0833 ] + +Replace negations of nft_rbtree_interval_end() with a new helper, +nft_rbtree_interval_start(), wherever this helps to visualise the +problem at hand, that is, for all the occurrences except for the +comparison against given flags in __nft_rbtree_get(). + +This gets especially useful in the next patch. + +Signed-off-by: Stefano Brivio +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_rbtree.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index 0221510328d4f..84d317418d184 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -36,6 +36,11 @@ static bool nft_rbtree_interval_end(const struct nft_rbtree_elem *rbe) + (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END); + } + ++static bool nft_rbtree_interval_start(const struct nft_rbtree_elem *rbe) ++{ ++ return !nft_rbtree_interval_end(rbe); ++} ++ + static bool nft_rbtree_equal(const struct nft_set *set, const void *this, + const struct nft_rbtree_elem *interval) + { +@@ -67,7 +72,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set + if (interval && + nft_rbtree_equal(set, this, interval) && + nft_rbtree_interval_end(rbe) && +- !nft_rbtree_interval_end(interval)) ++ nft_rbtree_interval_start(interval)) + continue; + interval = rbe; + } else if (d > 0) +@@ -92,7 +97,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set + + if (set->flags & NFT_SET_INTERVAL && interval != NULL && + nft_set_elem_active(&interval->ext, genmask) && +- !nft_rbtree_interval_end(interval)) { ++ nft_rbtree_interval_start(interval)) { + *ext = &interval->ext; + return true; + } +@@ -221,9 +226,9 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, + p = &parent->rb_right; + else { + if (nft_rbtree_interval_end(rbe) && +- !nft_rbtree_interval_end(new)) { ++ nft_rbtree_interval_start(new)) { + p = &parent->rb_left; +- } else if (!nft_rbtree_interval_end(rbe) && ++ } else if (nft_rbtree_interval_start(rbe) && + nft_rbtree_interval_end(new)) { + p = &parent->rb_right; + } else if (nft_set_elem_active(&rbe->ext, genmask)) { +@@ -314,10 +319,10 @@ static void *nft_rbtree_deactivate(const struct net *net, + parent = parent->rb_right; + else { + if (nft_rbtree_interval_end(rbe) && +- !nft_rbtree_interval_end(this)) { ++ nft_rbtree_interval_start(this)) { + parent = parent->rb_left; + continue; +- } else if (!nft_rbtree_interval_end(rbe) && ++ } else if (nft_rbtree_interval_start(rbe) && + nft_rbtree_interval_end(this)) { + parent = parent->rb_right; + continue; +-- +2.20.1 + diff --git a/queue-4.19/nfs-fix-fscache-super_cookie-index_key-from-changing.patch b/queue-4.19/nfs-fix-fscache-super_cookie-index_key-from-changing.patch new file mode 100644 index 00000000000..3ea89697a30 --- /dev/null +++ b/queue-4.19/nfs-fix-fscache-super_cookie-index_key-from-changing.patch @@ -0,0 +1,71 @@ +From 1ddabea470851b62ea1ff9c076f57f4a9a9e769c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Apr 2020 16:14:41 -0400 +Subject: NFS: Fix fscache super_cookie index_key from changing after umount + +From: Dave Wysochanski + +[ Upstream commit d9bfced1fbcb35b28d8fbed4e785d2807055ed2b ] + +Commit 402cb8dda949 ("fscache: Attach the index key and aux data to +the cookie") added the index_key and index_key_len parameters to +fscache_acquire_cookie(), and updated the callers in the NFS client. +One of the callers was inside nfs_fscache_get_super_cookie() +and was changed to use the full struct nfs_fscache_key as the +index_key. However, a couple members of this structure contain +pointers and thus will change each time the same NFS share is +remounted. Since index_key is used for fscache_cookie->key_hash +and this subsequently is used to compare cookies, the effectiveness +of fscache with NFS is reduced to the point at which a umount +occurs. Any subsequent remount of the same share will cause a +unique NFS super_block index_key and key_hash to be generated for +the same data, rendering any prior fscache data unable to be +found. A simple reproducer demonstrates the problem. + +1. Mount share with 'fsc', create a file, drop page cache +systemctl start cachefilesd +mount -o vers=3,fsc 127.0.0.1:/export /mnt +dd if=/dev/zero of=/mnt/file1.bin bs=4096 count=1 +echo 3 > /proc/sys/vm/drop_caches + +2. Read file into page cache and fscache, then unmount +dd if=/mnt/file1.bin of=/dev/null bs=4096 count=1 +umount /mnt + +3. Remount and re-read which should come from fscache +mount -o vers=3,fsc 127.0.0.1:/export /mnt +echo 3 > /proc/sys/vm/drop_caches +dd if=/mnt/file1.bin of=/dev/null bs=4096 count=1 + +4. Check for READ ops in mountstats - there should be none +grep READ: /proc/self/mountstats + +Looking at the history and the removed function, nfs_super_get_key(), +we should only use nfs_fscache_key.key plus any uniquifier, for +the fscache index_key. + +Fixes: 402cb8dda949 ("fscache: Attach the index key and aux data to the cookie") +Signed-off-by: Dave Wysochanski +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/nfs/fscache.