From: Sasha Levin Date: Mon, 21 Dec 2020 21:02:45 +0000 (-0500) Subject: Fixes for 4.14 X-Git-Tag: v5.10.3~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8195a891133d4a55d8034e80068b8a18886738c8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch b/queue-4.14/arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch new file mode 100644 index 00000000000..afd3ab2db09 --- /dev/null +++ b/queue-4.14/arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch @@ -0,0 +1,39 @@ +From 0e0744e3611eff374ab4dec2f5fa55472c891afe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 13:08:51 +0800 +Subject: ARM: dts: sun8i: v3s: fix GIC node memory range + +From: Icenowy Zheng + +[ Upstream commit a98fd117a2553ab1a6d2fe3c7acae88c1eca4372 ] + +Currently the GIC node in V3s DTSI follows some old DT examples, and +being broken. This leads a warning at boot. + +Fix this. + +Fixes: f989086ccbc6 ("ARM: dts: sunxi: add dtsi file for V3s SoC") +Signed-off-by: Icenowy Zheng +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201120050851.4123759-1-icenowy@aosc.io +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-v3s.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi +index da5823c6fa3e6..e31804e448da2 100644 +--- a/arch/arm/boot/dts/sun8i-v3s.dtsi ++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi +@@ -419,7 +419,7 @@ + gic: interrupt-controller@01c81000 { + compatible = "arm,cortex-a7-gic", "arm,cortex-a15-gic"; + reg = <0x01c81000 0x1000>, +- <0x01c82000 0x1000>, ++ <0x01c82000 0x2000>, + <0x01c84000 0x2000>, + <0x01c86000 0x2000>; + interrupt-controller; +-- +2.27.0 + diff --git a/queue-4.14/can-softing-softing_netdev_open-fix-error-handling.patch b/queue-4.14/can-softing-softing_netdev_open-fix-error-handling.patch new file mode 100644 index 00000000000..c4cca988190 --- /dev/null +++ b/queue-4.14/can-softing-softing_netdev_open-fix-error-handling.patch @@ -0,0 +1,47 @@ +From c61249f9ba548be24686beed28f5076b652b9aa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 14:35:06 +0100 +Subject: can: softing: softing_netdev_open(): fix error handling + +From: Zhang Qilong + +[ Upstream commit 4d1be581ec6b92a338bb7ed23e1381f45ddf336f ] + +If softing_netdev_open() fails, we should call close_candev() to avoid +reference leak. + +Fixes: 03fd3cf5a179d ("can: add driver for Softing card") +Signed-off-by: Zhang Qilong +Acked-by: Kurt Van Dijck +Link: https://lore.kernel.org/r/20201202151632.1343786-1-zhangqilong3@huawei.com +Signed-off-by: Marc Kleine-Budde +Link: https://lore.kernel.org/r/20201204133508.742120-2-mkl@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/can/softing/softing_main.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c +index 5f64deec9f6c1..26b3072daabd6 100644 +--- a/drivers/net/can/softing/softing_main.c ++++ b/drivers/net/can/softing/softing_main.c +@@ -393,8 +393,13 @@ static int softing_netdev_open(struct net_device *ndev) + + /* check or determine and set bittime */ + ret = open_candev(ndev); +- if (!ret) +- ret = softing_startstop(ndev, 1); ++ if (ret) ++ return ret; ++ ++ ret = softing_startstop(ndev, 1); ++ if (ret < 0) ++ close_candev(ndev); ++ + return ret; + } + +-- +2.27.0 + diff --git a/queue-4.14/dm-table-remove-bug_on-in_interrupt.patch b/queue-4.14/dm-table-remove-bug_on-in_interrupt.patch new file mode 100644 index 00000000000..1ec9e787cf5 --- /dev/null +++ b/queue-4.14/dm-table-remove-bug_on-in_interrupt.patch @@ -0,0 +1,45 @@ +From 4595b4448112a2405948430b246536787ec18bd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 15:19:10 +0100 +Subject: dm table: Remove BUG_ON(in_interrupt()) + +From: Thomas Gleixner + +[ Upstream commit e7b624183d921b49ef0a96329f21647d38865ee9 ] + +The BUG_ON(in_interrupt()) in dm_table_event() is a historic leftover from +a rework of the dm table code which changed the calling context. + +Issuing a BUG for a wrong calling context is frowned upon and +in_interrupt() is deprecated and only covering parts of the wrong +contexts. The sanity check for the context is covered by +CONFIG_DEBUG_ATOMIC_SLEEP and other debug facilities already. + +Signed-off-by: Thomas Gleixner +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-table.