From: Sasha Levin Date: Mon, 28 Dec 2020 04:33:22 +0000 (-0500) Subject: Fixes for 4.14 X-Git-Tag: v4.4.249~32 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bfab57bb31507f4ac2ba7e2341183f4e8669c812;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch b/queue-4.14/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch new file mode 100644 index 00000000000..40d77df0685 --- /dev/null +++ b/queue-4.14/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch @@ -0,0 +1,62 @@ +From 1ee6563c7485f2af03b759cd90d0833109b22b53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 23:28:17 +0100 +Subject: ARM: dts: at91: at91sam9rl: fix ADC triggers + +From: Alexandre Belloni + +[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ] + +The triggers for the ADC were taken from at91sam9260 dtsi but are not +correct. + +Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support") +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20201128222818.1910764-10-alexandre.belloni@bootlin.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi +index 7768342a66385..64273f9439926 100644 +--- a/arch/arm/boot/dts/at91sam9rl.dtsi ++++ b/arch/arm/boot/dts/at91sam9rl.dtsi +@@ -274,23 +274,26 @@ + atmel,adc-use-res = "highres"; + + trigger0 { +- trigger-name = "timer-counter-0"; ++ trigger-name = "external-rising"; + trigger-value = <0x1>; ++ trigger-external; + }; ++ + trigger1 { +- trigger-name = "timer-counter-1"; +- trigger-value = <0x3>; ++ trigger-name = "external-falling"; ++ trigger-value = <0x2>; ++ trigger-external; + }; + + trigger2 { +- trigger-name = "timer-counter-2"; +- trigger-value = <0x5>; ++ trigger-name = "external-any"; ++ trigger-value = <0x3>; ++ trigger-external; + }; + + trigger3 { +- trigger-name = "external"; +- trigger-value = <0x13>; +- trigger-external; ++ trigger-name = "continuous"; ++ trigger-value = <0x6>; + }; + }; + +-- +2.27.0 + diff --git a/queue-4.14/arm-dts-at91-sama5d2-map-securam-as-device.patch b/queue-4.14/arm-dts-at91-sama5d2-map-securam-as-device.patch new file mode 100644 index 00000000000..dc5d6ff8ee4 --- /dev/null +++ b/queue-4.14/arm-dts-at91-sama5d2-map-securam-as-device.patch @@ -0,0 +1,39 @@ +From e175ffb7f928f710df1a3f08ef95bfda71cbbdc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 11:57:05 +0200 +Subject: ARM: dts: at91: sama5d2: map securam as device + +From: Claudiu Beznea + +[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ] + +Due to strobe signal not being propagated from CPU to securam +the securam needs to be mapped as device or strongly ordered memory +to work properly. Otherwise, updating to one offset may affect +the adjacent locations in securam. + +Fixes: d4ce5f44d4409 ("ARM: dts: at91: sama5d2: Add securam node") +Signed-off-by: Claudiu Beznea +Signed-off-by: Alexandre Belloni +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/1606903025-14197-3-git-send-email-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama5d2.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi +index a8e4b89097d9c..8a09c2eab0f97 100644 +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -1243,6 +1243,7 @@ + clocks = <&securam_clk>; + #address-cells = <1>; + #size-cells = <1>; ++ no-memory-wc; + ranges = <0 0xf8044000 0x1420>; + }; + +-- +2.27.0 + diff --git a/queue-4.14/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch b/queue-4.14/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch new file mode 100644 index 00000000000..0ef83f203ca --- /dev/null +++ b/queue-4.14/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch @@ -0,0 +1,51 @@ +From 68aebdef5a071fb191005b77aad17c2b919febd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 14:00:19 +0200 +Subject: ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host + +From: Cristian Birsan + +[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ] + +The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without +it the driver probes but VBus is not powered because of wrong pincontrol +configuration. + +Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board") +Signed-off-by: Cristian Birsan +Signed-off-by: Alexandre Belloni +Acked-by: Ludovic Desroches +Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +index 3af088d2cba79..ce059f9eaa7d9 100644 +--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +@@ -231,6 +231,11 @@ + atmel,pins = + ; /* PE9, conflicts with A9 */ + }; ++ pinctrl_usb_default: usb_default { ++ atmel,pins = ++ ; ++ }; + }; + }; + }; +@@ -248,6 +253,8 @@ + &pioE 3 GPIO_ACTIVE_LOW + &pioE 4 GPIO_ACTIVE_LOW + >; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usb_default>; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-4.14/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch b/queue-4.14/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch new file mode 100644 index 00000000000..3158e87563a --- /dev/null +++ b/queue-4.14/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch @@ -0,0 +1,51 @@ +From f44e7d33b462e5841f463fad0017958083eab061 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 14:00:18 +0200 +Subject: ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host + +From: Cristian Birsan + +[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ] + +The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without +it the driver probes but VBus is not powered because of wrong pincontrol +configuration. + +Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board") +Signed-off-by: Cristian Birsan +Signed-off-by: Alexandre Belloni +Acked-by: Ludovic Desroches +Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +index 10f2fb9e0ea61..c271ca960caee 100644 +--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +@@ -158,6 +158,11 @@ + atmel,pins = + ; + }; ++ pinctrl_usb_default: usb_default { ++ atmel,pins = ++ ; ++ }; + pinctrl_key_gpio: key_gpio_0 { + atmel,pins = + ; +@@ -183,6 +188,8 @@ + &pioE 11 GPIO_ACTIVE_HIGH + &pioE 14 GPIO_ACTIVE_HIGH + >; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usb_default>; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-4.14/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch b/queue-4.14/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch new file mode 100644 index 00000000000..8271583c38d --- /dev/null +++ b/queue-4.14/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch @@ -0,0 +1,40 @@ +From 57f6397d9505884a5f80fc6ace939c9007a06f7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 09:17:11 +1200 +Subject: ARM: dts: Remove non-existent i2c1 from 98dx3236 + +From: Chris Packham + +[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ] + +The switches with integrated CPUs have only got a single i2c controller. +They incorrectly gained one when they were split from the Armada-XP. + +Fixes: 43e28ba87708 ("ARM: dts: Use armada-370-xp as a base for armada-xp-98dx3236") +Signed-off-by: Chris Packham +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi +index bdd4c7a45fbf4..8d1356311e3f0 100644 +--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi ++++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi +@@ -303,11 +303,6 @@ + reg = <0x11000 0x100>; + }; + +-&i2c1 { +- compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c"; +- reg = <0x11100 0x100>; +-}; +- + &mpic { + reg = <0x20a00 0x2d0>, <0x21070 0x58>; + }; +-- +2.27.0 + diff --git a/queue-4.14/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch b/queue-4.14/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch new file mode 100644 index 00000000000..25acfac819c --- /dev/null +++ b/queue-4.14/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch @@ -0,0 +1,55 @@ +From 638c4c0ab93425a3cbdf138aa61c3426c6fe51ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 00:10:16 +0200 +Subject: ARM: p2v: fix handling of LPAE translation in BE mode + +From: Ard Biesheuvel + +[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ] + +When running in BE mode on LPAE hardware with a PA-to-VA translation +that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong +byte of the opcode. So fix that, by rotating the offset in r0 to the +right by 8 bits, which will put the 8-bit immediate in bits 31:24. + +Note that this will also move bit #22 in its correct place when +applying the rotation to the constant #0x400000. + +Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE") +Acked-by: Nicolas Pitre +Reviewed-by: Linus Walleij +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/head.S | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S +index 6b1148cafffdb..90add5ded3f1f 100644 +--- a/arch/arm/kernel/head.S ++++ b/arch/arm/kernel/head.S +@@ -674,12 +674,8 @@ ARM_BE8(rev16 ip, ip) + ldrcc r7, [r4], #4 @ use branch for delay slot + bcc 1b + bx lr +-#else +-#ifdef CONFIG_CPU_ENDIAN_BE8 +- moveq r0, #0x00004000 @ set bit 22, mov to mvn instruction + #else + moveq r0, #0x400000 @ set bit 22, mov to mvn instruction +-#endif + b 2f + 1: ldr ip, [r7, r3] + #ifdef CONFIG_CPU_ENDIAN_BE8 +@@ -688,7 +684,7 @@ ARM_BE8(rev16 ip, ip) + tst ip, #0x000f0000 @ check the rotation field + orrne ip, ip, r6, lsl #24 @ mask in offset bits 31-24 + biceq ip, ip, #0x00004000 @ clear bit 22 +- orreq ip, ip, r0 @ mask in offset bits 7-0 ++ orreq ip, ip, r0, ror #8 @ mask in offset bits 7-0 + #else + bic ip, ip, #0x000000ff + tst ip, #0xf00 @ check the rotation field +-- +2.27.0 + diff --git a/queue-4.14/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch b/queue-4.14/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch new file mode 100644 index 00000000000..dd2a146fd82 --- /dev/null +++ b/queue-4.14/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch @@ -0,0 +1,50 @@ +From c05778d258d31b68b92bc4391d33c87521a6cb2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 14:39:26 +0100 +Subject: arm64: dts: exynos: Correct psci compatible used on Exynos7 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paweł Chmiel + +[ Upstream commit e1e47fbca668507a81bb388fcae044b89d112ecc ] + +It's not possible to reboot or poweroff Exynos7420 using PSCI. Instead +we need to use syscon reboot/poweroff drivers, like it's done for other +Exynos SoCs. This was confirmed by checking vendor source and testing it +on Samsung Galaxy S6 device based on this SoC. + +To be able to use custom restart/poweroff handlers instead of PSCI +functions, we need to correct psci compatible. This also requires us to +provide function ids for CPU_ON and CPU_OFF. + +Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7") +Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7") +Signed-off-by: Paweł Chmiel +Link: https://lore.kernel.org/r/20201107133926.37187-2-pawel.mikolaj.chmiel@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi +index 9a3fbed1765af..875297a470dab 100644 +--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi ++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi +@@ -65,8 +65,10 @@ + }; + + psci { +- compatible = "arm,psci-0.2"; ++ compatible = "arm,psci"; + method = "smc"; ++ cpu_off = <0x84000002>; ++ cpu_on = <0xC4000003>; + }; + + soc: soc { +-- +2.27.0 + diff --git a/queue-4.14/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch b/queue-4.14/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch new file mode 100644 index 00000000000..b5a21923a73 --- /dev/null +++ b/queue-4.14/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch @@ -0,0 +1,75 @@ +From dbf34f52882d67d778dbfdccce1e41036402cb5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 14:48:05 +0800 +Subject: arm64: dts: rockchip: Fix UART pull-ups on rk3328 + +From: Chen-Yu Tsai + +[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ] + +For UARTs, the local pull-ups should be on the RX pin, not the TX pin. +UARTs transmit active-low, so a disconnected RX pin should be pulled +high instead of left floating to prevent noise being interpreted as +transmissions. + +This gets rid of bogus sysrq events when the UART console is not +connected. + +Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20201204064805.6480-1-wens@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index c34daae3c37c2..6c3684885fac0 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -1062,8 +1062,8 @@ + + uart0 { + uart0_xfer: uart0-xfer { +- rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>, +- <1 RK_PB0 1 &pcfg_pull_none>; ++ rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>, ++ <1 RK_PB0 1 &pcfg_pull_up>; + }; + + uart0_cts: uart0-cts { +@@ -1081,8 +1081,8 @@ + + uart1 { + uart1_xfer: uart1-xfer { +- rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>, +- <3 RK_PA6 4 &pcfg_pull_none>; ++ rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>, ++ <3 RK_PA6 4 &pcfg_pull_up>; + }; + + uart1_cts: uart1-cts { +@@ -1100,15 +1100,15 @@ + + uart2-0 { + uart2m0_xfer: uart2m0-xfer { +- rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>, +- <1 RK_PA1 2 &pcfg_pull_none>; ++ rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>, ++ <1 RK_PA1 2 &pcfg_pull_up>; + }; + }; + + uart2-1 { + uart2m1_xfer: uart2m1-xfer { +- rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>, +- <2 RK_PA1 1 &pcfg_pull_none>; ++ rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>, ++ <2 RK_PA1 1 &pcfg_pull_up>; + }; + }; + +-- +2.27.0 + diff --git a/queue-4.14/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch b/queue-4.14/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch new file mode 100644 index 00000000000..a81641a5f66 --- /dev/null +++ b/queue-4.14/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch @@ -0,0 +1,40 @@ +From ed33c137338a2dad410f0f9bf5a9806a1d0a538f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 21:09:20 +0800 +Subject: ASoC: arizona: Fix a wrong free in wm8997_probe + +From: Zhang Qilong + +[ Upstream commit 5e7aace13df24ff72511f29c14ebbfe638ef733c ] + +In the normal path, we should not free the arizona, +we should return immediately. It will be free when +call remove operation. + +Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe") +Reported-by: Richard Fitzgerald +Signed-off-by: Zhang Qilong +Acked-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20201111130923.220186-2-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8997.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c +index 49401a8aae64a..19c963801e264 100644 +--- a/sound/soc/codecs/wm8997.c ++++ b/sound/soc/codecs/wm8997.c +@@ -1179,6 +1179,8 @@ static int wm8997_probe(struct platform_device *pdev) + goto err_spk_irqs; + } + ++ return ret; ++ + err_spk_irqs: + arizona_free_spk_irqs(arizona); + +-- +2.27.0 + diff --git a/queue-4.14/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch b/queue-4.14/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch new file mode 100644 index 00000000000..c5f0f088f61 --- /dev/null +++ b/queue-4.14/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch @@ -0,0 +1,44 @@ +From 5c8063f64de3d1367d971a0ee4da8a331f88e6c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 22:42:27 +0800 +Subject: ASoC: jz4740-i2s: add missed checks for clk_get() + +From: Chuhong Yuan + +[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ] + +jz4740_i2s_set_sysclk() does not check the return values of clk_get(), +while the file dereferences the pointers in clk_put(). +Add the missed checks to fix it. + +Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support") +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/jz4740/jz4740-i2s.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c +index e099c0505b765..2c6b0ac97c684 100644 +--- a/sound/soc/jz4740/jz4740-i2s.c ++++ b/sound/soc/jz4740/jz4740-i2s.c +@@ -318,10 +318,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id, + switch (clk_id) { + case JZ4740_I2S_CLKSRC_EXT: + parent = clk_get(NULL, "ext"); ++ if (IS_ERR(parent)) ++ return PTR_ERR(parent); + clk_set_parent(i2s->clk_i2s, parent); + break; + case JZ4740_I2S_CLKSRC_PLL: + parent = clk_get(NULL, "pll half"); ++ if (IS_ERR(parent)) ++ return PTR_ERR(parent); + clk_set_parent(i2s->clk_i2s, parent); + ret = clk_set_rate(i2s->clk_i2s, freq); + break; +-- +2.27.0 + diff --git a/queue-4.14/asoc-pcm-drain-support-reactivation.patch b/queue-4.14/asoc-pcm-drain-support-reactivation.patch new file mode 100644 index 00000000000..ddc6b21db86 --- /dev/null +++ b/queue-4.14/asoc-pcm-drain-support-reactivation.patch @@ -0,0 +1,51 @@ +From c917dcf72be4fec1b0d402b9b0b8ea150899efe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 11:01:29 +0100 +Subject: ASoC: pcm: DRAIN support reactivation + +From: Cezary Rojewski + +[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ] + +soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel +v5.4 where explicit switch(cmd) has been introduced which takes into +account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update +switch statement to reactive support for it. + +As DRAIN is somewhat unique by lacking negative/stop counterpart, bring +behaviour of dpcm_fe_dai_do_trigger() for said command back to its +pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group. + +Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command") +Signed-off-by: Cezary Rojewski +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index fd4b71729eedd..e995e96ab9030 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2172,6 +2172,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd) + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: ++ case SNDRV_PCM_TRIGGER_DRAIN: + ret = dpcm_dai_trigger_fe_be(substream, cmd, true); + break; + case SNDRV_PCM_TRIGGER_STOP: +@@ -2189,6 +2190,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd) + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: ++ case SNDRV_PCM_TRIGGER_DRAIN: + ret = dpcm_dai_trigger_fe_be(substream, cmd, false); + break; + case SNDRV_PCM_TRIGGER_STOP: +-- +2.27.0 + diff --git a/queue-4.14/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch b/queue-4.14/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch new file mode 100644 index 00000000000..924e8e05060 --- /dev/null +++ b/queue-4.14/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch @@ -0,0 +1,48 @@ +From 08c7fcdbe6a8e23cb3f1b313ed7a9c006f827e58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 12:13:26 +0800 +Subject: ASoC: wm8998: Fix PM disable depth imbalance on error + +From: Zhang Qilong + +[ Upstream commit 193aa0a043645220d2a2f783ba06ae13d4601078 ] + +The pm_runtime_enable will increase power disable depth. Thus +a pairing decrement is needed on the error handling path to +keep it balanced according to context. + +Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe") +Signed-off-by: Zhang Qilong +Reviewed-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20201111041326.1257558-4-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8998.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c +index 44f447136e224..a94e0aeb2e198 100644 +--- a/sound/soc/codecs/wm8998.c ++++ b/sound/soc/codecs/wm8998.c +@@ -1425,7 +1425,7 @@ static int wm8998_probe(struct platform_device *pdev) + + ret = arizona_init_spk_irqs(arizona); + if (ret < 0) +- return ret; ++ goto err_pm_disable; + + ret = snd_soc_register_codec(&pdev->dev, &soc_codec_dev_wm8998, + wm8998_dai, ARRAY_SIZE(wm8998_dai)); +@@ -1438,6 +1438,8 @@ static int wm8998_probe(struct platform_device *pdev) + + err_spk_irqs: + arizona_free_spk_irqs(arizona); ++err_pm_disable: ++ pm_runtime_disable(&pdev->dev); + + return ret; + } +-- +2.27.0 + diff --git a/queue-4.14/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch b/queue-4.14/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch new file mode 100644 index 00000000000..d6981d628e2 --- /dev/null +++ b/queue-4.14/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch @@ -0,0 +1,50 @@ +From 0ec8b8f81473454d827df5bb991f7d058d3ed6c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 09:54:09 +0300 +Subject: ASoC: wm_adsp: remove "ctl" from list on error in + wm_adsp_create_control() + +From: Dan Carpenter + +[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ] + +The error handling frees "ctl" but it's still on the "dsp->ctl_list" +list so that could result in a use after free. Remove it from the list +before returning. + +Fixes: 2323736dca72 ("ASoC: wm_adsp: Add basic support for rev 1 firmware file format") +Signed-off-by: Dan Carpenter +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/X9B0keV/02wrx9Xs@mwanda +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index 158ce68bc9bf3..1516252aa0a53 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -1391,7 +1391,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp, + ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL); + if (!ctl_work) { + ret = -ENOMEM; +- goto err_ctl_cache; ++ goto err_list_del; + } + + ctl_work->dsp = dsp; +@@ -1401,7 +1401,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp, + + return 0; + +-err_ctl_cache: ++err_list_del: ++ list_del(&ctl->list); + kfree(ctl->cache); + err_ctl_name: + kfree(ctl->name); +-- +2.27.0 + diff --git a/queue-4.14/ath10k-fix-an-error-handling-path.patch b/queue-4.14/ath10k-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..f95ad8d4377 --- /dev/null +++ b/queue-4.14/ath10k-fix-an-error-handling-path.patch @@ -0,0 +1,37 @@ +From a505c8638c442c1f2a1af8f0b02aeb1f037e2606 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 17:59:18 +0200 +Subject: ath10k: Fix an error handling path + +From: Christophe JAILLET + +[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ] + +If 'ath10k_usb_create()' fails, we should release some resources and report +an error instead of silently continuing. + +Fixes: 4db66499df91 ("ath10k: add initial USB support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c +index c64a03f164c0f..f4e6d84bfb91c 100644 +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -1019,6 +1019,8 @@ static int ath10k_usb_probe(struct usb_interface *interface, + + ar_usb = ath10k_usb_priv(ar); + ret = ath10k_usb_create(ar, interface); ++ if (ret) ++ goto err; + ar_usb->ar = ar; + + ar->dev_id = product_id; +-- +2.27.0 + diff --git a/queue-4.14/ath10k-release-some-resources-in-an-error-handling-p.patch b/queue-4.14/ath10k-release-some-resources-in-an-error-handling-p.patch new file mode 100644 index 00000000000..9e3c9b1318b --- /dev/null +++ b/queue-4.14/ath10k-release-some-resources-in-an-error-handling-p.patch @@ -0,0 +1,47 @@ +From d84eff0ea32a3aa14a1c27d8d1f6f2b5870ab1eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 17:59:18 +0200 +Subject: ath10k: Release some resources in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ] + +Should an error occur after calling 'ath10k_usb_create()', it should be +undone by a corresponding 'ath10k_usb_destroy()' call + +Fixes: 4db66499df91 ("ath10k: add initial USB support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/usb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c +index f4e6d84bfb91c..16d5fe6d1e2e4 100644 +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -1032,7 +1032,7 @@ static int ath10k_usb_probe(struct usb_interface *interface, + ret = ath10k_core_register(ar, chip_id); + if (ret) { + ath10k_warn(ar, "failed to register driver core: %d\n", ret); +- goto err; ++ goto err_usb_destroy; + } + + /* TODO: remove this once USB support is fully implemented */ +@@ -1040,6 +1040,9 @@ static int ath10k_usb_probe(struct usb_interface *interface, + + return 0; + ++err_usb_destroy: ++ ath10k_usb_destroy(ar); ++ + err: + ath10k_core_destroy(ar); + +-- +2.27.0 + diff --git a/queue-4.14/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch b/queue-4.14/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch new file mode 100644 index 00000000000..d7cc4915cdf --- /dev/null +++ b/queue-4.14/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch @@ -0,0 +1,49 @@ +From 8c36df8bf2c4e35fdbbc6175922cde1d44f1a6bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Sep 2020 19:48:13 +0530 +Subject: Bluetooth: Fix null pointer dereference in hci_event_packet() + +From: Anmol Karn + +[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ] + +AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called +from hci_event_packet() and there is a possibility, that hcon->amp_mgr may +not be found when accessing after initialization of hcon. + +- net/bluetooth/hci_event.c:4945 +The bug seems to get triggered in this line: + +bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon; + +Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status. + +Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt") +Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f +Signed-off-by: Anmol Karn +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 0db218b14bf3c..5e05a96e0646a 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4350,6 +4350,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev, + return; + } + ++ if (!hcon->amp_mgr) { ++ hci_dev_unlock(hdev); ++ return; ++ } ++ + if (ev->status) { + hci_conn_del(hcon); + hci_dev_unlock(hdev); +-- +2.27.0 + diff --git a/queue-4.14/cfg80211-initialize-rekey_data.patch b/queue-4.14/cfg80211-initialize-rekey_data.patch new file mode 100644 index 00000000000..605f38b76e7 --- /dev/null +++ b/queue-4.14/cfg80211-initialize-rekey_data.patch @@ -0,0 +1,36 @@ +From 9f266852d82be441a4b31cdf2e3b690d489266b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Nov 2020 17:30:44 +0200 +Subject: cfg80211: initialize rekey_data + +From: Sara Sharon + +[ Upstream commit f495acd8851d7b345e5f0e521b2645b1e1f928a0 ] + +In case we have old supplicant, the akm field is uninitialized. + +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20201129172929.930f0ab7ebee.Ic546e384efab3f4a89f318eafddc3eb7d556aecb@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 6bd4f6c8fc2ef..f630fa2e31647 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -10969,7 +10969,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) + struct net_device *dev = info->user_ptr[1]; + struct wireless_dev *wdev = dev->ieee80211_ptr; + struct nlattr *tb[NUM_NL80211_REKEY_DATA]; +- struct cfg80211_gtk_rekey_data rekey_data; ++ struct cfg80211_gtk_rekey_data rekey_data = {}; + int err; + + if (!info->attrs[NL80211_ATTR_REKEY_DATA]) +-- +2.27.0 + diff --git a/queue-4.14/checkpatch-fix-unescaped-left-brace.patch b/queue-4.14/checkpatch-fix-unescaped-left-brace.patch new file mode 100644 index 00000000000..fc3e6d64984 --- /dev/null +++ b/queue-4.14/checkpatch-fix-unescaped-left-brace.patch @@ -0,0 +1,42 @@ +From 509b6a14a66d6a5a6ffabe26a37d52ca0c938c84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Dec 2020 20:45:02 -0800 +Subject: checkpatch: fix unescaped left brace + +From: Dwaipayan Ray + +[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ] + +There is an unescaped left brace in a regex in OPEN_BRACE check. This +throws a runtime error when checkpatch is run with --fix flag and the +OPEN_BRACE check is executed. + +Fix it by escaping the left brace. + +Link: https://lkml.kernel.org/r/20201115202928.81955-1-dwaipayanray1@gmail.com +Fixes: 8d1824780f2f ("checkpatch: add --fix option for a couple OPEN_BRACE misuses") +Signed-off-by: Dwaipayan Ray +Acked-by: Joe Perches +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/checkpatch.pl | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl +index d702bdf19eb10..0f24a6f3af995 100755 +--- a/scripts/checkpatch.pl ++++ b/scripts/checkpatch.pl +@@ -3898,7 +3898,7 @@ sub process { + $fix) { + fix_delete_line($fixlinenr, $rawline); + my $fixed_line = $rawline; +- $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/; ++ $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/; + my $line1 = $1; + my $line2 = $2; + fix_insert_line($fixlinenr, ltrim($line1)); +-- +2.27.0 + diff --git a/queue-4.14/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch b/queue-4.14/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch new file mode 100644 index 00000000000..8db55b8158c --- /dev/null +++ b/queue-4.14/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch @@ -0,0 +1,41 @@ +From 04a77db63d83aecc61fe5dcc8e8c6d6d38f8e03a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 13:28:18 +0100 +Subject: clk: s2mps11: Fix a resource leak in error handling paths in the + probe function + +From: Christophe JAILLET + +[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ] + +Some resource should be released in the error handling path of the probe +function, as already done in the remove function. + +The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add +missing of_node_put and of_clk_del_provider") + +Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201212122818.86195-1-christophe.jaillet@wanadoo.fr +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-s2mps11.