From: Sasha Levin Date: Sun, 15 Nov 2020 14:34:30 +0000 (-0500) Subject: Fixes for 4.19 X-Git-Tag: v4.4.244~63^2~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9228d564c7f2d08aa60134218babb7f2b9895245;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch b/queue-4.19/alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch new file mode 100644 index 00000000000..8c166021a50 --- /dev/null +++ b/queue-4.19/alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch @@ -0,0 +1,36 @@ +From e91a8308433dfd05b750c3df6f8da13d312d8b8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 21:00:38 +0800 +Subject: ALSA: hda: Reinstate runtime_allow() for all hda controllers + +From: Kai-Heng Feng + +[ Upstream commit 9fc149c3bce7bdbb94948a8e6bd025e3b3538603 ] + +The broken jack detection should be fixed by commit a6e7d0a4bdb0 ("ALSA: +hda: fix jack detection with Realtek codecs when in D3"), let's try +enabling runtime PM by default again. + +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20201027130038.16463-4-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_intel.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index d43245937db7e..8e1eb5f243a27 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2478,6 +2478,7 @@ static int azx_probe_continue(struct azx *chip) + + if (azx_has_pm_runtime(chip)) { + pm_runtime_use_autosuspend(&pci->dev); ++ pm_runtime_allow(&pci->dev); + pm_runtime_put_autosuspend(&pci->dev); + } + +-- +2.27.0 + diff --git a/queue-4.19/cfg80211-regulatory-fix-inconsistent-format-argument.patch b/queue-4.19/cfg80211-regulatory-fix-inconsistent-format-argument.patch new file mode 100644 index 00000000000..1121df1dbc0 --- /dev/null +++ b/queue-4.19/cfg80211-regulatory-fix-inconsistent-format-argument.patch @@ -0,0 +1,38 @@ +From 4ddce8084fdd498033a1ed8e94fb34e6077ae9b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 15:02:15 +0800 +Subject: cfg80211: regulatory: Fix inconsistent format argument + +From: Ye Bin + +[ Upstream commit db18d20d1cb0fde16d518fb5ccd38679f174bc04 ] + +Fix follow warning: +[net/wireless/reg.c:3619]: (warning) %d in format string (no. 2) +requires 'int' but the argument type is 'unsigned int'. + +Reported-by: Hulk Robot +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20201009070215.63695-1-yebin10@huawei.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/reg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 935aebf150107..c7825b951f725 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -3374,7 +3374,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd) + power_rule = ®_rule->power_rule; + + if (reg_rule->flags & NL80211_RRF_AUTO_BW) +- snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO", ++ snprintf(bw, sizeof(bw), "%d KHz, %u KHz AUTO", + freq_range->max_bandwidth_khz, + reg_get_max_bandwidth(rd, reg_rule)); + else +-- +2.27.0 + diff --git a/queue-4.19/drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch b/queue-4.19/drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch new file mode 100644 index 00000000000..35526a57029 --- /dev/null +++ b/queue-4.19/drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch @@ -0,0 +1,44 @@ +From 5fb2fa63568c362ec407d758b98a242c7cf19f31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 10:24:18 +0800 +Subject: drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running + +From: Evan Quan + +[ Upstream commit 786436b453001dafe81025389f96bf9dac1e9690 ] + +This reverts commit f87812284172a9809820d10143b573d833cd3f75 ("drm/amdgpu: +Fix bug where DPM is not enabled after hibernate and resume"). +It was intended to fix Hawaii S4(hibernation) issue but break S3. As +ixFEATURE_STATUS is filled with garbage data on resume which can be +only cleared by reloading smc firmware(but that will involve many +changes). So, we will revert this S4 fix and seek a new way. + +Signed-off-by: Evan Quan +Tested-by: Sandeep Raghuraman +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +index 0d4dd607e85c8..c05bec5effb2e 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +@@ -2723,10 +2723,7 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr) + + static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr) + { +- return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device, +- CGS_IND_REG__SMC, FEATURE_STATUS, +- VOLTAGE_CONTROLLER_ON)) +- ? true : false; ++ return ci_is_smc_ram_running(hwmgr); + } + + static int ci_smu_init(struct pp_hwmgr *hwmgr) +-- +2.27.0 + diff --git a/queue-4.19/drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch b/queue-4.19/drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch new file mode 100644 index 00000000000..23d96f5dcf8 --- /dev/null +++ b/queue-4.19/drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch @@ -0,0 +1,122 @@ +From b8327aa0ade710cdd5caae1cf53946d7beb1d9ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 10:45:26 +0800 +Subject: drm/amd/pm: perform SMC reset on suspend/hibernation + +From: Evan Quan + +[ Upstream commit 277b080f98803cb73a83fb234f0be83a10e63958 ] + +So that the succeeding resume can be performed based on +a clean state. + +Signed-off-by: Evan Quan +Tested-by: Sandeep Raghuraman +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 ++++ + drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + + drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 ++ + .../gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 24 +++++++++++++++++++ + drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 +++++++ + 5 files changed, 39 insertions(+) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +index 058898b321b8a..d8e624d64ae38 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -1531,6 +1531,10 @@ int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr) + PP_ASSERT_WITH_CODE((tmp_result == 0), + "Failed to reset to default!", result = tmp_result); + ++ tmp_result = smum_stop_smc(hwmgr); ++ PP_ASSERT_WITH_CODE((tmp_result == 0), ++ "Failed to stop smc!", result = tmp_result); ++ + tmp_result = smu7_force_switch_to_arbf0(hwmgr); + PP_ASSERT_WITH_CODE((tmp_result == 0), + "Failed to force to switch arbf0!", result = tmp_result); +diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h +index 6ee864455a12a..f59e1e737735f 100644 +--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h ++++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h +@@ -216,6 +216,7 @@ struct pp_smumgr_func { + bool (*is_hw_avfs_present)(struct pp_hwmgr *hwmgr); + int (*update_dpm_settings)(struct pp_hwmgr *hwmgr, void *profile_setting); + int (*smc_table_manager)(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw); /*rw: true for read, false for write */ ++ int (*stop_smc)(struct pp_hwmgr *hwmgr); + }; + + struct pp_hwmgr_func { +diff --git a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h +index 82550a8a3a3fc..ef4f2392e2e7d 100644 +--- a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h ++++ b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h +@@ -113,4 +113,6 @@ extern int smum_update_dpm_settings(struct pp_hwmgr *hwmgr, void *profile_settin + + extern int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw); + ++extern int smum_stop_smc(struct pp_hwmgr *hwmgr); ++ + #endif +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +index db87cb8930d24..0d4dd607e85c8 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +@@ -2934,6 +2934,29 @@ static int ci_update_smc_table(struct pp_hwmgr *hwmgr, uint32_t type) + return 0; + } + ++static void ci_reset_smc(struct pp_hwmgr *hwmgr) ++{ ++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, ++ SMC_SYSCON_RESET_CNTL, ++ rst_reg, 1); ++} ++ ++ ++static void ci_stop_smc_clock(struct pp_hwmgr *hwmgr) ++{ ++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, ++ SMC_SYSCON_CLOCK_CNTL_0, ++ ck_disable, 1); ++} ++ ++static int ci_stop_smc(struct pp_hwmgr *hwmgr) ++{ ++ ci_reset_smc(hwmgr); ++ ci_stop_smc_clock(hwmgr); ++ ++ return 0; ++} ++ + const struct pp_smumgr_func ci_smu_funcs = { + .smu_init = ci_smu_init, + .smu_fini = ci_smu_fini, +@@ -2957,4 +2980,5 @@ const struct pp_smumgr_func ci_smu_funcs = { + .is_dpm_running = ci_is_dpm_running, + .update_dpm_settings = ci_update_dpm_settings, + .update_smc_table = ci_update_smc_table, ++ .stop_smc = ci_stop_smc, + }; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c +index a6edd5df33b0f..20ecf994d47f3 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c +@@ -213,3 +213,11 @@ int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t tabl + + return -EINVAL; + } ++ ++int smum_stop_smc(struct pp_hwmgr *hwmgr) ++{ ++ if (hwmgr->smumgr_funcs->stop_smc) ++ return hwmgr->smumgr_funcs->stop_smc(hwmgr); ++ ++ return 0; ++} +-- +2.27.0 + diff --git a/queue-4.19/drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch b/queue-4.19/drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch new file mode 100644 index 00000000000..55443e244d7 --- /dev/null +++ b/queue-4.19/drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch @@ -0,0 +1,63 @@ +From 3a0c81ec66d9ffcea305c1ddad1078efe4c7ea2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 15:29:59 +0800 +Subject: drm/amdgpu: perform srbm soft reset always on SDMA resume + +From: Evan Quan + +[ Upstream commit 253475c455eb5f8da34faa1af92709e7bb414624 ] + +This can address the random SDMA hang after pci config reset +seen on Hawaii. + +Signed-off-by: Evan Quan +Tested-by: Sandeep Raghuraman +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++++++++++++--------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c +index d0fa2aac23888..ca66c2f797584 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c +@@ -1086,22 +1086,19 @@ static int cik_sdma_soft_reset(void *handle) + { + u32 srbm_soft_reset = 0; + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +- u32 tmp = RREG32(mmSRBM_STATUS2); ++ u32 tmp; + +- if (tmp & SRBM_STATUS2__SDMA_BUSY_MASK) { +- /* sdma0 */ +- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET); +- tmp |= SDMA0_F32_CNTL__HALT_MASK; +- WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp); +- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK; +- } +- if (tmp & SRBM_STATUS2__SDMA1_BUSY_MASK) { +- /* sdma1 */ +- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET); +- tmp |= SDMA0_F32_CNTL__HALT_MASK; +- WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp); +- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK; +- } ++ /* sdma0 */ ++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET); ++ tmp |= SDMA0_F32_CNTL__HALT_MASK; ++ WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp); ++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK; ++ ++ /* sdma1 */ ++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET); ++ tmp |= SDMA0_F32_CNTL__HALT_MASK; ++ WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp); ++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK; + + if (srbm_soft_reset) { + tmp = RREG32(mmSRBM_SOFT_RESET); +-- +2.27.0 + diff --git a/queue-4.19/gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch b/queue-4.19/gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch new file mode 100644 index 00000000000..592bcf2ce2c --- /dev/null +++ b/queue-4.19/gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch @@ -0,0 +1,39 @@ +From 9a76418d26dfab1d6b06f691283b94531b20fb93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 10:10:02 -0500 +Subject: gfs2: Add missing truncate_inode_pages_final for sd_aspace + +From: Bob Peterson + +[ Upstream commit a9dd945ccef07a904e412f208f8de708a3d7159e ] + +Gfs2 creates an address space for its rgrps called sd_aspace, but it never +called truncate_inode_pages_final on it. This confused vfs greatly which +tried to reference the address space after gfs2 had freed the superblock +that contained it. + +This patch adds a call to truncate_inode_pages_final for sd_aspace, thus +avoiding the use-after-free. + +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/super.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index a971862b186e3..22cd68bd8c9b0 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -934,6 +934,7 @@ restart: + gfs2_jindex_free(sdp); + /* Take apart glock structures and buffer lists */ + gfs2_gl_hash_clear(sdp); ++ truncate_inode_pages_final(&sdp->sd_aspace); + gfs2_delete_debugfs_file(sdp); + /* Unmount the locking protocol */ + gfs2_lm_unmount(sdp); +-- +2.27.0 + diff --git a/queue-4.19/gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch b/queue-4.19/gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch new file mode 100644 index 00000000000..30730c33624 --- /dev/null +++ b/queue-4.19/gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch @@ -0,0 +1,49 @@ +From 2b3b11745445a869bdbd16ec1cecfcfd7008c4e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 13:42:18 -0500 +Subject: gfs2: check for live vs. read-only file system in gfs2_fitrim + +From: Bob Peterson + +[ Upstream commit c5c68724696e7d2f8db58a5fce3673208d35c485 ] + +Before this patch, gfs2_fitrim was not properly checking for a "live" file +system. If the file system had something to trim and the file system +was read-only (or spectator) it would start the trim, but when it starts +the transaction, gfs2_trans_begin returns -EROFS (read-only file system) +and it errors out. However, if the file system was already trimmed so +there's no work to do, it never called gfs2_trans_begin. That code is +bypassed so it never returns the error. Instead, it returns a good +return code with 0 work. All this makes for inconsistent behavior: +The same fstrim command can return -EROFS in one case and 0 in another. +This tripped up xfstests generic/537 which reports the error as: + + +fstrim with unrecovered metadata just ate your filesystem + +This patch adds a check for a "live" (iow, active journal, iow, RW) +file system, and if not, returns the error properly. + +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/rgrp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 1686a40099f21..de9b561b1c385 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1387,6 +1387,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp) + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + ++ if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)) ++ return -EROFS; ++ + if (!blk_queue_discard(q)) + return -EOPNOTSUPP; + +-- +2.27.0 + diff --git a/queue-4.19/gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch b/queue-4.19/gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch new file mode 100644 index 00000000000..69969dbe91c --- /dev/null +++ b/queue-4.19/gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch @@ -0,0 +1,39 @@ +From d19dea29eb38dbd862d2f072a1f237a0a05f1361 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 10:10:01 -0500 +Subject: gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free + +From: Bob Peterson + +[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ] + +Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling +return_all_reservations, but return_all_reservations still dereferences +rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the +call to return_all_reservations. + +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/rgrp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index c94c4ac1ae78b..1686a40099f21 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -739,9 +739,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) + } + + gfs2_free_clones(rgd); ++ return_all_reservations(rgd); + kfree(rgd->rd_bits); + rgd->rd_bits = NULL; +- return_all_reservations(rgd); + kmem_cache_free(gfs2_rgrpd_cachep, rgd); + } + } +-- +2.27.0 + diff --git a/queue-4.19/iommu-amd-increase-interrupt-remapping-table-limit-t.patch b/queue-4.19/iommu-amd-increase-interrupt-remapping-table-limit-t.patch new file mode 100644 index 00000000000..0d93cecd87d --- /dev/null +++ b/queue-4.19/iommu-amd-increase-interrupt-remapping-table-limit-t.patch @@ -0,0 +1,53 @@ +From 675e59fa98a4871bcaef8c7e37662aa9011e8e87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 02:50:02 +0000 +Subject: iommu/amd: Increase interrupt remapping table limit to 512 entries + +From: Suravee Suthikulpanit + +[ Upstream commit 73db2fc595f358460ce32bcaa3be1f0cce4a2db1 ] + +Certain device drivers allocate IO queues on a per-cpu basis. +On AMD EPYC platform, which can support up-to 256 cpu threads, +this can exceed the current MAX_IRQ_PER_TABLE limit of 256, +and result in the error message: + + AMD-Vi: Failed to allocate IRTE + +This has been observed with certain NVME devices. + +AMD IOMMU hardware can actually support upto 512 interrupt +remapping table entries. Therefore, update the driver to +match the hardware limit. + +Please note that this also increases the size of interrupt remapping +table to 8KB per device when using the 128-bit IRTE format. + +Signed-off-by: Suravee Suthikulpanit +Link: https://lore.kernel.org/r/20201015025002.87997-1-suravee.suthikulpanit@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_types.h | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h +index 859b06424e5c4..df6f3cc958e5e 100644 +--- a/drivers/iommu/amd_iommu_types.h ++++ b/drivers/iommu/amd_iommu_types.h +@@ -410,7 +410,11 @@ extern bool amd_iommu_np_cache; + /* Only true if all IOMMUs support device IOTLBs */ + extern bool amd_iommu_iotlb_sup; + +-#define MAX_IRQS_PER_TABLE 256 ++/* ++ * AMD IOMMU hardware only support 512 IRTEs despite ++ * the architectural limitation of 2048 entries. ++ */ ++#define MAX_IRQS_PER_TABLE 512 + #define IRQ_TABLE_ALIGNMENT 128 + + struct irq_remap_table { +-- +2.27.0 + diff --git a/queue-4.19/mac80211-always-wind-down-sta-state.patch b/queue-4.19/mac80211-always-wind-down-sta-state.patch new file mode 100644 index 00000000000..176f5665272 --- /dev/null +++ b/queue-4.19/mac80211-always-wind-down-sta-state.patch @@ -0,0 +1,64 @@ +From 4a5c7469e7d809dc4b44294831f6d0efe00b03d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 14:17:11 +0200 +Subject: mac80211: always wind down STA state + +From: Johannes Berg + +[ Upstream commit dcd479e10a0510522a5d88b29b8f79ea3467d501 ] + +When (for example) an IBSS station is pre-moved to AUTHORIZED +before it's inserted, and then the insertion fails, we don't +clean up the fast RX/TX states that might already have been +created, since we don't go through all the state transitions +again on the way down. + +Do that, if it hasn't been done already, when the station is +freed. I considered only freeing the fast TX/RX state there, +but we might add more state so it's more robust to wind down +the state properly. + +Note that we warn if the station was ever inserted, it should +have been properly cleaned up in that case, and the driver +will probably not like things happening out of order. + +Reported-by: syzbot+2e293dbd67de2836ba42@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20201009141710.7223b322a955.I95bd08b9ad0e039c034927cce0b75beea38e059b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 9968b8a976f19..d11eb5139c92a 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -244,6 +244,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata, + */ + void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) + { ++ /* ++ * If we had used sta_info_pre_move_state() then we might not ++ * have gone through the state transitions down again, so do ++ * it here now (and warn if it's inserted). ++ * ++ * This will clear state such as fast TX/RX that may have been ++ * allocated during state transitions. ++ */ ++ while (sta->sta_state > IEEE80211_STA_NONE) { ++ int ret; ++ ++ WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED)); ++ ++ ret = sta_info_move_state(sta, sta->sta_state - 1); ++ if (WARN_ONCE(ret, "sta_info_move_state() returned %d\n", ret)) ++ break; ++ } ++ + if (sta->rate_ctrl) + rate_control_free_sta(sta); + +-- +2.27.0 + diff --git a/queue-4.19/mac80211-fix-use-of-skb-payload-instead-of-header.patch b/queue-4.19/mac80211-fix-use-of-skb-payload-instead-of-header.patch new file mode 100644 index 00000000000..321b0116b7b --- /dev/null +++ b/queue-4.19/mac80211-fix-use-of-skb-payload-instead-of-header.patch @@ -0,0 +1,127 @@ +From 1fc4b8f0c2017e6816e283ae9776dfdcdbe730dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 13:25:41 +0200 +Subject: mac80211: fix use of skb payload instead of header + +From: Johannes Berg + +[ Upstream commit 14f46c1e5108696ec1e5a129e838ecedf108c7bf ] + +When ieee80211_skb_resize() is called from ieee80211_build_hdr() +the skb has no 802.11 header yet, in fact it consist only of the +payload as the ethernet frame is removed. As such, we're using +the payload data for ieee80211_is_mgmt(), which