From: Greg Kroah-Hartman Date: Sat, 18 Apr 2020 10:55:21 +0000 (+0200) Subject: 5.5-stable patches X-Git-Tag: v4.19.117~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9cbd838471263c5dc326b570edafff7f18f66c5f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.5-stable patches added patches: acpi-nfit-improve-bounds-checking-for-func.patch alsa-hda-realtek-enable-the-headset-mic-on-asus-fx505dt.patch alsa-usb-audio-check-mapping-at-creating-connector-controls-too.patch alsa-usb-audio-don-t-create-jack-controls-for-pcm-terminals.patch alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch alsa-usb-audio-filter-error-from-connector-kctl-ops-too.patch arm-dts-imx7-colibri-fix-muxing-of-usbc_det-pin.patch arm64-dts-librem5-devkit-add-a-vbus-supply-to-usb0.patch arm64-vdso-don-t-free-unallocated-pages.patch asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch btrfs-check-commit-root-generation-in-should_ignore_root.patch clk-at91-sam9x60-fix-usb-clock-parents.patch clk-at91-usb-use-proper-usbs_mask.patch ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch ext4-fix-incorrect-inodes-per-group-in-error-message.patch hid-lg-g15-do-not-fail-the-probe-when-we-fail-to-disable-f-emulation.patch jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch keys-fix-proc_keys_next-to-increase-position-index.patch mac80211-fix-race-in-ieee80211_register_hw.patch mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch net-bpfilter-remove-superfluous-testing-message.patch net-stmmac-xgmac-fix-vlan-register-handling.patch nl80211-fix-nl80211_attr_ftm_responder-policy.patch ovl-fix-value-of-i_ino-for-lower-hardlink-corner-case.patch perf-report-fix-no-branch-type-statistics-report-issue.patch platform-chrome-cros_ec_rpmsg-fix-race-with-host-event.patch pwm-pca9685-fix-pwm-gpio-inter-operation.patch revert-acpi-ec-do-not-clear-boot_ec_is_ecdt-in-acpi_ec_add.patch scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch tracing-fix-the-race-between-registering-snapshot-event-trigger-and-triggering-snapshot-operation.patch usb-dwc3-gadget-don-t-clear-flags-before-transfer-ended.patch --- diff --git a/queue-5.5/acpi-nfit-improve-bounds-checking-for-func.patch b/queue-5.5/acpi-nfit-improve-bounds-checking-for-func.patch new file mode 100644 index 00000000000..7eeb5ee2438 --- /dev/null +++ b/queue-5.5/acpi-nfit-improve-bounds-checking-for-func.patch @@ -0,0 +1,80 @@ +From 01091c496f920e634ea84b689f480c39016752a8 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 25 Feb 2020 19:20:06 +0300 +Subject: acpi/nfit: improve bounds checking for 'func' + +From: Dan Carpenter + +commit 01091c496f920e634ea84b689f480c39016752a8 upstream. + +The 'func' variable can come from the user in the __nd_ioctl(). If it's +too high then the (1 << func) shift in acpi_nfit_clear_to_send() is +undefined. In acpi_nfit_ctl() we pass 'func' to test_bit(func, &dsm_mask) +which could result in an out of bounds access. + +To fix these issues, I introduced the NVDIMM_CMD_MAX (31) define and +updated nfit_dsm_revid() to use that define as well instead of magic +numbers. + +Fixes: 11189c1089da ("acpi/nfit: Fix command-supported detection") +Signed-off-by: Dan Carpenter +Reviewed-by: Dan Williams +Link: https://lore.kernel.org/r/20200225161927.hvftuq7kjn547fyj@kili.mountain +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/nfit/core.c | 10 ++++++---- + drivers/acpi/nfit/nfit.h | 1 + + 2 files changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -360,7 +360,7 @@ static union acpi_object *acpi_label_inf + + static u8 nfit_dsm_revid(unsigned family, unsigned func) + { +- static const u8 revid_table[NVDIMM_FAMILY_MAX+1][32] = { ++ static const u8 revid_table[NVDIMM_FAMILY_MAX+1][NVDIMM_CMD_MAX+1] = { + [NVDIMM_FAMILY_INTEL] = { + [NVDIMM_INTEL_GET_MODES] = 2, + [NVDIMM_INTEL_GET_FWINFO] = 2, +@@ -386,7 +386,7 @@ static u8 nfit_dsm_revid(unsigned family + + if (family > NVDIMM_FAMILY_MAX) + return 0; +- if (func > 31) ++ if (func > NVDIMM_CMD_MAX) + return 0; + id = revid_table[family][func]; + if (id == 0) +@@ -492,7 +492,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc + * Check for a valid command. For ND_CMD_CALL, we also have to + * make sure that the DSM function is supported. + */ +- if (cmd == ND_CMD_CALL && !test_bit(func, &dsm_mask)) ++ if (cmd == ND_CMD_CALL && ++ (func > NVDIMM_CMD_MAX || !test_bit(func, &dsm_mask))) + return -ENOTTY; + else if (!test_bit(cmd, &cmd_mask)) + return -ENOTTY; +@@ -3492,7 +3493,8 @@ static int acpi_nfit_clear_to_send(struc + if (nvdimm && cmd == ND_CMD_CALL && + call_pkg->nd_family == NVDIMM_FAMILY_INTEL) { + func = call_pkg->nd_command; +- if ((1 << func) & NVDIMM_INTEL_SECURITY_CMDMASK) ++ if (func > NVDIMM_CMD_MAX || ++ (1 << func) & NVDIMM_INTEL_SECURITY_CMDMASK) + return -EOPNOTSUPP; + } + +--- a/drivers/acpi/nfit/nfit.h ++++ b/drivers/acpi/nfit/nfit.h +@@ -34,6 +34,7 @@ + | ACPI_NFIT_MEM_NOT_ARMED | ACPI_NFIT_MEM_MAP_FAILED) + + #define NVDIMM_FAMILY_MAX NVDIMM_FAMILY_HYPERV ++#define NVDIMM_CMD_MAX 31 + + #define NVDIMM_STANDARD_CMDMASK \ + (1 << ND_CMD_SMART | 1 << ND_CMD_SMART_THRESHOLD | 1 << ND_CMD_DIMM_FLAGS \ diff --git a/queue-5.5/alsa-hda-realtek-enable-the-headset-mic-on-asus-fx505dt.patch b/queue-5.5/alsa-hda-realtek-enable-the-headset-mic-on-asus-fx505dt.patch new file mode 100644 index 00000000000..461e81e39f8 --- /dev/null +++ b/queue-5.5/alsa-hda-realtek-enable-the-headset-mic-on-asus-fx505dt.patch @@ -0,0 +1,37 @@ +From 4963d66b8a26c489958063abb6900ea6ed8e4836 Mon Sep 17 00:00:00 2001 +From: Adam Barber +Date: Fri, 10 Apr 2020 17:00:32 +0800 +Subject: ALSA: hda/realtek - Enable the headset mic on Asus FX505DT + +From: Adam Barber + +commit 4963d66b8a26c489958063abb6900ea6ed8e4836 upstream. + +On Asus FX505DT with Realtek ALC233, the headset mic is connected +to pin 0x19, with default 0x411111f0. + +Enable headset mic by reconfiguring the pin to an external mic +associated with the headphone on 0x21. Mic jack detection was also +found to be working. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207131 +Signed-off-by: Adam Barber +Cc: +Link: https://lore.kernel.org/r/20200410090032.2759-1-barberadam995@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7253,6 +7253,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), diff --git a/queue-5.5/alsa-usb-audio-check-mapping-at-creating-connector-controls-too.patch b/queue-5.5/alsa-usb-audio-check-mapping-at-creating-connector-controls-too.patch new file mode 100644 index 00000000000..113664c2c37 --- /dev/null +++ b/queue-5.5/alsa-usb-audio-check-mapping-at-creating-connector-controls-too.patch @@ -0,0 +1,105 @@ +From 934b96594ed66b07dbc7e576d28814466df3a494 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 12 Apr 2020 10:13:31 +0200 +Subject: ALSA: usb-audio: Check mapping at creating connector controls, too + +From: Takashi Iwai + +commit 934b96594ed66b07dbc7e576d28814466df3a494 upstream. + +Add the mapping check to build_connector_control() so that the device +specific quirk can provide the node to skip for the badly behaving +connector controls. As an example, ALC1220-VB-based codec implements +the skip entry for the broken SPDIF connector detection. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 +Cc: +Link: https://lore.kernel.org/r/20200412081331.4742-5-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer.c | 18 +++++++++++------- + sound/usb/mixer_maps.c | 4 +++- + 2 files changed, 14 insertions(+), 8 deletions(-) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1750,11 +1750,15 @@ static void get_connector_control_name(s + + /* Build a mixer control for a UAC connector control (jack-detect) */ + static void build_connector_control(struct usb_mixer_interface *mixer, ++ const struct usbmix_name_map *imap, + struct usb_audio_term *term, bool is_input) + { + struct snd_kcontrol *kctl; + struct usb_mixer_elem_info *cval; + ++ if (check_ignored_ctl(find_map(imap, term->id, 0))) ++ return; ++ + cval = kzalloc(sizeof(*cval), GFP_KERNEL); + if (!cval) + return; +@@ -2090,7 +2094,7 @@ static int parse_audio_input_terminal(st + /* Check for jack detection. */ + if ((iterm.type & 0xff00) != 0x0100 && + uac_v2v3_control_is_readable(bmctls, control)) +- build_connector_control(state->mixer, &iterm, true); ++ build_connector_control(state->mixer, state->map, &iterm, true); + + return 0; + } +@@ -3051,13 +3055,13 @@ static int snd_usb_mixer_controls_badd(s + memset(&iterm, 0, sizeof(iterm)); + iterm.id = UAC3_BADD_IT_ID4; + iterm.type = UAC_BIDIR_TERMINAL_HEADSET; +- build_connector_control(mixer, &iterm, true); ++ build_connector_control(mixer, map->map, &iterm, true); + + /* Output Term - Insertion control */ + memset(&oterm, 0, sizeof(oterm)); + oterm.id = UAC3_BADD_OT_ID3; + oterm.type = UAC_BIDIR_TERMINAL_HEADSET; +- build_connector_control(mixer, &oterm, false); ++ build_connector_control(mixer, map->map, &oterm, false); + } + + return 0; +@@ -3132,8 +3136,8 @@ static int snd_usb_mixer_controls(struct + if ((state.oterm.type & 0xff00) != 0x0100 && + uac_v2v3_control_is_readable(le16_to_cpu(desc->bmControls), + UAC2_TE_CONNECTOR)) { +- build_connector_control(state.mixer, &state.oterm, +- false); ++ build_connector_control(state.mixer, state.map, ++ &state.oterm, false); + } + } else { /* UAC_VERSION_3 */ + struct uac3_output_terminal_descriptor *desc = p; +@@ -3158,8 +3162,8 @@ static int snd_usb_mixer_controls(struct + if ((state.oterm.type & 0xff00) != 0x0100 && + uac_v2v3_control_is_readable(le32_to_cpu(desc->bmControls), + UAC3_TE_INSERTION)) { +- build_connector_control(state.mixer, &state.oterm, +- false); ++ build_connector_control(state.mixer, state.map, ++ &state.oterm, false); + } + } + } +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -350,9 +350,11 @@ static const struct usbmix_name_map dell + }; + + /* Some mobos shipped with a dummy HD-audio show the invalid GET_MIN/GET_MAX +- * response for Input Gain Pad (id=19, control=12). Skip it. ++ * response for Input Gain Pad (id=19, control=12) and the connector status ++ * for SPDIF terminal (id=18). Skip them. + */ + static const struct usbmix_name_map asus_rog_map[] = { ++ { 18, NULL }, /* OT, connector control */ + { 19, NULL, 12 }, /* FU, Input Gain Pad */ + {} + }; diff --git a/queue-5.5/alsa-usb-audio-don-t-create-jack-controls-for-pcm-terminals.patch b/queue-5.5/alsa-usb-audio-don-t-create-jack-controls-for-pcm-terminals.patch new file mode 100644 index 00000000000..67d19e119bf --- /dev/null +++ b/queue-5.5/alsa-usb-audio-don-t-create-jack-controls-for-pcm-terminals.patch @@ -0,0 +1,56 @@ +From 7dc3c5a0172e6c0449502103356c3628d05bc0e0 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 12 Apr 2020 10:13:30 +0200 +Subject: ALSA: usb-audio: Don't create jack controls for PCM terminals + +From: Takashi Iwai + +commit 7dc3c5a0172e6c0449502103356c3628d05bc0e0 upstream. + +Some funky firmwares set the connector flag even on PCM terminals +although it doesn't make sense (and even actually the firmware doesn't +react properly!). Let's skip creation of jack controls in such a +case. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 +Cc: +Link: https://lore.kernel.org/r/20200412081331.4742-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -2088,7 +2088,8 @@ static int parse_audio_input_terminal(st + check_input_term(state, term_id, &iterm); + + /* Check for jack detection. */ +- if (uac_v2v3_control_is_readable(bmctls, control)) ++ if ((iterm.type & 0xff00) != 0x0100 && ++ uac_v2v3_control_is_readable(bmctls, control)) + build_connector_control(state->mixer, &iterm, true); + + return 0; +@@ -3128,7 +3129,8 @@ static int snd_usb_mixer_controls(struct + if (err < 0 && err != -EINVAL) + return err; + +- if (uac_v2v3_control_is_readable(le16_to_cpu(desc->bmControls), ++ if ((state.oterm.type & 0xff00) != 0x0100 && ++ uac_v2v3_control_is_readable(le16_to_cpu(desc->bmControls), + UAC2_TE_CONNECTOR)) { + build_connector_control(state.mixer, &state.oterm, + false); +@@ -3153,7 +3155,8 @@ static int snd_usb_mixer_controls(struct + if (err < 0 && err != -EINVAL) + return err; + +- if (uac_v2v3_control_is_readable(le32_to_cpu(desc->bmControls), ++ if ((state.oterm.type & 0xff00) != 0x0100 && ++ uac_v2v3_control_is_readable(le32_to_cpu(desc->bmControls), + UAC3_TE_INSERTION)) { + build_connector_control(state.mixer, &state.oterm, + false); diff --git a/queue-5.5/alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch b/queue-5.5/alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch new file mode 100644 index 00000000000..f4884a0e144 --- /dev/null +++ b/queue-5.5/alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch @@ -0,0 +1,36 @@ +From 3507245b82b4362dc9721cbc328644905a3efa22 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 12 Apr 2020 10:13:29 +0200 +Subject: ALSA: usb-audio: Don't override ignore_ctl_error value from the map + +From: Takashi Iwai + +commit 3507245b82b4362dc9721cbc328644905a3efa22 upstream. + +The mapping table may contain also ignore_ctl_error flag for devices +that are known to behave wild. Since this flag always writes the +card's own ignore_ctl_error flag, it overrides the value already set +by the module option, so it doesn't follow user's expectation. +Let's fix the code not to clear the flag that has been set by user. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 +Cc: +Link: https://lore.kernel.org/r/20200412081331.4742-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -3085,7 +3085,7 @@ static int snd_usb_mixer_controls(struct + if (map->id == state.chip->usb_id) { + state.map = map->map; + state.selector_map = map->selector_map; +- mixer->ignore_ctl_error = map->ignore_ctl_error; ++ mixer->ignore_ctl_error |= map->ignore_ctl_error; + break; + } + } diff --git a/queue-5.5/alsa-usb-audio-filter-error-from-connector-kctl-ops-too.patch b/queue-5.5/alsa-usb-audio-filter-error-from-connector-kctl-ops-too.patch new file mode 100644 index 00000000000..c251971bae0 --- /dev/null +++ b/queue-5.5/alsa-usb-audio-filter-error-from-connector-kctl-ops-too.patch @@ -0,0 +1,38 @@ +From 48cc42973509afac24e83d6edc23901d102872d1 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 12 Apr 2020 10:13:28 +0200 +Subject: ALSA: usb-audio: Filter error from connector kctl ops, too + +From: Takashi Iwai + +commit 48cc42973509afac24e83d6edc23901d102872d1 upstream. + +The ignore_ctl_error option should filter the error at kctl accesses, +but there was an overlook: mixer_ctl_connector_get() returns an error +from the request. + +This patch covers the forgotten code path and apply filter_error() +properly. The locking error is still returned since this is a fatal +error that has to be reported even with ignore_ctl_error option. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 +Cc: +Link: https://lore.kernel.org/r/20200412081331.4742-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1446,7 +1446,7 @@ error: + usb_audio_err(chip, + "cannot get connectors status: req = %#x, wValue = %#x, wIndex = %#x, type = %d\n", + UAC_GET_CUR, validx, idx, cval->val_type); +- return ret; ++ return filter_error(cval, ret); + } + + ucontrol->value.integer.value[0] = val; diff --git a/queue-5.5/arm-dts-imx7-colibri-fix-muxing-of-usbc_det-pin.patch b/queue-5.5/arm-dts-imx7-colibri-fix-muxing-of-usbc_det-pin.patch new file mode 100644 index 00000000000..6b061d25b1c --- /dev/null +++ b/queue-5.5/arm-dts-imx7-colibri-fix-muxing-of-usbc_det-pin.patch @@ -0,0 +1,55 @@ +From 7007f2eca0f258710899ca486da00546d03db0ed Mon Sep 17 00:00:00 2001 +From: Oleksandr Suvorov +Date: Tue, 4 Feb 2020 13:11:47 +0200 +Subject: ARM: dts: imx7-colibri: fix muxing of usbc_det pin + +From: Oleksandr Suvorov + +commit 7007f2eca0f258710899ca486da00546d03db0ed upstream. + +USB_C_DET pin shouldn't be in ethernet group. + +Creating a separate group allows one to use this pin +as an USB ID pin. + +Fixes: b326629f25b7 ("ARM: dts: imx7: add Toradex Colibri iMX7S/iMX7D suppor") +Signed-off-by: Oleksandr Suvorov +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx7-colibri.dtsi | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/imx7-colibri.dtsi ++++ b/arch/arm/boot/dts/imx7-colibri.dtsi +@@ -345,7 +345,7 @@ + &iomuxc { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_gpio1 &pinctrl_gpio2 &pinctrl_gpio3 &pinctrl_gpio4 +- &pinctrl_gpio7>; ++ &pinctrl_gpio7 &pinctrl_usbc_det>; + + pinctrl_gpio1: gpio1-grp { + fsl,pins = < +@@ -450,7 +450,6 @@ + + pinctrl_enet1: enet1grp { + fsl,pins = < +- MX7D_PAD_ENET1_CRS__GPIO7_IO14 0x14 + MX7D_PAD_ENET1_RGMII_RX_CTL__ENET1_RGMII_RX_CTL 0x73 + MX7D_PAD_ENET1_RGMII_RD0__ENET1_RGMII_RD0 0x73 + MX7D_PAD_ENET1_RGMII_RD1__ENET1_RGMII_RD1 0x73 +@@ -648,6 +647,12 @@ + >; + }; + ++ pinctrl_usbc_det: gpio-usbc-det { ++ fsl,pins = < ++ MX7D_PAD_ENET1_CRS__GPIO7_IO14 0x14 ++ >; ++ }; ++ + pinctrl_usbh_reg: gpio-usbh-vbus { + fsl,pins = < + MX7D_PAD_UART3_CTS_B__GPIO4_IO7 0x14 /* SODIMM 129 USBH PEN */ diff --git a/queue-5.5/arm64-dts-librem5-devkit-add-a-vbus-supply-to-usb0.patch b/queue-5.5/arm64-dts-librem5-devkit-add-a-vbus-supply-to-usb0.patch new file mode 100644 index 00000000000..647a8c3a64b --- /dev/null +++ b/queue-5.5/arm64-dts-librem5-devkit-add-a-vbus-supply-to-usb0.patch @@ -0,0 +1,31 @@ +From dde061b865598ad91f50140760e1d224e5045db9 Mon Sep 17 00:00:00 2001 +From: "Angus Ainslie (Purism)" +Date: Thu, 27 Feb 2020 14:17:26 +0100 +Subject: arm64: dts: librem5-devkit: add a vbus supply to usb0 + +From: Angus Ainslie (Purism) + +commit dde061b865598ad91f50140760e1d224e5045db9 upstream. + +Without a VBUS supply the dwc3 driver won't go into otg mode. + +Fixes: eb4ea0857c83 ("arm64: dts: fsl: librem5: Add a device tree for the Librem5 devkit") +Signed-off-by: Angus Ainslie (Purism) +Signed-off-by: Martin Kepplinger +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/freescale/imx8mq-librem5-devkit.dts | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/boot/dts/freescale/imx8mq-librem5-devkit.