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c +index f5d74e8db4327..1803af6230b27 100644 +--- a/drivers/clk/clk-s2mps11.c ++++ b/drivers/clk/clk-s2mps11.c +@@ -211,6 +211,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev) + return ret; + + err_reg: ++ of_node_put(s2mps11_clks[0].clk_np); + while (--i >= 0) + clkdev_drop(s2mps11_clks[i].lookup); + +-- +2.27.0 + diff --git a/queue-4.14/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch b/queue-4.14/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch new file mode 100644 index 00000000000..5f696f1dabd --- /dev/null +++ b/queue-4.14/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch @@ -0,0 +1,54 @@ +From d81f239580d3e6ecf4841f776ac7a4d1b1a102e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 21:38:17 +0100 +Subject: clk: sunxi-ng: Make sure divider tables have sentinel + +From: Jernej Skrabec + +[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ] + +Two clock divider tables are missing sentinel at the end. Effect of that +is that clock framework reads past the last entry. Fix that with adding +sentinel at the end. + +Issue was discovered with KASan. + +Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks") +Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks") +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201202203817.438713-1-jernej.skrabec@siol.net +Acked-by: Maxime Ripard +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 + + drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +index 183985c8c9bab..7e3cd0bd597dc 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +@@ -381,6 +381,7 @@ static struct clk_div_table ths_div_table[] = { + { .val = 1, .div = 2 }, + { .val = 2, .div = 4 }, + { .val = 3, .div = 6 }, ++ { /* Sentinel */ }, + }; + static const char * const ths_parents[] = { "osc24M" }; + static struct ccu_div ths_clk = { +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +index b09acda71abe9..aa44602896fac 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +@@ -315,6 +315,7 @@ static struct clk_div_table ths_div_table[] = { + { .val = 1, .div = 2 }, + { .val = 2, .div = 4 }, + { .val = 3, .div = 6 }, ++ { /* Sentinel */ }, + }; + static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M", + 0x074, 0, 2, ths_div_table, BIT(31), 0); +-- +2.27.0 + diff --git a/queue-4.14/clk-tegra-fix-duplicated-se-clock-entry.patch b/queue-4.14/clk-tegra-fix-duplicated-se-clock-entry.patch new file mode 100644 index 00000000000..fcd48cc07aa --- /dev/null +++ b/queue-4.14/clk-tegra-fix-duplicated-se-clock-entry.patch @@ -0,0 +1,55 @@ +From 6d1248aa7a1d58b044a494772ed9999611b6e1a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 01:42:12 +0300 +Subject: clk: tegra: Fix duplicated SE clock entry + +From: Dmitry Osipenko + +[ Upstream commit 5bf5861d6ea6c3f4b38fc8fda2062b2dc44ac63d ] + +The periph_clks[] array contains duplicated entry for Security Engine +clock which was meant to be defined for T210, but it wasn't added +properly. This patch corrects the T210 SE entry and fixes the following +error message on T114/T124: "Tegra clk 127: register failed with -17". + +Fixes: dc37fec48314 ("clk: tegra: periph: Add new periph clks and muxes for Tegra210") +Tested-by Nicolas Chauvet +Reported-by Nicolas Chauvet +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20201025224212.7790-1-digetx@gmail.com +Acked-by: Thierry Reding +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-id.h | 1 + + drivers/clk/tegra/clk-tegra-periph.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h +index 11ee5f9ce99e1..4374e4a6b5be5 100644 +--- a/drivers/clk/tegra/clk-id.h ++++ b/drivers/clk/tegra/clk-id.h +@@ -234,6 +234,7 @@ enum clk_id { + tegra_clk_sdmmc4_8, + tegra_clk_sdmmc4_9, + tegra_clk_se, ++ tegra_clk_se_10, + tegra_clk_soc_therm, + tegra_clk_soc_therm_8, + tegra_clk_sor0, +diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c +index d300a256fcacb..ca0735dc70ece 100644 +--- a/drivers/clk/tegra/clk-tegra-periph.c ++++ b/drivers/clk/tegra/clk-tegra-periph.c +@@ -673,7 +673,7 @@ static struct tegra_periph_init_data periph_clks[] = { + INT8("host1x", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_8), + INT8("host1x", mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_9), + INT8("se", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se), +- INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se), ++ INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se_10), + INT8("2d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_2D, 21, 0, tegra_clk_gr2d_8), + INT8("3d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_3D, 24, 0, tegra_clk_gr3d_8), + INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03), +-- +2.27.0 + diff --git a/queue-4.14/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch b/queue-4.14/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch new file mode 100644 index 00000000000..64a6a4de770 --- /dev/null +++ b/queue-4.14/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch @@ -0,0 +1,60 @@ +From 064c59543d9597998eef3c86d193030207e79248 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 21:16:23 +0800 +Subject: clk: ti: Fix memleak in ti_fapll_synth_setup + +From: Zhang Qilong + +[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ] + +If clk_register fails, we should goto free branch +before function returns to prevent memleak. + +Fixes: 163152cbbe321 ("clk: ti: Add support for FAPLL on dm816x") +Reported-by: Hulk Robot +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201113131623.2098222-1-zhangqilong3@huawei.com +Acked-by: Tony Lindgren +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/fapll.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c +index 071af44b1ba85..e33ce851837e4 100644 +--- a/drivers/clk/ti/fapll.c ++++ b/drivers/clk/ti/fapll.c +@@ -497,6 +497,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd, + { + struct clk_init_data *init; + struct fapll_synth *synth; ++ struct clk *clk = ERR_PTR(-ENOMEM); + + init = kzalloc(sizeof(*init), GFP_KERNEL); + if (!init) +@@ -519,13 +520,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd, + synth->hw.init = init; + synth->clk_pll = pll_clk; + +- return clk_register(NULL, &synth->hw); ++ clk = clk_register(NULL, &synth->hw); ++ if (IS_ERR(clk)) { ++ pr_err("failed to register clock\n"); ++ goto free; ++ } ++ ++ return clk; + + free: + kfree(synth); + kfree(init); + +- return ERR_PTR(-ENOMEM); ++ return clk; + } + + static void __init ti_fapll_setup(struct device_node *node) +-- +2.27.0 + diff --git a/queue-4.14/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch b/queue-4.14/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch new file mode 100644 index 00000000000..f6f7858526d --- /dev/null +++ b/queue-4.14/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch @@ -0,0 +1,70 @@ +From 02b83c8e92f6bc781d5ec1e6c93b4d12306c18cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 15:31:26 +0800 +Subject: clocksource/drivers/arm_arch_timer: Correct fault programming of + CNTKCTL_EL1.EVNTI + +From: Keqian Zhu + +[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ] + +ARM virtual counter supports event stream, it can only trigger an event +when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes, +so the actual period of event stream is 2^(cntkctl_evnti + 1). For example, +when the trigger bit is 0, then virtual counter trigger an event for every +two cycles. + +While we're at it, rework the way we compute the trigger bit position +by making it more obvious that when bits [n:n-1] are both set (with n +being the most significant bit), we pick bit (n + 1). + +Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream") +Suggested-by: Marc Zyngier +Signed-off-by: Keqian Zhu +Acked-by: Marc Zyngier +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c +index 14e2419063e93..2c5913057b87b 100644 +--- a/drivers/clocksource/arm_arch_timer.c ++++ b/drivers/clocksource/arm_arch_timer.c +@@ -744,15 +744,24 @@ static void arch_timer_evtstrm_enable(int divider) + + static void arch_timer_configure_evtstream(void) + { +- int evt_stream_div, pos; ++ int evt_stream_div, lsb; ++ ++ /* ++ * As the event stream can at most be generated at half the frequency ++ * of the counter, use half the frequency when computing the divider. ++ */ ++ evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2; ++ ++ /* ++ * Find the closest power of two to the divisor. If the adjacent bit ++ * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1). ++ */ ++ lsb = fls(evt_stream_div) - 1; ++ if (lsb > 0 && (evt_stream_div & BIT(lsb - 1))) ++ lsb++; + +- /* Find the closest power of two to the divisor */ +- evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ; +- pos = fls(evt_stream_div); +- if (pos > 1 && !(evt_stream_div & (1 << (pos - 2)))) +- pos--; + /* enable event stream */ +- arch_timer_evtstrm_enable(min(pos, 15)); ++ arch_timer_evtstrm_enable(max(0, min(lsb, 15))); + } + + static void arch_counter_set_user_access(void) +-- +2.27.0 + diff --git a/queue-4.14/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch b/queue-4.14/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch new file mode 100644 index 00000000000..c995a5cf7b1 --- /dev/null +++ b/queue-4.14/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch @@ -0,0 +1,74 @@ +From f1067e738e6a7e0bb830759c378168b5e66f9fe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 21:51:23 +0800 +Subject: clocksource/drivers/cadence_ttc: Fix memory leak in + ttc_setup_clockevent() + +From: Yu Kuai + +[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ] + +If clk_notifier_register() failed, ttc_setup_clockevent() will return +without freeing 'ttcce', which will leak memory. + +Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error") +Reported-by: Hulk Robot +Signed-off-by: Yu Kuai +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20201116135123.2164033-1-yukuai3@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/cadence_ttc_timer.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c +index 29d51755e18b2..a7eb858a84a0f 100644 +--- a/drivers/clocksource/cadence_ttc_timer.c ++++ b/drivers/clocksource/cadence_ttc_timer.c +@@ -419,10 +419,8 @@ static int __init ttc_setup_clockevent(struct clk *clk, + ttcce->ttc.clk = clk; + + err = clk_prepare_enable(ttcce->ttc.clk); +- if (err) { +- kfree(ttcce); +- return err; +- } ++ if (err) ++ goto out_kfree; + + ttcce->ttc.clk_rate_change_nb.notifier_call = + ttc_rate_change_clockevent_cb; +@@ -432,7 +430,7 @@ static int __init ttc_setup_clockevent(struct clk *clk, + &ttcce->ttc.clk_rate_change_nb); + if (err) { + pr_warn("Unable to register clock notifier.\n"); +- return err; ++ goto out_kfree; + } + + ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk); +@@ -461,15 +459,17 @@ static int __init ttc_setup_clockevent(struct clk *clk, + + err = request_irq(irq, ttc_clock_event_interrupt, + IRQF_TIMER, ttcce->ce.name, ttcce); +- if (err) { +- kfree(ttcce); +- return err; +- } ++ if (err) ++ goto out_kfree; + + clockevents_config_and_register(&ttcce->ce, + ttcce->ttc.freq / PRESCALE, 1, 0xfffe); + + return 0; ++ ++out_kfree: ++ kfree(ttcce); ++ return err; + } + + /** +-- +2.27.0 + diff --git a/queue-4.14/cpufreq-highbank-add-missing-module_device_table.patch b/queue-4.14/cpufreq-highbank-add-missing-module_device_table.patch new file mode 100644 index 00000000000..d756e06c4e2 --- /dev/null +++ b/queue-4.14/cpufreq-highbank-add-missing-module_device_table.patch @@ -0,0 +1,45 @@ +From 8ff9eb903cb6147146ec9300039a2e75080a2862 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:32 +0100 +Subject: cpufreq: highbank: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: 6754f556103be ("cpufreq / highbank: add support for highbank cpufreq") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/highbank-cpufreq.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c +index 1608f7105c9f8..ad743f2f31e78 100644 +--- a/drivers/cpufreq/highbank-cpufreq.c ++++ b/drivers/cpufreq/highbank-cpufreq.c +@@ -104,6 +104,13 @@ out_put_node: + } + module_init(hb_cpufreq_driver_init); + ++static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = { ++ { .compatible = "calxeda,highbank" }, ++ { .compatible = "calxeda,ecx-2000" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match); ++ + MODULE_AUTHOR("Mark Langsdorf "); + MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver"); + MODULE_LICENSE("GPL"); +-- +2.27.0 + diff --git a/queue-4.14/cpufreq-loongson1-add-missing-module_alias.patch b/queue-4.14/cpufreq-loongson1-add-missing-module_alias.patch new file mode 100644 index 00000000000..f9b30b15877 --- /dev/null +++ b/queue-4.14/cpufreq-loongson1-add-missing-module_alias.patch @@ -0,0 +1,38 @@ +From 82e76e328b1afe62ef32ae254c82562d03d5dad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:37 +0100 +Subject: cpufreq: loongson1: Add missing MODULE_ALIAS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ] + +This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq +driver when it is compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: a0a22cf14472f ("cpufreq: Loongson1: Add cpufreq driver for Loongson1B") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/loongson1-cpufreq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/loongson1-cpufreq.c b/drivers/cpufreq/loongson1-cpufreq.c +index be89416e2358f..9d902f67f8716 100644 +--- a/drivers/cpufreq/loongson1-cpufreq.c ++++ b/drivers/cpufreq/loongson1-cpufreq.c +@@ -217,6 +217,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = { + + module_platform_driver(ls1x_cpufreq_platdrv); + ++MODULE_ALIAS("platform:ls1x-cpufreq"); + MODULE_AUTHOR("Kelvin Cheung "); + MODULE_DESCRIPTION("Loongson1 CPUFreq driver"); + MODULE_LICENSE("GPL"); +-- +2.27.0 + diff --git a/queue-4.14/cpufreq-mediatek-add-missing-module_device_table.patch b/queue-4.14/cpufreq-mediatek-add-missing-module_device_table.patch new file mode 100644 index 00000000000..25558138e8f --- /dev/null +++ b/queue-4.14/cpufreq-mediatek-add-missing-module_device_table.patch @@ -0,0 +1,39 @@ +From 2f100c5696c14769b55e190df74469d82c8f2e1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:33 +0100 +Subject: cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: 501c574f4e3a5 ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 18c4bd9a5c656..993cd461e34c1 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -582,6 +582,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = { + + { } + }; ++MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines); + + static int __init mtk_cpufreq_driver_init(void) + { +-- +2.27.0 + diff --git a/queue-4.14/cpufreq-scpi-add-missing-module_alias.patch b/queue-4.14/cpufreq-scpi-add-missing-module_alias.patch new file mode 100644 index 00000000000..1eb7b89e72e --- /dev/null +++ b/queue-4.14/cpufreq-scpi-add-missing-module_alias.patch @@ -0,0 +1,38 @@ +From 0e7b2b66e5cca026e7b5056783b40e796a69ddb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:38 +0100 +Subject: cpufreq: scpi: Add missing MODULE_ALIAS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ] + +This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq +driver when it is compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: 8def31034d033 ("cpufreq: arm_big_little: add SCPI interface driver") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scpi-cpufreq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c +index 8de2364b5995a..df6617b19de28 100644 +--- a/drivers/cpufreq/scpi-cpufreq.c ++++ b/drivers/cpufreq/scpi-cpufreq.c +@@ -85,6 +85,7 @@ static struct platform_driver scpi_cpufreq_platdrv = { + }; + module_platform_driver(scpi_cpufreq_platdrv); + ++MODULE_ALIAS("platform:scpi-cpufreq"); + MODULE_AUTHOR("Sudeep Holla "); + MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver"); + MODULE_LICENSE("GPL v2"); +-- +2.27.0 + diff --git a/queue-4.14/cpufreq-st-add-missing-module_device_table.patch b/queue-4.14/cpufreq-st-add-missing-module_device_table.patch new file mode 100644 index 00000000000..35e3eada6b1 --- /dev/null +++ b/queue-4.14/cpufreq-st-add-missing-module_device_table.patch @@ -0,0 +1,45 @@ +From 528cddc7449071994ab341a5a5960ba03ed0d887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:35 +0100 +Subject: cpufreq: st: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: ab0ea257fc58d ("cpufreq: st: Provide runtime initialised driver for ST's platforms") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/sti-cpufreq.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c +index 6b5d241c30b70..2d09960afa591 100644 +--- a/drivers/cpufreq/sti-cpufreq.c ++++ b/drivers/cpufreq/sti-cpufreq.c +@@ -295,6 +295,13 @@ register_cpufreq_dt: + } + module_init(sti_cpufreq_init); + ++static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = { ++ { .compatible = "st,stih407" }, ++ { .compatible = "st,stih410" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match); ++ + MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver"); + MODULE_AUTHOR("Ajitpal Singh "); + MODULE_AUTHOR("Lee Jones "); +-- +2.27.0 + diff --git a/queue-4.14/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch b/queue-4.14/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch new file mode 100644 index 00000000000..f1f68ec1206 --- /dev/null +++ b/queue-4.14/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch @@ -0,0 +1,45 @@ +From 1e55b3d39ee3aef66aed6f292e778fa3612b1e3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 21:17:28 +0800 +Subject: crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe + +From: Zhang Qilong + +[ Upstream commit ff8107200367f4abe0e5bce66a245e8d0f2d229e ] + +The pm_runtime_enable will increase power disable depth. +Thus a pairing decrement is needed on the error handling +path to keep it balanced according to context. + +Fixes: f7b2b5dd6a62a ("crypto: omap-aes - add error check for pm_runtime_get_sync") +Signed-off-by: Zhang Qilong +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/omap-aes.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c +index c376a3ee7c2c3..41c411ee0da5d 100644 +--- a/drivers/crypto/omap-aes.c ++++ b/drivers/crypto/omap-aes.c +@@ -1071,7 +1071,7 @@ static int omap_aes_probe(struct platform_device *pdev) + if (err < 0) { + dev_err(dev, "%s: failed to get_sync(%d)\n", + __func__, err); +- goto err_res; ++ goto err_pm_disable; + } + + omap_aes_dma_stop(dd); +@@ -1180,6 +1180,7 @@ err_engine: + omap_aes_dma_cleanup(dd); + err_irq: + tasklet_kill(&dd->done_task); ++err_pm_disable: + pm_runtime_disable(dev); + err_res: + dd = NULL; +-- +2.27.0 + diff --git a/queue-4.14/crypto-talitos-fix-return-type-of-current_desc_hdr.patch b/queue-4.14/crypto-talitos-fix-return-type-of-current_desc_hdr.patch new file mode 100644 index 00000000000..20f641d0aa2 --- /dev/null +++ b/queue-4.14/crypto-talitos-fix-return-type-of-current_desc_hdr.patch @@ -0,0 +1,55 @@ +From 5045761073502c5177decc5947fa2f94138546c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 09:34:56 +0000 +Subject: crypto: talitos - Fix return type of current_desc_hdr() + +From: Christophe Leroy + +[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ] + +current_desc_hdr() returns a u32 but in fact this is a __be32, +leading to a lot of sparse warnings. + +Change the return type to __be32 and ensure it is handled as +sure by the caller. + +Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path") +Signed-off-by: Christophe Leroy +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/talitos.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index 6c8a03a1132f6..8028fbd5cda47 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -447,7 +447,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE) + /* + * locate current (offending) descriptor + */ +-static u32 current_desc_hdr(struct device *dev, int ch) ++static __be32 current_desc_hdr(struct device *dev, int ch) + { + struct talitos_private *priv = dev_get_drvdata(dev); + int tail, iter; +@@ -478,13 +478,13 @@ static u32 current_desc_hdr(struct device *dev, int ch) + /* + * user diagnostics; report root cause of error based on execution unit status + */ +-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr) ++static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr) + { + struct talitos_private *priv = dev_get_drvdata(dev); + int i; + + if (!desc_hdr) +- desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF); ++ desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF)); + + switch (desc_hdr & DESC_HDR_SEL0_MASK) { + case DESC_HDR_SEL0_AFEU: +-- +2.27.0 + diff --git a/queue-4.14/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch b/queue-4.14/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch new file mode 100644 index 00000000000..311d05e256d --- /dev/null +++ b/queue-4.14/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch @@ -0,0 +1,46 @@ +From 592f795a0147ada4d15e9ce0a87a1d51b4eff4f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 15:08:42 +0800 +Subject: cw1200: fix missing destroy_workqueue() on error in + cw1200_init_common + +From: Qinglang Miao + +[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ] + +Add the missing destroy_workqueue() before return from +cw1200_init_common in the error handling case. + +Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/st/cw1200/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c +index 84624c812a15f..f4338bce78f4a 100644 +--- a/drivers/net/wireless/st/cw1200/main.c ++++ b/drivers/net/wireless/st/cw1200/main.c +@@ -385,6 +385,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr, + CW1200_LINK_ID_MAX, + cw1200_skb_dtor, + priv)) { ++ destroy_workqueue(priv->workqueue); + ieee80211_free_hw(hw); + return NULL; + } +@@ -396,6 +397,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr, + for (; i > 0; i--) + cw1200_queue_deinit(&priv->tx_queue[i - 1]); + cw1200_queue_stats_deinit(&priv->tx_queue_stats); ++ destroy_workqueue(priv->workqueue); + ieee80211_free_hw(hw); + return NULL; + } +-- +2.27.0 + diff --git a/queue-4.14/dm-ioctl-fix-error-return-code-in-target_message.patch b/queue-4.14/dm-ioctl-fix-error-return-code-in-target_message.patch new file mode 100644 index 00000000000..fd050981964 --- /dev/null +++ b/queue-4.14/dm-ioctl-fix-error-return-code-in-target_message.patch @@ -0,0 +1,36 @@ +From d493808998ae0759edbbcc888758ac0a74164693 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 18:19:59 +0800 +Subject: dm ioctl: fix error return code in target_message + +From: Qinglang Miao + +[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index ca948155191ac..469453e106d14 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -1574,6 +1574,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para + + if (!argc) { + DMWARN("Empty message received."); ++ r = -EINVAL; + goto out_argv; + } + +-- +2.27.0 + diff --git a/queue-4.14/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch b/queue-4.14/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch new file mode 100644 index 00000000000..ae929d5b34a --- /dev/null +++ b/queue-4.14/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch @@ -0,0 +1,41 @@ +From ff4de49b1d5e8af4ccd58f5a76712093ff9311ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 19:22:38 -0800 +Subject: drivers: soc: ti: knav_qmss_queue: Fix error return code in + knav_queue_probe + +From: Zhihao Cheng + +[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ] + +Fix to return the error code from of_get_child_by_name() instaed of 0 +in knav_queue_probe(). + +Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver") +Reported-by: Hulk Robot +Signed-off-by: Zhihao Cheng +Signed-off-by: Santosh Shilimkar +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/knav_qmss_queue.