is of course +completely wrong. This didn't really hurt us because these are +always data frames, so we could only have added more tailroom +than we needed if we determined it was a management frame and +sdata->crypto_tx_tailroom_needed_cnt was false. + +However, syzbot found that of course there need not be any payload, +so we're using at best uninitialized memory for the check. + +Fix this to pass explicitly the kind of frame that we have instead +of checking there, by replacing the "bool may_encrypt" argument +with an argument that can carry the three possible states - it's +not going to be encrypted, it's a management frame, or it's a data +frame (and then we check sdata->crypto_tx_tailroom_needed_cnt). + +Reported-by: syzbot+32fd1a1bfe355e93f1e2@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Link: https://lore.kernel.org/r/20201009132538.e1fd7f802947.I799b288466ea2815f9d4c84349fae697dca2f189@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/tx.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 3160ffd93a153..98d048630ad2f 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1908,19 +1908,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata, + + /* device xmit handlers */ + ++enum ieee80211_encrypt { ++ ENCRYPT_NO, ++ ENCRYPT_MGMT, ++ ENCRYPT_DATA, ++}; ++ + static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, + struct sk_buff *skb, +- int head_need, bool may_encrypt) ++ int head_need, ++ enum ieee80211_encrypt encrypt) + { + struct ieee80211_local *local = sdata->local; +- struct ieee80211_hdr *hdr; + bool enc_tailroom; + int tail_need = 0; + +- hdr = (struct ieee80211_hdr *) skb->data; +- enc_tailroom = may_encrypt && +- (sdata->crypto_tx_tailroom_needed_cnt || +- ieee80211_is_mgmt(hdr->frame_control)); ++ enc_tailroom = encrypt == ENCRYPT_MGMT || ++ (encrypt == ENCRYPT_DATA && ++ sdata->crypto_tx_tailroom_needed_cnt); + + if (enc_tailroom) { + tail_need = IEEE80211_ENCRYPT_TAILROOM; +@@ -1952,23 +1957,29 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +- struct ieee80211_hdr *hdr; ++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; + int headroom; +- bool may_encrypt; ++ enum ieee80211_encrypt encrypt; + +- may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT); ++ if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT) ++ encrypt = ENCRYPT_NO; ++ else if (ieee80211_is_mgmt(hdr->frame_control)) ++ encrypt = ENCRYPT_MGMT; ++ else ++ encrypt = ENCRYPT_DATA; + + headroom = local->tx_headroom; +- if (may_encrypt) ++ if (encrypt != ENCRYPT_NO) + headroom += sdata->encrypt_headroom; + headroom -= skb_headroom(skb); + headroom = max_t(int, 0, headroom); + +- if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) { ++ if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) { + ieee80211_free_txskb(&local->hw, skb); + return; + } + ++ /* reload after potential resize */ + hdr = (struct ieee80211_hdr *) skb->data; + info->control.vif = &sdata->vif; + +@@ -2751,7 +2762,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, + head_need += sdata->encrypt_headroom; + head_need += local->tx_headroom; + head_need = max_t(int, 0, head_need); +- if (ieee80211_skb_resize(sdata, skb, head_need, true)) { ++ if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) { + ieee80211_free_txskb(&local->hw, skb); + skb = NULL; + return ERR_PTR(-ENOMEM); +@@ -3414,7 +3425,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata, + if (unlikely(ieee80211_skb_resize(sdata, skb, + max_t(int, extra_head + hw_headroom - + skb_headroom(skb), 0), +- false))) { ++ ENCRYPT_NO))) { + kfree_skb(skb); + return true; + } +-- +2.27.0 + diff --git a/queue-4.19/s390-smp-move-rcu_cpu_starting-earlier.patch b/queue-4.19/s390-smp-move-rcu_cpu_starting-earlier.patch new file mode 100644 index 00000000000..8a5b8d0b6bc --- /dev/null +++ b/queue-4.19/s390-smp-move-rcu_cpu_starting-earlier.patch @@ -0,0 +1,72 @@ +From e66086ba2887d779c7b0ecde1de2b10e4956c94d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 14:27:42 -0400 +Subject: s390/smp: move rcu_cpu_starting() earlier + +From: Qian Cai + +[ Upstream commit de5d9dae150ca1c1b5c7676711a9ca139d1a8dec ] + +The call to rcu_cpu_starting() in smp_init_secondary() is not early +enough in the CPU-hotplug onlining process, which results in lockdep +splats as follows: + + WARNING: suspicious RCU usage + ----------------------------- + kernel/locking/lockdep.c:3497 RCU-list traversed in non-reader section!! + + other info that might help us debug this: + + RCU used illegally from offline CPU! + rcu_scheduler_active = 1, debug_locks = 1 + no locks held by swapper/1/0. + + Call Trace: + show_stack+0x158/0x1f0 + dump_stack+0x1f2/0x238 + __lock_acquire+0x2640/0x4dd0 + lock_acquire+0x3a8/0xd08 + _raw_spin_lock_irqsave+0xc0/0xf0 + clockevents_register_device+0xa8/0x528 + init_cpu_timer+0x33e/0x468 + smp_init_secondary+0x11a/0x328 + smp_start_secondary+0x82/0x88 + +This is avoided by moving the call to rcu_cpu_starting up near the +beginning of the smp_init_secondary() function. Note that the +raw_smp_processor_id() is required in order to avoid calling into +lockdep before RCU has declared the CPU to be