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mq-librem5-devkit.dts +@@ -743,6 +743,7 @@ + }; + + &usb3_phy0 { ++ vbus-supply = <®_5v_p>; + status = "okay"; + }; + diff --git a/queue-5.5/arm64-vdso-don-t-free-unallocated-pages.patch b/queue-5.5/arm64-vdso-don-t-free-unallocated-pages.patch new file mode 100644 index 00000000000..1e560c388cc --- /dev/null +++ b/queue-5.5/arm64-vdso-don-t-free-unallocated-pages.patch @@ -0,0 +1,53 @@ +From 9cc3d0c6915aee5140f8335d41bbc3ff1b79aa4e Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Tue, 14 Apr 2020 11:42:48 +0100 +Subject: arm64: vdso: don't free unallocated pages + +From: Mark Rutland + +commit 9cc3d0c6915aee5140f8335d41bbc3ff1b79aa4e upstream. + +The aarch32_vdso_pages[] array never has entries allocated in the C_VVAR +or C_VDSO slots, and as the array is zero initialized these contain +NULL. + +However in __aarch32_alloc_vdso_pages() when +aarch32_alloc_kuser_vdso_page() fails we attempt to free the page whose +struct page is at NULL, which is obviously nonsensical. + +This patch removes the erroneous page freeing. + +Fixes: 7c1deeeb0130 ("arm64: compat: VDSO setup for compat layer") +Cc: # 5.3.x- +Cc: Vincenzo Frascino +Acked-by: Will Deacon +Signed-off-by: Mark Rutland +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/vdso.c | 13 +------------ + 1 file changed, 1 insertion(+), 12 deletions(-) + +--- a/arch/arm64/kernel/vdso.c ++++ b/arch/arm64/kernel/vdso.c +@@ -260,18 +260,7 @@ static int __aarch32_alloc_vdso_pages(vo + if (ret) + return ret; + +- ret = aarch32_alloc_kuser_vdso_page(); +- if (ret) { +- unsigned long c_vvar = +- (unsigned long)page_to_virt(aarch32_vdso_pages[C_VVAR]); +- unsigned long c_vdso = +- (unsigned long)page_to_virt(aarch32_vdso_pages[C_VDSO]); +- +- free_page(c_vvar); +- free_page(c_vdso); +- } +- +- return ret; ++ return aarch32_alloc_kuser_vdso_page(); + } + #else + static int __aarch32_alloc_vdso_pages(void) diff --git a/queue-5.5/asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch b/queue-5.5/asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch new file mode 100644 index 00000000000..42a3d16f39a --- /dev/null +++ b/queue-5.5/asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch @@ -0,0 +1,35 @@ +From f5e056e1e46fcbb5f74ce560792aeb7d57ce79e6 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 19 Nov 2019 11:36:40 +0000 +Subject: ASoC: Intel: mrfld: fix incorrect check on p->sink + +From: Colin Ian King + +commit f5e056e1e46fcbb5f74ce560792aeb7d57ce79e6 upstream. + +The check on p->sink looks bogus, I believe it should be p->source +since the following code blocks are related to p->source. Fix +this by replacing p->sink with p->source. + +Fixes: 24c8d14192cc ("ASoC: Intel: mrfld: add DSP core controls") +Signed-off-by: Colin Ian King +Addresses-Coverity: ("Copy-paste error") +Link: https://lore.kernel.org/r/20191119113640.166940-1-colin.king@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/atom/sst-atom-controls.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/intel/atom/sst-atom-controls.c ++++ b/sound/soc/intel/atom/sst-atom-controls.c +@@ -1333,7 +1333,7 @@ int sst_send_pipe_gains(struct snd_soc_d + dai->capture_widget->name); + w = dai->capture_widget; + snd_soc_dapm_widget_for_each_source_path(w, p) { +- if (p->connected && !p->connected(w, p->sink)) ++ if (p->connected && !p->connected(w, p->source)) + continue; + + if (p->connect && p->source->power && diff --git a/queue-5.5/asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch b/queue-5.5/asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch new file mode 100644 index 00000000000..7311f90c144 --- /dev/null +++ b/queue-5.5/asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch @@ -0,0 +1,38 @@ +From 3025571edd9df653e1ad649f0638368a39d1bbb5 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Sat, 8 Feb 2020 22:07:20 +0000 +Subject: ASoC: Intel: mrfld: return error codes when an error occurs + +From: Colin Ian King + +commit 3025571edd9df653e1ad649f0638368a39d1bbb5 upstream. + +Currently function sst_platform_get_resources always returns zero and +error return codes set by the function are never returned. Fix this +by returning the error return code in variable ret rather than the +hard coded zero. + +Addresses-Coverity: ("Unused value") +Fixes: f533a035e4da ("ASoC: Intel: mrfld - create separate module for pci part") +Signed-off-by: Colin Ian King +Acked-by: Cezary Rojewski +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200208220720.36657-1-colin.king@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/atom/sst/sst_pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/intel/atom/sst/sst_pci.c ++++ b/sound/soc/intel/atom/sst/sst_pci.c +@@ -99,7 +99,7 @@ static int sst_platform_get_resources(st + dev_dbg(ctx->dev, "DRAM Ptr %p\n", ctx->dram); + do_release_regions: + pci_release_regions(pci); +- return 0; ++ return ret; + } + + /* diff --git a/queue-5.5/btrfs-check-commit-root-generation-in-should_ignore_root.patch b/queue-5.5/btrfs-check-commit-root-generation-in-should_ignore_root.patch new file mode 100644 index 00000000000..949ba12ad43 --- /dev/null +++ b/queue-5.5/btrfs-check-commit-root-generation-in-should_ignore_root.patch @@ -0,0 +1,54 @@ +From 4d4225fc228e46948486d8b8207955f0c031b92e Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Thu, 2 Apr 2020 15:51:18 -0400 +Subject: btrfs: check commit root generation in should_ignore_root + +From: Josef Bacik + +commit 4d4225fc228e46948486d8b8207955f0c031b92e upstream. + +Previously we would set the reloc root's last snapshot to transid - 1. +However there was a problem with doing this, and we changed it to +setting the last snapshot to the generation of the commit node of the fs +root. + +This however broke should_ignore_root(). The assumption is that if we +are in a generation newer than when the reloc root was created, then we +would find the reloc root through normal backref lookups, and thus can +ignore any fs roots we find with an old enough reloc root. + +Now that the last snapshot could be considerably further in the past +than before, we'd end up incorrectly ignoring an fs root. Thus we'd +find no nodes for the bytenr we were searching for, and we'd fail to +relocate anything. We'd loop through the relocate code again and see +that there were still used space in that block group, attempt to +relocate those bytenr's again, fail in the same way, and just loop like +this forever. This is tricky in that we have to not modify the fs root +at all during this time, so we need to have a block group that has data +in this fs root that is not shared by any other root, which is why this +has been difficult to reproduce. + +Fixes: 054570a1dc94 ("Btrfs: fix relocation incorrectly dropping data references") +CC: stable@vger.kernel.org # 4.9+ +Reviewed-by: Filipe Manana +Signed-off-by: Josef Bacik +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/relocation.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -561,8 +561,8 @@ static int should_ignore_root(struct btr + if (!reloc_root) + return 0; + +- if (btrfs_root_last_snapshot(&reloc_root->root_item) == +- root->fs_info->running_transaction->transid - 1) ++ if (btrfs_header_generation(reloc_root->commit_root) == ++ root->fs_info->running_transaction->transid) + return 0; + /* + * if there is reloc tree and it was created in previous diff --git a/queue-5.5/clk-at91-sam9x60-fix-usb-clock-parents.patch b/queue-5.5/clk-at91-sam9x60-fix-usb-clock-parents.patch new file mode 100644 index 00000000000..4a24beb9ec5 --- /dev/null +++ b/queue-5.5/clk-at91-sam9x60-fix-usb-clock-parents.patch @@ -0,0 +1,36 @@ +From 43b203d32b77d1b1b2209e22837f49767020553e Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Fri, 17 Jan 2020 13:36:47 +0200 +Subject: clk: at91: sam9x60: fix usb clock parents + +From: Claudiu Beznea + +commit 43b203d32b77d1b1b2209e22837f49767020553e upstream. + +SAM9X60's USB clock has 3 parents: plla, upll and main_osc. + +Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver") +Signed-off-by: Claudiu Beznea +Link: https://lkml.kernel.org/r/1579261009-4573-3-git-send-email-claudiu.beznea@microchip.com +Acked-by: Alexandre Belloni +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/at91/sam9x60.