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 777343cff5f1e..78d4e7347e2f3 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -1295,12 +1295,6 @@ void dm_table_event_callback(struct dm_table *t, + + void dm_table_event(struct dm_table *t) + { +- /* +- * You can no longer call dm_table_event() from interrupt +- * context, use a bottom half instead. +- */ +- BUG_ON(in_interrupt()); +- + mutex_lock(&_event_lock); + if (t->event_fn) + t->event_fn(t->event_context); +-- +2.27.0 + diff --git a/queue-4.14/drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch b/queue-4.14/drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch new file mode 100644 index 00000000000..1b3ab43a0e5 --- /dev/null +++ b/queue-4.14/drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch @@ -0,0 +1,52 @@ +From c31e78e0e58a4570070afe698f7ecff104af037d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 09:34:24 +0800 +Subject: drm/tegra: sor: Disable clocks on error in tegra_sor_init() + +From: Qinglang Miao + +[ Upstream commit bf3a3cdcad40e5928a22ea0fd200d17fd6d6308d ] + +Fix the missing clk_disable_unprepare() before return from +tegra_sor_init() in the error handling case. + +Signed-off-by: Qinglang Miao +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/sor.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index 7ab1d1dc7cd73..352ae52be3418 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -2378,17 +2378,23 @@ static int tegra_sor_init(struct host1x_client *client) + if (err < 0) { + dev_err(sor->dev, "failed to deassert SOR reset: %d\n", + err); ++ clk_disable_unprepare(sor->clk); + return err; + } + } + + err = clk_prepare_enable(sor->clk_safe); +- if (err < 0) ++ if (err < 0) { ++ clk_disable_unprepare(sor->clk); + return err; ++ } + + err = clk_prepare_enable(sor->clk_dp); +- if (err < 0) ++ if (err < 0) { ++ clk_disable_unprepare(sor->clk_safe); ++ clk_disable_unprepare(sor->clk); + return err; ++ } + + return 0; + } +-- +2.27.0 + diff --git a/queue-4.14/gpio-mvebu-fix-potential-user-after-free-on-probe.patch b/queue-4.14/gpio-mvebu-fix-potential-user-after-free-on-probe.patch new file mode 100644 index 00000000000..42cd462e3dc --- /dev/null +++ b/queue-4.14/gpio-mvebu-fix-potential-user-after-free-on-probe.patch @@ -0,0 +1,69 @@ +From f35b2d8bfa9a040c7a5749919661eef6a752b388 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 09:15:32 +0200 +Subject: gpio: mvebu: fix potential user-after-free on probe + +From: Baruch Siach + +[ Upstream commit 7ee1a01e47403f72b9f38839a737692f6991263e ] + +When mvebu_pwm_probe() fails IRQ domain is not released. Move pwm probe +before IRQ domain allocation. Add pwm cleanup code to the failure path. + +Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") +Reported-by: Andrew Lunn +Signed-off-by: Baruch Siach +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mvebu.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c +index be85d4b39e997..fc762b4adcb22 100644 +--- a/drivers/gpio/gpio-mvebu.c ++++ b/drivers/gpio/gpio-mvebu.c +@@ -1195,6 +1195,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev) + + devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip); + ++ /* Some MVEBU SoCs have simple PWM support for GPIO lines */ ++ if (IS_ENABLED(CONFIG_PWM)) { ++ err = mvebu_pwm_probe(pdev, mvchip, id); ++ if (err) ++ return err; ++ } ++ + /* Some gpio controllers do not provide irq support */ + if (!have_irqs) + return 0; +@@ -1204,7 +1211,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev) + if (!mvchip->domain) { + dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n", + mvchip->chip.label); +- return -ENODEV; ++ err = -ENODEV; ++ goto err_pwm; + } + + err = irq_alloc_domain_generic_chips( +@@ -1252,14 +1260,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev) + mvchip); + } + +- /* Some MVEBU SoCs have simple PWM support for GPIO lines */ +- if (IS_ENABLED(CONFIG_PWM)) +- return mvebu_pwm_probe(pdev, mvchip, id); +- + return 0; + + err_domain: + irq_domain_remove(mvchip->domain); ++err_pwm: ++ pwmchip_remove(&mvchip->mvpwm->chip); + + return err; + } +-- +2.27.0 + diff --git a/queue-4.14/kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch b/queue-4.14/kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch new file mode 100644 index 00000000000..820f0922f81 --- /dev/null +++ b/queue-4.14/kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch @@ -0,0 +1,55 @@ +From 9192f198f03e97136da6ecdc583bceb2259af50f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 20:25:29 +1000 +Subject: kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm + handling + +From: Nicholas Piggin + +[ Upstream commit 8ff00399b153440c1c83e20c43020385b416415b ] + +powerpc/64s keeps a counter in the mm which counts bits set in +mm_cpumask as well as other things. This means it can't use generic code +to clear bits out of the mask and doesn't adjust the arch specific +counter. + +Add an arch override that allows powerpc/64s to use +clear_tasks_mm_cpumask(). + +Signed-off-by: Nicholas Piggin +Reviewed-by: Aneesh Kumar K.V +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201126102530.691335-4-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/cpu.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/kernel/cpu.c b/kernel/cpu.c +index d8c77bfb6e7e4..e1d10629022a5 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -772,6 +772,10 @@ void __init cpuhp_threads_init(void) + } + + #ifdef CONFIG_HOTPLUG_CPU ++#ifndef arch_clear_mm_cpumask_cpu ++#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm)) ++#endif ++ + /** + * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU + * @cpu: a CPU id +@@ -807,7 +811,7 @@ void clear_tasks_mm_cpumask(int cpu) + t = find_lock_task_mm(p); + if (!t) + continue; +- cpumask_clear_cpu(cpu, mm_cpumask(t->mm)); ++ arch_clear_mm_cpumask_cpu(cpu, t->mm); + task_unlock(t); + } + rcu_read_unlock(); +-- +2.27.0 + diff --git a/queue-4.14/pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch b/queue-4.14/pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch new file mode 100644 index 00000000000..831b4c728bb --- /dev/null +++ b/queue-4.14/pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch @@ -0,0 +1,72 @@ +From 0945b6208f4671d0e24322b6a4545f9c0f5830ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 21:03:01 +0200 +Subject: pinctrl: baytrail: Avoid clearing debounce value when turning it off + +From: Andy Shevchenko + +[ Upstream commit 0b74e40a4e41f3cbad76dff4c50850d47b525b26 ] + +Baytrail pin control has a common register to set up debounce timeout. +When a pin configuration requested debounce to be disabled, the rest +of the pins may still want to have debounce enabled and thus rely on +the common timeout value. Avoid clearing debounce value when turning +it off for one pin while others may still use it. + +Fixes: 658b476c742f ("pinctrl: baytrail: Add debounce configuration") +Depends-on: 04ff5a095d66 ("pinctrl: baytrail: Rectify debounce support") +Depends-on: 827e1579e1d5 ("pinctrl: baytrail: Rectify debounce support (part 2)") +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c +index 62eac76be9f66..519758d4297ee 100644 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -1266,7 +1266,6 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, + break; + case PIN_CONFIG_INPUT_DEBOUNCE: + debounce = readl(db_reg); +- debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + + if (arg) + conf |= BYT_DEBOUNCE_EN; +@@ -1275,24 +1274,31 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, + + switch (arg) { + case 375: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_375US; + break; + case 750: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_750US; + break; + case 1500: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_1500US; + break; + case 3000: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_3MS; + break; + case 6000: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_6MS; + break; + case 12000: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_12MS; + break; + case 24000: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_24MS; + break; + default: +-- +2.27.0 + diff --git a/queue-4.14/pinctrl-merrifield-set-default-bias-in-case-no-parti.patch b/queue-4.14/pinctrl-merrifield-set-default-bias-in-case-no-parti.patch new file mode 100644 index 00000000000..1845b7c4fb2 --- /dev/null +++ b/queue-4.14/pinctrl-merrifield-set-default-bias-in-case-no-parti.patch @@ -0,0 +1,58 @@ +From 7dfc18de983d3150e1d8817637c77fec74ddd3f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 14:06:05 +0200 +Subject: pinctrl: merrifield: Set default bias in case no particular value + given + +From: Andy Shevchenko + +[ Upstream commit 0fa86fc2e28227f1e64f13867e73cf864c6d25ad ] + +When GPIO library asks pin control to set the bias, it doesn't pass +any value of it and argument is considered boolean (and this is true +for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual +drivers must behave well, when they got the resistance value of 1 Ohm, +i.e. transforming it to sane default. + +In case of Intel Merrifield pin control hardware the 20 kOhm sounds plausible +because it gives a good trade off between weakness and minimization of leakage +current (will be only 50 uA with the above choice). + +Fixes: 4e80c8f50574 ("pinctrl: intel: Add Intel Merrifield pin controller support") +Depends-on: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips") +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-merrifield.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c +index 86c4b3fab7b0e..5aa6d1dbc70ae 100644 +--- a/drivers/pinctrl/intel/pinctrl-merrifield.c ++++ b/drivers/pinctrl/intel/pinctrl-merrifield.c +@@ -731,6 +731,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin, + mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK; + bits |= BUFCFG_PU_EN; + ++ /* Set default strength value in case none is given */ ++ if (arg == 1) ++ arg = 20000; ++ + switch (arg) { + case 50000: + bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT; +@@ -751,6 +755,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin, + mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK; + bits |= BUFCFG_PD_EN; + ++ /* Set default strength value in case none is given */ ++ if (arg == 1) ++ arg = 20000; ++ + switch (arg) { + case 50000: + bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT; +-- +2.27.0 + diff --git a/queue-4.14/rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch b/queue-4.14/rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch new file mode 100644 index 00000000000..c55b2e618ed --- /dev/null +++ b/queue-4.14/rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch @@ -0,0 +1,79 @@ +From 3adb878be595347cbdcad655e0e37092ecf89e54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 08:42:05 +0200 +Subject: RDMA/cm: Fix an attempt to use non-valid pointer when cleaning + timewait +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 340b940ea0ed12d9adbb8f72dea17d516b2019e8 ] + +If cm_create_timewait_info() fails, the timewait_info pointer will contain +an error value and will be used in cm_remove_remote() later. + + general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI + KASAN: null-ptr-deref in range [0×0000000000000120-0×0000000000000127] + CPU: 2 PID: 12446 Comm: syz-executor.3 Not tainted 5.10.0-rc5-5d4c0742a60e #27 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + RIP: 0010:cm_remove_remote.isra.0+0x24/0×170 drivers/infiniband/core/cm.c:978 + Code: 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 8d ab 2d 01 00 00 e8 7d bf 4b fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 fc 00 00 00 + RSP: 0018:ffff888013127918 EFLAGS: 00010006 + RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc9000a18b000 + RDX: 0000000000000024 RSI: ffffffff82edc573 RDI: fffffffffffffff4 + RBP: 0000000000000121 R08: 0000000000000001 R09: ffffed1002624f1d + R10: 0000000000000003 R11: ffffed1002624f1c R12: ffff888107760c70 + R13: ffff888107760c40 R14: fffffffffffffff4 R15: ffff888107760c9c + FS: 00007fe1ffcc1700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000001b2ff21000 CR3: 000000010f504001 CR4: 0000000000370ee0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + cm_destroy_id+0x189/0×15b0 drivers/infiniband/core/cm.c:1155 + cma_connect_ib drivers/infiniband/core/cma.c:4029 [inline] + rdma_connect_locked+0x1100/0×17c0 drivers/infiniband/core/cma.c:4107 + rdma_connect+0x2a/0×40 drivers/infiniband/core/cma.c:4140 + ucma_connect+0x277/0×340 drivers/infiniband/core/ucma.c:1069 + ucma_write+0x236/0×2f0 