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c +index 6f45b1a957397..b931169c2bb24 100644 +--- a/fs/nfs/fscache.c ++++ b/fs/nfs/fscache.c +@@ -192,7 +192,8 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int + /* create a cache index for looking up filehandles */ + nfss->fscache = fscache_acquire_cookie(nfss->nfs_client->fscache, + &nfs_fscache_super_index_def, +- key, sizeof(*key) + ulen, ++ &key->key, ++ sizeof(key->key) + ulen, + NULL, 0, + nfss, 0, true); + dfprintk(FSCACHE, "NFS: get superblock cookie (0x%p/0x%p)\n", +-- +2.20.1 + diff --git a/queue-4.19/nfs-fscache-use-timespec64-in-inode-auxdata.patch b/queue-4.19/nfs-fscache-use-timespec64-in-inode-auxdata.patch new file mode 100644 index 00000000000..891ae1c2e31 --- /dev/null +++ b/queue-4.19/nfs-fscache-use-timespec64-in-inode-auxdata.patch @@ -0,0 +1,115 @@ +From 0dbdce87e65fdaf6aa06b2cfeeeab6c21bb57042 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2019 21:16:25 +0100 +Subject: nfs: fscache: use timespec64 in inode auxdata + +From: Arnd Bergmann + +[ Upstream commit 6e31ded6895adfca97211118cc9b72236e8f6d53 ] + +nfs currently behaves differently on 32-bit and 64-bit kernels regarding +the on-disk format of nfs_fscache_inode_auxdata. + +That format should really be the same on any kernel, and we should avoid +the 'timespec' type in order to remove that from the kernel later on. + +Using plain 'timespec64' would not be good here, since that includes +implied padding and would possibly leak kernel stack data to the on-disk +format on 32-bit architectures. + +struct __kernel_timespec would work as a replacement, but open-coding +the two struct members in nfs_fscache_inode_auxdata makes it more +obvious what's going on here, and keeps the current format for 64-bit +architectures. + +Cc: David Howells +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + fs/nfs/fscache-index.c | 6 ++++-- + fs/nfs/fscache.c | 18 ++++++++++++------ + fs/nfs/fscache.h | 8 +++++--- + 3 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/fs/nfs/fscache-index.c b/fs/nfs/fscache-index.c +index 666415d13d521..b7ca0b85b1fe2 100644 +--- a/fs/nfs/fscache-index.c ++++ b/fs/nfs/fscache-index.c +@@ -88,8 +88,10 @@ enum fscache_checkaux nfs_fscache_inode_check_aux(void *cookie_netfs_data, + return FSCACHE_CHECKAUX_OBSOLETE; + + memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime = timespec64_to_timespec(nfsi->vfs_inode.i_mtime); +- auxdata.ctime = timespec64_to_timespec(nfsi->vfs_inode.i_ctime); ++ auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; ++ auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; ++ auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; ++ auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; + + if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4) + auxdata.change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode); +diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c +index b931169c2bb24..0a4d6b35545a3 100644 +--- a/fs/nfs/fscache.c ++++ b/fs/nfs/fscache.c +@@ -245,8 +245,10 @@ void nfs_fscache_init_inode(struct inode *inode) + return; + + memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime = timespec64_to_timespec(nfsi->vfs_inode.i_mtime); +- auxdata.ctime = timespec64_to_timespec(nfsi->vfs_inode.i_ctime); ++ auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; ++ auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; ++ auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; ++ auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; + + if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4) + auxdata.change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode); +@@ -270,8 +272,10 @@ void nfs_fscache_clear_inode(struct inode *inode) + dfprintk(FSCACHE, "NFS: clear cookie (0x%p/0x%p)\n", nfsi, cookie); + + memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime = timespec64_to_timespec(nfsi->vfs_inode.i_mtime); +- auxdata.ctime = timespec64_to_timespec(nfsi->vfs_inode.i_ctime); ++ auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; ++ auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; ++ auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; ++ auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; + fscache_relinquish_cookie(cookie, &auxdata, false); + nfsi->fscache = NULL; + } +@@ -312,8 +316,10 @@ void nfs_fscache_open_file(struct inode *inode, struct file *filp) + return; + + memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime = timespec64_to_timespec(nfsi->vfs_inode.i_mtime); +- auxdata.ctime = timespec64_to_timespec(nfsi->vfs_inode.i_ctime); ++ auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; ++ auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; ++ auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; ++ auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; + + if (inode_is_open_for_write(inode)) { + dfprintk(FSCACHE, "NFS: nfsi 0x%p disabling cache\n", nfsi); +diff --git a/fs/nfs/fscache.h b/fs/nfs/fscache.h +index 6363ea9568581..89d2f956668f2 100644 +--- a/fs/nfs/fscache.h ++++ b/fs/nfs/fscache.h +@@ -66,9 +66,11 @@ struct nfs_fscache_key { + * cache object. + */ + struct nfs_fscache_inode_auxdata { +- struct timespec mtime; +- struct timespec ctime; +- u64 change_attr; ++ s64 mtime_sec; ++ s64 mtime_nsec; ++ s64 ctime_sec; ++ s64 ctime_nsec; ++ u64 change_attr; + }; + + /* +-- +2.20.1 + diff --git a/queue-4.19/nfsv4-fix-fscache-cookie-aux_data-to-ensure-change_a.patch b/queue-4.19/nfsv4-fix-fscache-cookie-aux_data-to-ensure-change_a.patch new file mode 100644 index 00000000000..ee5b1407eae --- /dev/null +++ b/queue-4.19/nfsv4-fix-fscache-cookie-aux_data-to-ensure-change_a.patch @@ -0,0 +1,100 @@ +From 9e25e3d1040506cbc1747c95eef99e4021401291 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Apr 2020 06:06:08 -0400 +Subject: NFSv4: Fix fscache cookie aux_data to ensure change_attr is included + +From: Dave Wysochanski + +[ Upstream commit 50eaa652b54df1e2b48dc398d9e6114c9ed080eb ] + +Commit 402cb8dda949 ("fscache: Attach the index key and aux data to +the cookie") added the aux_data and aux_data_len to parameters to +fscache_acquire_cookie(), and updated the callers in the NFS client. +In the process it modified the aux_data to include the change_attr, +but missed adding change_attr to a couple places where aux_data was +used. Specifically, when opening a file and the change_attr is not +added, the following attempt to lookup an object will fail inside +cachefiles_check_object_xattr() = -116 due to +nfs_fscache_inode_check_aux() failing memcmp on auxdata and returning +FSCACHE_CHECKAUX_OBSOLETE. + +Fix this by adding nfs_fscache_update_auxdata() to set the auxdata +from all relevant fields in the inode, including the change_attr. + +Fixes: 402cb8dda949 ("fscache: Attach the index key and aux data to the cookie") +Signed-off-by: Dave Wysochanski +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/nfs/fscache.c | 34 ++++++++++++++++------------------ + 1 file changed, 16 insertions(+), 18 deletions(-) + +diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c +index 0a4d6b35545a3..7dfa45a380882 100644 +--- a/fs/nfs/fscache.c ++++ b/fs/nfs/fscache.c +@@ -231,6 +231,19 @@ void nfs_fscache_release_super_cookie(struct super_block *sb) + } + } + ++static void nfs_fscache_update_auxdata(struct nfs_fscache_inode_auxdata *auxdata, ++ struct nfs_inode *nfsi) ++{ ++ memset(auxdata, 0, sizeof(*auxdata)); ++ auxdata->mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; ++ auxdata->mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; ++ auxdata->ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; ++ auxdata->ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; ++ ++ if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4) ++ auxdata->change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode); ++} ++ + /* + * Initialise the per-inode cache cookie pointer for an NFS inode. + */ +@@ -244,14 +257,7 @@ void nfs_fscache_init_inode(struct inode *inode) + if (!