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/clk/at91/sam9x60.c ++++ b/drivers/clk/at91/sam9x60.c +@@ -237,9 +237,8 @@ static void __init sam9x60_pmc_setup(str + + parent_names[0] = "pllack"; + parent_names[1] = "upllck"; +- parent_names[2] = "mainck"; +- parent_names[3] = "mainck"; +- hw = sam9x60_clk_register_usb(regmap, "usbck", parent_names, 4); ++ parent_names[2] = "main_osc"; ++ hw = sam9x60_clk_register_usb(regmap, "usbck", parent_names, 3); + if (IS_ERR(hw)) + goto err_free; + diff --git a/queue-5.5/clk-at91-usb-use-proper-usbs_mask.patch b/queue-5.5/clk-at91-usb-use-proper-usbs_mask.patch new file mode 100644 index 00000000000..a47c940a969 --- /dev/null +++ b/queue-5.5/clk-at91-usb-use-proper-usbs_mask.patch @@ -0,0 +1,34 @@ +From d7a83d67a1694c42cc95fc0755d823f7ca3bfcfb Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Fri, 17 Jan 2020 13:36:48 +0200 +Subject: clk: at91: usb: use proper usbs_mask + +From: Claudiu Beznea + +commit d7a83d67a1694c42cc95fc0755d823f7ca3bfcfb upstream. + +Use usbs_mask passed as argument. The usbs_mask is different for +SAM9X60. + +Fixes: 2423eeaead6f8 ("clk: at91: usb: Add sam9x60 support") +Signed-off-by: Claudiu Beznea +Link: https://lkml.kernel.org/r/1579261009-4573-4-git-send-email-claudiu.beznea@microchip.com +Acked-by: Alexandre Belloni +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/at91/clk-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/at91/clk-usb.c ++++ b/drivers/clk/at91/clk-usb.c +@@ -211,7 +211,7 @@ _at91sam9x5_clk_register_usb(struct regm + + usb->hw.init = &init; + usb->regmap = regmap; +- usb->usbs_mask = SAM9X5_USBS_MASK; ++ usb->usbs_mask = usbs_mask; + + hw = &usb->hw; + ret = clk_hw_register(NULL, &usb->hw); diff --git a/queue-5.5/ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch b/queue-5.5/ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch new file mode 100644 index 00000000000..918ba389c05 --- /dev/null +++ b/queue-5.5/ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch @@ -0,0 +1,39 @@ +From df41460a21b06a76437af040d90ccee03888e8e5 Mon Sep 17 00:00:00 2001 +From: Josh Triplett +Date: Sat, 28 Mar 2020 14:54:01 -0700 +Subject: ext4: fix incorrect group count in ext4_fill_super error message + +From: Josh Triplett + +commit df41460a21b06a76437af040d90ccee03888e8e5 upstream. + +ext4_fill_super doublechecks the number of groups before mounting; if +that check fails, the resulting error message prints the group count +from the ext4_sb_info sbi, which hasn't been set yet. Print the freshly +computed group count instead (which at that point has just been computed +in "blocks_count"). + +Signed-off-by: Josh Triplett +Fixes: 4ec1102813798 ("ext4: Add sanity checks for the superblock before mounting the filesystem") +Link: https://lore.kernel.org/r/8b957cd1513fcc4550fe675c10bcce2175c33a49.1585431964.git.josh@joshtriplett.org +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4241,9 +4241,9 @@ static int ext4_fill_super(struct super_ + EXT4_BLOCKS_PER_GROUP(sb) - 1); + do_div(blocks_count, EXT4_BLOCKS_PER_GROUP(sb)); + if (blocks_count > ((uint64_t)1<<32) - EXT4_DESC_PER_BLOCK(sb)) { +- ext4_msg(sb, KERN_WARNING, "groups count too large: %u " ++ ext4_msg(sb, KERN_WARNING, "groups count too large: %llu " + "(block count %llu, first data block %u, " +- "blocks per group %lu)", sbi->s_groups_count, ++ "blocks per group %lu)", blocks_count, + ext4_blocks_count(es), + le32_to_cpu(es->s_first_data_block), + EXT4_BLOCKS_PER_GROUP(sb)); diff --git a/queue-5.5/ext4-fix-incorrect-inodes-per-group-in-error-message.patch b/queue-5.5/ext4-fix-incorrect-inodes-per-group-in-error-message.patch new file mode 100644 index 00000000000..1714b74f52b --- /dev/null +++ b/queue-5.5/ext4-fix-incorrect-inodes-per-group-in-error-message.patch @@ -0,0 +1,35 @@ +From b9c538da4e52a7b79dfcf4cfa487c46125066dfb Mon Sep 17 00:00:00 2001 +From: Josh Triplett +Date: Sat, 28 Mar 2020 15:34:15 -0700 +Subject: ext4: fix incorrect inodes per group in error message + +From: Josh Triplett + +commit b9c538da4e52a7b79dfcf4cfa487c46125066dfb upstream. + +If ext4_fill_super detects an invalid number of inodes per group, the +resulting error message printed the number of blocks per group, rather +than the number of inodes per group. Fix it to print the correct value. + +Fixes: cd6bb35bf7f6d ("ext4: use more strict checks for inodes_per_block on mount") +Link: https://lore.kernel.org/r/8be03355983a08e5d4eed480944613454d7e2550.1585434649.git.josh@joshtriplett.org +Reviewed-by: Andreas Dilger +Signed-off-by: Josh Triplett +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4112,7 +4112,7 @@ static int ext4_fill_super(struct super_ + if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > blocksize * 8) { + ext4_msg(sb, KERN_ERR, "invalid inodes per group: %lu\n", +- sbi->s_blocks_per_group); ++ sbi->s_inodes_per_group); + goto failed_mount; + } + sbi->s_itb_per_group = sbi->s_inodes_per_group / diff --git a/queue-5.5/hid-lg-g15-do-not-fail-the-probe-when-we-fail-to-disable-f-emulation.patch b/queue-5.5/hid-lg-g15-do-not-fail-the-probe-when-we-fail-to-disable-f-emulation.patch new file mode 100644 index 00000000000..7f6ab440091 --- /dev/null +++ b/queue-5.5/hid-lg-g15-do-not-fail-the-probe-when-we-fail-to-disable-f-emulation.patch @@ -0,0 +1,60 @@ +From b8a75eaddae9410767c7d95a1c5f3a547aae7b81 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 15 Mar 2020 18:34:49 +0100 +Subject: HID: lg-g15: Do not fail the probe when we fail to disable F# emulation + +From: Hans de Goede + +commit b8a75eaddae9410767c7d95a1c5f3a547aae7b81 upstream. + +By default the G1-G12 keys on the Logitech gaming keyboards send +F1 - F12 when in "generic HID" mode. + +The first thing the hid-lg-g15 driver does is disable this behavior. + +We have received a bugreport that this does not work when the keyboard +is connected through an Aten KVM switch. Using a gaming keyboard with +a KVM is a bit weird setup, but still we can try to fail a bit more +gracefully here. + +On the G510 keyboards the same USB-interface which is used for the gaming +keys is also used for the media-keys. Before this commit we would call +hid_hw_stop() on failure to disable the F# emulation and then exit the +probe method with an error code. + +This not only causes us to not handle the gaming-keys, but this also +breaks the media keys which is a regression compared to the situation +when these keyboards where handled by the generic hidinput driver. + +This commit changes the error handling to clear the hiddev drvdata +(to disable our .raw_event handler) and then returning from the probe +method with success. + +The net result of this is that, when connected through a KVM, things +work as well as they did before the hid-lg-g15 driver was introduced. + +Fixes: ad4203f5a243 ("HID: lg-g15: Add support for the G510 keyboards' gaming keys") +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1806321 +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-lg-g15.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-lg-g15.c ++++ b/drivers/hid/hid-lg-g15.c +@@ -803,8 +803,10 @@ static int lg_g15_probe(struct hid_devic + } + + if (ret < 0) { +- hid_err(hdev, "Error disabling keyboard emulation for the G-keys\n"); +- goto error_hw_stop; ++ hid_err(hdev, "Error %d disabling keyboard emulation for the G-keys, falling back to generic hid-input driver\n", ++ ret); ++ hid_set_drvdata(hdev, NULL); ++ return 0; + } + + /* Get initial brightness levels */ diff --git a/queue-5.5/jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch b/queue-5.5/jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch new file mode 100644 index 00000000000..81515519b40 --- /dev/null +++ b/queue-5.5/jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch @@ -0,0 +1,41 @@ +From 780f66e59231fcf882f36c63f287252ee47cc75a Mon Sep 17 00:00:00 2001 +From: "zhangyi (F)" +Date: Mon, 17 Feb 2020 19:27:06 +0800 +Subject: jbd2: improve comments about freeing data buffers whose page mapping is NULL + +From: zhangyi (F) + +commit 780f66e59231fcf882f36c63f287252ee47cc75a upstream. + +Improve comments in jbd2_journal_commit_transaction() to describe why +we don't need to clear the buffer_mapped bit for freeing file mapping +buffers whose page mapping is NULL. + +Link: https://lore.kernel.org/r/20200217112706.20085-1-yi.zhang@huawei.com +Fixes: c96dceeabf76 ("jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer") +Suggested-by: Jan Kara +Reviewed-by: Jan Kara +Signed-off-by: zhangyi (F) +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/commit.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -997,9 +997,10 @@ restart_loop: + * journalled data) we need to unmap buffer and clear + * more bits. We also need to be careful about the check + * because the data page mapping can get cleared under +- * out hands, which alse need not to clear more bits +- * because the page and buffers will be freed and can +- * never be reused once we are done with them. ++ * our hands. Note that if mapping == NULL, we don't ++ * need to make buffer unmapped because the page is ++ * already detached from the mapping and buffers cannot ++ * get reused. + */ + mapping = READ_ONCE(bh->b_page->mapping); + if (mapping && !sb_is_blkdev_sb(mapping->host->i_sb)) { diff --git a/queue-5.5/keys-fix-proc_keys_next-to-increase-position-index.patch b/queue-5.5/keys-fix-proc_keys_next-to-increase-position-index.patch new file mode 100644 index 00000000000..4115b179a10 --- /dev/null +++ b/queue-5.5/keys-fix-proc_keys_next-to-increase-position-index.patch @@ -0,0 +1,70 @@ +From 86d32f9a7c54ad74f4514d7fef7c847883207291 Mon Sep 17 00:00:00 2001 +From: Vasily Averin +Date: Tue, 14 Apr 2020 21:33:16 +0100 +Subject: keys: Fix proc_keys_next to increase position index + +From: Vasily Averin + +commit 86d32f9a7c54ad74f4514d7fef7c847883207291 upstream. + +If seq_file .next function does not change position index, +read after some lseek can generate unexpected output: + + $ dd if=/proc/keys bs=1 # full usual output + 0f6bfdf5 I--Q--- 2 perm 3f010000 1000 1000 user 4af2f79ab8848d0a: 740 + 1fb91b32 I--Q--- 3 perm 1f3f0000 1000 