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c +index eef79cd5a7238..25baf13d6dfd2 100644 +--- a/drivers/soc/ti/knav_qmss_queue.c ++++ b/drivers/soc/ti/knav_qmss_queue.c +@@ -1787,9 +1787,10 @@ static int knav_queue_probe(struct platform_device *pdev) + if (ret) + goto err; + +- regions = of_get_child_by_name(node, "descriptor-regions"); ++ regions = of_get_child_by_name(node, "descriptor-regions"); + if (!regions) { + dev_err(dev, "descriptor-regions not specified\n"); ++ ret = -ENODEV; + goto err; + } + ret = knav_queue_setup_regions(kdev, regions); +-- +2.27.0 + diff --git a/queue-4.14/drm-gma500-fix-double-free-of-gma_connector.patch b/queue-4.14/drm-gma500-fix-double-free-of-gma_connector.patch new file mode 100644 index 00000000000..f223805fac3 --- /dev/null +++ b/queue-4.14/drm-gma500-fix-double-free-of-gma_connector.patch @@ -0,0 +1,45 @@ +From 5010329d5d76508c67587e7d04578f9e51c4b45e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Oct 2020 12:39:28 -0700 +Subject: drm/gma500: fix double free of gma_connector + +From: Tom Rix + +[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ] + +clang static analysis reports this problem: + +cdv_intel_dp.c:2101:2: warning: Attempt to free released memory + kfree(gma_connector); + ^~~~~~~~~~~~~~~~~~~~ + +In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off() +fails, the handler calls cdv_intel_dp_destroy(connector) which does +the first free of gma_connector. So adjust the goto label and skip +the second free. + +Fixes: d112a8163f83 ("gma500/cdv: Add eDP support") +Signed-off-by: Tom Rix +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c +index 7ec4e3fbafd8c..ec6ea202cf5de 100644 +--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c ++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c +@@ -2126,7 +2126,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev + DRM_INFO("failed to retrieve link info, disabling eDP\n"); + cdv_intel_dp_encoder_destroy(encoder); + cdv_intel_dp_destroy(connector); +- goto err_priv; ++ goto err_connector; + } else { + DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n", + intel_dp->dpcd[0], intel_dp->dpcd[1], +-- +2.27.0 + diff --git a/queue-4.14/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch b/queue-4.14/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch new file mode 100644 index 00000000000..dfc01e9b1d7 --- /dev/null +++ b/queue-4.14/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch @@ -0,0 +1,36 @@ +From f47c21ea745718cb2cc11648d100a493e183f7d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 14:10:45 +0800 +Subject: drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() + +From: Yang Yingliang + +[ Upstream commit 723ae803218da993143387bf966042eccefac077 ] + +Return -ENOMEM when allocating refill memory failed. + +Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index 32901c6fe3dfc..6d0c0405e736d 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -751,6 +751,7 @@ static int omap_dmm_probe(struct platform_device *dev) + &omap_dmm->refill_pa, GFP_KERNEL); + if (!omap_dmm->refill_va) { + dev_err(&dev->dev, "could not allocate refill memory\n"); ++ ret = -ENOMEM; + goto fail; + } + +-- +2.27.0 + diff --git a/queue-4.14/extcon-max77693-fix-modalias-string.patch b/queue-4.14/extcon-max77693-fix-modalias-string.patch new file mode 100644 index 00000000000..48018813898 --- /dev/null +++ b/queue-4.14/extcon-max77693-fix-modalias-string.patch @@ -0,0 +1,34 @@ +From 7da2b7a923c6e2d7d6a710068096a309b77d325e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 14:36:27 +0100 +Subject: extcon: max77693: Fix modalias string + +From: Marek Szyprowski + +[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ] + +The platform device driver name is "max77693-muic", so advertise it +properly in the modalias string. This fixes automated module loading when +this driver is compiled as a module. + +Fixes: db1b9037424b ("extcon: MAX77693: Add extcon-max77693 driver to support Maxim MAX77693 MUIC device") +Signed-off-by: Marek Szyprowski +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-max77693.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c +index 7a58568090474..8ea33946b4b25 100644 +--- a/drivers/extcon/extcon-max77693.c ++++ b/drivers/extcon/extcon-max77693.c +@@ -1275,4 +1275,4 @@ module_platform_driver(max77693_muic_driver); + MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver"); + MODULE_AUTHOR("Chanwoo Choi "); + MODULE_LICENSE("GPL"); +-MODULE_ALIAS("platform:extcon-max77693"); ++MODULE_ALIAS("platform:max77693-muic"); +-- +2.27.0 + diff --git a/queue-4.14/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch b/queue-4.14/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch new file mode 100644 index 00000000000..5ab79ca3c8c --- /dev/null +++ b/queue-4.14/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch @@ -0,0 +1,55 @@ +From 95e9b72d340a0b7e756502283526b81904e1a558 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Nov 2020 13:55:51 +0000 +Subject: genirq/irqdomain: Don't try to free an interrupt that has no mapping + +From: Marc Zyngier + +[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ] + +When an interrupt allocation fails for N interrupts, it is pretty +common for the error handling code to free the same number of interrupts, +no matter how many interrupts have actually been allocated. + +This may result in the domain freeing code to be unexpectedly called +for interrupts that have no mapping in that domain. Things end pretty +badly. + +Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure +that thiss does not follow the hierarchy if no mapping exists for a given +interrupt. + +Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support") +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/irq/irqdomain.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 0d54f8256b9f4..cafea68749e0a 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -1364,8 +1364,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain, + unsigned int irq_base, + unsigned int nr_irqs) + { +- if (domain->ops->free) +- domain->ops->free(domain, irq_base, nr_irqs); ++ unsigned int i; ++ ++ if (!domain->ops->free) ++ return; ++ ++ for (i = 0; i < nr_irqs; i++) { ++ if (irq_domain_get_irq_data(domain, irq_base + i)) ++ domain->ops->free(domain, irq_base + i, 1); ++ } + } + + int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain, +-- +2.27.0 + diff --git a/queue-4.14/hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-15254 b/queue-4.14/hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-15254 new file mode 100644 index 00000000000..389f76c05e8 --- /dev/null +++ b/queue-4.14/hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-15254 @@ -0,0 +1,43 @@ +From 5f27f8375839bd1c7fb189e68a6679da9f6d8a03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 18:51:58 +0100 +Subject: HID: i2c-hid: add Vero K147 to descriptor override + +From: Julian Sax + +commit c870d50ce387d84b6438211a7044c60afbd5d60a upstream. + +This device uses the SIPODEV SP1064 touchpad, which does not +supply descriptors, so it has to be added to the override list. + +Cc: stable@vger.kernel.org +Signed-off-by: Julian Sax +Reviewed-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 58a753ef27175..5808eed6d6ba6 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -405,6 +405,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Vero K147", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VERO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "K147"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { } /* Terminate list */ + }; + +-- +2.27.0 + diff --git a/queue-4.14/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch b/queue-4.14/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch new file mode 100644 index 00000000000..0f0777a09f9 --- /dev/null +++ b/queue-4.14/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch @@ -0,0 +1,36 @@ +From daa2944eb525f9664f5442dd67d752af843db1aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Oct 2020 10:56:43 +0800 +Subject: HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() + +From: Jing Xiangfeng + +[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ] + +In current code, it jumps to ida_simple_remove() when ida_simple_get() +failes to allocate an ID. Just return to fix it. + +Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module") +Signed-off-by: Jing Xiangfeng +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/controllers/omap_ssi_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c +index 88e48b3469164..3554443a609cb 100644 +--- a/drivers/hsi/controllers/omap_ssi_core.c ++++ b/drivers/hsi/controllers/omap_ssi_core.c +@@ -389,7 +389,7 @@ static int ssi_add_controller(struct hsi_controller *ssi, + + err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL); + if (err < 0) +- goto out_err; ++ return err; + ssi->id = err; + + ssi->owner = THIS_MODULE; +-- +2.27.0 + diff --git a/queue-4.14/input-ads7846-fix-integer-overflow-on-rt-calculation.patch b/queue-4.14/input-ads7846-fix-integer-overflow-on-rt-calculation.patch new file mode 100644 index 00000000000..83255e6ec03 --- /dev/null +++ b/queue-4.14/input-ads7846-fix-integer-overflow-on-rt-calculation.patch @@ -0,0 +1,52 @@ +From 116fe8b9f51eec0dd0aed870ab3526a31ebe88a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 15:33:24 -0800 +Subject: Input: ads7846 - fix integer overflow on Rt calculation + +From: Oleksij Rempel + +[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ] + +In some rare cases the 32 bit Rt value will overflow if z2 and x is max, +z1 is minimal value and x_plate_ohms is relatively high (for example 800 +ohm). This would happen on some screen age with low pressure. + +There are two possible fixes: +- make Rt 64bit +- reorder calculation to avoid overflow + +The second variant seems to be preferable, since 64 bit calculation on +32 bit system is a bit more expensive. + +Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver") +Co-developed-by: David Jander +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/ads7846.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 0fbad337e45a3..7ce0eedaa0e5e 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -801,10 +801,11 @@ static void ads7846_report_state(struct ads7846 *ts) + /* compute touch pressure resistance using equation #2 */ + Rt = z2; + Rt -= z1; +- Rt *= x; + Rt *= ts->x_plate_ohms; ++ Rt = DIV_ROUND_CLOSEST(Rt, 16); ++ Rt *= x; + Rt /= z1; +- Rt = (Rt + 2047) >> 12; ++ Rt = DIV_ROUND_CLOSEST(Rt, 256); + } else { + Rt = 0; + } +-- +2.27.0 + diff --git a/queue-4.14/input-ads7846-fix-race-that-causes-missing-releases.patch b/queue-4.14/input-ads7846-fix-race-that-causes-missing-releases.patch new file mode 100644 index 00000000000..838aaa3fc32 --- /dev/null +++ b/queue-4.14/input-ads7846-fix-race-that-causes-missing-releases.patch @@ -0,0 +1,103 @@ +From fe3dff0e8f76e5caf7a509ebdcd425f77fae6882 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 11:00:59 -0800 +Subject: Input: ads7846 - fix race that causes missing releases + +From: David Jander + +[ Upstream commit e52cd628a03f72a547dbf90ccb703ee64800504a ] + +If touchscreen is released while busy reading HWMON device, the release +can be missed. The IRQ thread is not started because no touch is active +and BTN_TOUCH release event is never sent. + +Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/ads7846.c | 44 +++++++++++++++++------------ + 1 file changed, 26 insertions(+), 18 deletions(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index a2f45aefce08a..0fbad337e45a3 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -199,6 +199,26 @@ struct ads7846 { + #define REF_ON (READ_12BIT_DFR(x, 1, 1)) + #define REF_OFF (READ_12BIT_DFR(y, 0, 0)) + ++static int get_pendown_state(struct ads7846 *ts) ++{ ++ if (ts->get_pendown_state) ++ return ts->get_pendown_state(); ++ ++ return !gpio_get_value(ts->gpio_pendown); ++} ++ ++static void ads7846_report_pen_up(struct ads7846 *ts) ++{ ++ struct input_dev *input = ts->input; ++ ++ input_report_key(input, BTN_TOUCH, 0); ++ input_report_abs(input, ABS_PRESSURE, 0); ++ input_sync(input); ++ ++ ts->pendown = false; ++ dev_vdbg(&ts->spi->dev, "UP\n"); ++} ++ + /* Must be called with ts->lock held */ + static void ads7846_stop(struct ads7846 *ts) + { +@@ -215,6 +235,10 @@ static void ads7846_stop(struct ads7846 *ts) + static void ads7846_restart(struct ads7846 *ts) + { + if (!ts->disabled && !ts->suspended) { ++ /* Check if pen was released since last stop */ ++ if (ts->pendown && !get_pendown_state(ts)) ++ ads7846_report_pen_up(ts); ++ + /* Tell IRQ thread that it may poll the device. */ + ts->stopped = false; + mb(); +@@ -605,14 +629,6 @@ static const struct attribute_group ads784x_attr_group = { + + /*--------------------------------------------------------------------------*/ + +-static int get_pendown_state(struct ads7846 *ts) +-{ +- if (ts->get_pendown_state) +- return ts->get_pendown_state(); +- +- return !gpio_get_value(ts->gpio_pendown); +-} +- + static void null_wait_for_sync(void) + { + } +@@ -871,16 +887,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle) + msecs_to_jiffies(TS_POLL_PERIOD)); + } + +- if (ts->pendown && !ts->stopped) { +- struct input_dev *input = ts->input; +- +- input_report_key(input, BTN_TOUCH, 0); +- input_report_abs(input, ABS_PRESSURE, 0); +- input_sync(input); +- +- ts->pendown = false; +- dev_vdbg(&ts->spi->dev, "UP\n"); +- } ++ if (ts->pendown && !ts->stopped) ++ ads7846_report_pen_up(ts); + + return IRQ_HANDLED; + } +-- +2.27.0 + diff --git a/queue-4.14/input-ads7846-fix-unaligned-access-on-7845.patch b/queue-4.14/input-ads7846-fix-unaligned-access-on-7845.patch new file mode 100644 index 00000000000..e030bd40b8c --- /dev/null +++ b/queue-4.14/input-ads7846-fix-unaligned-access-on-7845.patch @@ -0,0 +1,43 @@ +From 24f86c10cfc9d827f881710f57130d7c52d05a0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 17:17:11 -0800 +Subject: Input: ads7846 - fix unaligned access on 7845 + +From: Dmitry Torokhov + +[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ] + +req->sample[1] is not naturally aligned at word boundary, and therefore we +should use get_unaligned_be16() when accessing it. + +Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support") +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/ads7846.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 7ce0eedaa0e5e..b536768234b7c 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + /* + * This code has been heavily tested on a Nokia 770, and lightly +@@ -434,7 +435,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command) + + if (status == 0) { + /* BE12 value, then padding */ +- status = be16_to_cpu(*((u16 *)&req->sample[1])); ++ status = get_unaligned_be16(&req->sample[1]); + status = status >> 3; + status &= 0x0fff; + } +-- +2.27.0 + diff --git a/queue-4.14/input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch b/queue-4.14/input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch new file mode 100644 index 00000000000..e5f1abc0577 --- /dev/null +++ b/queue-4.14/input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch @@ -0,0 +1,37 @@ +From 50ea2c3bc1f340cbfe932457c419707fd0bd868f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 17:59:53 -0800 +Subject: Input: cros_ec_keyb - send 'scancodes' in addition to key events + +From: Dmitry Torokhov + +[ Upstream commit 80db2a087f425b63f0163bc95217abd01c637cb5 ] + +To let userspace know what 'scancodes' should be used in EVIOCGKEYCODE +and EVIOCSKEYCODE ioctls, we should send EV_MSC/MSC_SCAN events in +addition to EV_KEY/KEY_* events. The driver already declared MSC_SCAN +capability, so it is only matter of actually sending the events. + +Link: https://lore.kernel.org/r/X87aOaSptPTvZ3nZ@google.com +Acked-by: Rajat Jain +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/cros_ec_keyb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c +index 0993b3f12df6a..149f4045f0f15 100644 +--- a/drivers/input/keyboard/cros_ec_keyb.c ++++ b/drivers/input/keyboard/cros_ec_keyb.c +@@ -196,6 +196,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev, + "changed: [r%d c%d]: byte %02x\n", + row, col, new_state); + ++ input_event(idev, EV_MSC, MSC_SCAN, pos); + input_report_key(idev, keycodes[pos], + new_state); + } +-- +2.27.0 + diff --git a/queue-4.14/input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch b/queue-4.14/input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch new file mode 100644 index 00000000000..1594e19a01c --- /dev/null +++ b/queue-4.14/input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch @@ -0,0 +1,47 @@ +From 59d9df4cd85c6ec97b1b90bbbd0e8004bc23a8f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Dec 2020 16:17:32 -0800 +Subject: Input: goodix - add upside-down quirk for Teclast X98 Pro tablet + +From: Simon Beginn + +[ Upstream commit cffdd6d90482316e18d686060a4397902ea04bd2 ] + +The touchscreen on the Teclast x98 Pro is also mounted upside-down in +relation to the display orientation. + +Signed-off-by: Simon Beginn +Signed-off-by: Bastien Nocera +Link: https://lore.kernel.org/r/20201117004253.27A5A27EFD@localhost +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/goodix.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index 777dd5b159d39..87f5722a67829 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -101,6 +101,18 @@ static const struct dmi_system_id rotated_screen[] = { + DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), + }, + }, ++ { ++ .ident = "Teclast X98 Pro", ++ .matches = { ++ /* ++ * Only match BIOS date, because the manufacturers ++ * BIOS does not report the board name at all ++ * (sometimes)... ++ */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"), ++ }, ++ }, + { + .ident = "WinBook TW100", + .matches = { +-- +2.27.0 + diff --git a/queue-4.14/input-omap4-keypad-fix-runtime-pm-error-handling.patch b/queue-4.14/input-omap4-keypad-fix-runtime-pm-error-handling.patch new file mode 100644 index 00000000000..77bd5ac4d20 --- /dev/null +++ b/queue-4.14/input-omap4-keypad-fix-runtime-pm-error-handling.patch @@ -0,0 +1,202 @@ +From 5399df3f1f98ef6b8c61745775c73a13c8bdb840 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 16:36:49 -0800 +Subject: Input: omap4-keypad - fix runtime PM error handling + +From: Zhang Qilong + +[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ] + +In omap4_keypad_probe, the patch fix several bugs. + + 1) pm_runtime_get_sync will increment pm usage counter even it + failed. Forgetting to pm_runtime_put_noidle will result in + reference leak. + + 2) In err_unmap, forget to disable runtime of device, + pm_runtime_enable will increase power disable depth. Thus a + pairing decrement is needed on the error handling path to keep + it balanced. + + 3) In err_pm_disable, it will call pm_runtime_put_sync twice not + one time. + +To fix this we factor out code reading revision and disabling touchpad, and +drop PM reference once we are done talking to the device. + +Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets") +Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201120133918.2559681-1-zhangqilong3@huawei.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++----------- + 1 file changed, 53 insertions(+), 36 deletions(-) + +diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c +index 5480f1a5658ee..a42a75a53a113 100644 +--- a/drivers/input/keyboard/omap4-keypad.c ++++ b/drivers/input/keyboard/omap4-keypad.c +@@ -199,12 +199,8 @@ static int omap4_keypad_open(struct input_dev *input) + return 0; + } + +-static void omap4_keypad_close(struct input_dev *input) ++static void omap4_keypad_stop(struct omap4_keypad *keypad_data) + { +- struct omap4_keypad *keypad_data = input_get_drvdata(input); +- +- disable_irq(keypad_data->irq); +- + /* Disable interrupts and wake-up events */ + kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE, + OMAP4_VAL_IRQDISABLE); +@@ -213,7 +209,15 @@ static void omap4_keypad_close(struct input_dev *input) + /* clear pending interrupts */ + kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, + kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)); ++} ++ ++static void omap4_keypad_close(struct input_dev *input) ++{ ++ struct omap4_keypad *keypad_data; + ++ keypad_data = input_get_drvdata(input); ++ disable_irq(keypad_data->irq); ++ omap4_keypad_stop(keypad_data); + enable_irq(keypad_data->irq); + + pm_runtime_put_sync(input->dev.parent); +@@ -236,13 +240,37 @@ static int omap4_keypad_parse_dt(struct device *dev, + return 0; + } + ++static int omap4_keypad_check_revision(struct device *dev, ++ struct omap4_keypad *keypad_data) ++{ ++ unsigned int rev; ++ ++ rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION); ++ rev &= 0x03 << 30; ++ rev >>= 30; ++ switch (rev) { ++ case KBD_REVISION_OMAP4: ++ keypad_data->reg_offset = 0x00; ++ keypad_data->irqreg_offset = 0x00; ++ break; ++ case KBD_REVISION_OMAP5: ++ keypad_data->reg_offset = 0x10; ++ keypad_data->irqreg_offset = 0x0c; ++ break; ++ default: ++ dev_err(dev, "Keypad reports unsupported revision %d", rev); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static int omap4_keypad_probe(struct platform_device *pdev) + { + struct omap4_keypad *keypad_data; + struct input_dev *input_dev; + struct resource *res; + unsigned int max_keys; +- int rev; + int irq; + int error; + +@@ -282,41 +310,33 @@ static int omap4_keypad_probe(struct platform_device *pdev) + goto err_release_mem; + } + ++ pm_runtime_enable(&pdev->dev); + + /* + * Enable clocks for the keypad module so that we can read + * revision register. + */ +- pm_runtime_enable(&pdev->dev); + error = pm_runtime_get_sync(&pdev->dev); + if (error) { + dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n"); +- goto err_unmap; +- } +- rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION); +- rev &= 0x03 << 30; +- rev >>= 30; +- switch (rev) { +- case KBD_REVISION_OMAP4: +- keypad_data->reg_offset = 0x00; +- keypad_data->irqreg_offset = 0x00; +- break; +- case KBD_REVISION_OMAP5: +- keypad_data->reg_offset = 0x10; +- keypad_data->irqreg_offset = 0x0c; +- break; +- default: +- dev_err(&pdev->dev, +- "Keypad reports unsupported revision %d", rev); +- error = -EINVAL; +- goto err_pm_put_sync; ++ pm_runtime_put_noidle(&pdev->dev); ++ } else { ++ error = omap4_keypad_check_revision(&pdev->dev, ++ keypad_data); ++ if (!error) { ++ /* Ensure device does not raise interrupts */ ++ omap4_keypad_stop(keypad_data); ++ } ++ pm_runtime_put_sync(&pdev->dev); + } ++ if (error) ++ goto err_pm_disable; + + /* input device allocation */ + keypad_data->input = input_dev = input_allocate_device(); + if (!input_dev) { + error = -ENOMEM; +- goto err_pm_put_sync; ++ goto err_pm_disable; + } + + input_dev->name = pdev->name; +@@ -361,28 +381,25 @@ static int omap4_keypad_probe(struct platform_device *pdev) + goto err_free_keymap; + } + +- device_init_wakeup(&pdev->dev, true); +- pm_runtime_put_sync(&pdev->dev); +- + error = input_register_device(keypad_data->input); + if (error < 0) { + dev_err(&pdev->dev, "failed to register input device\n"); +- goto err_pm_disable; ++ goto err_free_irq; + } + ++ device_init_wakeup(&pdev->dev, true); + platform_set_drvdata(pdev, keypad_data); ++ + return 0; + +-err_pm_disable: +- pm_runtime_disable(&pdev->dev); ++err_free_irq: + free_irq(keypad_data->irq, keypad_data); + err_free_keymap: + kfree(keypad_data->keymap); + err_free_input: + input_free_device(input_dev); +-err_pm_put_sync: +- pm_runtime_put_sync(&pdev->dev); +-err_unmap: ++err_pm_disable: ++ pm_runtime_disable(&pdev->dev); + iounmap(keypad_data->base); + err_release_mem: + release_mem_region(res->start, resource_size(res)); +-- +2.27.0 + diff --git a/queue-4.14/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch b/queue-4.14/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch new file mode 100644 index 00000000000..3cb0000dfdf --- /dev/null +++ b/queue-4.14/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch @@ -0,0 +1,43 @@ +From f7534915e628d75e5e6b7dd90d160215e6d306aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Nov 2020 13:55:25 +0000 +Subject: irqchip/alpine-msi: Fix freeing of interrupts on allocation error + path + +From: Marc Zyngier + +[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ] + +The alpine-msi driver has an interesting allocation error handling, +where it frees the same interrupts repeatedly. Hilarity follows. + +This code is probably never executed, but let's fix it nonetheless. + +Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller") +Signed-off-by: Marc Zyngier +Reviewed-by: Antoine Tenart +Cc: Tsahee Zidenberg +Cc: Antoine Tenart +Link: https://lore.kernel.org/r/20201129135525.396671-1-maz@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-alpine-msi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c +index 63d980995d17d..ac431697ebe1c 100644 +--- a/drivers/irqchip/irq-alpine-msi.c ++++ b/drivers/irqchip/irq-alpine-msi.c +@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain, + return 0; + + err_sgi: +- while (--i >= 0) +- irq_domain_free_irqs_parent(domain, virq, i); ++ irq_domain_free_irqs_parent(domain, virq, i - 1); + alpine_msix_free_sgi(priv, sgi, nr_irqs); + return err; + } +-- +2.27.0 + diff --git a/queue-4.14/lockd-don-t-use-interval-based-rebinding-over-tcp.patch b/queue-4.14/lockd-don-t-use-interval-based-rebinding-over-tcp.patch new file mode 100644 index 00000000000..a779d0fe9da --- /dev/null +++ b/queue-4.14/lockd-don-t-use-interval-based-rebinding-over-tcp.patch @@ -0,0 +1,99 @@ +From f742b4c0de91b0d8e32edebc23becf61f217c788 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 20:16:27 +0000 +Subject: lockd: don't use interval-based rebinding over TCP + +From: Calum Mackay + +[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ] + +NLM uses an interval-based rebinding, i.e. it clears the transport's +binding under certain conditions if more than 60 seconds have elapsed +since the connection was last bound. + +This rebinding is not necessary for an autobind RPC client over a +connection-oriented protocol like TCP. + +It can also cause problems: it is possible for nlm_bind_host() to clear +XPRT_BOUND whilst a connection worker is in the middle of trying to +reconnect, after it had already been checked in xprt_connect(). + +When the connection worker notices that XPRT_BOUND has been cleared +under it, in xs_tcp_finish_connecting(), that results in: + + xs_tcp_setup_socket: connect returned unhandled error -107 + +Worse, it's possible that the two can get into lockstep, resulting in +the same behaviour repeated indefinitely, with the above error every +300 seconds, without ever recovering, and the connection never being +established. This has been seen in practice, with a large number of NLM +client tasks, following a server restart. + +The existing callers of nlm_bind_host & nlm_rebind_host should not need +to force the rebind, for TCP, so restrict the interval-based rebinding +to UDP only. + +For TCP, we will still rebind when needed, e.g. on timeout, and connection +error (including closure), since connection-related errors on an existing +connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(), +already unconditionally clear XPRT_BOUND. + +To avoid having to add the fix, and explanation, to both nlm_bind_host() +and nlm_rebind_host(), remove the duplicate code from the former, and +have it call the latter. + +Drop the dprintk, which adds no value over a trace. + +Signed-off-by: Calum Mackay +Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/lockd/host.