(nfss->fscache && S_ISREG(inode->i_mode))) + return; + +- memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; +- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; +- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; +- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; +- +- if (NFS_SERVER(&nfsi->vfs_inode)->nfs_client->rpc_ops->version == 4) +- auxdata.change_attr = inode_peek_iversion_raw(&nfsi->vfs_inode); ++ nfs_fscache_update_auxdata(&auxdata, nfsi); + + nfsi->fscache = fscache_acquire_cookie(NFS_SB(inode->i_sb)->fscache, + &nfs_fscache_inode_object_def, +@@ -271,11 +277,7 @@ void nfs_fscache_clear_inode(struct inode *inode) + + dfprintk(FSCACHE, "NFS: clear cookie (0x%p/0x%p)\n", nfsi, cookie); + +- memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; +- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; +- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; +- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; ++ nfs_fscache_update_auxdata(&auxdata, nfsi); + fscache_relinquish_cookie(cookie, &auxdata, false); + nfsi->fscache = NULL; + } +@@ -315,11 +317,7 @@ void nfs_fscache_open_file(struct inode *inode, struct file *filp) + if (!fscache_cookie_valid(cookie)) + return; + +- memset(&auxdata, 0, sizeof(auxdata)); +- auxdata.mtime_sec = nfsi->vfs_inode.i_mtime.tv_sec; +- auxdata.mtime_nsec = nfsi->vfs_inode.i_mtime.tv_nsec; +- auxdata.ctime_sec = nfsi->vfs_inode.i_ctime.tv_sec; +- auxdata.ctime_nsec = nfsi->vfs_inode.i_ctime.tv_nsec; ++ nfs_fscache_update_auxdata(&auxdata, nfsi); + + if (inode_is_open_for_write(inode)) { + dfprintk(FSCACHE, "NFS: nfsi 0x%p disabling cache\n", nfsi); +-- +2.20.1 + diff --git a/queue-4.19/pinctrl-baytrail-enable-pin-configuration-setting-fo.patch b/queue-4.19/pinctrl-baytrail-enable-pin-configuration-setting-fo.patch new file mode 100644 index 00000000000..47978cb38a0 --- /dev/null +++ b/queue-4.19/pinctrl-baytrail-enable-pin-configuration-setting-fo.patch @@ -0,0 +1,38 @@ +From 1b3f77248732452a4dbb4d887552f51456ea8261 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 19:32:54 +0200 +Subject: pinctrl: baytrail: Enable pin configuration setting for GPIO chip + +From: Andy Shevchenko + +[ Upstream commit ccd025eaddaeb99e982029446197c544252108e2 ] + +It appears that pin configuration for GPIO chip hasn't been enabled yet +due to absence of ->set_config() callback. + +Enable it here for Intel Baytrail. + +Fixes: c501d0b149de ("pinctrl: baytrail: Add pin control operations") +Depends-on: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips") +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-baytrail.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c +index a760d8bda0af7..acb02a7aa9496 100644 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -1495,6 +1495,7 @@ static const struct gpio_chip byt_gpio_chip = { + .direction_output = byt_gpio_direction_output, + .get = byt_gpio_get, + .set = byt_gpio_set, ++ .set_config = gpiochip_generic_config, + .dbg_show = byt_gpio_dbg_show, + }; + +-- +2.20.1 + diff --git a/queue-4.19/pinctrl-cherryview-add-missing-spinlock-usage-in-chv.patch b/queue-4.19/pinctrl-cherryview-add-missing-spinlock-usage-in-chv.patch new file mode 100644 index 00000000000..eaa91367959 --- /dev/null +++ b/queue-4.19/pinctrl-cherryview-add-missing-spinlock-usage-in-chv.patch @@ -0,0 +1,51 @@ +From ed525025d26fd5e81c141ce3dc6eee74ff530a17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Apr 2020 12:11:54 +0800 +Subject: pinctrl: cherryview: Add missing spinlock usage in + chv_gpio_irq_handler + +From: Grace Kao + +[ Upstream commit 69388e15f5078c961b9e5319e22baea4c57deff1 ] + +According to Braswell NDA Specification Update (#557593), +concurrent read accesses may result in returning 0xffffffff and write +instructions may be dropped. We have an established format for the +commit references, i.e. +cdca06e4e859 ("pinctrl: baytrail: Add missing spinlock usage in +byt_gpio_irq_handler") + +Fixes: 0bd50d719b00 ("pinctrl: cherryview: prevent concurrent access to GPIO controllers") +Signed-off-by: Grace Kao +Reported-by: Brian Norris +Reviewed-by: Brian Norris +Acked-by: Mika Westerberg +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-cherryview.