65534 keyring _uid.1000: 2 + 27589480 I--Q--- 1 perm 0b0b0000 0 0 user invocation_id: 16 + 2f33ab67 I--Q--- 152 perm 3f030000 0 0 keyring _ses: 2 + 33f1d8fa I--Q--- 4 perm 3f030000 1000 1000 keyring _ses: 1 + 3d427fda I--Q--- 2 perm 3f010000 1000 1000 user 69ec44aec7678e5a: 740 + 3ead4096 I--Q--- 1 perm 1f3f0000 1000 65534 keyring _uid_ses.1000: 1 + 521+0 records in + 521+0 records out + 521 bytes copied, 0,00123769 s, 421 kB/s + +But a read after lseek in middle of last line results in the partial +last line and then a repeat of the final line: + + $ dd if=/proc/keys bs=500 skip=1 + dd: /proc/keys: cannot skip to specified offset + g _uid_ses.1000: 1 + 3ead4096 I--Q--- 1 perm 1f3f0000 1000 65534 keyring _uid_ses.1000: 1 + 0+1 records in + 0+1 records out + 97 bytes copied, 0,000135035 s, 718 kB/s + +and a read after lseek beyond end of file results in the last line being +shown: + + $ dd if=/proc/keys bs=1000 skip=1 # read after lseek beyond end of file + dd: /proc/keys: cannot skip to specified offset + 3ead4096 I--Q--- 1 perm 1f3f0000 1000 65534 keyring _uid_ses.1000: 1 + 0+1 records in + 0+1 records out + 76 bytes copied, 0,000119981 s, 633 kB/s + +See https://bugzilla.kernel.org/show_bug.cgi?id=206283 + +Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code ...") +Signed-off-by: Vasily Averin +Signed-off-by: David Howells +Reviewed-by: Jarkko Sakkinen +Cc: stable@vger.kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/proc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/security/keys/proc.c ++++ b/security/keys/proc.c +@@ -139,6 +139,8 @@ static void *proc_keys_next(struct seq_f + n = key_serial_next(p, v); + if (n) + *_pos = key_node_serial(n); ++ else ++ (*_pos)++; + return n; + } + diff --git a/queue-5.5/mac80211-fix-race-in-ieee80211_register_hw.patch b/queue-5.5/mac80211-fix-race-in-ieee80211_register_hw.patch new file mode 100644 index 00000000000..6cb3460a394 --- /dev/null +++ b/queue-5.5/mac80211-fix-race-in-ieee80211_register_hw.patch @@ -0,0 +1,149 @@ +From 52e04b4ce5d03775b6a78f3ed1097480faacc9fd Mon Sep 17 00:00:00 2001 +From: Sumit Garg +Date: Tue, 7 Apr 2020 15:40:55 +0530 +Subject: mac80211: fix race in ieee80211_register_hw() + +From: Sumit Garg + +commit 52e04b4ce5d03775b6a78f3ed1097480faacc9fd upstream. + +A race condition leading to a kernel crash is observed during invocation +of ieee80211_register_hw() on a dragonboard410c device having wcn36xx +driver built as a loadable module along with a wifi manager in user-space +waiting for a wifi device (wlanX) to be active. + +Sequence diagram for a particular kernel crash scenario: + + user-space ieee80211_register_hw() ieee80211_tasklet_handler() + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + | | | + |<---phy0----wiphy_register() | + |-----iwd if_add---->| | + | |<---IRQ----(RX packet) + | Kernel crash | + | due to unallocated | + | workqueue. | + | | | + | alloc_ordered_workqueue() | + | | | + | Misc wiphy init. | + | | | + | ieee80211_if_add() | + | | | + +As evident from above sequence diagram, this race condition isn't specific +to a particular wifi driver but rather the initialization sequence in +ieee80211_register_hw() needs to be fixed. So re-order the initialization +sequence and the updated sequence diagram would look like: + + user-space ieee80211_register_hw() ieee80211_tasklet_handler() + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + | | | + | alloc_ordered_workqueue() | + | | | + | Misc wiphy init. | + | | | + |<---phy0----wiphy_register() | + |-----iwd if_add---->| | + | |<---IRQ----(RX packet) + | | | + | ieee80211_if_add() | + | | | + +Cc: stable@vger.kernel.org +Signed-off-by: Sumit Garg +Link: https://lore.kernel.org/r/1586254255-28713-1-git-send-email-sumit.garg@linaro.org +[Johannes: fix rtnl imbalances] +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/main.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1051,7 +1051,7 @@ int ieee80211_register_hw(struct ieee802 + local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC; + if (hw->max_signal <= 0) { + result = -EINVAL; +- goto fail_wiphy_register; ++ goto fail_workqueue; + } + } + +@@ -1113,7 +1113,7 @@ int ieee80211_register_hw(struct ieee802 + + result = ieee80211_init_cipher_suites(local); + if (result < 0) +- goto fail_wiphy_register; ++ goto fail_workqueue; + + if (!local->ops->remain_on_channel) + local->hw.wiphy->max_remain_on_channel_duration = 5000; +@@ -1139,10 +1139,6 @@ int ieee80211_register_hw(struct ieee802 + + local->hw.wiphy->max_num_csa_counters = IEEE80211_MAX_CSA_COUNTERS_NUM; + +- result = wiphy_register(local->hw.wiphy); +- if (result < 0) +- goto fail_wiphy_register; +- + /* + * We use the number of queues for feature tests (QoS, HT) internally + * so restrict them appropriately. +@@ -1198,9 +1194,9 @@ int ieee80211_register_hw(struct ieee802 + goto fail_flows; + + rtnl_lock(); +- + result = ieee80211_init_rate_ctrl_alg(local, + hw->rate_control_algorithm); ++ rtnl_unlock(); + if (result < 0) { + wiphy_debug(local->hw.wiphy, + "Failed to initialize rate control algorithm\n"); +@@ -1254,6 +1250,12 @@ int ieee80211_register_hw(struct ieee802 + local->sband_allocated |= BIT(band); + } + ++ result = wiphy_register(local->hw.wiphy); ++ if (result < 0) ++ goto fail_wiphy_register; ++ ++ rtnl_lock(); ++ + /* add one default STA interface if supported */ + if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_STATION) && + !ieee80211_hw_check(hw, NO_AUTO_VIF)) { +@@ -1293,17 +1295,17 @@ int ieee80211_register_hw(struct ieee802 + #if defined(CONFIG_INET) || defined(CONFIG_IPV6) + fail_ifa: + #endif ++ wiphy_unregister(local->hw.wiphy); ++ fail_wiphy_register: + rtnl_lock(); + rate_control_deinitialize(local); + ieee80211_remove_interfaces(local); +- fail_rate: + rtnl_unlock(); ++ fail_rate: + fail_flows: + ieee80211_led_exit(local); + destroy_workqueue(local->workqueue); + fail_workqueue: +- wiphy_unregister(local->hw.wiphy); +- fail_wiphy_register: + if (local->wiphy_ciphers_allocated) + kfree(local->hw.wiphy->cipher_suites); + kfree(local->int_scan_req); +@@ -1353,8 +1355,8 @@ void ieee80211_unregister_hw(struct ieee + skb_queue_purge(&local->skb_queue_unreliable); + skb_queue_purge(&local->skb_queue_tdls_chsw); + +- destroy_workqueue(local->workqueue); + wiphy_unregister(local->hw.wiphy); ++ destroy_workqueue(local->workqueue); + ieee80211_led_exit(local); + kfree(local->int_scan_req); + } diff --git a/queue-5.5/mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch b/queue-5.5/mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch new file mode 100644 index 00000000000..d7b7d41df66 --- /dev/null +++ b/queue-5.5/mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch @@ -0,0 +1,68 @@ +From 7ea862048317aa76d0f22334202779a25530980c Mon Sep 17 00:00:00 2001 +From: Tuomas Tynkkynen +Date: Fri, 10 Apr 2020 15:32:57 +0300 +Subject: mac80211_hwsim: Use kstrndup() in place of kasprintf() + +From: Tuomas Tynkkynen + +commit 7ea862048317aa76d0f22334202779a25530980c upstream. + +syzbot reports a warning: + +precision 33020 too large +WARNING: CPU: 0 PID: 9618 at lib/vsprintf.c:2471 set_precision+0x150/0x180 lib/vsprintf.c:2471 + vsnprintf+0xa7b/0x19a0 lib/vsprintf.c:2547 + kvasprintf+0xb2/0x170 lib/kasprintf.c:22 + kasprintf+0xbb/0xf0 lib/kasprintf.c:59 + hwsim_del_radio_nl+0x63a/0x7e0 drivers/net/wireless/mac80211_hwsim.c:3625 + genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline] + ... + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Thus it seems that kasprintf() with "%.*s" format can not be used for +duplicating a string with arbitrary length. Replace it with kstrndup(). + +Note that later this string is limited to NL80211_WIPHY_NAME_MAXLEN == 64, +but the code is simpler this way. + +Reported-by: syzbot+6693adf1698864d21734@syzkaller.appspotmail.com +Reported-by: syzbot+a4aee3f42d7584d76761@syzkaller.appspotmail.com +Cc: stable@kernel.org +Signed-off-by: Tuomas Tynkkynen +Link: https://lore.kernel.org/r/20200410123257.14559-1-tuomas.tynkkynen@iki.fi +[johannes: add note about length limit] +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mac80211_hwsim.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3600,9 +3600,9 @@ static int hwsim_new_radio_nl(struct sk_ + } + + if (info->attrs[HWSIM_ATTR_RADIO_NAME]) { +- hwname = kasprintf(GFP_KERNEL, "%.*s", +- nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), +- (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME])); ++ hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ GFP_KERNEL); + if (!hwname) + return -ENOMEM; + param.hwname = hwname; +@@ -3622,9 +3622,9 @@ static int hwsim_del_radio_nl(struct sk_ + if (info->attrs[HWSIM_ATTR_RADIO_ID]) { + idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]); + } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) { +- hwname = kasprintf(GFP_KERNEL, "%.