watched for readers. + +Link: https://lore.kernel.org/lkml/160223032121.7002.1269740091547117869.tip-bot2@tip-bot2/ +Signed-off-by: Qian Cai +Acked-by: Paul E. McKenney +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/smp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 8e31dfd85de32..888f247c9261a 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -831,7 +831,7 @@ void __init smp_detect_cpus(void) + */ + static void smp_start_secondary(void *cpuvoid) + { +- int cpu = smp_processor_id(); ++ int cpu = raw_smp_processor_id(); + + S390_lowcore.last_update_clock = get_tod_clock(); + S390_lowcore.restart_stack = (unsigned long) restart_stack; +@@ -844,6 +844,7 @@ static void smp_start_secondary(void *cpuvoid) + set_cpu_flag(CIF_ASCE_PRIMARY); + set_cpu_flag(CIF_ASCE_SECONDARY); + cpu_init(); ++ rcu_cpu_starting(cpu); + preempt_disable(); + init_cpu_timer(); + vtime_init(); +-- +2.27.0 + diff --git a/queue-4.19/scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch b/queue-4.19/scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch new file mode 100644 index 00000000000..d3324d61645 --- /dev/null +++ b/queue-4.19/scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch @@ -0,0 +1,49 @@ +From b6f909addf389e50c7398015d708f1203dfd22b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 07:31:24 +0000 +Subject: scsi: hpsa: Fix memory leak in hpsa_init_one() + +From: Keita Suzuki + +[ Upstream commit af61bc1e33d2c0ec22612b46050f5b58ac56a962 ] + +When hpsa_scsi_add_host() fails, h->lastlogicals is leaked since it is +missing a free() in the error handler. + +Fix this by adding free() when hpsa_scsi_add_host() fails. + +Link: https://lore.kernel.org/r/20201027073125.14229-1-keitasuzuki.park@sslab.ics.keio.ac.jp +Tested-by: Don Brace +Acked-by: Don Brace +Signed-off-by: Keita Suzuki +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 11de2198bb87d..0fe21cbdf0ca7 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -8781,7 +8781,7 @@ reinit_after_soft_reset: + /* hook into SCSI subsystem */ + rc = hpsa_scsi_add_host(h); + if (rc) +- goto clean7; /* perf, sg, cmd, irq, shost, pci, lu, aer/h */ ++ goto clean8; /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */ + + /* Monitor the controller for firmware lockups */ + h->heartbeat_sample_interval = HEARTBEAT_SAMPLE_INTERVAL; +@@ -8796,6 +8796,8 @@ reinit_after_soft_reset: + HPSA_EVENT_MONITOR_INTERVAL); + return 0; + ++clean8: /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */ ++ kfree(h->lastlogicals); + clean7: /* perf, sg, cmd, irq, shost, pci, lu, aer/h */ + hpsa_free_performant_mode(h); + h->access.set_intr_mask(h, HPSA_INTR_OFF); +-- +2.27.0 + diff --git a/queue-4.19/scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch b/queue-4.19/scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch new file mode 100644 index 00000000000..e59647e676a --- /dev/null +++ b/queue-4.19/scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch @@ -0,0 +1,73 @@ +From 615c1f8e8f6a4dd6890dc6adb18d33493e3491e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 12:45:59 +0200 +Subject: scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() + +From: Hannes Reinecke + +[ Upstream commit 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca ] + +alua_bus_detach() might be running concurrently with alua_rtpg_work(), so +we might trip over h->sdev == NULL and call BUG_ON(). The correct way of +handling it is to not set h->sdev to NULL in alua_bus_detach(), and call +rcu_synchronize() before the final delete to ensure that all concurrent +threads have left the critical section. Then we can get rid of the +BUG_ON() and replace it with a simple if condition. + +Link: https://lore.kernel.org/r/1600167537-12509-1-git-send-email-jitendra.khasdev@oracle.com +Link: https://lore.kernel.org/r/20200924104559.26753-1-hare@suse.de +Cc: Brian Bunker +Acked-by: Brian Bunker +Tested-by: Jitendra Khasdev +Reviewed-by: Jitendra Khasdev +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index c95c782b93a53..60c48dc5d9453 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -672,8 +672,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + rcu_read_lock(); + list_for_each_entry_rcu(h, + &tmp_pg->dh_list, node) { +- /* h->sdev should always be valid */ +- BUG_ON(!h->sdev); ++ if (!h->sdev) ++ continue; + h->sdev->access_state = desc[0]; + } + rcu_read_unlock(); +@@ -719,7 +719,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + pg->expiry = 0; + rcu_read_lock(); + list_for_each_entry_rcu(h, &pg->dh_list, node) { +- BUG_ON(!h->sdev); ++ if (!h->sdev) ++ continue; + h->sdev->access_state = + (pg->state & SCSI_ACCESS_STATE_MASK); + if (pg->pref) +@@ -1160,7 +1161,6 @@ static void alua_bus_detach(struct scsi_device *sdev) + spin_lock(&h->pg_lock); + pg = rcu_dereference_protected(h->pg, lockdep_is_held(&h->pg_lock)); + rcu_assign_pointer(h->pg, NULL); +- h->sdev = NULL; + spin_unlock(&h->pg_lock); + if (pg) { + spin_lock_irq(&pg->lock); +@@ -1169,6 +1169,7 @@ static void alua_bus_detach(struct scsi_device *sdev) + kref_put(&pg->kref, release_port_group); + } + sdev->handler_data = NULL; ++ synchronize_rcu(); + kfree(h); + } + +-- +2.27.0 + diff --git a/queue-4.19/selftests-proc-fix-warning-_gnu_source-redefined.patch b/queue-4.19/selftests-proc-fix-warning-_gnu_source-redefined.patch new file mode 100644 index 00000000000..d69f107accf --- /dev/null +++ b/queue-4.19/selftests-proc-fix-warning-_gnu_source-redefined.patch @@ -0,0 +1,60 @@ +From a77af8a3b28417d7939e095caeeea335ba534ce1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 15:26:30 +0300 +Subject: selftests: proc: fix warning: _GNU_SOURCE redefined + +From: Tommi Rantala + +[ Upstream commit f3ae6c6e8a3ea49076d826c64e63ea78fbf9db43 ] + +Makefile already contains -D_GNU_SOURCE, so we can remove it from the +*.c files. + +Signed-off-by: Tommi Rantala +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/proc/proc-loadavg-001.c | 1 - + tools/testing/selftests/proc/proc-self-syscall.c | 1 - + tools/testing/selftests/proc/proc-uptime-002.c | 1 - + 3 files changed, 3 deletions(-) + +diff --git a/tools/testing/selftests/proc/proc-loadavg-001.c b/tools/testing/selftests/proc/proc-loadavg-001.c +index fcff7047000da..8edaafc2b92fd 100644 +--- a/tools/testing/selftests/proc/proc-loadavg-001.c ++++ b/tools/testing/selftests/proc/proc-loadavg-001.c +@@ -14,7 +14,6 @@ + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + /* Test that /proc/loadavg correctly reports last pid in pid namespace. */ +-#define _GNU_SOURCE + #include + #include + #include +diff --git a/tools/testing/selftests/proc/proc-self-syscall.c b/tools/testing/selftests/proc/proc-self-syscall.c +index 5ab5f4810e43a..7b9018fad092a 100644 +--- a/tools/testing/selftests/proc/proc-self-syscall.c ++++ b/tools/testing/selftests/proc/proc-self-syscall.c +@@ -13,7 +13,6 @@ + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ +-#define _GNU_SOURCE + #include + #include + #include +diff --git a/tools/testing/selftests/proc/proc-uptime-002.c b/tools/testing/selftests/proc/proc-uptime-002.c +index 30e2b78490898..e7ceabed7f51f 100644 +--- a/tools/testing/selftests/proc/proc-uptime-002.c ++++ b/tools/testing/selftests/proc/proc-uptime-002.c +@@ -15,7 +15,6 @@ + */ + // Test that values in /proc/uptime increment monotonically + // while shifting across CPUs. +-#define _GNU_SOURCE + #undef NDEBUG + #include + #include +-- +2.27.0 + diff --git a/queue-4.19/series b/queue-4.19/series index 47ad7d8cc88..b147e8dd3c7 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -27,3 +27,21 @@ btrfs-fix-missing-error-return-if-writeback-for-exte.patch ath9k_htc-use-appropriate-rs_datalen-type.patch netfilter-use-actual-socket-sk-rather-than-skb-sk-when-routing-harder.patch crypto-arm64-aes-modes-get-rid-of-literal-load-of-addend-vector.patch +usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch +alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch +gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch +gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch +gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch +scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch +drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch +drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch +drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch +mac80211-fix-use-of-skb-payload-instead-of-header.patch +mac80211-always-wind-down-sta-state.patch +cfg80211-regulatory-fix-inconsistent-format-argument.patch +scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch +iommu-amd-increase-interrupt-remapping-table-limit-t.patch +s390-smp-move-rcu_cpu_starting-earlier.patch +vfio-platform-fix-reference-leak-in-vfio_platform_op.patch +selftests-proc-fix-warning-_gnu_source-redefined.patch +tpm_tis-disable-interrupts-on-thinkpad-t490s.patch diff --git a/queue-4.19/tpm_tis-disable-interrupts-on-thinkpad-t490s.patch b/queue-4.19/tpm_tis-disable-interrupts-on-thinkpad-t490s.patch new file mode 100644 index 00000000000..4fff3b6a53f --- /dev/null +++ b/queue-4.19/tpm_tis-disable-interrupts-on-thinkpad-t490s.patch @@ -0,0 +1,99 @@ +From f90e473271eea710b510c8b274a3148ebb9d1569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 14:44:30 -0700 +Subject: tpm_tis: Disable interrupts on ThinkPad T490s + +From: Jerry Snitselaar + +[ Upstream commit b154ce11ead925de6a94feb3b0317fafeefa0ebc ] + +There is a misconfiguration in the bios of the gpio pin used for the +interrupt in the T490s. When interrupts are enabled in the tpm_tis +driver code this results in an interrupt storm. This was initially +reported when we attempted to enable the interrupt code in the tpm_tis +driver, which previously wasn't setting a flag to enable it. Due to +the reports of the interrupt storm that code was reverted and we went back +to polling instead of using interrupts. Now that we know the T490s problem +is a firmware issue, add code to check if the system is a T490s and +disable interrupts if that is the case. This will allow us to enable +interrupts for everyone else. If the user has a fixed bios they can +force the enabling of interrupts with tpm_tis.interrupts=1 on the +kernel command line. + +Cc: Peter Huewe +Cc: Jason Gunthorpe +Cc: Hans de Goede +Signed-off-by: Jerry Snitselaar +Reviewed-by: James Bottomley +Reviewed-by: Hans de Goede +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis.c | 29 +++++++++++++++++++++++++++-- + 1 file changed, 27 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index f08949a5f6785..5a3a4f0953910 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + #include "tpm.h" + #include "tpm_tis_core.h" + +@@ -53,8 +54,8 @@ static inline struct tpm_tis_tcg_phy *to_tpm_tis_tcg_phy(struct tpm_tis_data *da + return container_of(data, struct tpm_tis_tcg_phy, priv); + } + +-static bool interrupts = true; +-module_param(interrupts, bool, 0444); ++static int interrupts = -1; ++module_param(interrupts, int, 0444); + MODULE_PARM_DESC(interrupts, "Enable interrupts"); + + static bool itpm; +@@ -67,6 +68,28 @@ module_param(force, bool, 0444); + MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry"); + #endif + ++static int tpm_tis_disable_irq(const struct dmi_system_id *d) ++{ ++ if (interrupts == -1) { ++ pr_notice("tpm_tis: %s detected: disabling interrupts.\n", d->ident); ++ interrupts = 0; ++ } ++ ++ return 0; ++} ++ ++static const struct dmi_system_id tpm_tis_dmi_table[] = { ++ { ++ .callback = tpm_tis_disable_irq, ++ .ident = "ThinkPad T490s", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T490s"), ++ }, ++ }, ++ {} ++}; ++ + #if defined(CONFIG_PNP) && defined(CONFIG_ACPI) + static int has_hid(struct acpi_device *dev, const char *hid) + { +@@ -196,6 +219,8 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info) + int irq = -1; + int rc; + ++ dmi_check_system(tpm_tis_dmi_table); ++ + rc = check_acpi_tpm2(dev); + if (rc) + return rc; +-- +2.27.0 + diff --git a/queue-4.19/usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch b/queue-4.19/usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch new file mode 100644 index 00000000000..56fcfe0c6bb --- /dev/null +++ b/queue-4.19/usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch @@ -0,0 +1,51 @@ +From 0651915fd3e4f8da194e4926b3cc846d65bdca19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 18:01:55 +0300 +Subject: usb: gadget: goku_udc: fix potential crashes in probe + +From: Evgeny Novikov + +[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ] + +goku_probe() goes to error label "err" and invokes goku_remove() +in case of failures of pci_enable_device(), pci_resource_start() +and ioremap(). goku_remove() gets a device from +pci_get_drvdata(pdev) and works with it without any checks, in +particular it dereferences a corresponding pointer. But +goku_probe() did not set this device yet. So, one can expect +various crashes. The patch moves setting the device just after +allocation of memory for it. + +Found by Linux Driver Verification project (linuxtesting.org). + +Reported-by: Pavel Andrianov +Signed-off-by: Evgeny Novikov +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/goku_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c +index c3721225b61ed..b706ad3034bc1 100644 +--- a/drivers/usb/gadget/udc/goku_udc.c ++++ b/drivers/usb/gadget/udc/goku_udc.c +@@ -1757,6 +1757,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto err; + } + ++ pci_set_drvdata(pdev, dev); + spin_lock_init(&dev->lock); + dev->pdev = pdev; + dev->gadget.ops = &goku_ops; +@@ -1790,7 +1791,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) + } + dev->regs = (struct goku_udc_regs __iomem *) base; + +- pci_set_drvdata(pdev, dev); + INFO(dev, "%s\n", driver_desc); + INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr()); + INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base); +-- +2.27.0 + diff --git a/queue-4.19/vfio-platform-fix-reference-leak-in-vfio_platform_op.patch b/queue-4.19/vfio-platform-fix-reference-leak-in-vfio_platform_op.patch new file mode 100644 index 00000000000..d98fedb43fd --- /dev/null +++ b/queue-4.19/vfio-platform-fix-reference-leak-in-vfio_platform_op.patch @@ -0,0 +1,45 @@ +From 16d7989091b702b486afb8c64a5878c1bb8479d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Oct 2020 11:03:53 +0800 +Subject: vfio: platform: fix reference leak in vfio_platform_open + +From: Zhang Qilong + +[ Upstream commit bb742ad01961a3b9d1f9d19375487b879668b6b2 ] + +pm_runtime_get_sync() will increment pm usage counter even it +failed. Forgetting to call pm_runtime_put will result in +reference leak in vfio_platform_open, so we should fix it. + +Signed-off-by: Zhang Qilong +Acked-by: Eric Auger +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/platform/vfio_platform_common.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c +index c0cd824be2b76..460760d0becfe 100644 +--- a/drivers/vfio/platform/vfio_platform_common.c ++++ b/drivers/vfio/platform/vfio_platform_common.c +@@ -273,7 +273,7 @@ static int vfio_platform_open(void *device_data) + + ret = pm_runtime_get_sync(vdev->device); + if (ret < 0) +- goto err_pm; ++ goto err_rst; + + ret = vfio_platform_call_reset(vdev, &extra_dbg); + if (ret && vdev->reset_required) { +@@ -290,7 +290,6 @@ static int vfio_platform_open(void *device_data) + + err_rst: + pm_runtime_put(vdev->device); +-err_pm: + vfio_platform_irq_cleanup(vdev); + err_irq: + vfio_platform_regions_cleanup(vdev); +-- +2.27.0 +