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/fs/lockd/host.c b/fs/lockd/host.c +index c4504ed9f6807..9c39e13a28df2 100644 +--- a/fs/lockd/host.c ++++ b/fs/lockd/host.c +@@ -431,12 +431,7 @@ nlm_bind_host(struct nlm_host *host) + * RPC rebind is required + */ + if ((clnt = host->h_rpcclnt) != NULL) { +- if (time_after_eq(jiffies, host->h_nextrebind)) { +- rpc_force_rebind(clnt); +- host->h_nextrebind = jiffies + NLM_HOST_REBIND; +- dprintk("lockd: next rebind in %lu jiffies\n", +- host->h_nextrebind - jiffies); +- } ++ nlm_rebind_host(host); + } else { + unsigned long increment = nlmsvc_timeout; + struct rpc_timeout timeparms = { +@@ -484,13 +479,20 @@ nlm_bind_host(struct nlm_host *host) + return clnt; + } + +-/* +- * Force a portmap lookup of the remote lockd port ++/** ++ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port ++ * @host: NLM host handle for peer ++ * ++ * This is not needed when using a connection-oriented protocol, such as TCP. ++ * The existing autobind mechanism is sufficient to force a rebind when ++ * required, e.g. on connection state transitions. + */ + void + nlm_rebind_host(struct nlm_host *host) + { +- dprintk("lockd: rebind host %s\n", host->h_name); ++ if (host->h_proto != IPPROTO_UDP) ++ return; ++ + if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) { + rpc_force_rebind(host->h_rpcclnt); + host->h_nextrebind = jiffies + NLM_HOST_REBIND; +-- +2.27.0 + diff --git a/queue-4.14/media-max2175-fix-max2175_set_csm_mode-error-code.patch b/queue-4.14/media-max2175-fix-max2175_set_csm_mode-error-code.patch new file mode 100644 index 00000000000..f4f3a676def --- /dev/null +++ b/queue-4.14/media-max2175-fix-max2175_set_csm_mode-error-code.patch @@ -0,0 +1,36 @@ +From 68f26cfcdf9a1c75e58401f0aa23adffe9032988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Mar 2020 15:23:12 +0100 +Subject: media: max2175: fix max2175_set_csm_mode() error code + +From: Dan Carpenter + +[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ] + +This is supposed to return negative error codes but the type is bool so +it returns true instead. + +Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support") +Signed-off-by: Dan Carpenter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/max2175.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c +index bf0e821a2b933..5cd09501ca7df 100644 +--- a/drivers/media/i2c/max2175.c ++++ b/drivers/media/i2c/max2175.c +@@ -511,7 +511,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx) + } + } + +-static bool max2175_set_csm_mode(struct max2175 *ctx, ++static int max2175_set_csm_mode(struct max2175 *ctx, + enum max2175_csm_mode new_mode) + { + int ret = max2175_poll_csm_ready(ctx); +-- +2.27.0 + diff --git a/queue-4.14/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch b/queue-4.14/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch new file mode 100644 index 00000000000..6647f7897c0 --- /dev/null +++ b/queue-4.14/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch @@ -0,0 +1,44 @@ +From b803c82fd59e0fa681bc01deb36285a7ad92a765 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 14:38:02 +0200 +Subject: media: mtk-vcodec: add missing put_device() call in + mtk_vcodec_release_dec_pm() + +From: Yu Kuai + +[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ] + +mtk_vcodec_release_dec_pm() will be called in two places: + +a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error. +b. mtk_vcodec_dec_remove(). + +In both cases put_device() call is needed, since of_find_device_by_node() +was called in mtk_vcodec_init_dec_pm() previously. + +Thus add put_devices() call in mtk_vcodec_release_dec_pm() + +Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver") +Signed-off-by: Yu Kuai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c +index 79ca03ac449c3..3f64119e8c082 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c +@@ -103,6 +103,7 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev) + void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev) + { + pm_runtime_disable(dev->pm.dev); ++ put_device(dev->pm.larbvdec); + } + + void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm) +-- +2.27.0 + diff --git a/queue-4.14/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch b/queue-4.14/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch new file mode 100644 index 00000000000..042bc37a6d2 --- /dev/null +++ b/queue-4.14/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch @@ -0,0 +1,56 @@ +From be3df42f07134580ca9331f5f4e2832a4a6ef9f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 08:23:40 +0100 +Subject: media: saa7146: fix array overflow in vidioc_s_audio() + +From: Dan Carpenter + +[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ] + +The "a->index" value comes from the user via the ioctl. The problem is +that the shift can wrap resulting in setting "mxb->cur_audinput" to an +invalid value, which later results in an array overflow. + +Fixes: 6680427791c9 ("[media] mxb: fix audio handling") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7146/mxb.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c +index 930218cc2de19..2e7bd82282caa 100644 +--- a/drivers/media/pci/saa7146/mxb.c ++++ b/drivers/media/pci/saa7146/mxb.c +@@ -652,16 +652,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio * + struct mxb *mxb = (struct mxb *)dev->ext_priv; + + DEB_D("VIDIOC_S_AUDIO %d\n", a->index); +- if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) { +- if (mxb->cur_audinput != a->index) { +- mxb->cur_audinput = a->index; +- tea6420_route(mxb, a->index); +- if (mxb->cur_audinput == 0) +- mxb_update_audmode(mxb); +- } +- return 0; ++ if (a->index >= 32 || ++ !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index))) ++ return -EINVAL; ++ ++ if (mxb->cur_audinput != a->index) { ++ mxb->cur_audinput = a->index; ++ tea6420_route(mxb, a->index); ++ if (mxb->cur_audinput == 0) ++ mxb_update_audmode(mxb); + } +- return -EINVAL; ++ return 0; + } + + #ifdef CONFIG_VIDEO_ADV_DEBUG +-- +2.27.0 + diff --git a/queue-4.14/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch b/queue-4.14/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch new file mode 100644 index 00000000000..8a87f6d0cda --- /dev/null +++ b/queue-4.14/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch @@ -0,0 +1,47 @@ +From 4c380fd52b02cad59a3ea6901eb26bec75da5b2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 14:56:57 +0200 +Subject: media: siano: fix memory leak of debugfs members in smsdvb_hotplug + +From: Keita Suzuki + +[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ] + +When dvb_create_media_graph fails, the debugfs kept inside client should +be released. However, the current implementation does not release them. + +Fix this by adding a new goto label to call smsdvb_debugfs_release. + +Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()") +Signed-off-by: Keita Suzuki +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/common/siano/smsdvb-main.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c +index affde1426b7a2..15e895c9f2e0b 100644 +--- a/drivers/media/common/siano/smsdvb-main.c ++++ b/drivers/media/common/siano/smsdvb-main.c +@@ -1180,12 +1180,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev, + rc = dvb_create_media_graph(&client->adapter, true); + if (rc < 0) { + pr_err("dvb_create_media_graph failed %d\n", rc); +- goto client_error; ++ goto media_graph_error; + } + + pr_info("DVB interface registered.\n"); + return 0; + ++media_graph_error: ++ smsdvb_debugfs_release(client); ++ + client_error: + dvb_unregister_frontend(&client->frontend); + +-- +2.27.0 + diff --git a/queue-4.14/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch b/queue-4.14/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch new file mode 100644 index 00000000000..70d856fcb1b --- /dev/null +++ b/queue-4.14/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch @@ -0,0 +1,38 @@ +From c5887063d86ed431087228357ccc6ca6d48c4529 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 04:22:01 +0100 +Subject: media: solo6x10: fix missing snd_card_free in error handling case + +From: Qinglang Miao + +[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ] + +Fix to goto snd_error in error handling case when fails +to do snd_ctl_add, as done elsewhere in this function. + +Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c +index 81be1b8df7584..0cbb3ee96e1e8 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-g723.c ++++ b/drivers/media/pci/solo6x10/solo6x10-g723.c +@@ -401,7 +401,7 @@ int solo_g723_init(struct solo_dev *solo_dev) + + ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev)); + if (ret < 0) +- return ret; ++ goto snd_error; + + ret = solo_snd_pcm_init(solo_dev); + if (ret < 0) +-- +2.27.0 + diff --git a/queue-4.14/memstick-fix-a-double-free-bug-in-memstick_check.patch b/queue-4.14/memstick-fix-a-double-free-bug-in-memstick_check.patch new file mode 100644 index 00000000000..b73e966752b --- /dev/null +++ b/queue-4.14/memstick-fix-a-double-free-bug-in-memstick_check.patch @@ -0,0 +1,37 @@ +From 6d0fe9fb6602895d5cb3f8b2005c89a34d737021 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 15:48:46 +0800 +Subject: memstick: fix a double-free bug in memstick_check + +From: Qinglang Miao + +[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ] + +kfree(host->card) has been called in put_device so that +another kfree would raise cause a double-free bug. + +Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/core/memstick.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c +index b1564cacd19e1..20ae8652adf44 100644 +--- a/drivers/memstick/core/memstick.c ++++ b/drivers/memstick/core/memstick.c +@@ -469,7 +469,6 @@ static void memstick_check(struct work_struct *work) + host->card = card; + if (device_register(&card->dev)) { + put_device(&card->dev); +- kfree(host->card); + host->card = NULL; + } + } else +-- +2.27.0 + diff --git a/queue-4.14/memstick-r592-fix-error-return-in-r592_probe.patch b/queue-4.14/memstick-r592-fix-error-return-in-r592_probe.patch new file mode 100644 index 00000000000..eee0d1fca55 --- /dev/null +++ b/queue-4.14/memstick-r592-fix-error-return-in-r592_probe.patch @@ -0,0 +1,57 @@ +From 9b88d02ec7e618026bc569788f6f839f404945c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 09:47:18 +0800 +Subject: memstick: r592: Fix error return in r592_probe() + +From: Jing Xiangfeng + +[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ] + +Fix to return a error code from the error handling case instead of 0. + +Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader") +Signed-off-by: Jing Xiangfeng +Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/host/r592.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c +index d5cfb503b9d69..2539984c1db1c 100644 +--- a/drivers/memstick/host/r592.c ++++ b/drivers/memstick/host/r592.c +@@ -762,8 +762,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto error3; + + dev->mmio = pci_ioremap_bar(pdev, 0); +- if (!dev->mmio) ++ if (!dev->mmio) { ++ error = -ENOMEM; + goto error4; ++ } + + dev->irq = pdev->irq; + spin_lock_init(&dev->irq_lock); +@@ -790,12 +792,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id) + &dev->dummy_dma_page_physical_address, GFP_KERNEL); + r592_stop_dma(dev , 0); + +- if (request_irq(dev->irq, &r592_irq, IRQF_SHARED, +- DRV_NAME, dev)) ++ error = request_irq(dev->irq, &r592_irq, IRQF_SHARED, ++ DRV_NAME, dev); ++ if (error) + goto error6; + + r592_update_card_detect(dev); +- if (memstick_add_host(host)) ++ error = memstick_add_host(host); ++ if (error) + goto error7; + + message("driver successfully loaded"); +-- +2.27.0 + diff --git a/queue-4.14/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch b/queue-4.14/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch new file mode 100644 index 00000000000..c3d004bf5f3 --- /dev/null +++ b/queue-4.14/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch @@ -0,0 +1,48 @@ +From 477f5c4f013862f89b244622455ec4134bd0f397 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 00:34:01 +0300 +Subject: MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA + +From: Necip Fazil Yildiran + +[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ] + +When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results +in the following Kbuild warning: + +WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE + Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y + Selected by [y]: + - BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y] + +The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without +depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE +depends on BCMA_DRIVER_PCI. This can also fail building the kernel. + +Honor the kconfig dependency to remove unmet direct dependency warnings +and avoid any potential build failures. + +Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879 +Signed-off-by: Necip Fazil Yildiran +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bcm47xx/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig +index 29471038d817e..c6b99845fb377 100644 +--- a/arch/mips/bcm47xx/Kconfig ++++ b/arch/mips/bcm47xx/Kconfig +@@ -27,6 +27,7 @@ config BCM47XX_BCMA + select BCMA + select BCMA_HOST_SOC + select BCMA_DRIVER_MIPS ++ select BCMA_DRIVER_PCI if PCI + select BCMA_DRIVER_PCI_HOSTMODE if PCI + select BCMA_DRIVER_GPIO + default y +-- +2.27.0 + diff --git a/queue-4.14/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch b/queue-4.14/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch new file mode 100644 index 00000000000..fc6fa431104 --- /dev/null +++ b/queue-4.14/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch @@ -0,0 +1,41 @@ +From d03cb4693f300589b53eec317cc8aa71d7f84149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 15:48:47 +0800 +Subject: mips: cdmm: fix use-after-free in mips_cdmm_bus_discover + +From: Qinglang Miao + +[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ] + +kfree(dev) has been called inside put_device so anther +kfree would cause a use-after-free bug/ + +Fixes: 8286ae03308c ("MIPS: Add CDMM bus support") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Acked-by: Serge Semin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + drivers/bus/mips_cdmm.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c +index 1b14256376d24..7c1da45be166e 100644 +--- a/drivers/bus/mips_cdmm.c ++++ b/drivers/bus/mips_cdmm.c +@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus) + dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id); + ++id; + ret = device_register(&dev->dev); +- if (ret) { ++ if (ret) + put_device(&dev->dev); +- kfree(dev); +- } + } + } + +-- +2.27.0 + diff --git a/queue-4.14/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch b/queue-4.14/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch new file mode 100644 index 00000000000..e1726c4092e --- /dev/null +++ b/queue-4.14/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch @@ -0,0 +1,78 @@ +From 96ba90058892ea98ce03da6074d798ef67baa03a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 23:21:09 +0900 +Subject: mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure + +From: Tsuchiya Yuto + +[ Upstream commit fa74cb1dc0f4da46c441b735ca865ac52de42c0e ] + +When a PCIe function level reset (FLR) is performed but without fw reset for +some reasons (e.g., on Microsoft Surface devices, fw reset requires other +quirks), it fails to reset wifi properly. You can trigger the issue on such +devices via debugfs entry for reset: + + $ echo 1 | sudo tee /sys/kernel/debug/mwifiex/mlan0/reset + +and the resulting dmesg log: + + [ 45.740508] mwifiex_pcie 0000:03:00.0: Resetting per request + [ 45.742937] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 3 + [ 45.744666] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex... + [ 45.751530] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.751539] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771691] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771695] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771697] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771698] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771699] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771701] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771702] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771703] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771704] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771705] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771707] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771708] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 53.099343] mwifiex_pcie 0000:03:00.0: info: trying to associate to '[SSID]' bssid [BSSID] + [ 53.241870] mwifiex_pcie 0000:03:00.0: info: associated to bssid [BSSID] successfully + [ 75.377942] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110 + [ 85.385491] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 15 + [ 87.539408] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110 + [ 87.539412] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 99.699917] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110 + [ 99.699925] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 111.859802] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110 + [ 111.859808] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [...] + +When comparing mwifiex_shutdown_sw() with mwifiex_pcie_remove(), it +lacks mwifiex_init_shutdown_fw(). + +This commit fixes mwifiex_shutdown_sw() by adding the missing +mwifiex_init_shutdown_fw(). + +Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support") +Signed-off-by: Tsuchiya Yuto +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201028142110.18144-2-kitakar@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c +index ee40b739b2897..cd668e5427d07 100644 +--- a/drivers/net/wireless/marvell/mwifiex/main.c ++++ b/drivers/net/wireless/marvell/mwifiex/main.c +@@ -1447,6 +1447,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter) + priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY); + mwifiex_deauthenticate(priv, NULL); + ++ mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN); ++ + mwifiex_uninit_sw(adapter); + + if (adapter->if_ops.down_dev) +-- +2.27.0 + diff --git a/queue-4.14/net-allwinner-fix-some-resources-leak-in-the-error-h.patch b/queue-4.14/net-allwinner-fix-some-resources-leak-in-the-error-h.patch new file mode 100644 index 00000000000..b70fc60fdf5 --- /dev/null +++ b/queue-4.14/net-allwinner-fix-some-resources-leak-in-the-error-h.patch @@ -0,0 +1,65 @@ +From 69a2263078d174b830ca0571697ec7a887401425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 21:21:17 +0100 +Subject: net: allwinner: Fix some resources leak in the error handling path of + the probe and in the remove function + +From: Christophe JAILLET + +[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ] + +'irq_of_parse_and_map()' should be balanced by a corresponding +'irq_dispose_mapping()' call. Otherwise, there is some resources leaks. + +Add such a call in the error handling path of the probe function and in the +remove function. + +Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201214202117.146293-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c +index c458b81ba63af..d249a4309da2f 100644 +--- a/drivers/net/ethernet/allwinner/sun4i-emac.c ++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c +@@ -847,13 +847,13 @@ static int emac_probe(struct platform_device *pdev) + db->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(db->clk)) { + ret = PTR_ERR(db->clk); +- goto out_iounmap; ++ goto out_dispose_mapping; + } + + ret = clk_prepare_enable(db->clk); + if (ret) { + dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret); +- goto out_iounmap; ++ goto out_dispose_mapping; + } + + ret = sunxi_sram_claim(&pdev->dev); +@@ -910,6 +910,8 @@ out_release_sram: + sunxi_sram_release(&pdev->dev); + out_clk_disable_unprepare: + clk_disable_unprepare(db->clk); ++out_dispose_mapping: ++ irq_dispose_mapping(ndev->irq); + out_iounmap: + iounmap(db->membase); + out: +@@ -928,6 +930,7 @@ static int emac_remove(struct platform_device *pdev) + unregister_netdev(ndev); + sunxi_sram_release(&pdev->dev); + clk_disable_unprepare(db->clk); ++ irq_dispose_mapping(ndev->irq); + iounmap(db->membase); + free_netdev(ndev); + +-- +2.27.0 + diff --git a/queue-4.14/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch b/queue-4.14/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch new file mode 100644 index 00000000000..3fbe1e7f875 --- /dev/null +++ b/queue-4.14/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch @@ -0,0 +1,42 @@ +From 1f491eeb9bb6bfdc26aa15f37f658d13216b58df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 19:20:05 +0100 +Subject: net: bcmgenet: Fix a resource leak in an error handling path in the + probe functin + +From: Christophe JAILLET + +[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ] + +If the 'register_netdev()' call fails, we must undo a previous +'bcmgenet_mii_init()' call. + +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Christophe JAILLET +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20201212182005.120437-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 8bfa2523e2533..5855ffec49528 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -3593,8 +3593,10 @@ static int bcmgenet_probe(struct platform_device *pdev) + clk_disable_unprepare(priv->clk); + + err = register_netdev(dev); +- if (err) ++ if (err) { ++ bcmgenet_mii_exit(dev); + goto err; ++ } + + return err; + +-- +2.27.0 + diff --git a/queue-4.14/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch b/queue-4.14/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch new file mode 100644 index 00000000000..bf989b9e11d --- /dev/null +++ b/queue-4.14/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch @@ -0,0 +1,38 @@ +From 4eaf4e9deb7a1b909df26b1af68119d685bfd6ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 20:35:14 +0100 +Subject: net: evaluate net.ipv4.conf.all.proxy_arp_pvlan + +From: Vincent Bernat + +[ Upstream commit 1af5318c00a8acc33a90537af49b3f23f72a2c4b ] + +Introduced in 65324144b50b, the "proxy_arp_vlan" sysctl is a +per-interface sysctl to tune proxy ARP support for private VLANs. +While the "all" variant is exposed, it was a noop and never evaluated. +We use the usual "or" logic for this kind of sysctls. + +Fixes: 65324144b50b ("net: RFC3069, private VLAN proxy arp support") +Signed-off-by: Vincent Bernat +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/inetdevice.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h +index ff876bf66cf25..52e1230cfe1b4 100644 +--- a/include/linux/inetdevice.h ++++ b/include/linux/inetdevice.h +@@ -102,7 +102,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev) + + #define IN_DEV_LOG_MARTIANS(in_dev) IN_DEV_ORCONF((in_dev), LOG_MARTIANS) + #define IN_DEV_PROXY_ARP(in_dev) IN_DEV_ORCONF((in_dev), PROXY_ARP) +-#define IN_DEV_PROXY_ARP_PVLAN(in_dev) IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN) ++#define IN_DEV_PROXY_ARP_PVLAN(in_dev) IN_DEV_ORCONF((in_dev), PROXY_ARP_PVLAN) + #define IN_DEV_SHARED_MEDIA(in_dev) IN_DEV_ORCONF((in_dev), SHARED_MEDIA) + #define IN_DEV_TX_REDIRECTS(in_dev) IN_DEV_ORCONF((in_dev), SEND_REDIRECTS) + #define IN_DEV_SEC_REDIRECTS(in_dev) IN_DEV_ORCONF((in_dev), \ +-- +2.27.0 + diff --git a/queue-4.14/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch b/queue-4.14/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch new file mode 100644 index 00000000000..5a647bfb0b1 --- /dev/null +++ b/queue-4.14/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch @@ -0,0 +1,111 @@ +From 537771d4fa2b6a7ef1d0bb6bd9adaeb256dacb0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 20:35:13 +0100 +Subject: net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown + +From: Vincent Bernat + +[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ] + +Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl +ignores a route whose interface is down. It is provided as a +per-interface sysctl. However, while a "all" variant is exposed, it +was a noop since it was never evaluated. We use the usual "or" logic +for this kind of sysctls. + +Tested with: + + ip link add type veth # veth0 + veth1 + ip link add type veth # veth1 + veth2 + ip link set up dev veth0 + ip link set up dev veth1 # link-status paired with veth0 + ip link set up dev veth2 + ip link set up dev veth3 # link-status paired with veth2 + + # First available path + ip -4 addr add 203.0.113.${uts#H}/24 dev veth0 + ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0 + + # Second available path + ip -4 addr add 192.0.2.