*s", +- nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), +- (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME])); ++ hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ GFP_KERNEL); + if (!hwname) + return -ENOMEM; + } else diff --git a/queue-5.5/net-bpfilter-remove-superfluous-testing-message.patch b/queue-5.5/net-bpfilter-remove-superfluous-testing-message.patch new file mode 100644 index 00000000000..e33264fb66d --- /dev/null +++ b/queue-5.5/net-bpfilter-remove-superfluous-testing-message.patch @@ -0,0 +1,34 @@ +From 41c55ea6c2a7ca4c663eeec05bdf54f4e2419699 Mon Sep 17 00:00:00 2001 +From: Bruno Meneguele +Date: Tue, 31 Mar 2020 10:06:30 -0300 +Subject: net/bpfilter: remove superfluous testing message + +From: Bruno Meneguele + +commit 41c55ea6c2a7ca4c663eeec05bdf54f4e2419699 upstream. + +A testing message was brought by 13d0f7b814d9 ("net/bpfilter: fix dprintf +usage for /dev/kmsg") but should've been deleted before patch submission. +Although it doesn't cause any harm to the code or functionality itself, it's +totally unpleasant to have it displayed on every loop iteration with no real +use case. Thus remove it unconditionally. + +Fixes: 13d0f7b814d9 ("net/bpfilter: fix dprintf usage for /dev/kmsg") +Signed-off-by: Bruno Meneguele +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/bpfilter/main.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/bpfilter/main.c ++++ b/net/bpfilter/main.c +@@ -35,7 +35,6 @@ static void loop(void) + struct mbox_reply reply; + int n; + +- fprintf(debug_f, "testing the buffer\n"); + n = read(0, &req, sizeof(req)); + if (n != sizeof(req)) { + fprintf(debug_f, "invalid request %d\n", n); diff --git a/queue-5.5/net-stmmac-xgmac-fix-vlan-register-handling.patch b/queue-5.5/net-stmmac-xgmac-fix-vlan-register-handling.patch new file mode 100644 index 00000000000..922c2eeb3a8 --- /dev/null +++ b/queue-5.5/net-stmmac-xgmac-fix-vlan-register-handling.patch @@ -0,0 +1,60 @@ +From 21f64e72e7073199a6f8d7d8efe52cd814d7d665 Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Thu, 2 Apr 2020 15:57:07 +0200 +Subject: net: stmmac: xgmac: Fix VLAN register handling + +From: Jose Abreu + +commit 21f64e72e7073199a6f8d7d8efe52cd814d7d665 upstream. + +Commit 907a076881f1, forgot that we need to clear old values of +XGMAC_VLAN_TAG register when we switch from VLAN perfect matching to +HASH matching. + +Fix it. + +Fixes: 907a076881f1 ("net: stmmac: xgmac: fix incorrect XGMAC_VLAN_TAG register writting") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +@@ -576,8 +576,13 @@ static void dwxgmac2_update_vlan_hash(st + value |= XGMAC_VLAN_EDVLP; + value |= XGMAC_VLAN_ESVL; + value |= XGMAC_VLAN_DOVLTC; ++ } else { ++ value &= ~XGMAC_VLAN_EDVLP; ++ value &= ~XGMAC_VLAN_ESVL; ++ value &= ~XGMAC_VLAN_DOVLTC; + } + ++ value &= ~XGMAC_VLAN_VID; + writel(value, ioaddr + XGMAC_VLAN_TAG); + } else if (perfect_match) { + u32 value = readl(ioaddr + XGMAC_PACKET_FILTER); +@@ -588,13 +593,19 @@ static void dwxgmac2_update_vlan_hash(st + + value = readl(ioaddr + XGMAC_VLAN_TAG); + ++ value &= ~XGMAC_VLAN_VTHM; + value |= XGMAC_VLAN_ETV; + if (is_double) { + value |= XGMAC_VLAN_EDVLP; + value |= XGMAC_VLAN_ESVL; + value |= XGMAC_VLAN_DOVLTC; ++ } else { ++ value &= ~XGMAC_VLAN_EDVLP; ++ value &= ~XGMAC_VLAN_ESVL; ++ value &= ~XGMAC_VLAN_DOVLTC; + } + ++ value &= ~XGMAC_VLAN_VID; + writel(value | perfect_match, ioaddr + XGMAC_VLAN_TAG); + } else { + u32 value = readl(ioaddr + XGMAC_PACKET_FILTER); diff --git a/queue-5.5/nl80211-fix-nl80211_attr_ftm_responder-policy.patch b/queue-5.5/nl80211-fix-nl80211_attr_ftm_responder-policy.patch new file mode 100644 index 00000000000..77563122b66 --- /dev/null +++ b/queue-5.5/nl80211-fix-nl80211_attr_ftm_responder-policy.patch @@ -0,0 +1,38 @@ +From 0e012b4e4b5ec8e064be3502382579dd0bb43269 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Sun, 12 Apr 2020 00:40:30 +0200 +Subject: nl80211: fix NL80211_ATTR_FTM_RESPONDER policy + +From: Johannes Berg + +commit 0e012b4e4b5ec8e064be3502382579dd0bb43269 upstream. + +The nested policy here should be established using the +NLA_POLICY_NESTED() macro so the length is properly +filled in. + +Cc: stable@vger.kernel.org +Fixes: 81e54d08d9d8 ("cfg80211: support FTM responder configuration/statistics") +Link: https://lore.kernel.org/r/20200412004029.9d0722bb56c8.Ie690bfcc4a1a61ff8d8ca7e475d59fcaa52fb2da@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -618,10 +618,8 @@ const struct nla_policy nl80211_policy[N + [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY, + .len = NL80211_HE_MAX_CAPABILITY_LEN }, + +- [NL80211_ATTR_FTM_RESPONDER] = { +- .type = NLA_NESTED, +- .validation_data = nl80211_ftm_responder_policy, +- }, ++ [NL80211_ATTR_FTM_RESPONDER] = ++ NLA_POLICY_NESTED(nl80211_ftm_responder_policy), + [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1), + [NL80211_ATTR_PEER_MEASUREMENTS] = + NLA_POLICY_NESTED(nl80211_pmsr_attr_policy), diff --git a/queue-5.5/ovl-fix-value-of-i_ino-for-lower-hardlink-corner-case.patch b/queue-5.5/ovl-fix-value-of-i_ino-for-lower-hardlink-corner-case.patch new file mode 100644 index 00000000000..95a09b23b88 --- /dev/null +++ b/queue-5.5/ovl-fix-value-of-i_ino-for-lower-hardlink-corner-case.patch @@ -0,0 +1,51 @@ +From 300b124fcf6ad2cd99a7b721e0f096785e0a3134 Mon Sep 17 00:00:00 2001 +From: Amir Goldstein +Date: Tue, 19 Nov 2019 15:36:14 +0200 +Subject: ovl: fix value of i_ino for lower hardlink corner case + +From: Amir Goldstein + +commit 300b124fcf6ad2cd99a7b721e0f096785e0a3134 upstream. + +Commit 6dde1e42f497 ("ovl: make i_ino consistent with st_ino in more +cases"), relaxed the condition nfs_export=on in order to set the value of +i_ino to xino map of real ino. + +Specifically, it also relaxed the pre-condition that index=on for +consistent i_ino. This opened the corner case of lower hardlink in +ovl_get_inode(), which calls ovl_fill_inode() with ino=0 and then +ovl_init_inode() is called to set i_ino to lower real ino without the xino +mapping. + +Pass the correct values of ino;fsid in this case to ovl_fill_inode(), so it +can initialize i_ino correctly. + +Fixes: 6dde1e42f497 ("ovl: make i_ino consistent with st_ino in more ...") +Signed-off-by: Amir Goldstein +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/overlayfs/inode.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -881,7 +881,7 @@ struct inode *ovl_get_inode(struct super + struct dentry *lowerdentry = lowerpath ? lowerpath->dentry : NULL; + bool bylower = ovl_hash_bylower(sb, upperdentry, lowerdentry, + oip->index); +- int fsid = bylower ? oip->lowerpath->layer->fsid : 0; ++ int fsid = bylower ? lowerpath->layer->fsid : 0; + bool is_dir, metacopy = false; + unsigned long ino = 0; + int err = oip->newinode ? -EEXIST : -ENOMEM; +@@ -931,6 +931,8 @@ struct inode *ovl_get_inode(struct super + err = -ENOMEM; + goto out_err; + } ++ ino = realinode->i_ino; ++ fsid = lowerpath->layer->fsid; + } + ovl_fill_inode(inode, realinode->i_mode, realinode->i_rdev, ino, fsid); + ovl_inode_init(inode, upperdentry, lowerdentry, oip->lowerdata); diff --git a/queue-5.5/perf-report-fix-no-branch-type-statistics-report-issue.patch b/queue-5.5/perf-report-fix-no-branch-type-statistics-report-issue.patch new file mode 100644 index 00000000000..25e15dc74f1 --- /dev/null +++ b/queue-5.5/perf-report-fix-no-branch-type-statistics-report-issue.patch @@ -0,0 +1,84 @@ +From c3b10649a80e9da2892c1fd3038c53abd57588f6 Mon Sep 17 00:00:00 2001 +From: Jin Yao +Date: Fri, 13 Mar 2020 21:46:07 +0800 +Subject: perf report: Fix no branch type statistics report issue + +From: Jin Yao + +commit c3b10649a80e9da2892c1fd3038c53abd57588f6 upstream. + +Previously we could get the report of branch type statistics. + +For example: + + # perf record -j any,save_type ... + # t perf report --stdio + + # + # Branch Statistics: + # + COND_FWD: 40.6% + COND_BWD: 4.1% + CROSS_4K: 24.7% + CROSS_2M: 12.3% + COND: 44.7% + UNCOND: 0.0% + IND: 6.1% + CALL: 24.5% + RET: 24.7% + +But now for the recent perf, it can't report the branch type statistics. + +It's a regression issue caused by commit 40c39e304641 ("perf report: Fix +a no annotate browser displayed issue"), which only counts the branch +type statistics for browser mode. + +This patch moves the branch_type_count() outside of ui__has_annotation() +checking, then branch type statistics can work for stdio mode. + +Fixes: 40c39e304641 ("perf report: Fix a no annotate browser displayed issue") +Signed-off-by: Jin Yao +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20200313134607.12873-1-yao.jin@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/builtin-report.