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c +index f16baf9b86962..25932d2a71547 100644 +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -1485,11 +1485,15 @@ static void chv_gpio_irq_handler(struct irq_desc *desc) + struct chv_pinctrl *pctrl = gpiochip_get_data(gc); + struct irq_chip *chip = irq_desc_get_chip(desc); + unsigned long pending; ++ unsigned long flags; + u32 intr_line; + + chained_irq_enter(chip, desc); + ++ raw_spin_lock_irqsave(&chv_lock, flags); + pending = readl(pctrl->regs + CHV_INTSTAT); ++ raw_spin_unlock_irqrestore(&chv_lock, flags); ++ + for_each_set_bit(intr_line, &pending, pctrl->community->nirqs) { + unsigned irq, offset; + +-- +2.20.1 + diff --git a/queue-4.19/riscv-fix-vdso-build-with-lld.patch b/queue-4.19/riscv-fix-vdso-build-with-lld.patch new file mode 100644 index 00000000000..5b61d8344b8 --- /dev/null +++ b/queue-4.19/riscv-fix-vdso-build-with-lld.patch @@ -0,0 +1,55 @@ +From ea9e39ec9752a1b4782f3a37c935c2ea48facd01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Apr 2020 17:29:58 +0300 +Subject: riscv: fix vdso build with lld + +From: Ilie Halip + +[ Upstream commit 3c1918c8f54166598195d938564072664a8275b1 ] + +When building with the LLVM linker this error occurrs: + LD arch/riscv/kernel/vdso/vdso-syms.o + ld.lld: error: no input files + +This happens because the lld treats -R as an alias to -rpath, as opposed +to ld where -R means --just-symbols. + +Use the long option name for compatibility between the two. + +Link: https://github.com/ClangBuiltLinux/linux/issues/805 +Reported-by: Dmitry Golovin +Reviewed-by: Nick Desaulniers +Signed-off-by: Ilie Halip +Reviewed-by: Fangrui Song +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/vdso/Makefile | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile +index 87f71a6cd3ef8..1dd134fc0d84a 100644 +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -30,15 +30,15 @@ $(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE + $(call if_changed,vdsold) + + # We also create a special relocatable object that should mirror the symbol +-# table and layout of the linked DSO. With ld -R we can then refer to +-# these symbols in the kernel code rather than hand-coded addresses. ++# table and layout of the linked DSO. With ld --just-symbols we can then ++# refer to these symbols in the kernel code rather than hand-coded addresses. + + SYSCFLAGS_vdso.so.dbg = -shared -s -Wl,-soname=linux-vdso.so.1 \ + $(call cc-ldoption, -Wl$(comma)--hash-style=both) + $(obj)/vdso-dummy.o: $(src)/vdso.lds $(obj)/rt_sigreturn.o FORCE + $(call if_changed,vdsold) + +-LDFLAGS_vdso-syms.o := -r -R ++LDFLAGS_vdso-syms.o := -r --just-symbols + $(obj)/vdso-syms.o: $(obj)/vdso-dummy.o FORCE + $(call if_changed,ld) + +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series index f177c5186e9..44a75c25b33 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -19,3 +19,25 @@ net-ipv4-really-enforce-backoff-for-redirects.patch netprio_cgroup-fix-unlimited-memory-leak-of-v2-cgroups.patch net-tcp-fix-rx-timestamp-behavior-for-tcp_recvmsg.patch tcp-fix-so_rcvlowat-hangs-with-fat-skbs.patch +riscv-fix-vdso-build-with-lld.patch +dmaengine-pch_dma.c-avoid-data-race-between-probe-an.patch +dmaengine-mmp_tdma-reset-channel-error-on-release.patch +cpufreq-intel_pstate-only-mention-the-bios-disabling.patch +alsa-hda-hdmi-fix-race-in-monitor-detection-during-p.patch +drm-qxl-lost-qxl_bo_kunmap_atomic_page-in-qxl_image_.patch +ipc-util.c-sysvipc_find_ipc-incorrectly-updates-posi.patch +alsa-hda-realtek-fix-s3-pop-noise-on-dell-wyse.patch +gfs2-another-gfs2_walk_metadata-fix.patch +pinctrl-baytrail-enable-pin-configuration-setting-fo.patch +pinctrl-cherryview-add-missing-spinlock-usage-in-chv.patch +i40iw-fix-error-handling-in-i40iw_manage_arp_cache.patch +mmc-core-check-request-type-before-completing-the-re.patch +mmc-block-fix-request-completion-in-the-cqe-timeout-.patch +nfs-fix-fscache-super_cookie-index_key-from-changing.patch +nfs-fscache-use-timespec64-in-inode-auxdata.patch +nfsv4-fix-fscache-cookie-aux_data-to-ensure-change_a.patch +netfilter-conntrack-avoid-gcc-10-zero-length-bounds-.patch +arm64-fix-the-flush_icache_range-arguments-in-machin.patch +netfilter-nft_set_rbtree-introduce-and-use-nft_rbtre.patch +ib-mlx4-test-return-value-of-calls-to-ib_get_cached_.patch +hwmon-da9052-synchronize-access-with-mfd.patch