${uts#H}/24 dev veth2 + ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2 + + # More specific route through first path + ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0 + ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0 + + # Less specific route through second path + ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2 + ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2 + + # H1: enable on "all" + # H2: enable on "veth0" + for v in ipv4 ipv6; do + case $uts in + H1) + sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1 + ;; + H2) + sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1 + ;; + esac + done + + set -xe + # When veth0 is up, best route is through veth0 + ip -o route get 198.51.100.1 | grep -Fw veth0 + ip -o route get 2001:db8:3::1 | grep -Fw veth0 + + # When veth0 is down, best route should be through veth2 on H1/H2, + # but on veth0 on H2 + ip link set down dev veth1 # down veth0 + ip route show + [ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0 + [ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0 + [ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2 + [ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2 + +Without this patch, the two last lines would fail on H1 (the one using +the "all" sysctl). With the patch, everything succeeds as expected. + +Also document the sysctl in `ip-sysctl.rst`. + +Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down") +Signed-off-by: Vincent Bernat +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/networking/ip-sysctl.txt | 3 +++ + include/linux/inetdevice.h | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt +index 5f1e3dc567f1d..fe0e46418f6db 100644 +--- a/Documentation/networking/ip-sysctl.txt ++++ b/Documentation/networking/ip-sysctl.txt +@@ -1271,6 +1271,9 @@ igmpv3_unsolicited_report_interval - INTEGER + IGMPv3 report retransmit will take place. + Default: 1000 (1 seconds) + ++ignore_routes_with_linkdown - BOOLEAN ++ Ignore routes whose link is down when performing a FIB lookup. ++ + promote_secondaries - BOOLEAN + When a primary IP address is removed from this interface + promote a corresponding secondary IP address instead of +diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h +index 5058f061cb2bd..ff876bf66cf25 100644 +--- a/include/linux/inetdevice.h ++++ b/include/linux/inetdevice.h +@@ -123,7 +123,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev) + IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS))) + + #define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \ +- IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN) ++ IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN) + + #define IN_DEV_ARPFILTER(in_dev) IN_DEV_ORCONF((in_dev), ARPFILTER) + #define IN_DEV_ARP_ACCEPT(in_dev) IN_DEV_ORCONF((in_dev), ARP_ACCEPT) +-- +2.27.0 + diff --git a/queue-4.14/net-korina-fix-return-value.patch b/queue-4.14/net-korina-fix-return-value.patch new file mode 100644 index 00000000000..c340b99f92d --- /dev/null +++ b/queue-4.14/net-korina-fix-return-value.patch @@ -0,0 +1,43 @@ +From 9bbb0c6e70875b1e69a63fdd9c8face647eb5eb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 23:09:52 +0100 +Subject: net: korina: fix return value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vincent Stehlé + +[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ] + +The ndo_start_xmit() method must not attempt to free the skb to transmit +when returning NETDEV_TX_BUSY. Therefore, make sure the +korina_send_packet() function returns NETDEV_TX_OK when it frees a packet. + +Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC") +Suggested-by: Jakub Kicinski +Signed-off-by: Vincent Stehlé +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20201214220952.19935-1-vincent.stehle@laposte.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/korina.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c +index 1eccdbaa9a515..ec1c14e3eace6 100644 +--- a/drivers/net/ethernet/korina.c ++++ b/drivers/net/ethernet/korina.c +@@ -216,7 +216,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev) + dev_kfree_skb_any(skb); + spin_unlock_irqrestore(&lp->lock, flags); + +- return NETDEV_TX_BUSY; ++ return NETDEV_TX_OK; + } + } + +-- +2.27.0 + diff --git a/queue-4.14/net-mlx5-properly-convey-driver-version-to-firmware.patch b/queue-4.14/net-mlx5-properly-convey-driver-version-to-firmware.patch new file mode 100644 index 00000000000..1cbf36b0889 --- /dev/null +++ b/queue-4.14/net-mlx5-properly-convey-driver-version-to-firmware.patch @@ -0,0 +1,47 @@ +From 5b9e845fb7b1dfeb24095d55c3a50edc9e3d7807 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 14:52:00 +0300 +Subject: net/mlx5: Properly convey driver version to firmware + +From: Leon Romanovsky + +[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ] + +mlx5 firmware expects driver version in specific format X.X.X, so +make it always correct and based on real kernel version aligned with +the driver. + +Fixes: 012e50e109fd ("net/mlx5: Set driver version into firmware") +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 1ac0e173da12c..049d9d19c66d9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -51,6 +51,7 @@ + #ifdef CONFIG_RFS_ACCEL + #include + #endif ++#include + #include + #include "mlx5_core.h" + #include "fs_core.h" +@@ -204,7 +205,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev) + strncat(string, ",", remaining_size); + + remaining_size = max_t(int, 0, driver_ver_sz - strlen(string)); +- strncat(string, DRIVER_VERSION, remaining_size); ++ ++ snprintf(string + strlen(string), remaining_size, "%u.%u.%u", ++ (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff), ++ (u16)(LINUX_VERSION_CODE & 0xffff)); + + /*Send the command*/ + MLX5_SET(set_driver_version_in, in, opcode, +-- +2.27.0 + diff --git a/queue-4.14/nfc-s3fwrn5-release-the-nfc-firmware.patch b/queue-4.14/nfc-s3fwrn5-release-the-nfc-firmware.patch new file mode 100644 index 00000000000..d80ff7cbf67 --- /dev/null +++ b/queue-4.14/nfc-s3fwrn5-release-the-nfc-firmware.patch @@ -0,0 +1,41 @@ +From 9be326077b3cdc683e5f0ca7fb40c0f02570dcdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Dec 2020 18:58:50 +0900 +Subject: nfc: s3fwrn5: Release the nfc firmware + +From: Bongsu Jeon + +[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ] + +add the code to release the nfc firmware when the firmware image size is +wrong. + +Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip") +Signed-off-by: Bongsu Jeon +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201213095850.28169-1-bongsu.jeon@samsung.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/s3fwrn5/firmware.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c +index 38548bd970cd2..43c801e725b6f 100644 +--- a/drivers/nfc/s3fwrn5/firmware.c ++++ b/drivers/nfc/s3fwrn5/firmware.c +@@ -304,8 +304,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info) + if (ret < 0) + return ret; + +- if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) ++ if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) { ++ release_firmware(fw->fw); + return -EINVAL; ++ } + + memcpy(fw->date, fw->fw->data + 0x00, 12); + fw->date[12] = '\0'; +-- +2.27.0 + diff --git a/queue-4.14/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch b/queue-4.14/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch new file mode 100644 index 00000000000..83f05d483a0 --- /dev/null +++ b/queue-4.14/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch @@ -0,0 +1,52 @@ +From f9450815858bd7656e4a0a4e2b23b8a510887209 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 11:24:33 +1100 +Subject: NFS: switch nfsiod to be an UNBOUND workqueue. + +From: NeilBrown + +[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ] + +nfsiod is currently a concurrency-managed workqueue (CMWQ). +This means that workitems scheduled to nfsiod on a given CPU are queued +behind all other work items queued on any CMWQ on the same CPU. This +can introduce unexpected latency. + +Occaionally nfsiod can even cause excessive latency. If the work item +to complete a CLOSE request calls the final iput() on an inode, the +address_space of that inode will be dismantled. This takes time +proportional to the number of in-memory pages, which on a large host +working on large files (e.g.. 5TB), can be a large number of pages +resulting in a noticable number of seconds. + +We can avoid these latency problems by switching nfsiod to WQ_UNBOUND. +This causes each concurrent work item to gets a dedicated thread which +can be scheduled to an idle CPU. + +There is precedent for this as several other filesystems use WQ_UNBOUND +workqueue for handling various async events. + +Signed-off-by: NeilBrown +Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 71a399f6805ac..f0534b356f071 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -2053,7 +2053,7 @@ static int nfsiod_start(void) + { + struct workqueue_struct *wq; + dprintk("RPC: creating workqueue nfsiod\n"); +- wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0); ++ wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0); + if (wq == NULL) + return -ENOMEM; + nfsiod_workqueue = wq; +-- +2.27.0 + diff --git a/queue-4.14/nfs_common-need-lock-during-iterate-through-the-list.patch b/queue-4.14/nfs_common-need-lock-during-iterate-through-the-list.patch new file mode 100644 index 00000000000..8c779dd1c8c --- /dev/null +++ b/queue-4.14/nfs_common-need-lock-during-iterate-through-the-list.patch @@ -0,0 +1,79 @@ +From 87c97a73c9ddc03a6d280230b5b248fecf975e7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 07:06:35 -0500 +Subject: nfs_common: need lock during iterate through the list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cheng Lin + +[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ] + +If the elem is deleted during be iterated on it, the iteration +process will fall into an endless loop. + +kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137] + +PID: 17137  TASK: ffff8818d93c0000  CPU: 4   COMMAND: "nfsd" +    [exception RIP: __state_in_grace+76] +    RIP: ffffffffc00e817c  RSP: ffff8818d3aefc98  RFLAGS: 00000246 +    RAX: ffff881dc0c38298  RBX: ffffffff81b03580  RCX: ffff881dc02c9f50 +    RDX: ffff881e3fce8500  RSI: 0000000000000001  RDI: ffffffff81b03580 +    RBP: ffff8818d3aefca0   R8: 0000000000000020   R9: ffff8818d3aefd40 +    R10: ffff88017fc03800  R11: ffff8818e83933c0  R12: ffff8818d3aefd40 +    R13: 0000000000000000  R14: ffff8818e8391068  R15: ffff8818fa6e4000 +    CS: 0010  SS: 0018 + #0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace] + #1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd] + #2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd] + #3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd] + #4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd] + #5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc] + #6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc] + #7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd] + #8 [ffff8818d3aefec8] kthread at ffffffff810b88c1 + #9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607 + +The troublemake elem: +crash> lock_manager ffff881dc0c38298 +struct lock_manager { +  list = { +    next = 0xffff881dc0c38298, +    prev = 0xffff881dc0c38298 +  }, +  block_opens = false +} + +Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens") +Signed-off-by: Cheng Lin  +Signed-off-by: Yi Wang  +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfs_common/grace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c +index 3b13fb3b05530..63c9c2a70937f 100644 +--- a/fs/nfs_common/grace.c ++++ b/fs/nfs_common/grace.c +@@ -75,10 +75,14 @@ __state_in_grace(struct net *net, bool open) + if (!open) + return !list_empty(grace_list); + ++ spin_lock(&grace_lock); + list_for_each_entry(lm, grace_list, list) { +- if (lm->block_opens) ++ if (lm->block_opens) { ++ spin_unlock(&grace_lock); + return true; ++ } + } ++ spin_unlock(&grace_lock); + return false; + } + +-- +2.27.0 + diff --git a/queue-4.14/nfsd-fix-message-level-for-normal-termination.patch b/queue-4.14/nfsd-fix-message-level-for-normal-termination.patch new file mode 100644 index 00000000000..7caaf541dff --- /dev/null +++ b/queue-4.14/nfsd-fix-message-level-for-normal-termination.patch @@ -0,0 +1,41 @@ +From beadbfad59379b7c89718eb26c7f2967d5f09a8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 15:26:59 +0900 +Subject: nfsd: Fix message level for normal termination + +From: kazuo ito + +[ Upstream commit 4420440c57892779f265108f46f83832a88ca795 ] + +The warning message from nfsd terminating normally +can confuse system adminstrators or monitoring software. + +Though it's not exactly fair to pin-point a commit where it +originated, the current form in the current place started +to appear in: + +Fixes: e096bbc6488d ("knfsd: remove special handling for SIGHUP") +Signed-off-by: kazuo ito +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfssvc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 4a9e0fb634b6c..67e85a752d3a4 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -410,8 +410,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net) + return; + + nfsd_shutdown_net(net); +- printk(KERN_WARNING "nfsd: last server has exited, flushing export " +- "cache\n"); ++ pr_info("nfsd: last server has exited, flushing export cache\n"); + nfsd_export_flush(net); + } + +-- +2.27.0 + diff --git a/queue-4.14/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch b/queue-4.14/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch new file mode 100644 index 00000000000..588b02d4c3d --- /dev/null +++ b/queue-4.14/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch @@ -0,0 +1,74 @@ +From 3feb36af82c4ca7ab773b407da6374c538aa7ae0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 16:03:38 -0500 +Subject: NFSv4.2: condition READDIR's mask for security label based on LSM + state + +From: Olga Kornievskaia + +[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ] + +Currently, the client will always ask for security_labels if the server +returns that it supports that feature regardless of any LSM modules +(such as Selinux) enforcing security policy. This adds performance +penalty to the READDIR operation. + +Client adjusts superblock's support of the security_label based on +the server's support but also current client's configuration of the +LSM modules. Thus, prior to using the default bitmask in READDIR, +this patch checks the server's capabilities and then instructs +READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask. + +v5: fixing silly mistakes of the rushed v4 +v4: simplifying logic +v3: changing label's initialization per Ondrej's comment +v2: dropping selinux hook and using the sb cap. + +Suggested-by: Ondrej Mosnacek +Suggested-by: Scott Mayhew +Signed-off-by: Olga Kornievskaia +Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index bb899a6fe8ac0..9f2ba4874f10f 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -4445,12 +4445,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred, + u64 cookie, struct page **pages, unsigned int count, bool plus) + { + struct inode *dir = d_inode(dentry); ++ struct nfs_server *server = NFS_SERVER(dir); + struct nfs4_readdir_arg args = { + .fh = NFS_FH(dir), + .pages = pages, + .pgbase = 0, + .count = count, +- .bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask, + .plus = plus, + }; + struct nfs4_readdir_res res; +@@ -4465,9 +4465,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred, + dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__, + dentry, + (unsigned long long)cookie); ++ if (!(server->caps & NFS_CAP_SECURITY_LABEL)) ++ args.bitmask = server->attr_bitmask_nl; ++ else ++ args.bitmask = server->attr_bitmask; ++ + nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args); + res.pgbase = args.pgbase; +- status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0); ++ status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, ++ &res.seq_res, 0); + if (status >= 0) { + memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE); + status += args.pgbase; +-- +2.27.0 + diff --git a/queue-4.14/orinoco-move-context-allocation-after-processing-the.patch b/queue-4.14/orinoco-move-context-allocation-after-processing-the.patch new file mode 100644 index 00000000000..8d56430f480 --- /dev/null +++ b/queue-4.14/orinoco-move-context-allocation-after-processing-the.patch @@ -0,0 +1,60 @@ +From 3cea5d33695100fdc0cae05472358485abea9e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 22:22:43 +0100 +Subject: orinoco: Move context allocation after processing the skb + +From: Sebastian Andrzej Siewior + +[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ] + +ezusb_xmit() allocates a context which is leaked if +orinoco_process_xmit_skb() returns an error. + +Move ezusb_alloc_ctx() after the invocation of +orinoco_process_xmit_skb() because the context is not needed so early. +ezusb_access_ltv() will cleanup the context in case of an error. + +Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + .../net/wireless/intersil/orinoco/orinoco_usb.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c +index 5a64674a5c8da..74a313e6d98f2 100644 +--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c ++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c +@@ -1237,13 +1237,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev) + if (skb->len < ETH_HLEN) + goto drop; + +- ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0); +- if (!ctx) +- goto busy; +- +- memset(ctx->buf, 0, BULK_BUF_SIZE); +- buf = ctx->buf->data; +- + tx_control = 0; + + err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control, +@@ -1251,6 +1244,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev) + if (err) + goto drop; + ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0); ++ if (!ctx) ++ goto drop; ++ ++ memset(ctx->buf, 0, BULK_BUF_SIZE); ++ buf = ctx->buf->data; ++ + { + __le16 *tx_cntl = (__le16 *)buf; + *tx_cntl = cpu_to_le16(tx_control); +-- +2.27.0 + diff --git a/queue-4.14/pci-iproc-fix-out-of-bound-array-accesses.patch b/queue-4.14/pci-iproc-fix-out-of-bound-array-accesses.patch new file mode 100644 index 00000000000..1b38ebc0666 --- /dev/null +++ b/queue-4.14/pci-iproc-fix-out-of-bound-array-accesses.patch @@ -0,0 +1,74 @@ +From 67d282bfd590ce46643e65ade4e6345f5449b636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 11:30:52 +0530 +Subject: PCI: iproc: Fix out-of-bound array accesses + +From: Bharat Gooty + +[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ] + +Declare the full size array for all revisions of PAX register sets +to avoid potentially out of bound access of the register array +when they are being initialized in iproc_pcie_rev_init(). + +Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com +Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population") +Signed-off-by: Bharat Gooty +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/host/pcie-iproc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c +index 8f8dac0155d63..2565abbe1a910 100644 +--- a/drivers/pci/host/pcie-iproc.c ++++ b/drivers/pci/host/pcie-iproc.c +@@ -306,7 +306,7 @@ enum iproc_pcie_reg { + }; + + /* iProc PCIe PAXB BCMA registers */ +-static const u16 iproc_pcie_reg_paxb_bcma[] = { ++static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -317,7 +317,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = { + }; + + /* iProc PCIe PAXB registers */ +-static const u16 iproc_pcie_reg_paxb[] = { ++static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -333,7 +333,7 @@ static const u16 iproc_pcie_reg_paxb[] = { + }; + + /* iProc PCIe PAXB v2 registers */ +-static const u16 iproc_pcie_reg_paxb_v2[] = { ++static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -361,7 +361,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = { + }; + + /* iProc PCIe PAXC v1 registers */ +-static const u16 iproc_pcie_reg_paxc[] = { ++static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x1f0, + [IPROC_PCIE_CFG_IND_DATA] = 0x1f4, +@@ -370,7 +370,7 @@ static const u16 iproc_pcie_reg_paxc[] = { + }; + + /* iProc PCIe PAXC v2 registers */ +-static const u16 iproc_pcie_reg_paxc_v2[] = { ++static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_MSI_GIC_MODE] = 0x050, + [IPROC_PCIE_MSI_BASE_ADDR] = 0x074, + [IPROC_PCIE_MSI_WINDOW_SIZE] = 0x078, +-- +2.27.0 + diff --git a/queue-4.14/perf-record-fix-memory-leak-when-using-user-regs-to-.patch b/queue-4.14/perf-record-fix-memory-leak-when-using-user-regs-to-.patch new file mode 100644 index 00000000000..e439d14a2aa --- /dev/null +++ b/queue-4.14/perf-record-fix-memory-leak-when-using-user-regs-to-.patch @@ -0,0 +1,45 @@ +From 4966e6db1f2c1fa6004989b3143342d42ded040b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2020 17:33:44 +0800 +Subject: =?UTF-8?q?perf=20record:=20Fix=20memory=20leak=20when=20using=20'?= + =?UTF-8?q?--user-regs=3D=3F'=20to=20list=20registers?= + +From: Zheng Zengkai + +[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ] + +When using 'perf record's option '-I' or '--user-regs=' along with +argument '?' to list available register names, memory of variable 'os' +allocated by strdup() needs to be released before __parse_regs() +returns, otherwise memory leak will occur. + +Fixes: bcc84ec65ad1 ("perf record: Add ability to name registers to record") +Signed-off-by: Zheng Zengkai +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Li Bin +Cc: Mark Rutland +Cc: Namhyung Kim +Link: https://lore.kernel.org/r/20200703093344.189450-1-zhengzengkai@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/parse-regs-options.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c +index e6599e290f467..e5ad120e7f69a 100644 +--- a/tools/perf/util/parse-regs-options.c ++++ b/tools/perf/util/parse-regs-options.c +@@ -41,7 +41,7 @@ parse_regs(const struct option *opt, const char *str, int unset) + } + fputc('\n', stderr); + /* just printing available regs */ +- return -1; ++ goto error; + } + for (r = sample_reg_masks; r->name; r++) { + if (!strcasecmp(s, r->name)) +-- +2.27.0 + diff --git a/queue-4.14/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch b/queue-4.14/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch new file mode 100644 index 00000000000..cfd5bac7761 --- /dev/null +++ b/queue-4.14/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch @@ -0,0 +1,64 @@ +From d8387970cc749683ef0503249a9cf26cd7e876f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 09:12:19 +0800 +Subject: pinctrl: falcon: add missing put_device() call in + pinctrl_falcon_probe() + +From: Yu Kuai + +[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ] + +if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have +a corresponding put_device(). Thus add put_device() to fix the exception +handling for this function implementation. + +Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c +index fb73dcbb5ef37..68dcf53aaac34 100644 +--- a/drivers/pinctrl/pinctrl-falcon.c ++++ b/drivers/pinctrl/pinctrl-falcon.c +@@ -438,24 +438,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev) + + /* load and remap the pad resources of the different banks */ + for_each_compatible_node(np, NULL, "lantiq,pad-falcon") { +- struct platform_device *ppdev = of_find_device_by_node(np); + const __be32 *bank = of_get_property(np, "lantiq,bank", NULL); + struct resource res; ++ struct platform_device *ppdev; + u32 avail; + int pins; + + if (!of_device_is_available(np)) + continue; + +- if (!ppdev) { +- dev_err(&pdev->dev, "failed to find pad pdev\n"); +- continue; +- } + if (!bank || *bank >= PORTS) + continue; + if (of_address_to_resource(np, 0, &res)) + continue; ++ ++ ppdev = of_find_device_by_node(np); ++ if (!ppdev) { ++ dev_err(&pdev->dev, "failed to find pad pdev\n"); ++ continue; ++ } ++ + falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL); ++ put_device(&ppdev->dev); + if (IS_ERR(falcon_info.clk[*bank])) { + dev_err(&ppdev->dev, "failed to get clock\n"); + return PTR_ERR(falcon_info.clk[*bank]); +-- +2.27.0 + diff --git a/queue-4.14/power-supply-bq24190_charger-fix-reference-leak.patch b/queue-4.14/power-supply-bq24190_charger-fix-reference-leak.patch new file mode 100644 index 00000000000..62a4ff12fc2 --- /dev/null +++ b/queue-4.14/power-supply-bq24190_charger-fix-reference-leak.patch @@ -0,0 +1,91 @@ +From b3b475a0a8ec705bfe5a69d141b2b24fec39be54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 22:33:21 +0800 +Subject: power: supply: bq24190_charger: fix reference leak + +From: Zhang Qilong + +[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to call pm_runtime_put_noidle will result +in reference leak in callers(bq24190_sysfs_show, +bq24190_charger_get_property, bq24190_charger_set_property, +bq24190_battery_get_property, bq24190_battery_set_property), +so we should fix it. + +Fixes: f385e6e2a1532 ("power: bq24190_charger: Use PM runtime autosuspend") +Signed-off-by: Zhang Qilong +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c +index 35ff406aca483..0906f6b562bc4 100644 +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -450,8 +450,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev, + return -EINVAL; + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v); + if (ret) +@@ -1086,8 +1088,10 @@ static int bq24190_charger_get_property(struct power_supply *psy, + dev_dbg(bdi->dev, "prop: %d\n", psp); + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + switch (psp) { + case POWER_SUPPLY_PROP_CHARGE_TYPE: +@@ -1158,8 +1162,10 @@ static int bq24190_charger_set_property(struct power_supply *psy, + dev_dbg(bdi->dev, "prop: %d\n", psp); + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + switch (psp) { + case POWER_SUPPLY_PROP_ONLINE: +@@ -1424,8 +1430,10 @@ static int bq24190_battery_get_property(struct power_supply *psy, + dev_dbg(bdi->dev, "prop: %d\n", psp); + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + switch (psp) { + case POWER_SUPPLY_PROP_STATUS: +@@ -1470,8 +1478,10 @@ static int bq24190_battery_set_property(struct power_supply *psy, + dev_dbg(bdi->dev, "prop: %d\n", psp); + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + switch (psp) { + case POWER_SUPPLY_PROP_ONLINE: +-- +2.27.0 + diff --git a/queue-4.14/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch b/queue-4.14/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch new file mode 100644 