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -185,24 +185,23 @@ static int hist_iter__branch_callback(st + { + struct hist_entry *he = iter->he; + struct report *rep = arg; +- struct branch_info *bi; ++ struct branch_info *bi = he->branch_info; + struct perf_sample *sample = iter->sample; + struct evsel *evsel = iter->evsel; + int err; + ++ branch_type_count(&rep->brtype_stat, &bi->flags, ++ bi->from.addr, bi->to.addr); ++ + if (!ui__has_annotation() && !rep->symbol_ipc) + return 0; + +- bi = he->branch_info; + err = addr_map_symbol__inc_samples(&bi->from, sample, evsel); + if (err) + goto out; + + err = addr_map_symbol__inc_samples(&bi->to, sample, evsel); + +- branch_type_count(&rep->brtype_stat, &bi->flags, +- bi->from.addr, bi->to.addr); +- + out: + return err; + } diff --git a/queue-5.5/platform-chrome-cros_ec_rpmsg-fix-race-with-host-event.patch b/queue-5.5/platform-chrome-cros_ec_rpmsg-fix-race-with-host-event.patch new file mode 100644 index 00000000000..c43de231838 --- /dev/null +++ b/queue-5.5/platform-chrome-cros_ec_rpmsg-fix-race-with-host-event.patch @@ -0,0 +1,66 @@ +From f775ac78fcfc6bdc96bdda07029d11f2a5e84869 Mon Sep 17 00:00:00 2001 +From: Pi-Hsun Shih +Date: Fri, 14 Feb 2020 16:26:38 +0800 +Subject: platform/chrome: cros_ec_rpmsg: Fix race with host event + +From: Pi-Hsun Shih + +commit f775ac78fcfc6bdc96bdda07029d11f2a5e84869 upstream. + +Host event can be sent by remoteproc by any time, and +cros_ec_rpmsg_callback would be called after cros_ec_rpmsg_create_ept. +But the cros_ec_device is initialized after that, which cause host event +handler to use cros_ec_device that are not initialized properly yet. + +Fix this by don't schedule host event handler before cros_ec_register +returns. Instead, remember that we have a pending host event, and +schedule host event handler after cros_ec_register. + +Fixes: 71cddb7097e2 ("platform/chrome: cros_ec_rpmsg: Fix race with host command when probe failed.") +Signed-off-by: Pi-Hsun Shih +Signed-off-by: Enric Balletbo i Serra +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/chrome/cros_ec_rpmsg.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/drivers/platform/chrome/cros_ec_rpmsg.c ++++ b/drivers/platform/chrome/cros_ec_rpmsg.c +@@ -42,6 +42,8 @@ struct cros_ec_rpmsg { + struct completion xfer_ack; + struct work_struct host_event_work; + struct rpmsg_endpoint *ept; ++ bool has_pending_host_event; ++ bool probe_done; + }; + + /** +@@ -175,7 +177,14 @@ static int cros_ec_rpmsg_callback(struct + memcpy(ec_dev->din, resp->data, len); + complete(&ec_rpmsg->xfer_ack); + } else if (resp->type == HOST_EVENT_MARK) { +- schedule_work(&ec_rpmsg->host_event_work); ++ /* ++ * If the host event is sent before cros_ec_register is ++ * finished, queue the host event. ++ */ ++ if (ec_rpmsg->probe_done) ++ schedule_work(&ec_rpmsg->host_event_work); ++ else ++ ec_rpmsg->has_pending_host_event = true; + } else { + dev_warn(ec_dev->dev, "rpmsg received invalid type = %d", + resp->type); +@@ -238,6 +247,11 @@ static int cros_ec_rpmsg_probe(struct rp + return ret; + } + ++ ec_rpmsg->probe_done = true; ++ ++ if (ec_rpmsg->has_pending_host_event) ++ schedule_work(&ec_rpmsg->host_event_work); ++ + return 0; + } + diff --git a/queue-5.5/pwm-pca9685-fix-pwm-gpio-inter-operation.patch b/queue-5.5/pwm-pca9685-fix-pwm-gpio-inter-operation.patch new file mode 100644 index 00000000000..74e70992d23 --- /dev/null +++ b/queue-5.5/pwm-pca9685-fix-pwm-gpio-inter-operation.patch @@ -0,0 +1,204 @@ +From 9cc5f232a4b6a0ef6e9b57876d61b88f61bdd7c2 Mon Sep 17 00:00:00 2001 +From: Sven Van Asbroeck +Date: Wed, 1 Apr 2020 19:01:06 +0200 +Subject: pwm: pca9685: Fix PWM/GPIO inter-operation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sven Van Asbroeck + +commit 9cc5f232a4b6a0ef6e9b57876d61b88f61bdd7c2 upstream. + +This driver allows pwms to be requested as gpios via gpiolib. Obviously, +it should not be allowed to request a GPIO when its corresponding PWM is +already requested (and vice versa). So it requires some exclusion code. + +Given that the PWMm and GPIO cores are not synchronized with respect to +each other, this exclusion code will also require proper +synchronization. + +Such a mechanism was in place, but was inadvertently removed by Uwe's +clean-up in commit e926b12c611c ("pwm: Clear chip_data in pwm_put()"). + +Upon revisiting the synchronization mechanism, we found that +theoretically, it could allow two threads to successfully request +conflicting PWMs/GPIOs. + +Replace with a bitmap which tracks PWMs in-use, plus a mutex. As long as +PWM and GPIO's respective request/free functions modify the in-use +bitmap while holding the mutex, proper synchronization will be +guaranteed. + +Reported-by: YueHaibing +Fixes: e926b12c611c ("pwm: Clear chip_data in pwm_put()") +Cc: Mika Westerberg +Cc: Uwe Kleine-König +Cc: YueHaibing +Link: https://lkml.org/lkml/2019/5/31/963 +Signed-off-by: Sven Van Asbroeck +Reviewed-by: Mika Westerberg +[cg: Tested on an i.MX6Q board with two NXP PCA9685 chips] +Tested-by: Clemens Gruber +Reviewed-by: Sven Van Asbroeck # cg's rebase +Link: https://lore.kernel.org/lkml/20200330160238.GD2817345@ulmo/ +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pwm/pwm-pca9685.c | 85 +++++++++++++++++++++++++--------------------- + 1 file changed, 48 insertions(+), 37 deletions(-) + +--- a/drivers/pwm/pwm-pca9685.c ++++ b/drivers/pwm/pwm-pca9685.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + /* + * Because the PCA9685 has only one prescaler per chip, changing the period of +@@ -74,6 +75,7 @@ struct pca9685 { + #if IS_ENABLED(CONFIG_GPIOLIB) + struct mutex lock; + struct gpio_chip gpio; ++ DECLARE_BITMAP(pwms_inuse, PCA9685_MAXCHAN + 1); + #endif + }; + +@@ -83,51 +85,51 @@ static inline struct pca9685 *to_pca(str + } + + #if IS_ENABLED(CONFIG_GPIOLIB) +-static int pca9685_pwm_gpio_request(struct gpio_chip *gpio, unsigned int offset) ++static bool pca9685_pwm_test_and_set_inuse(struct pca9685 *pca, int pwm_idx) + { +- struct pca9685 *pca = gpiochip_get_data(gpio); +- struct pwm_device *pwm; ++ bool is_inuse; + + mutex_lock(&pca->lock); +- +- pwm = &pca->chip.pwms[offset]; +- +- if (pwm->flags & (PWMF_REQUESTED | PWMF_EXPORTED)) { +- mutex_unlock(&pca->lock); +- return -EBUSY; ++ if (pwm_idx >= PCA9685_MAXCHAN) { ++ /* ++ * "all LEDs" channel: ++ * pretend already in use if any of the PWMs are requested ++ */ ++ if (!bitmap_empty(pca->pwms_inuse, PCA9685_MAXCHAN)) { ++ is_inuse = true; ++ goto out; ++ } ++ } else { ++ /* ++ * regular channel: ++ * pretend already in use if the "all LEDs" channel is requested ++ */ ++ if (test_bit(PCA9685_MAXCHAN, pca->pwms_inuse)) { ++ is_inuse = true; ++ goto out; ++ } + } +- +- pwm_set_chip_data(pwm, (void *)1); +- ++ is_inuse = test_and_set_bit(pwm_idx, pca->pwms_inuse); ++out: + mutex_unlock(&pca->lock); +- pm_runtime_get_sync(pca->chip.dev); +- return 0; ++ return is_inuse; + } + +-static bool pca9685_pwm_is_gpio(struct pca9685 *pca, struct pwm_device *pwm) ++static void pca9685_pwm_clear_inuse(struct pca9685 *pca, int pwm_idx) + { +- bool is_gpio = false; +- + mutex_lock(&pca->lock); ++ clear_bit(pwm_idx, pca->pwms_inuse); ++ mutex_unlock(&pca->lock); ++} + +- if (pwm->hwpwm >= PCA9685_MAXCHAN) { +- unsigned int i; +- +- /* +- * Check if any of the GPIOs are requested and in that case +- * prevent using the "all LEDs" channel. +- */ +- for (i = 0; i < pca->gpio.ngpio; i++) +- if (gpiochip_is_requested(&pca->gpio, i)) { +- is_gpio = true; +- break; +- } +- } else if (pwm_get_chip_data(pwm)) { +- is_gpio = true; +- } ++static int pca9685_pwm_gpio_request(struct gpio_chip *gpio, unsigned int offset) ++{ ++ struct pca9685 *pca = gpiochip_get_data(gpio); + +- mutex_unlock(&pca->lock); +- return is_gpio; ++ if (pca9685_pwm_test_and_set_inuse(pca, offset)) ++ return -EBUSY; ++ pm_runtime_get_sync(pca->chip.dev); ++ return 0; + } + + static int pca9685_pwm_gpio_get(struct gpio_chip *gpio, unsigned int offset) +@@ -162,6 +164,7 @@ static void pca9685_pwm_gpio_free(struct + + pca9685_pwm_gpio_set(gpio, offset, 0); + pm_runtime_put(pca->chip.dev); ++ pca9685_pwm_clear_inuse(pca, offset); + } + + static int pca9685_pwm_gpio_get_direction(struct gpio_chip *chip, +@@ -213,12 +216,17 @@ static int pca9685_pwm_gpio_probe(struct + return devm_gpiochip_add_data(dev, &pca->gpio, pca); + } + #else +-static inline bool pca9685_pwm_is_gpio(struct pca9685 *pca, +- struct pwm_device *pwm) ++static inline bool pca9685_pwm_test_and_set_inuse(struct pca9685 *pca, ++ int pwm_idx) + { + return false; + } + ++static inline void ++pca9685_pwm_clear_inuse(struct pca9685 *pca, int pwm_idx) ++{ ++} ++ + static inline int pca9685_pwm_gpio_probe(struct pca9685 *pca) + { + return 0; +@@ -402,7 +410,7 @@ static int pca9685_pwm_request(struct pw + { + struct pca9685 *pca = to_pca(chip); + +- if (pca9685_pwm_is_gpio(pca, pwm)) ++ if (pca9685_pwm_test_and_set_inuse(pca, pwm->hwpwm)) + return -EBUSY; + pm_runtime_get_sync(chip->dev); + +@@ -411,8 +419,11 @@ static int pca9685_pwm_request(struct pw + + static void pca9685_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm) + { ++ struct pca9685 *pca = to_pca(chip); ++ + pca9685_pwm_disable(chip, pwm); + pm_runtime_put(chip->dev); ++ pca9685_pwm_clear_inuse(pca, pwm->hwpwm); + } + + static const struct pwm_ops pca9685_pwm_ops = { diff --git a/queue-5.5/revert-acpi-ec-do-not-clear-boot_ec_is_ecdt-in-acpi_ec_add.patch b/queue-5.5/revert-acpi-ec-do-not-clear-boot_ec_is_ecdt-in-acpi_ec_add.patch new file mode 100644 index 00000000000..4420993928b --- /dev/null +++ b/queue-5.5/revert-acpi-ec-do-not-clear-boot_ec_is_ecdt-in-acpi_ec_add.patch @@ -0,0 +1,50 @@ +From df541c011f5d731447d5c99fd77d77c2191d0c6d Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Sat, 18 Apr 2020 11:29:04 +0200 +Subject: Revert "ACPI: EC: Do not clear boot_ec_is_ecdt in acpi_ec_add()" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Greg Kroah-Hartman + +This reverts commit e8eab1acd6cdf142fb93c47201a1ae1f3dcbfc5f which is +commit 65a691f5f8f0bb63d6a82eec7b0ffd193d8d8a5f upstream. + +Rafael writes: + It has not been marked for -stable or otherwise requested to be + included AFAICS. Also it depends on other mainline commits that + have not been included into 5.6.5. + +Reported-by: Toralf Förster +Reported-by: Rafael J. Wysocki +Cc: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/ec.