drivers/infiniband/core/ucma.c:1724 + vfs_write+0x220/0×830 fs/read_write.c:603 + ksys_write+0x1df/0×240 fs/read_write.c:658 + do_syscall_64+0x33/0×40 arch/x86/entry/common.c:46 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation") +Link: https://lore.kernel.org/r/20201204064205.145795-1-leon@kernel.org +Reviewed-by: Maor Gottlieb +Reported-by: Amit Matityahu +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index 80a8eb7e5d6ec..3ddc556df809c 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1349,6 +1349,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, + id.local_id); + if (IS_ERR(cm_id_priv->timewait_info)) { + ret = PTR_ERR(cm_id_priv->timewait_info); ++ cm_id_priv->timewait_info = NULL; + goto out; + } + +@@ -1836,6 +1837,7 @@ static int cm_req_handler(struct cm_work *work) + id.local_id); + if (IS_ERR(cm_id_priv->timewait_info)) { + ret = PTR_ERR(cm_id_priv->timewait_info); ++ cm_id_priv->timewait_info = NULL; + goto destroy; + } + cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id; +-- +2.27.0 + diff --git a/queue-4.14/scsi-bnx2i-requires-mmu.patch b/queue-4.14/scsi-bnx2i-requires-mmu.patch new file mode 100644 index 00000000000..87234ba9ba4 --- /dev/null +++ b/queue-4.14/scsi-bnx2i-requires-mmu.patch @@ -0,0 +1,52 @@ +From b51319917d18e4b6a02ab07b1d17a8141049d216 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 23:09:16 -0800 +Subject: scsi: bnx2i: Requires MMU + +From: Randy Dunlap + +[ Upstream commit 2d586494c4a001312650f0b919d534e429dd1e09 ] + +The SCSI_BNX2_ISCSI kconfig symbol selects CNIC and CNIC selects UIO, which +depends on MMU. + +Since 'select' does not follow dependency chains, add the same MMU +dependency to SCSI_BNX2_ISCSI. + +Quietens this kconfig warning: + +WARNING: unmet direct dependencies detected for CNIC + Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) && MMU [=n] + Selected by [m]: + - SCSI_BNX2_ISCSI [=m] && SCSI_LOWLEVEL [=y] && SCSI [=y] && NET [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) + +Link: https://lore.kernel.org/r/20201129070916.3919-1-rdunlap@infradead.org +Fixes: cf4e6363859d ("[SCSI] bnx2i: Add bnx2i iSCSI driver.") +Cc: linux-scsi@vger.kernel.org +Cc: Nilesh Javali +Cc: Manish Rangankar +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Signed-off-by: Randy Dunlap +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2i/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig +index ba30ff86d5818..b27a3738d940c 100644 +--- a/drivers/scsi/bnx2i/Kconfig ++++ b/drivers/scsi/bnx2i/Kconfig +@@ -3,6 +3,7 @@ config SCSI_BNX2_ISCSI + depends on NET + depends on PCI + depends on (IPV6 || IPV6=n) ++ depends on MMU + select SCSI_ISCSI_ATTRS + select NETDEVICES + select ETHERNET +-- +2.27.0 + diff --git a/queue-4.14/scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch b/queue-4.14/scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch new file mode 100644 index 00000000000..ba3142e04ee --- /dev/null +++ b/queue-4.14/scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch @@ -0,0 +1,38 @@ +From b04639c5530d90bf0c9e28d73b84539a2e2252e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 13:57:33 +0530 +Subject: scsi: mpt3sas: Increase IOCInit request timeout to 30s + +From: Sreekanth Reddy + +[ Upstream commit 85dad327d9b58b4c9ce08189a2707167de392d23 ] + +Currently the IOCInit request message timeout is set to 10s. This is not +sufficient in some scenarios such as during HBA FW downgrade operations. + +Increase the IOCInit request timeout to 30s. + +Link: https://lore.kernel.org/r/20201130082733.26120-1-sreekanth.reddy@broadcom.com +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 556971c5f0b0e..20bf1fa7f2733 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -4575,7 +4575,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc) + + r = _base_handshake_req_reply_wait(ioc, + sizeof(Mpi2IOCInitRequest_t), (u32 *)&mpi_request, +- sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 10); ++ sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 30); + + if (r != 0) { + pr_err(MPT3SAS_FMT "%s: handshake failed (r=%d)\n", +-- +2.27.0 + diff --git a/queue-4.14/series b/queue-4.14/series index 8f24923097c..197ee97892d 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -32,3 +32,16 @@ usb-sisusbvga-make-console-support-depend-on-broken.patch alsa-pcm-oss-fix-potential-out-of-bounds-shift.patch serial-8250_omap-avoid-fifo-corruption-caused-by-mdr1-access.patch drm-fix-drm_dp_mst_port-refcount-leaks-in-drm_dp_mst_allocate_vcpi.patch +pinctrl-merrifield-set-default-bias-in-case-no-parti.patch +pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch +arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch +gpio-mvebu-fix-potential-user-after-free-on-probe.patch +scsi-bnx2i-requires-mmu.patch +can-softing-softing_netdev_open-fix-error-handling.patch +rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch +kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch +drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch +vxlan-add-needed_headroom-for-lower-device.patch +vxlan-copy-needed_tailroom-from-lowerdev.patch +scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch +dm-table-remove-bug_on-in_interrupt.patch diff --git a/queue-4.14/vxlan-add-needed_headroom-for-lower-device.patch b/queue-4.14/vxlan-add-needed_headroom-for-lower-device.patch new file mode 100644 index 00000000000..b1bd627027f --- /dev/null +++ b/queue-4.14/vxlan-add-needed_headroom-for-lower-device.patch @@ -0,0 +1,51 @@ +From 0d5945d901b50594cf2110507a960db2607a35ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 13:52:46 +0100 +Subject: vxlan: Add needed_headroom for lower device + +From: Sven Eckelmann + +[ Upstream commit 0a35dc41fea67ac4495ce7584406bf9557a6e7d0 ] + +It was observed that sending data via batadv over vxlan (on top of +wireguard) reduced the performance massively compared to raw ethernet or +batadv on raw ethernet. A check of perf data showed that the +vxlan_build_skb was calling all the time pskb_expand_head to allocate +enough headroom for: + + min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len + + VXLAN_HLEN + iphdr_len; + +But the vxlan_config_apply only requested needed headroom for: + + lowerdev->hard_header_len + VXLAN6_HEADROOM or VXLAN_HEADROOM + +So it completely ignored the needed_headroom of the lower device. The first +caller of net_dev_xmit could therefore never make sure that enough headroom +was allocated for the rest of the transmit path. + +Cc: Annika Wickert +Signed-off-by: Sven Eckelmann +Tested-by: Annika Wickert +Link: https://lore.kernel.org/r/20201126125247.1047977-1-sven@narfation.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 82efa5bbf568b..c21f28840f05b 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3184,6 +3184,7 @@ static void vxlan_config_apply(struct net_device *dev, + dev->gso_max_segs = lowerdev->gso_max_segs; + + needed_headroom = lowerdev->hard_header_len; ++ needed_headroom += lowerdev->needed_headroom; + + max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : + VXLAN_HEADROOM); +-- +2.27.0 + diff --git a/queue-4.14/vxlan-copy-needed_tailroom-from-lowerdev.patch b/queue-4.14/vxlan-copy-needed_tailroom-from-lowerdev.patch new file mode 100644 index 00000000000..0ba4ad13b56 --- /dev/null +++ b/queue-4.14/vxlan-copy-needed_tailroom-from-lowerdev.patch @@ -0,0 +1,37 @@ +From 4cce92eaadfaed85b4055357cb18590c72b09951 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 13:52:47 +0100 +Subject: vxlan: Copy needed_tailroom from lowerdev + +From: Sven Eckelmann + +[ Upstream commit a5e74021e84bb5eadf760aaf2c583304f02269be ] + +While vxlan doesn't need any extra tailroom, the lowerdev might need it. In +that case, copy it over to reduce the chance for additional (re)allocations +in the transmit path. + +Signed-off-by: Sven Eckelmann +Link: https://lore.kernel.org/r/20201126125247.1047977-2-sven@narfation.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index c21f28840f05b..94a9add2fc878 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3186,6 +3186,8 @@ static void vxlan_config_apply(struct net_device *dev, + needed_headroom = lowerdev->hard_header_len; + needed_headroom += lowerdev->needed_headroom; + ++ dev->needed_tailroom = lowerdev->needed_tailroom; ++ + max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : + VXLAN_HEADROOM); + if (max_mtu < ETH_MIN_MTU) +-- +2.27.0 +