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1654,6 +1654,7 @@ static int acpi_ec_add(struct acpi_devic + + if (boot_ec && ec->command_addr == boot_ec->command_addr && + ec->data_addr == boot_ec->data_addr) { ++ boot_ec_is_ecdt = false; + /* + * Trust PNP0C09 namespace location rather than + * ECDT ID. But trust ECDT GPE rather than _GPE +@@ -1673,12 +1674,9 @@ static int acpi_ec_add(struct acpi_devic + + if (ec == boot_ec) + acpi_handle_info(boot_ec->handle, +- "Boot %s EC initialization complete\n", ++ "Boot %s EC used to handle transactions and events\n", + boot_ec_is_ecdt ? "ECDT" : "DSDT"); + +- acpi_handle_info(ec->handle, +- "EC: Used to handle transactions and events\n"); +- + device->driver_data = ec; + + ret = !!request_region(ec->data_addr, 1, "EC data"); diff --git a/queue-5.5/scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch b/queue-5.5/scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch new file mode 100644 index 00000000000..42702e4b6a8 --- /dev/null +++ b/queue-5.5/scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch @@ -0,0 +1,43 @@ +From c63d6099a7959ecc919b2549dc6b71f53521f819 Mon Sep 17 00:00:00 2001 +From: Can Guo +Date: Mon, 10 Feb 2020 19:40:48 -0800 +Subject: scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic + +From: Can Guo + +commit c63d6099a7959ecc919b2549dc6b71f53521f819 upstream. + +The async version of ufshcd_hold(async == true), which is only called in +queuecommand path as for now, is expected to work in atomic context, thus +it should not sleep or schedule out. When it runs into the condition that +clocks are ON but link is still in hibern8 state, it should bail out +without flushing the clock ungate work. + +Fixes: f2a785ac2312 ("scsi: ufshcd: Fix race between clk scaling and ungate work") +Link: https://lore.kernel.org/r/1581392451-28743-6-git-send-email-cang@codeaurora.org +Reviewed-by: Hongwu Su +Reviewed-by: Asutosh Das +Reviewed-by: Bean Huo +Reviewed-by: Stanley Chu +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/ufs/ufshcd.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -1542,6 +1542,11 @@ start: + */ + if (ufshcd_can_hibern8_during_gating(hba) && + ufshcd_is_link_hibern8(hba)) { ++ if (async) { ++ rc = -EAGAIN; ++ hba->clk_gating.active_reqs--; ++ break; ++ } + spin_unlock_irqrestore(hba->host->host_lock, flags); + flush_work(&hba->clk_gating.ungate_work); + spin_lock_irqsave(hba->host->host_lock, flags); diff --git a/queue-5.5/series b/queue-5.5/series index 8aa038abd83..4bd60011ee7 100644 --- a/queue-5.5/series +++ b/queue-5.5/series @@ -17,3 +17,35 @@ net-mlx5e-fix-pfnum-in-devlink-port-attribute.patch net-icmp6-do-not-select-saddr-from-iif-when-route-has-prefsrc-set.patch net-mscc-ocelot-fix-untagged-packet-drops-when-enslaving-to-vlan-aware-bridge.patch net-stmmac-dwmac-sunxi-provide-tx-and-rx-fifo-sizes.patch +revert-acpi-ec-do-not-clear-boot_ec_is_ecdt-in-acpi_ec_add.patch +ovl-fix-value-of-i_ino-for-lower-hardlink-corner-case.patch +scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch +platform-chrome-cros_ec_rpmsg-fix-race-with-host-event.patch +jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch +acpi-nfit-improve-bounds-checking-for-func.patch +perf-report-fix-no-branch-type-statistics-report-issue.patch +pwm-pca9685-fix-pwm-gpio-inter-operation.patch +net-stmmac-xgmac-fix-vlan-register-handling.patch +net-bpfilter-remove-superfluous-testing-message.patch +ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch +ext4-fix-incorrect-inodes-per-group-in-error-message.patch +hid-lg-g15-do-not-fail-the-probe-when-we-fail-to-disable-f-emulation.patch +clk-at91-sam9x60-fix-usb-clock-parents.patch +clk-at91-usb-use-proper-usbs_mask.patch +arm-dts-imx7-colibri-fix-muxing-of-usbc_det-pin.patch +arm64-dts-librem5-devkit-add-a-vbus-supply-to-usb0.patch +usb-dwc3-gadget-don-t-clear-flags-before-transfer-ended.patch +asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch +asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch +alsa-hda-realtek-enable-the-headset-mic-on-asus-fx505dt.patch +alsa-usb-audio-filter-error-from-connector-kctl-ops-too.patch +alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch +alsa-usb-audio-don-t-create-jack-controls-for-pcm-terminals.patch +alsa-usb-audio-check-mapping-at-creating-connector-controls-too.patch +arm64-vdso-don-t-free-unallocated-pages.patch +keys-fix-proc_keys_next-to-increase-position-index.patch +tracing-fix-the-race-between-registering-snapshot-event-trigger-and-triggering-snapshot-operation.patch +btrfs-check-commit-root-generation-in-should_ignore_root.patch +nl80211-fix-nl80211_attr_ftm_responder-policy.patch +mac80211-fix-race-in-ieee80211_register_hw.patch +mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch diff --git a/queue-5.5/tracing-fix-the-race-between-registering-snapshot-event-trigger-and-triggering-snapshot-operation.patch b/queue-5.5/tracing-fix-the-race-between-registering-snapshot-event-trigger-and-triggering-snapshot-operation.patch new file mode 100644 index 00000000000..847b28867b3 --- /dev/null +++ b/queue-5.5/tracing-fix-the-race-between-registering-snapshot-event-trigger-and-triggering-snapshot-operation.patch @@ -0,0 +1,56 @@ +From 0bbe7f719985efd9adb3454679ecef0984cb6800 Mon Sep 17 00:00:00 2001 +From: Xiao Yang +Date: Tue, 14 Apr 2020 09:51:45 +0800 +Subject: tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation + +From: Xiao Yang + +commit 0bbe7f719985efd9adb3454679ecef0984cb6800 upstream. + +Traced event can trigger 'snapshot' operation(i.e. calls snapshot_trigger() +or snapshot_count_trigger()) when register_snapshot_trigger() has completed +registration but doesn't allocate buffer for 'snapshot' event trigger. In +the rare case, 'snapshot' operation always detects the lack of allocated +buffer so make register_snapshot_trigger() allocate buffer first. + +trigger-snapshot.tc in kselftest reproduces the issue on slow vm: +----------------------------------------------------------- +cat trace +... +ftracetest-3028 [002] .... 236.784290: sched_process_fork: comm=ftracetest pid=3028 child_comm=ftracetest child_pid=3036 + <...>-2875 [003] .... 240.460335: tracing_snapshot_instance_cond: *** SNAPSHOT NOT ALLOCATED *** + <...>-2875 [003] .... 240.460338: tracing_snapshot_instance_cond: *** stopping trace here! *** +----------------------------------------------------------- + +Link: http://lkml.kernel.org/r/20200414015145.66236-1-yangx.jy@cn.fujitsu.com + +Cc: stable@vger.kernel.org +Fixes: 93e31ffbf417a ("tracing: Add 'snapshot' event trigger command") +Signed-off-by: Xiao Yang +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_events_trigger.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -1088,14 +1088,10 @@ register_snapshot_trigger(char *glob, st + struct event_trigger_data *data, + struct trace_event_file *file) + { +- int ret = register_trigger(glob, ops, data, file); ++ if (tracing_alloc_snapshot_instance(file->tr) != 0) ++ return 0; + +- if (ret > 0 && tracing_alloc_snapshot_instance(file->tr) != 0) { +- unregister_trigger(glob, ops, data, file); +- ret = 0; +- } +- +- return ret; ++ return register_trigger(glob, ops, data, file); + } + + static int diff --git a/queue-5.5/usb-dwc3-gadget-don-t-clear-flags-before-transfer-ended.patch b/queue-5.5/usb-dwc3-gadget-don-t-clear-flags-before-transfer-ended.patch new file mode 100644 index 00000000000..f268ad8b8d4 --- /dev/null +++ b/queue-5.5/usb-dwc3-gadget-don-t-clear-flags-before-transfer-ended.patch @@ -0,0 +1,36 @@ +From a114c4ca64bd522aec1790c7e5c60c882f699d8f Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 5 Mar 2020 13:23:49 -0800 +Subject: usb: dwc3: gadget: Don't clear flags before transfer ended + +From: Thinh Nguyen + +commit a114c4ca64bd522aec1790c7e5c60c882f699d8f upstream. + +We track END_TRANSFER command completion. Don't clear transfer +started/ended flag prematurely. Otherwise, we'd run into the problem +with restarting transfer before END_TRANSFER command finishes. + +Fixes: 6d8a019614f3 ("usb: dwc3: gadget: check for Missed Isoc from event status") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2567,10 +2567,8 @@ static void dwc3_gadget_endpoint_transfe + + dwc3_gadget_ep_cleanup_completed_requests(dep, event, status); + +- if (stop) { ++ if (stop) + dwc3_stop_active_transfer(dep, true, true); +- dep->flags = DWC3_EP_ENABLED; +- } + + /* + * WORKAROUND: This is the 2nd half of U1/U2 -> U0 workaround.