index 00000000000..0ea88856424 --- /dev/null +++ b/queue-4.14/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch @@ -0,0 +1,68 @@ +From 915e8f90776e998cf3ac49ebd4f803b8c7d65484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 18:07:12 +0000 +Subject: powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 + +From: Christophe Leroy + +[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ] + +On 8xx, we get the following features: + +[ 0.000000] cpu_features = 0x0000000000000100 +[ 0.000000] possible = 0x0000000000000120 +[ 0.000000] always = 0x0000000000000000 + +This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all +other configurations, the three lines should be equal. + +The problem is due to CPU_FTRS_GENERIC_32 which is taken when +CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is +pointless because there is no generic configuration supporting +all 32 bits but book3s/32. + +Remove this pointless generic features definition to unbreak the +calculation of 'possible' features and 'always' features. + +Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/cputable.h | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h +index e4451b30d7e32..89a5cdf46ad7f 100644 +--- a/arch/powerpc/include/asm/cputable.h ++++ b/arch/powerpc/include/asm/cputable.h +@@ -423,7 +423,6 @@ enum { + CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \ + CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \ + CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT) +-#define CPU_FTRS_GENERIC_32 (CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN) + + /* 64-bit CPUs */ + #define CPU_FTRS_POWER4 (CPU_FTR_USE_TB | CPU_FTR_LWSYNC | \ +@@ -515,8 +514,6 @@ enum { + CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX | + CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 | + CPU_FTRS_CLASSIC32 | +-#else +- CPU_FTRS_GENERIC_32 | + #endif + #ifdef CONFIG_PPC_8xx + CPU_FTRS_8XX | +@@ -567,8 +564,6 @@ enum { + CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX & + CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 & + CPU_FTRS_CLASSIC32 & +-#else +- CPU_FTRS_GENERIC_32 & + #endif + #ifdef CONFIG_PPC_8xx + CPU_FTRS_8XX & +-- +2.27.0 + diff --git a/queue-4.14/powerpc-ps3-use-dma_mapping_error.patch b/queue-4.14/powerpc-ps3-use-dma_mapping_error.patch new file mode 100644 index 00000000000..2d6a13fb8ad --- /dev/null +++ b/queue-4.14/powerpc-ps3-use-dma_mapping_error.patch @@ -0,0 +1,41 @@ +From 3f6405301df32eb3325edb015e3f45a9c3f0889a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Dec 2020 19:26:22 +0100 +Subject: powerpc/ps3: use dma_mapping_error() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vincent Stehlé + +[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ] + +The DMA address returned by dma_map_single() should be checked with +dma_mapping_error(). Fix the ps3stor_setup() function accordingly. + +Fixes: 80071802cb9c ("[POWERPC] PS3: Storage Driver Core") +Signed-off-by: Vincent Stehlé +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201213182622.23047-1-vincent.stehle@laposte.net +Signed-off-by: Sasha Levin +--- + drivers/ps3/ps3stor_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c +index 8c3f5adf1bc65..2d76183756626 100644 +--- a/drivers/ps3/ps3stor_lib.c ++++ b/drivers/ps3/ps3stor_lib.c +@@ -201,7 +201,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler) + dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf)); + dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf, + dev->bounce_size, DMA_BIDIRECTIONAL); +- if (!dev->bounce_dma) { ++ if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) { + dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n", + __func__, __LINE__); + error = -ENODEV; +-- +2.27.0 + diff --git a/queue-4.14/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch b/queue-4.14/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch new file mode 100644 index 00000000000..a8c0979163e --- /dev/null +++ b/queue-4.14/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch @@ -0,0 +1,73 @@ +From f27c21eda528bb4559764a1bfcbef490457f7a2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 15:51:49 -0600 +Subject: powerpc/pseries/hibernation: drop pseries_suspend_begin() from + suspend ops + +From: Nathan Lynch + +[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ] + +There are three ways pseries_suspend_begin() can be reached: + +1. When "mem" is written to /sys/power/state: + +kobj_attr_store() +-> state_store() + -> pm_suspend() + -> suspend_devices_and_enter() + -> pseries_suspend_begin() + +This never works because there is no way to supply a valid stream id +using this interface, and H_VASI_STATE is called with a stream id of +zero. So this call path is useless at best. + +2. When a stream id is written to /sys/devices/system/power/hibernate. +pseries_suspend_begin() is polled directly from store_hibernate() +until the stream is in the "Suspending" state (i.e. the platform is +ready for the OS to suspend execution): + +dev_attr_store() +-> store_hibernate() + -> pseries_suspend_begin() + +3. When a stream id is written to /sys/devices/system/power/hibernate +(continued). After #2, pseries_suspend_begin() is called once again +from the pm core: + +dev_attr_store() +-> store_hibernate() + -> pm_suspend() + -> suspend_devices_and_enter() + -> pseries_suspend_begin() + +This is redundant because the VASI suspend state is already known to +be Suspending. + +The begin() callback of platform_suspend_ops is optional, so we can +simply remove that assignment with no loss of function. + +Fixes: 32d8ad4e621d ("powerpc/pseries: Partition hibernation support") +Signed-off-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201207215200.1785968-18-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/suspend.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c +index 89726f07d2492..33077ad106cf0 100644 +--- a/arch/powerpc/platforms/pseries/suspend.c ++++ b/arch/powerpc/platforms/pseries/suspend.c +@@ -224,7 +224,6 @@ static struct bus_type suspend_subsys = { + + static const struct platform_suspend_ops pseries_suspend_ops = { + .valid = suspend_valid_only_mem, +- .begin = pseries_suspend_begin, + .prepare_late = pseries_prepare_late, + .enter = pseries_suspend_enter, + }; +-- +2.27.0 + diff --git a/queue-4.14/powerpc-pseries-hibernation-remove-redundant-cachein.patch b/queue-4.14/powerpc-pseries-hibernation-remove-redundant-cachein.patch new file mode 100644 index 00000000000..5a72da480ac --- /dev/null +++ b/queue-4.14/powerpc-pseries-hibernation-remove-redundant-cachein.patch @@ -0,0 +1,53 @@ +From e89365cdc62996c6a9eb03891773dcd52054d5f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 15:51:56 -0600 +Subject: powerpc/pseries/hibernation: remove redundant cacheinfo update + +From: Nathan Lynch + +[ Upstream commit b866459489fe8ef0e92cde3cbd6bbb1af6c4e99b ] + +Partitions with cache nodes in the device tree can encounter the +following warning on resume: + +CPU 0 already accounted in PowerPC,POWER9@0(Data) +WARNING: CPU: 0 PID: 3177 at arch/powerpc/kernel/cacheinfo.c:197 cacheinfo_cpu_online+0x640/0x820 + +These calls to cacheinfo_cpu_offline/online have been redundant since +commit e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo +hierarchy post-migration"). + +Fixes: e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration") +Signed-off-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201207215200.1785968-25-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/suspend.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c +index 33077ad106cf0..b7cdad95584da 100644 +--- a/arch/powerpc/platforms/pseries/suspend.c ++++ b/arch/powerpc/platforms/pseries/suspend.c +@@ -26,7 +26,6 @@ + #include + #include + #include +-#include "../../kernel/cacheinfo.h" + + static u64 stream_id; + static struct device suspend_dev; +@@ -91,9 +90,7 @@ static void pseries_suspend_enable_irqs(void) + * Update configuration which can be modified based on device tree + * changes during resume. + */ +- cacheinfo_cpu_offline(smp_processor_id()); + post_mobility_fixup(); +- cacheinfo_cpu_online(smp_processor_id()); + } + + /** +-- +2.27.0 + diff --git a/queue-4.14/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch b/queue-4.14/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch new file mode 100644 index 00000000000..1ae6eacc340 --- /dev/null +++ b/queue-4.14/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch @@ -0,0 +1,44 @@ +From 826794e10e3e3027b3f43dc75bfee4d15d7ebcfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 19:11:35 +0530 +Subject: pwm: lp3943: Dynamically allocate PWM chip base +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lokesh Vutla + +[ Upstream commit 1f0f1e80fdd3aa9631f6c22cda4f8550cfcfcc3e ] + +When there are other PWM controllers enabled along with pwm-lp3943, +pwm-lp3942 is failing to probe with -EEXIST error. This is because +other PWM controllers are probed first and assigned PWM base 0 and +pwm-lp3943 is requesting for 0 again. + +In order to avoid this, assign the chip base with -1, so that it is +dynamically allocated. + +Fixes: af66b3c0934e ("pwm: Add LP3943 PWM driver") +Signed-off-by: Lokesh Vutla +Reviewed-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-lp3943.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c +index 52584e9962edd..fc446d5c19f93 100644 +--- a/drivers/pwm/pwm-lp3943.c ++++ b/drivers/pwm/pwm-lp3943.c +@@ -278,6 +278,7 @@ static int lp3943_pwm_probe(struct platform_device *pdev) + lp3943_pwm->chip.dev = &pdev->dev; + lp3943_pwm->chip.ops = &lp3943_pwm_ops; + lp3943_pwm->chip.npwm = LP3943_NUM_PWMS; ++ lp3943_pwm->chip.base = -1; + + platform_set_drvdata(pdev, lp3943_pwm); + +-- +2.27.0 + diff --git a/queue-4.14/pwm-zx-add-missing-cleanup-in-error-path.patch b/queue-4.14/pwm-zx-add-missing-cleanup-in-error-path.patch new file mode 100644 index 00000000000..92aa9ea95a7 --- /dev/null +++ b/queue-4.14/pwm-zx-add-missing-cleanup-in-error-path.patch @@ -0,0 +1,39 @@ +From adf27616fbc794c610e129dc09a41242e338a811 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 10:13:21 +0200 +Subject: pwm: zx: Add missing cleanup in error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 269effd03f6142df4c74814cfdd5f0b041b30bf9 ] + +zx_pwm_probe() called clk_prepare_enable() before; this must be undone +in the error path. + +Fixes: 4836193c435c ("pwm: Add ZTE ZX PWM device driver") +Signed-off-by: Uwe Kleine-König +Acked-by: Shawn Guo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-zx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-zx.c b/drivers/pwm/pwm-zx.c +index 5d27c16edfb13..0d4112410b69d 100644 +--- a/drivers/pwm/pwm-zx.c ++++ b/drivers/pwm/pwm-zx.c +@@ -241,6 +241,7 @@ static int zx_pwm_probe(struct platform_device *pdev) + ret = pwmchip_add(&zpc->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add PWM chip: %d\n", ret); ++ clk_disable_unprepare(zpc->pclk); + return ret; + } + +-- +2.27.0 + diff --git a/queue-4.14/qlcnic-fix-error-code-in-probe.patch b/queue-4.14/qlcnic-fix-error-code-in-probe.patch new file mode 100644 index 00000000000..a8d6552b2f1 --- /dev/null +++ b/queue-4.14/qlcnic-fix-error-code-in-probe.patch @@ -0,0 +1,36 @@ +From 3e2c04d53537346bb8a2a5de95324b3954d27c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Dec 2020 11:38:04 +0300 +Subject: qlcnic: Fix error code in probe + +From: Dan Carpenter + +[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ] + +Return -EINVAL if we can't find the correct device. Currently it +returns success. + +Fixes: 13159183ec7a ("qlcnic: 83xx base driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X9nHbMqEyI/xPfGd@mwanda +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +index 1b5f7d57b6f8f..6684a4cb8b88b 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +@@ -2511,6 +2511,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + qlcnic_sriov_vf_register_map(ahw); + break; + default: ++ err = -EINVAL; + goto err_out_free_hw_res; + } + +-- +2.27.0 + diff --git a/queue-4.14/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch b/queue-4.14/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch new file mode 100644 index 00000000000..a7cb506efeb --- /dev/null +++ b/queue-4.14/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch @@ -0,0 +1,37 @@ +From 0716b1b9783ff2a8c9fc3ab994a71b62d1dde0bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 14:49:52 +0300 +Subject: RDMA/bnxt_re: Set queue pair state when being queried + +From: Kamal Heib + +[ Upstream commit 53839b51a7671eeb3fb44d479d541cf3a0f2dd45 ] + +The API for ib_query_qp requires the driver to set cur_qp_state on return, +add the missing set. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/20201021114952.38876-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Acked-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index ef9135aa392c1..ab218767bf05f 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1590,6 +1590,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, + goto out; + } + qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state); ++ qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state); + qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0; + qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access); + qp_attr->pkey_index = qplib_qp->pkey_index; +-- +2.27.0 + diff --git a/queue-4.14/rdma-cxgb4-validate-the-number-of-cqes.patch b/queue-4.14/rdma-cxgb4-validate-the-number-of-cqes.patch new file mode 100644 index 00000000000..4813a605cdf --- /dev/null +++ b/queue-4.14/rdma-cxgb4-validate-the-number-of-cqes.patch @@ -0,0 +1,38 @@ +From eabe95d9a3ed13daaeb8a63a79ec8f4d74ecbe89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 15:20:07 +0200 +Subject: RDMA/cxgb4: Validate the number of CQEs + +From: Kamal Heib + +[ Upstream commit 6d8285e604e0221b67bd5db736921b7ddce37d00 ] + +Before create CQ, make sure that the requested number of CQEs is in the +supported range. + +Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC") +Link: https://lore.kernel.org/r/20201108132007.67537-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cq.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c +index 6b15508ce17e7..433ed96b6cc54 100644 +--- a/drivers/infiniband/hw/cxgb4/cq.c ++++ b/drivers/infiniband/hw/cxgb4/cq.c +@@ -906,6 +906,9 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, + + rhp = to_c4iw_dev(ibdev); + ++ if (entries < 1 || entries > ibdev->attrs.max_cqe) ++ return -EINVAL; ++ + if (vector >= rhp->rdev.lldi.nciq) + return ERR_PTR(-EINVAL); + +-- +2.27.0 + diff --git a/queue-4.14/rdma-mthca-work-around-wenum-conversion-warning.patch b/queue-4.14/rdma-mthca-work-around-wenum-conversion-warning.patch new file mode 100644 index 00000000000..6403df28528 --- /dev/null +++ b/queue-4.14/rdma-mthca-work-around-wenum-conversion-warning.patch @@ -0,0 +1,61 @@ +From 9301bdcbc96bbc8a6bf2e73e466dfd51c63da5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 22:12:30 +0100 +Subject: RDMa/mthca: Work around -Wenum-conversion warning + +From: Arnd Bergmann + +[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ] + +gcc points out a suspicious mixing of enum types in a function that +converts from MTHCA_OPCODE_* values to IB_WC_* values: + +drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one': +drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum ' to 'enum ib_wc_opcode' [-Wenum-conversion] + 607 | entry->opcode = MTHCA_OPCODE_INVALID; + +Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if +this is meaningful, but it seems harmless as it deals with an invalid +input. + +Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is +still bogus, but at least doesn't make compiler warnings. + +Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions") +Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mthca/mthca_cq.c | 2 +- + drivers/infiniband/hw/mthca/mthca_dev.h | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c +index a5694dec3f2ee..098653b8157ed 100644 +--- a/drivers/infiniband/hw/mthca/mthca_cq.c ++++ b/drivers/infiniband/hw/mthca/mthca_cq.c +@@ -609,7 +609,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev, + entry->byte_len = MTHCA_ATOMIC_BYTE_LEN; + break; + default: +- entry->opcode = MTHCA_OPCODE_INVALID; ++ entry->opcode = 0xFF; + break; + } + } else { +diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h +index 5508afbf1c677..b487e1339c7fb 100644 +--- a/drivers/infiniband/hw/mthca/mthca_dev.h ++++ b/drivers/infiniband/hw/mthca/mthca_dev.h +@@ -105,7 +105,6 @@ enum { + MTHCA_OPCODE_ATOMIC_CS = 0x11, + MTHCA_OPCODE_ATOMIC_FA = 0x12, + MTHCA_OPCODE_BIND_MW = 0x18, +- MTHCA_OPCODE_INVALID = 0xff + }; + + enum { +-- +2.27.0 + diff --git a/queue-4.14/rdma-rxe-compute-psn-windows-correctly.patch b/queue-4.14/rdma-rxe-compute-psn-windows-correctly.patch new file mode 100644 index 00000000000..72adebd92b6 --- /dev/null +++ b/queue-4.14/rdma-rxe-compute-psn-windows-correctly.patch @@ -0,0 +1,43 @@ +From b7860406661efc99a8195de8917da9344e209836 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 12:07:42 -0500 +Subject: RDMA/rxe: Compute PSN windows correctly + +From: Bob Pearson + +[ Upstream commit bb3ab2979fd69db23328691cb10067861df89037 ] + +The code which limited the number of unacknowledged PSNs was incorrect. +The PSNs are limited to 24 bits and wrap back to zero from 0x00ffffff. +The test was computing a 32 bit value which wraps at 32 bits so that +qp->req.psn can appear smaller than the limit when it is actually larger. + +Replace '>' test with psn_compare which is used for other PSN comparisons +and correctly handles the 24 bit size. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20201013170741.3590-1-rpearson@hpe.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_req.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index e6785b1ea85fc..693884160f001 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -664,7 +664,8 @@ next_wqe: + } + + if (unlikely(qp_type(qp) == IB_QPT_RC && +- qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) { ++ psn_compare(qp->req.psn, (qp->comp.psn + ++ RXE_MAX_UNACKED_PSNS)) > 0)) { + qp->req.wait_psn = 1; + goto exit; + } +-- +2.27.0 + diff --git a/queue-4.14/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch b/queue-4.14/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch new file mode 100644 index 00000000000..3ffbed16b05 --- /dev/null +++ b/queue-4.14/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch @@ -0,0 +1,50 @@ +From f7b0321d6a80a239172ef6ec42d1d921fce1327a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 09:03:09 +0000 +Subject: samples: bpf: Fix lwt_len_hist reusing previous BPF map + +From: Daniel T. Lee + +[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ] + +Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the +map isn't cleared on test end. This leds to reuse of that map for +each test, which prevents the results of the test from being accurate. + +This commit fixes the problem by removing of pinned map from bpffs. +Also, this commit add the executable permission to shell script +files. + +Fixes: f74599f7c5309 ("bpf: Add tests and samples for LWT-BPF") +Signed-off-by: Daniel T. Lee +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20201124090310.24374-7-danieltimlee@gmail.com +Signed-off-by: Sasha Levin +--- + samples/bpf/lwt_len_hist.sh | 2 ++ + samples/bpf/test_lwt_bpf.sh | 0 + 2 files changed, 2 insertions(+) + mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh + mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh + +diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh +old mode 100644 +new mode 100755 +index 090b96eaf7f76..0eda9754f50b8 +--- a/samples/bpf/lwt_len_hist.sh ++++ b/samples/bpf/lwt_len_hist.sh +@@ -8,6 +8,8 @@ VETH1=tst_lwt1b + TRACE_ROOT=/sys/kernel/debug/tracing + + function cleanup { ++ # To reset saved histogram, remove pinned map ++ rm /sys/fs/bpf/tc/globals/lwt_len_hist_map + ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null + ip link del $VETH0 2> /dev/null + ip link del $VETH1 2> /dev/null +diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh +old mode 100644 +new mode 100755 +-- +2.27.0 + diff --git a/queue-4.14/sched-deadline-fix-sched_dl_global_validate.patch b/queue-4.14/sched-deadline-fix-sched_dl_global_validate.patch new file mode 100644 index 00000000000..5cd94767476 --- /dev/null +++ b/queue-4.14/sched-deadline-fix-sched_dl_global_validate.patch @@ -0,0 +1,143 @@ +From cebe63b4f6a750c6c8c8921602ae73fe343b265f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 23:49:42 +0800 +Subject: sched/deadline: Fix sched_dl_global_validate() + +From: Peng Liu + +[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ] + +When change sched_rt_{runtime, period}_us, we validate that the new +settings should at least accommodate the currently allocated -dl +bandwidth: + + sched_rt_handler() + --> sched_dl_bandwidth_validate() + { + new_bw = global_rt_runtime()/global_rt_period(); + + for_each_possible_cpu(cpu) { + dl_b = dl_bw_of(cpu); + if (new_bw < dl_b->total_bw) <------- + ret = -EBUSY; + } + } + +But under CONFIG_SMP, dl_bw is per root domain , but not per CPU, +dl_b->total_bw is the allocated bandwidth of the whole root domain. +Instead, we should compare dl_b->total_bw against "cpus*new_bw", +where 'cpus' is the number of CPUs of the root domain. + +Also, below annotation(in kernel/sched/sched.h) implied implementation +only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept +evolving till got merged(v9), but the annotation remains unchanged, +meaningless and misleading, update it. + +* With respect to SMP, the bandwidth is given on a per-CPU basis, +* meaning that: +* - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU; +* - dl_total_bw array contains, in the i-eth element, the currently +* allocated bandwidth on the i-eth CPU. + +[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/ + +Fixes: 332ac17ef5bf ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks") +Signed-off-by: Peng Liu +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Daniel Bristot de Oliveira +Acked-by: Juri Lelli +Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 5 +++-- + kernel/sched/sched.h | 42 ++++++++++++++++++----------------------- + 2 files changed, 21 insertions(+), 26 deletions(-) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 22770168bff84..06a6bcd6cfa66 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2345,7 +2345,7 @@ int sched_dl_global_validate(void) + u64 period = global_rt_period(); + u64 new_bw = to_ratio(period, runtime); + struct dl_bw *dl_b; +- int cpu, ret = 0; ++ int cpu, cpus, ret = 0; + unsigned long flags; + + /* +@@ -2360,9 +2360,10 @@ int sched_dl_global_validate(void) + for_each_possible_cpu(cpu) { + rcu_read_lock_sched(); + dl_b = dl_bw_of(cpu); ++ cpus = dl_bw_cpus(cpu); + + raw_spin_lock_irqsave(&dl_b->lock, flags); +- if (new_bw < dl_b->total_bw) ++ if (new_bw * cpus < dl_b->total_bw) + ret = -EBUSY; + raw_spin_unlock_irqrestore(&dl_b->lock, flags); + +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 391d73a12ad72..e5cfec6bc8913 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -191,30 +191,6 @@ struct rt_bandwidth { + + void __dl_clear_params(struct task_struct *p); + +-/* +- * To keep the bandwidth of -deadline tasks and groups under control +- * we need some place where: +- * - store the maximum -deadline bandwidth of the system (the group); +- * - cache the fraction of that bandwidth that is currently allocated. +- * +- * This is all done in the data structure below. It is similar to the +- * one used for RT-throttling (rt_bandwidth), with the main difference +- * that, since here we are only interested in admission control, we +- * do not decrease any runtime while the group "executes", neither we +- * need a timer to replenish it. +- * +- * With respect to SMP, the bandwidth is given on a per-CPU basis, +- * meaning that: +- * - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU; +- * - dl_total_bw array contains, in the i-eth element, the currently +- * allocated bandwidth on the i-eth CPU. +- * Moreover, groups consume bandwidth on each CPU, while tasks only +- * consume bandwidth on the CPU they're running on. +- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw +- * that will be shown the next time the proc or cgroup controls will +- * be red. It on its turn can be changed by writing on its own +- * control. +- */ + struct dl_bandwidth { + raw_spinlock_t dl_runtime_lock; + u64 dl_runtime; +@@ -226,6 +202,24 @@ static inline int dl_bandwidth_enabled(void) + return sysctl_sched_rt_runtime >= 0; + } + ++/* ++ * To keep the bandwidth of -deadline tasks under control ++ * we need some place where: ++ * - store the maximum -deadline bandwidth of each cpu; ++ * - cache the fraction of bandwidth that is currently allocated in ++ * each root domain; ++ * ++ * This is all done in the data structure below. It is similar to the ++ * one used for RT-throttling (rt_bandwidth), with the main difference ++ * that, since here we are only interested in admission control, we ++ * do not decrease any runtime while the group "executes", neither we ++ * need a timer to replenish it. ++ * ++ * With respect to SMP, bandwidth is given on a per root domain basis, ++ * meaning that: ++ * - bw (< 100%) is the deadline bandwidth of each CPU; ++ * - total_bw is the currently allocated bandwidth in each root domain; ++ */ + struct dl_bw { + raw_spinlock_t lock; + u64 bw, total_bw; +-- +2.27.0 + diff --git a/queue-4.14/sched-reenable-interrupts-in-do_sched_yield.patch b/queue-4.14/sched-reenable-interrupts-in-do_sched_yield.patch new file mode 100644 index 00000000000..994bb00cd31 --- /dev/null +++ b/queue-4.14/sched-reenable-interrupts-in-do_sched_yield.patch @@ -0,0 +1,45 @@ +From feae17ae5b88b8dfde624a6d73a1d634ee9c5884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Oct 2020 16:46:55 +0200 +Subject: sched: Reenable interrupts in do_sched_yield() + +From: Thomas Gleixner + +[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ] + +do_sched_yield() invokes schedule() with interrupts disabled which is +not allowed. This goes back to the pre git era to commit a6efb709806c +("[PATCH] irqlock patch 2.5.27-H6") in the history tree. + +Reenable interrupts and remove the misleading comment which "explains" it. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index c5599174e7450..7cedada731c1b 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -4826,12 +4826,8 @@ SYSCALL_DEFINE0(sched_yield) + schedstat_inc(rq->yld_count); + current->sched_class->yield_task(rq); + +- /* +- * Since we are going to call schedule() anyway, there's +- * no need to preempt or enable interrupts: +- */ + preempt_disable(); +- rq_unlock(rq, &rf); ++ rq_unlock_irq(rq, &rf); + sched_preempt_enable_no_resched(); + + schedule(); +-- +2.27.0 + diff --git a/queue-4.14/scsi-core-fix-vpd-lun-id-designator-priorities.patch b/queue-4.14/scsi-core-fix-vpd-lun-id-designator-priorities.patch new file mode 100644 index 00000000000..0994aa0f123 --- /dev/null +++ b/queue-4.14/scsi-core-fix-vpd-lun-id-designator-priorities.patch @@ -0,0 +1,261 @@ +From 369d7fbe7706f757db0dd7130269a15efeb7e819 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 18:08:45 +0100 +Subject: scsi: core: Fix VPD LUN ID designator priorities + +From: Martin Wilck + +[ Upstream commit 2e4209b3806cda9b89c30fd5e7bfecb7044ec78b ] + +The current implementation of scsi_vpd_lun_id() uses the designator length +as an implicit measure of priority. This works most of the time, but not +always. For example, some Hitachi storage arrays return this in VPD 0x83: + +VPD INQUIRY: Device Identification page + Designation descriptor number 1, descriptor length: 24 + designator_type: T10 vendor identification, code_set: ASCII + associated with the Addressed logical unit + vendor id: HITACHI + vendor specific: 5030C3502025 + Designation descriptor number 2, descriptor length: 6 + designator_type: vendor specific [0x0], code_set: Binary + associated with the Target port + vendor specific: 08 03 + Designation descriptor number 3, descriptor length: 20 + designator_type: NAA, code_set: Binary + associated with the Addressed logical unit + NAA 6, IEEE Company_id: 0x60e8 + Vendor Specific Identifier: 0x7c35000 + Vendor Specific Identifier Extension: 0x30c35000002025 + [0x60060e8007c350000030c35000002025] + +The current code would use the first descriptor because it's longer than +the NAA descriptor. But this is wrong, the kernel is supposed to prefer NAA +descriptors over T10 vendor ID. Designator length should only be used to +compare designators of the same type. + +This patch addresses the issue by separating designator priority and +length. + +Link: https://lore.kernel.org/r/20201029170846.14786-1-mwilck@suse.com +Fixes: 9983bed3907c ("scsi: Add scsi_vpd_lun_id()") +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin Wilck +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_lib.c | 126 +++++++++++++++++++++++++++------------- + 1 file changed, 86 insertions(+), 40 deletions(-) + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index c36c84c8725a0..6e0981b09c58b 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -3326,6 +3326,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev) + } + EXPORT_SYMBOL(sdev_enable_disk_events); + ++static unsigned char designator_prio(const unsigned char *d) ++{ ++ if (d[1] & 0x30) ++ /* not associated with LUN */ ++ return 0; ++ ++ if (d[3] == 0) ++ /* invalid length */ ++ return 0; ++ ++ /* ++ * Order of preference for lun descriptor: ++ * - SCSI name string ++ * - NAA IEEE Registered Extended ++ * - EUI-64 based 16-byte ++ * - EUI-64 based 12-byte ++ * - NAA IEEE Registered ++ * - NAA IEEE Extended ++ * - EUI-64 based 8-byte ++ * - SCSI name string (truncated) ++ * - T10 Vendor ID ++ * as longer descriptors reduce the likelyhood ++ * of identification clashes. ++ */ ++ ++ switch (d[1] & 0xf) { ++ case 8: ++ /* SCSI name string, variable-length UTF-8 */ ++ return 9; ++ case 3: ++ switch (d[4] >> 4) { ++ case 6: ++ /* NAA registered extended */ ++ return 8; ++ case 5: ++ /* NAA registered */ ++ return 5; ++ case 4: ++ /* NAA extended */ ++ return 4; ++ case 3: ++ /* NAA locally assigned */ ++ return 1; ++ default: ++ break; ++ } ++ break; ++ case 2: ++ switch (d[3]) { ++ case 16: ++ /* EUI64-based, 16 byte */ ++ return 7; ++ case 12: ++ /* EUI64-based, 12 byte */ ++ return 6; ++ case 8: ++ /* EUI64-based, 8 byte */ ++ return 3; ++ default: ++ break; ++ } ++ break; ++ case 1: ++ /* T10 vendor ID */ ++ return 1; ++ default: ++ break; ++ } ++ ++ return 0; ++} ++ + /** + * scsi_vpd_lun_id - return a unique device identification + * @sdev: SCSI device +@@ -3342,7 +3414,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events); + */ + int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + { +- u8 cur_id_type = 0xff; ++ u8 cur_id_prio = 0; + u8 cur_id_size = 0; + const unsigned char *d, *cur_id_str; + const struct scsi_vpd *vpd_pg83; +@@ -3355,20 +3427,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + return -ENXIO; + } + +- /* +- * Look for the correct descriptor. +- * Order of preference for lun descriptor: +- * - SCSI name string +- * - NAA IEEE Registered Extended +- * - EUI-64 based 16-byte +- * - EUI-64 based 12-byte +- * - NAA IEEE Registered +- * - NAA IEEE Extended +- * - T10 Vendor ID +- * as longer descriptors reduce the likelyhood +- * of identification clashes. +- */ +- + /* The id string must be at least 20 bytes + terminating NULL byte */ + if (id_len < 21) { + rcu_read_unlock(); +@@ -3378,8 +3436,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + memset(id, 0, id_len); + d = vpd_pg83->data + 4; + while (d < vpd_pg83->data + vpd_pg83->len) { +- /* Skip designators not referring to the LUN */ +- if ((d[1] & 0x30) != 0x00) ++ u8 prio = designator_prio(d); ++ ++ if (prio == 0 || cur_id_prio > prio) + goto next_desig; + + switch (d[1] & 0xf) { +@@ -3387,28 +3446,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + /* T10 Vendor ID */ + if (cur_id_size > d[3]) + break; +- /* Prefer anything */ +- if (cur_id_type > 0x01 && cur_id_type != 0xff) +- break; ++ cur_id_prio = prio; + cur_id_size = d[3]; + if (cur_id_size + 4 > id_len) + cur_id_size = id_len - 4; + cur_id_str = d + 4; +- cur_id_type = d[1] & 0xf; + id_size = snprintf(id, id_len, "t10.%*pE", + cur_id_size, cur_id_str); + break; + case 0x2: + /* EUI-64 */ +- if (cur_id_size > d[3]) +- break; +- /* Prefer NAA IEEE Registered Extended */ +- if (cur_id_type == 0x3 && +- cur_id_size == d[3]) +- break; ++ cur_id_prio = prio; + cur_id_size = d[3]; + cur_id_str = d + 4; +- cur_id_type = d[1] & 0xf; + switch (cur_id_size) { + case 8: + id_size = snprintf(id, id_len, +@@ -3426,17 +3476,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + cur_id_str); + break; + default: +- cur_id_size = 0; + break; + } + break; + case 0x3: + /* NAA */ +- if (cur_id_size > d[3]) +- break; ++ cur_id_prio = prio; + cur_id_size = d[3]; + cur_id_str = d + 4; +- cur_id_type = d[1] & 0xf; + switch (cur_id_size) { + case 8: + id_size = snprintf(id, id_len, +@@ -3449,26 +3496,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + cur_id_str); + break; + default: +- cur_id_size = 0; + break; + } + break; + case 0x8: + /* SCSI name string */ +- if (cur_id_size + 4 > d[3]) ++ if (cur_id_size > d[3]) + break; + /* Prefer others for truncated descriptor */ +- if (cur_id_size && d[3] > id_len) +- break; ++ if (d[3] > id_len) { ++ prio = 2; ++ if (cur_id_prio > prio) ++ break; ++ } ++ cur_id_prio = prio; + cur_id_size = id_size = d[3]; + cur_id_str = d + 4; +- cur_id_type = d[1] & 0xf; + if (cur_id_size >= id_len) + cur_id_size = id_len - 1; + memcpy(id, cur_id_str, cur_id_size); +- /* Decrease priority for truncated descriptor */ +- if (cur_id_size != id_size) +- cur_id_size = 6; + break; + default: + break; +-- +2.27.0 + diff --git a/queue-4.14/scsi-fnic-fix-error-return-code-in-fnic_probe.patch b/queue-4.14/scsi-fnic-fix-error-return-code-in-fnic_probe.patch new file mode 100644 index 00000000000..54d5e9fb64a --- /dev/null +++ b/queue-4.14/scsi-fnic-fix-error-return-code-in-fnic_probe.patch @@ -0,0 +1,38 @@ +From 5bf57c70cec0946a0466913ffd984539401b4b3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 15:47:39 +0800 +Subject: scsi: fnic: Fix error return code in fnic_probe() + +From: Zhang Changzhong + +[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ] + +Return a negative error code from the error handling case instead of 0 as +done elsewhere in this function. + +Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com +Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA") +Reported-by: Hulk Robot +Reviewed-by: Karan Tilak Kumar +Signed-off-by: Zhang Changzhong +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fnic/fnic_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c +index aacadbf20b695..878e486762729 100644 +--- a/drivers/scsi/fnic/fnic_main.c ++++ b/drivers/scsi/fnic/fnic_main.c +@@ -746,6 +746,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + for (i = 0; i < FNIC_IO_LOCKS; i++) + spin_lock_init(&fnic->io_req_lock[i]); + ++ err = -ENOMEM; + fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache); + if (!fnic->io_req_pool) + goto err_out_free_resources; +-- +2.27.0 + diff --git a/queue-4.14/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch b/queue-4.14/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch new file mode 100644 index 00000000000..aa31e99701e --- /dev/null +++ b/queue-4.14/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch @@ -0,0 +1,41 @@ +From 11cbf4b85d7bba7b358826442c089270fdd216ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Dec 2020 19:55:51 +0800 +Subject: scsi: pm80xx: Fix error return in pm8001_pci_probe() + +From: Zhang Qilong + +[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ] + +The driver did not return an error in the case where +pm8001_configure_phy_settings() failed. + +Use rc to store the return value of pm8001_configure_phy_settings(). + +Link: https://lore.kernel.org/r/20201205115551.2079471-1-zhangqilong3@huawei.com +Fixes: 279094079a44 ("[SCSI] pm80xx: Phy settings support for motherboard controller.") +Acked-by: Jack Wang +Signed-off-by: Zhang Qilong +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c +index 0e013f76b582e..30e49b4acaeaf 100644 +--- a/drivers/scsi/pm8001/pm8001_init.c ++++ b/drivers/scsi/pm8001/pm8001_init.c +@@ -1054,7 +1054,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev, + + pm8001_init_sas_add(pm8001_ha); + /* phy setting support for motherboard controller */ +- if (pm8001_configure_phy_settings(pm8001_ha)) ++ rc = pm8001_configure_phy_settings(pm8001_ha); ++ if (rc) + goto err_out_shost; + + pm8001_post_sas_ha_init(shost, chip); +-- +2.27.0 + diff --git a/queue-4.14/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch b/queue-4.14/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch new file mode 100644 index 00000000000..0e191eb3b3a --- /dev/null +++ b/queue-4.14/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch @@ -0,0 +1,47 @@ +From 168dc00ec527bba51cba02ee2e2d5ec79b931673 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 17:15:18 +0800 +Subject: scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe + +From: Qinglang Miao + +[ Upstream commit 62eebd5247c4e4ce08826ad5995cf4dd7ce919dd ] + +Add the missing destroy_workqueue() before return from __qedi_probe in the +error handling case when fails to create workqueue qedi->offload_thread. + +Link: https://lore.kernel.org/r/20201109091518.55941-1-miaoqinglang@huawei.com +Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") +Reviewed-by: Mike Christie +Signed-off-by: Qinglang Miao +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 24b945b555ba3..a742b88567762 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -2387,7 +2387,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode) + QEDI_ERR(&qedi->dbg_ctx, + "Unable to start offload thread!\n"); + rc = -ENODEV; +- goto free_cid_que; ++ goto free_tmf_thread; + } + + /* F/w needs 1st task context memory entry for performance */ +@@ -2407,6 +2407,8 @@ static int __qedi_probe(struct pci_dev *pdev, int mode) + + return 0; + ++free_tmf_thread: ++ destroy_workqueue(qedi->tmf_thread); + free_cid_que: + qedi_release_cid_que(qedi); + free_uio: +-- +2.27.0 + diff --git a/queue-4.14/security-fix-namespaced-fscaps-when-config_security.patch b/queue-4.14/security-fix-namespaced-fscaps-when-config_security.patch new file mode 100644 index 00000000000..a407e8fbdae --- /dev/null +++ b/queue-4.14/security-fix-namespaced-fscaps-when-config_security.patch @@ -0,0 +1,71 @@ +From a86ba2fff1185aa558d189222f59d43c83f49391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 21:55:31 -0600 +Subject: [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Serge Hallyn + +[ Upstream commit ed9b25d1970a4787ac6a39c2091e63b127ecbfc1 ] + +Namespaced file capabilities were introduced in 8db6c34f1dbc . +When userspace reads an xattr for a namespaced capability, a +virtualized representation of it is returned if the caller is +in a user namespace owned by the capability's owning rootid. +The function which performs this virtualization was not hooked +up if CONFIG_SECURITY=n. Therefore in that case the original +xattr was shown instead of the virtualized one. + +To test this using libcap-bin (*1), + +$ v=$(mktemp) +$ unshare -Ur setcap cap_sys_admin-eip $v +$ unshare -Ur setcap -v cap_sys_admin-eip $v +/tmp/tmp.lSiIFRvt8Y: OK + +"setcap -v" verifies the values instead of setting them, and +will check whether the rootid value is set. Therefore, with +this bug un-fixed, and with CONFIG_SECURITY=n, setcap -v will +fail: + +$ v=$(mktemp) +$ unshare -Ur setcap cap_sys_admin=eip $v +$ unshare -Ur setcap -v cap_sys_admin=eip $v +nsowner[got=1000, want=0],/tmp/tmp.HHDiOOl9fY differs in [] + +Fix this bug by calling cap_inode_getsecurity() in +security_inode_getsecurity() instead of returning +-EOPNOTSUPP, when CONFIG_SECURITY=n. + +*1 - note, if libcap is too old for getcap to have the '-n' +option, then use verify-caps instead. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209689 +Cc: Hervé Guillemet +Acked-by: Casey Schaufler +Signed-off-by: Serge Hallyn +Signed-off-by: Andrew G. Morgan +Signed-off-by: James Morris +Signed-off-by: Sasha Levin +--- + include/linux/security.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/security.h b/include/linux/security.h +index ce6265960d6c4..dab093af4ee8d 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -780,7 +780,7 @@ static inline int security_inode_killpriv(struct dentry *dentry) + + static inline int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc) + { +- return -EOPNOTSUPP; ++ return cap_inode_getsecurity(inode, name, buffer, alloc); + } + + static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags) +-- +2.27.0 + diff --git a/queue-4.14/selinux-fix-error-initialization-in-inode_doinit_wit.patch b/queue-4.14/selinux-fix-error-initialization-in-inode_doinit_wit.patch new file mode 100644 index 00000000000..9c40df36a84 --- /dev/null +++ b/queue-4.14/selinux-fix-error-initialization-in-inode_doinit_wit.patch @@ -0,0 +1,62 @@ +From 0822944f99def273fc257927a4043435a7da796f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 09:36:30 +0800 +Subject: selinux: fix error initialization in inode_doinit_with_dentry() + +From: Tianyue Ren + +[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ] + +Mark the inode security label as invalid if we cannot find +a dentry so that we will retry later rather than marking it +initialized with the unlabeled SID. + +Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock") +Signed-off-by: Tianyue Ren +[PM: minor comment tweaks] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/hooks.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 5def19ec11797..af8ddae0ddedb 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1569,7 +1569,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + * inode_doinit with a dentry, before these inodes could + * be used again by userspace. + */ +- goto out; ++ isec->initialized = LABEL_INVALID; ++ /* ++ * There is nothing useful to jump to the "out" ++ * label, except a needless spin lock/unlock ++ * cycle. ++ */ ++ return 0; + } + + len = INITCONTEXTLEN; +@@ -1677,8 +1683,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + * inode_doinit() with a dentry, before these inodes + * could be used again by userspace. + */ +- if (!dentry) +- goto out; ++ if (!dentry) { ++ isec->initialized = LABEL_INVALID; ++ /* ++ * There is nothing useful to jump to the "out" ++ * label, except a needless spin lock/unlock ++ * cycle. ++ */ ++ return 0; ++ } + rc = selinux_genfs_get_sid(dentry, sclass, + sbsec->flags, &sid); + dput(dentry); +-- +2.27.0 + diff --git a/queue-4.14/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch b/queue-4.14/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch new file mode 100644 index 00000000000..c8d8564c419 --- /dev/null +++ b/queue-4.14/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch @@ -0,0 +1,101 @@ +From 35bf522c5d03d17ea5df135136220fbd500fb59d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 11:49:38 -0500 +Subject: selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling + +From: Paul Moore + +[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ] + +A previous fix, commit 83370b31a915 ("selinux: fix error initialization +in inode_doinit_with_dentry()"), changed how failures were handled +before a SELinux policy was loaded. Unfortunately that patch was +potentially problematic for two reasons: it set the isec->initialized +state without holding a lock, and it didn't set the inode's SELinux +label to the "default" for the particular filesystem. The later can +be a problem if/when a later attempt to revalidate the inode fails +and SELinux reverts to the existing inode label. + +This patch should restore the default inode labeling that existed +before the original fix, without affecting the LABEL_INVALID marking +such that revalidation will still be attempted in the future. + +Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()") +Reported-by: Sven Schnelle +Tested-by: Sven Schnelle +Reviewed-by: Ondrej Mosnacek +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/hooks.c | 31 +++++++++++++------------------ + 1 file changed, 13 insertions(+), 18 deletions(-) + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index af8ddae0ddedb..895d369bc4103 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1569,13 +1569,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + * inode_doinit with a dentry, before these inodes could + * be used again by userspace. + */ +- isec->initialized = LABEL_INVALID; +- /* +- * There is nothing useful to jump to the "out" +- * label, except a needless spin lock/unlock +- * cycle. +- */ +- return 0; ++ goto out_invalid; + } + + len = INITCONTEXTLEN; +@@ -1683,15 +1677,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + * inode_doinit() with a dentry, before these inodes + * could be used again by userspace. + */ +- if (!dentry) { +- isec->initialized = LABEL_INVALID; +- /* +- * There is nothing useful to jump to the "out" +- * label, except a needless spin lock/unlock +- * cycle. +- */ +- return 0; +- } ++ if (!dentry) ++ goto out_invalid; + rc = selinux_genfs_get_sid(dentry, sclass, + sbsec->flags, &sid); + dput(dentry); +@@ -1704,11 +1691,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + out: + spin_lock(&isec->lock); + if (isec->initialized == LABEL_PENDING) { +- if (!sid || rc) { ++ if (rc) { + isec->initialized = LABEL_INVALID; + goto out_unlock; + } +- + isec->initialized = LABEL_INITIALIZED; + isec->sid = sid; + } +@@ -1716,6 +1702,15 @@ out: + out_unlock: + spin_unlock(&isec->lock); + return rc; ++ ++out_invalid: ++ spin_lock(&isec->lock); ++ if (isec->initialized == LABEL_PENDING) { ++ isec->initialized = LABEL_INVALID; ++ isec->sid = sid; ++ } ++ spin_unlock(&isec->lock); ++ return 0; + } + + /* Convert a Linux signal to an access vector. */ +-- +2.27.0 + diff --git a/queue-4.14/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch b/queue-4.14/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch new file mode 100644 index 00000000000..4b26fcbdca8 --- /dev/null +++ b/queue-4.14/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch @@ -0,0 +1,68 @@ +From 5a6320463d7dbab9312ec9f6bc566b052b482f81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 17:10:58 +0100 +Subject: seq_buf: Avoid type mismatch for seq_buf_init + +From: Arnd Bergmann + +[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ] + +Building with W=2 prints a number of warnings for one function that +has a pointer type mismatch: + +linux/seq_buf.h: In function 'seq_buf_init': +linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign] + +Change the type in the function prototype according to the type in +the structure. + +Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org + +Fixes: 9a7777935c34 ("tracing: Convert seq_buf fields to be like seq_file fields") +Reviewed-by: Cezary Rojewski +Signed-off-by: Arnd Bergmann +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + include/linux/seq_buf.h | 2 +- + include/linux/trace_seq.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h +index aa5deb041c25d..7cc952282e8be 100644 +--- a/include/linux/seq_buf.h ++++ b/include/linux/seq_buf.h +@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s) + } + + static inline void +-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size) ++seq_buf_init(struct seq_buf *s, char *buf, unsigned int size) + { + s->buffer = buf; + s->size = size; +diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h +index 6609b39a72326..6db257466af68 100644 +--- a/include/linux/trace_seq.h ++++ b/include/linux/trace_seq.h +@@ -12,7 +12,7 @@ + */ + + struct trace_seq { +- unsigned char buffer[PAGE_SIZE]; ++ char buffer[PAGE_SIZE]; + struct seq_buf seq; + int full; + }; +@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s) + * that is about to be written to and then return the result + * of that write. + */ +-static inline unsigned char * ++static inline char * + trace_seq_buffer_ptr(struct trace_seq *s) + { + return s->buffer + seq_buf_used(&s->seq); +-- +2.27.0 + diff --git a/queue-4.14/series b/queue-4.14/series index 8721e653305..213fc9087cd 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -62,3 +62,120 @@ media-msi2500-assign-spi-bus-number-dynamically.patch crypto-af_alg-avoid-undefined-behavior-accessing-salg_name.patch md-fix-a-warning-caused-by-a-race-between-concurrent-md_ioctl-s.patch bluetooth-fix-slab-out-of-bounds-read-in-hci_le_direct_adv_report_evt.patch +hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-15254 +drm-gma500-fix-double-free-of-gma_connector.patch +soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch +soc-mediatek-check-if-power-domains-can-be-powered-o.patch +rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch +selinux-fix-error-initialization-in-inode_doinit_wit.patch +rdma-rxe-compute-psn-windows-correctly.patch +x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch +arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch +sched-deadline-fix-sched_dl_global_validate.patch +sched-reenable-interrupts-in-do_sched_yield.patch +crypto-talitos-fix-return-type-of-current_desc_hdr.patch +spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch +asoc-pcm-drain-support-reactivation.patch +selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch +arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch +bluetooth-fix-null-pointer-dereference-in-hci_event_.patch +spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch +spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch +spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch +spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch +mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch +asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch +net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch +net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch +asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch +rdma-mthca-work-around-wenum-conversion-warning.patch +mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch +staging-greybus-codecs-fix-reference-counter-leak-in.patch +media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch +scsi-core-fix-vpd-lun-id-designator-priorities.patch +media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch +drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch +input-ads7846-fix-race-that-causes-missing-releases.patch +input-ads7846-fix-integer-overflow-on-rt-calculation.patch +input-ads7846-fix-unaligned-access-on-7845.patch +powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch +crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch +soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch +soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch +drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch +input-omap4-keypad-fix-runtime-pm-error-handling.patch +rdma-cxgb4-validate-the-number-of-cqes.patch +memstick-fix-a-double-free-bug-in-memstick_check.patch +arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch +arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch +orinoco-move-context-allocation-after-processing-the.patch +cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch +media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch +samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch +mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch +media-max2175-fix-max2175_set_csm_mode-error-code.patch +hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch +arm-dts-remove-non-existent-i2c1-from-98dx3236.patch +power-supply-bq24190_charger-fix-reference-leak.patch +genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch +pci-iproc-fix-out-of-bound-array-accesses.patch +arm-dts-at91-at91sam9rl-fix-adc-triggers.patch +ath10k-fix-an-error-handling-path.patch +ath10k-release-some-resources-in-an-error-handling-p.patch +nfsv4.2-condition-readdir-s-mask-for-security-label-.patch +sunrpc-xprt_load_transport-needs-to-support-the-neti.patch +lockd-don-t-use-interval-based-rebinding-over-tcp.patch +nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch +vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch +media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch +clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch +arm-dts-at91-sama5d2-map-securam-as-device.patch +pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch +arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch +memstick-r592-fix-error-return-in-r592_probe.patch +net-mlx5-properly-convey-driver-version-to-firmware.patch +asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch +dm-ioctl-fix-error-return-code-in-target_message.patch +clocksource-drivers-arm_arch_timer-correct-fault-pro.patch +cpufreq-highbank-add-missing-module_device_table.patch +cpufreq-mediatek-add-missing-module_device_table.patch +cpufreq-st-add-missing-module_device_table.patch +cpufreq-loongson1-add-missing-module_alias.patch +cpufreq-scpi-add-missing-module_alias.patch +scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch +scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch +seq_buf-avoid-type-mismatch-for-seq_buf_init.patch +scsi-fnic-fix-error-return-code-in-fnic_probe.patch +powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch +powerpc-pseries-hibernation-remove-redundant-cachein.patch +usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch +usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch +speakup-fix-uninitialized-flush_lock.patch +nfsd-fix-message-level-for-normal-termination.patch +nfs_common-need-lock-during-iterate-through-the-list.patch +x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch +clk-tegra-fix-duplicated-se-clock-entry.patch +extcon-max77693-fix-modalias-string.patch +asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch +irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch +watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch +um-chan_xterm-fix-fd-leak.patch +nfc-s3fwrn5-release-the-nfc-firmware.patch +powerpc-ps3-use-dma_mapping_error.patch +checkpatch-fix-unescaped-left-brace.patch +net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch +net-allwinner-fix-some-resources-leak-in-the-error-h.patch +net-korina-fix-return-value.patch +watchdog-qcom-avoid-context-switch-in-restart-handle.patch +watchdog-coh901327-add-common_clk-dependency.patch +clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch +pwm-zx-add-missing-cleanup-in-error-path.patch +pwm-lp3943-dynamically-allocate-pwm-chip-base.patch +perf-record-fix-memory-leak-when-using-user-regs-to-.patch +qlcnic-fix-error-code-in-probe.patch +clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch +clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch +cfg80211-initialize-rekey_data.patch +security-fix-namespaced-fscaps-when-config_security.patch +input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch +input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch diff --git a/queue-4.14/soc-mediatek-check-if-power-domains-can-be-powered-o.patch b/queue-4.14/soc-mediatek-check-if-power-domains-can-be-powered-o.patch new file mode 100644 index 00000000000..3429280a747 --- /dev/null +++ b/queue-4.14/soc-mediatek-check-if-power-domains-can-be-powered-o.patch @@ -0,0 +1,55 @@ +From 9506647a37bfa97f28be17119a24fc359365c166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 11:31:35 +0800 +Subject: soc: mediatek: Check if power domains can be powered on at boot time + +From: Nicolas Boichat + +[ Upstream commit 4007844b05815717f522c7ea9914e24ad0ff6c79 ] + +In the error case, where a power domain cannot be powered on +successfully at boot time (in mtk_register_power_domains), +pm_genpd_init would still be called with is_off=false, and the +system would later try to disable the power domain again, triggering +warnings as disabled clocks are disabled again (and other potential +issues). + +Also print a warning splat in that case, as this should never +happen. + +Fixes: c84e358718a66f7 ("soc: Mediatek: Add SCPSYS power domain driver") +Signed-off-by: Nicolas Boichat +Link: https://lore.kernel.org/r/20200928113107.v2.1.I5e6f8c262031d0451fe7241b744f4f3111c1ce71@changeid +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-scpsys.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c +index fb2a8b1e79791..d0b18cc7e61b5 100644 +--- a/drivers/soc/mediatek/mtk-scpsys.c ++++ b/drivers/soc/mediatek/mtk-scpsys.c +@@ -481,6 +481,7 @@ static void mtk_register_power_domains(struct platform_device *pdev, + for (i = 0; i < num; i++) { + struct scp_domain *scpd = &scp->domains[i]; + struct generic_pm_domain *genpd = &scpd->genpd; ++ bool on; + + /* + * Initially turn on all domains to make the domains usable +@@ -488,9 +489,9 @@ static void mtk_register_power_domains(struct platform_device *pdev, + * software. The unused domains will be switched off during + * late_init time. + */ +- genpd->power_on(genpd); ++ on = !WARN_ON(genpd->power_on(genpd) < 0); + +- pm_genpd_init(genpd, NULL, false); ++ pm_genpd_init(genpd, NULL, !on); + } + + /* +-- +2.27.0 + diff --git a/queue-4.14/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch b/queue-4.14/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch new file mode 100644 index 00000000000..d3cabf69362 --- /dev/null +++ b/queue-4.14/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch @@ -0,0 +1,36 @@ +From cb0de5c7ba929a0e90931cb6db2510b9d53b1c73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Sep 2020 14:31:42 +0300 +Subject: soc: renesas: rmobile-sysc: Fix some leaks in + rmobile_init_pm_domains() + +From: Dan Carpenter + +[ Upstream commit cf25d802e029c31efac8bdc979236927f37183bd ] + +This code needs to call iounmap() on one error path. + +Fixes: 2173fc7cb681 ("ARM: shmobile: R-Mobile: Add DT support for PM domains") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200923113142.GC1473821@mwanda +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm/mach-shmobile/pm-rmobile.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-shmobile/pm-rmobile.c b/arch/arm/mach-shmobile/pm-rmobile.c +index 3a4ed4c33a68e..e312f676a0fdf 100644 +--- a/arch/arm/mach-shmobile/pm-rmobile.c ++++ b/arch/arm/mach-shmobile/pm-rmobile.c +@@ -336,6 +336,7 @@ static int __init rmobile_init_pm_domains(void) + + pmd = of_get_child_by_name(np, "pm-domains"); + if (!pmd) { ++ iounmap(base); + pr_warn("%pOF lacks pm-domains node\n", np); + continue; + } +-- +2.27.0 + diff --git a/queue-4.14/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch b/queue-4.14/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch new file mode 100644 index 00000000000..44e891fb1ef --- /dev/null +++ b/queue-4.14/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch @@ -0,0 +1,72 @@ +From eafffcfad9d81929a0c8c379de58405c9755f6d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 19:22:37 -0800 +Subject: soc: ti: Fix reference imbalance in knav_dma_probe + +From: Zhang Qilong + +[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ] + +The patch fix two reference leak. + + 1) pm_runtime_get_sync will increment pm usage counter even it + failed. Forgetting to call put operation will result in + reference leak. + + 2) The pm_runtime_enable will increase power disable depth. Thus + a pairing decrement is needed on the error handling path to + keep it balanced. + +We fix it by: 1) adding call pm_runtime_put_noidle or +pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable +in error handling, to keep usage counter and disable depth balanced. + +Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support") +Signed-off-by: Zhang Qilong +Signed-off-by: Santosh Shilimkar +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/knav_dma.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c +index 026182d3b27c1..6d137b1f43ae5 100644 +--- a/drivers/soc/ti/knav_dma.c ++++ b/drivers/soc/ti/knav_dma.c +@@ -752,8 +752,9 @@ static int knav_dma_probe(struct platform_device *pdev) + pm_runtime_enable(kdev->dev); + ret = pm_runtime_get_sync(kdev->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(kdev->dev); + dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + /* Initialise all packet dmas */ +@@ -767,13 +768,21 @@ static int knav_dma_probe(struct platform_device *pdev) + + if (list_empty(&kdev->list)) { + dev_err(dev, "no valid dma instance\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_put_sync; + } + + debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL, + &knav_dma_debug_ops); + + return ret; ++ ++err_put_sync: ++ pm_runtime_put_sync(kdev->dev); ++err_pm_disable: ++ pm_runtime_disable(kdev->dev); ++ ++ return ret; + } + + static int knav_dma_remove(struct platform_device *pdev) +-- +2.27.0 + diff --git a/queue-4.14/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch b/queue-4.14/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch new file mode 100644 index 00000000000..525acdf6286 --- /dev/null +++ b/queue-4.14/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch @@ -0,0 +1,36 @@ +From 1ccac2ff2d819a8b7fd64b5bb95c7f3039c86ba6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 19:22:00 -0800 +Subject: soc: ti: knav_qmss: fix reference leak in knav_queue_probe + +From: Zhang Qilong + +[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in knav_queue_probe, so we should fix it. + +Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver") +Signed-off-by: Zhang Qilong +Signed-off-by: Santosh Shilimkar +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/knav_qmss_queue.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c +index 9879ca5f8c5f5..eef79cd5a7238 100644 +--- a/drivers/soc/ti/knav_qmss_queue.c ++++ b/drivers/soc/ti/knav_qmss_queue.c +@@ -1719,6 +1719,7 @@ static int knav_queue_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + ret = pm_runtime_get_sync(&pdev->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(&pdev->dev); + dev_err(dev, "Failed to enable QMSS\n"); + return ret; + } +-- +2.27.0 + diff --git a/queue-4.14/speakup-fix-uninitialized-flush_lock.patch b/queue-4.14/speakup-fix-uninitialized-flush_lock.patch new file mode 100644 index 00000000000..60fe7b29818 --- /dev/null +++ b/queue-4.14/speakup-fix-uninitialized-flush_lock.patch @@ -0,0 +1,39 @@ +From b25f12255f58d29f8ca5e92c41cf277f2ba1aa02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 09:22:29 +0800 +Subject: speakup: fix uninitialized flush_lock + +From: Yang Yingliang + +[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ] + +The flush_lock is uninitialized, use DEFINE_SPINLOCK +to define and initialize flush_lock. + +Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") +Reported-by: Hulk Robot +Reviewed-by: Samuel Thibault +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20201117012229.3395186-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/speakup/speakup_dectlk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/speakup/speakup_dectlk.c b/drivers/staging/speakup/speakup_dectlk.c +index f069954800226..53316b0c0b13c 100644 +--- a/drivers/staging/speakup/speakup_dectlk.c ++++ b/drivers/staging/speakup/speakup_dectlk.c +@@ -46,7 +46,7 @@ static unsigned char get_index(struct spk_synth *synth); + static int in_escape; + static int is_flushing; + +-static spinlock_t flush_lock; ++static DEFINE_SPINLOCK(flush_lock); + static DECLARE_WAIT_QUEUE_HEAD(flush); + + static struct var_t vars[] = { +-- +2.27.0 + diff --git a/queue-4.14/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch b/queue-4.14/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch new file mode 100644 index 00000000000..eb890db38d7 --- /dev/null +++ b/queue-4.14/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch @@ -0,0 +1,41 @@ +From 2f554510c332924d5c6f3021a39a223fdf245059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 22:56:51 +0800 +Subject: spi: img-spfi: fix reference leak in img_spfi_resume + +From: Zhang Qilong + +[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in img_spfi_resume, so we should fix it. + +Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-img-spfi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c +index 2e65b70c78792..2a340234c85c1 100644 +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -771,8 +771,10 @@ static int img_spfi_resume(struct device *dev) + int ret; + + ret = pm_runtime_get_sync(dev); +- if (ret) ++ if (ret) { ++ pm_runtime_put_noidle(dev); + return ret; ++ } + spfi_reset(spfi); + pm_runtime_put(dev); + +-- +2.27.0 + diff --git a/queue-4.14/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch b/queue-4.14/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch new file mode 100644 index 00000000000..e2103baac97 --- /dev/null +++ b/queue-4.14/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch @@ -0,0 +1,37 @@ +From c0fd2af433d69b7e9192b1da953d6b5f9bebcf6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:09:47 +0800 +Subject: spi: spi-ti-qspi: fix reference leak in ti_qspi_setup + +From: Zhang Qilong + +[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in ti_qspi_setup, so we should fix it. + +Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-ti-qspi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c +index d0ea62d151c0f..29c1b5d3ae7ad 100644 +--- a/drivers/spi/spi-ti-qspi.c ++++ b/drivers/spi/spi-ti-qspi.c +@@ -180,6 +180,7 @@ static int ti_qspi_setup(struct spi_device *spi) + + ret = pm_runtime_get_sync(qspi->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(qspi->dev); + dev_err(qspi->dev, "pm_runtime_get_sync() failed\n"); + return ret; + } +-- +2.27.0 + diff --git a/queue-4.14/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch b/queue-4.14/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch new file mode 100644 index 00000000000..37cbda6d9d0 --- /dev/null +++ b/queue-4.14/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch @@ -0,0 +1,46 @@ +From ad875187d5e0256a0f2922e90e96f1e9f4504a51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:13:06 +0800 +Subject: spi: tegra114: fix reference leak in tegra spi ops + +From: Zhang Qilong + +[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in two callers(tegra_spi_setup and +tegra_spi_resume), so we should fix it. + +Fixes: f333a331adfac ("spi/tegra114: add spi driver") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra114.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index 84ff0c507f0b6..0e1a8d7aa3224 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -827,6 +827,7 @@ static int tegra_spi_setup(struct spi_device *spi) + + ret = pm_runtime_get_sync(tspi->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(tspi->dev); + dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +@@ -1252,6 +1253,7 @@ static int tegra_spi_resume(struct device *dev) + + ret = pm_runtime_get_sync(dev); + if (ret < 0) { ++ pm_runtime_put_noidle(dev); + dev_err(dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +-- +2.27.0 + diff --git a/queue-4.14/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch b/queue-4.14/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch new file mode 100644 index 00000000000..124308f232d --- /dev/null +++ b/queue-4.14/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch @@ -0,0 +1,37 @@ +From 0591d04b652ddf5fbd043b6b4a6635e3eb73b922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:13:23 +0800 +Subject: spi: tegra20-sflash: fix reference leak in tegra_sflash_resume + +From: Zhang Qilong + +[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in tegra_sflash_resume, so we should fix it. + +Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra20-sflash.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c +index 22893a7e0aa0e..749288310c36c 100644 +--- a/drivers/spi/spi-tegra20-sflash.c ++++ b/drivers/spi/spi-tegra20-sflash.c +@@ -564,6 +564,7 @@ static int tegra_sflash_resume(struct device *dev) + + ret = pm_runtime_get_sync(dev); + if (ret < 0) { ++ pm_runtime_put_noidle(dev); + dev_err(dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +-- +2.27.0 + diff --git a/queue-4.14/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch b/queue-4.14/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch new file mode 100644 index 00000000000..1c5b14a487a --- /dev/null +++ b/queue-4.14/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch @@ -0,0 +1,46 @@ +From 76c64b9a274352f1efdafeb965c5892b093cf335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:13:45 +0800 +Subject: spi: tegra20-slink: fix reference leak in slink ops of tegra20 + +From: Zhang Qilong + +[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in two callers(tegra_slink_setup and +tegra_slink_resume), so we should fix it. + +Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra20-slink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 62b074b167a9a..c39bfcbda5f2c 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -761,6 +761,7 @@ static int tegra_slink_setup(struct spi_device *spi) + + ret = pm_runtime_get_sync(tspi->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(tspi->dev); + dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +@@ -1197,6 +1198,7 @@ static int tegra_slink_resume(struct device *dev) + + ret = pm_runtime_get_sync(dev); + if (ret < 0) { ++ pm_runtime_put_noidle(dev); + dev_err(dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +-- +2.27.0 + diff --git a/queue-4.14/staging-greybus-codecs-fix-reference-counter-leak-in.patch b/queue-4.14/staging-greybus-codecs-fix-reference-counter-leak-in.patch new file mode 100644 index 00000000000..3eea05731cb --- /dev/null +++ b/queue-4.14/staging-greybus-codecs-fix-reference-counter-leak-in.patch @@ -0,0 +1,47 @@ +From 829da3b7cb85c27fa1c381282a6e9dd30be6b09f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 21:13:46 +0800 +Subject: staging: greybus: codecs: Fix reference counter leak in error + handling + +From: Zhang Qilong + +[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ] + +gb_pm_runtime_get_sync has increased the usage counter of the device here. +Forgetting to call gb_pm_runtime_put_noidle will result in usage counter +leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We +fixed it by adding it. + +Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201109131347.1725288-2-zhangqilong3@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/audio_codec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c +index a6d01f0761f32..6ba5a34fcdf29 100644 +--- a/drivers/staging/greybus/audio_codec.c ++++ b/drivers/staging/greybus/audio_codec.c +@@ -490,6 +490,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream, + if (ret) { + dev_err_ratelimited(dai->dev, "%d: Error during set_config\n", + ret); ++ gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + return ret; + } +@@ -566,6 +567,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream, + break; + } + if (ret) { ++ gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n", + ret); +-- +2.27.0 + diff --git a/queue-4.14/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch b/queue-4.14/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch new file mode 100644 index 00000000000..26afe05907f --- /dev/null +++ b/queue-4.14/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch @@ -0,0 +1,185 @@ +From f90ebea8ea7edea0a9895fbaa0216dbd57fd4180 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 16:33:38 -0500 +Subject: SUNRPC: xprt_load_transport() needs to support the netid "rdma6" + +From: Trond Myklebust + +[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ] + +According to RFC5666, the correct netid for an IPv6 addressed RDMA +transport is "rdma6", which we've supported as a mount option since +Linux-4.7. The problem is when we try to load the module "xprtrdma6", +that will fail, since there is no modulealias of that name. + +Fixes: 181342c5ebe8 ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/xprt.h | 1 + + net/sunrpc/xprt.c | 65 +++++++++++++++++++++++++-------- + net/sunrpc/xprtrdma/module.c | 1 + + net/sunrpc/xprtrdma/transport.c | 1 + + net/sunrpc/xprtsock.c | 4 ++ + 5 files changed, 56 insertions(+), 16 deletions(-) + +diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h +index 7fad83881ce19..9785715eea145 100644 +--- a/include/linux/sunrpc/xprt.h ++++ b/include/linux/sunrpc/xprt.h +@@ -316,6 +316,7 @@ struct xprt_class { + struct rpc_xprt * (*setup)(struct xprt_create *); + struct module *owner; + char name[32]; ++ const char * netid[]; + }; + + /* +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index b852c34bb6373..7b1213be3e81a 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -143,31 +143,64 @@ out: + } + EXPORT_SYMBOL_GPL(xprt_unregister_transport); + ++static void ++xprt_class_release(const struct xprt_class *t) ++{ ++ module_put(t->owner); ++} ++ ++static const struct xprt_class * ++xprt_class_find_by_netid_locked(const char *netid) ++{ ++ const struct xprt_class *t; ++ unsigned int i; ++ ++ list_for_each_entry(t, &xprt_list, list) { ++ for (i = 0; t->netid[i][0] != '\0'; i++) { ++ if (strcmp(t->netid[i], netid) != 0) ++ continue; ++ if (!try_module_get(t->owner)) ++ continue; ++ return t; ++ } ++ } ++ return NULL; ++} ++ ++static const struct xprt_class * ++xprt_class_find_by_netid(const char *netid) ++{ ++ const struct xprt_class *t; ++ ++ spin_lock(&xprt_list_lock); ++ t = xprt_class_find_by_netid_locked(netid); ++ if (!t) { ++ spin_unlock(&xprt_list_lock); ++ request_module("rpc%s", netid); ++ spin_lock(&xprt_list_lock); ++ t = xprt_class_find_by_netid_locked(netid); ++ } ++ spin_unlock(&xprt_list_lock); ++ return t; ++} ++ + /** + * xprt_load_transport - load a transport implementation +- * @transport_name: transport to load ++ * @netid: transport to load + * + * Returns: + * 0: transport successfully loaded + * -ENOENT: transport module not available + */ +-int xprt_load_transport(const char *transport_name) ++int xprt_load_transport(const char *netid) + { +- struct xprt_class *t; +- int result; ++ const struct xprt_class *t; + +- result = 0; +- spin_lock(&xprt_list_lock); +- list_for_each_entry(t, &xprt_list, list) { +- if (strcmp(t->name, transport_name) == 0) { +- spin_unlock(&xprt_list_lock); +- goto out; +- } +- } +- spin_unlock(&xprt_list_lock); +- result = request_module("xprt%s", transport_name); +-out: +- return result; ++ t = xprt_class_find_by_netid(netid); ++ if (!t) ++ return -ENOENT; ++ xprt_class_release(t); ++ return 0; + } + EXPORT_SYMBOL_GPL(xprt_load_transport); + +diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c +index 560712bd9fa2c..dd227de31a589 100644 +--- a/net/sunrpc/xprtrdma/module.c ++++ b/net/sunrpc/xprtrdma/module.c +@@ -19,6 +19,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport"); + MODULE_LICENSE("Dual BSD/GPL"); + MODULE_ALIAS("svcrdma"); + MODULE_ALIAS("xprtrdma"); ++MODULE_ALIAS("rpcrdma6"); + + static void __exit rpc_rdma_cleanup(void) + { +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index b1b40a1be8c57..ead20e6754ab7 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -849,6 +849,7 @@ static struct xprt_class xprt_rdma = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_RDMA, + .setup = xprt_setup_rdma, ++ .netid = { "rdma", "rdma6", "" }, + }; + + void xprt_rdma_cleanup(void) +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index f75b5b7c1fc2a..5124a21ecfa39 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -3208,6 +3208,7 @@ static struct xprt_class xs_local_transport = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_LOCAL, + .setup = xs_setup_local, ++ .netid = { "" }, + }; + + static struct xprt_class xs_udp_transport = { +@@ -3216,6 +3217,7 @@ static struct xprt_class xs_udp_transport = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_UDP, + .setup = xs_setup_udp, ++ .netid = { "udp", "udp6", "" }, + }; + + static struct xprt_class xs_tcp_transport = { +@@ -3224,6 +3226,7 @@ static struct xprt_class xs_tcp_transport = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_TCP, + .setup = xs_setup_tcp, ++ .netid = { "tcp", "tcp6", "" }, + }; + + static struct xprt_class xs_bc_tcp_transport = { +@@ -3232,6 +3235,7 @@ static struct xprt_class xs_bc_tcp_transport = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_BC_TCP, + .setup = xs_setup_bc_tcp, ++ .netid = { "" }, + }; + + /** +-- +2.27.0 + diff --git a/queue-4.14/um-chan_xterm-fix-fd-leak.patch b/queue-4.14/um-chan_xterm-fix-fd-leak.patch new file mode 100644 index 00000000000..167c0cfc459 --- /dev/null +++ b/queue-4.14/um-chan_xterm-fix-fd-leak.patch @@ -0,0 +1,66 @@ +From ad3342542a8936c13d017913574a2a933b3ef816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 17:19:40 +0000 +Subject: um: chan_xterm: Fix fd leak + +From: Anton Ivanov + +[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ] + +xterm serial channel was leaking a fd used in setting up the +port helper + +This bug is prehistoric - it predates switching to git. The "fixes" +header here is really just to mark all the versions we would like this to +apply to which is "Anything from the Cretaceous period onwards". + +No dinosaurs were harmed in fixing this bug. + +Fixes: b40997b872cd ("um: drivers/xterm.c: fix a file descriptor leak") +Signed-off-by: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/xterm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c +index 20e30be44795b..e3b422ebce09f 100644 +--- a/arch/um/drivers/xterm.c ++++ b/arch/um/drivers/xterm.c +@@ -18,6 +18,7 @@ + struct xterm_chan { + int pid; + int helper_pid; ++ int chan_fd; + char *title; + int device; + int raw; +@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts) + return NULL; + *data = ((struct xterm_chan) { .pid = -1, + .helper_pid = -1, ++ .chan_fd = -1, + .device = device, + .title = opts->xterm_title, + .raw = opts->raw } ); +@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d, + goto out_kill; + } + ++ data->chan_fd = fd; + new = xterm_fd(fd, &data->helper_pid); + if (new < 0) { + err = new; +@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d) + os_kill_process(data->helper_pid, 0); + data->helper_pid = -1; + ++ if (data->chan_fd != -1) ++ os_close_file(data->chan_fd); + os_close_file(fd); + } + +-- +2.27.0 + diff --git a/queue-4.14/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch b/queue-4.14/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch new file mode 100644 index 00000000000..c4d47118e73 --- /dev/null +++ b/queue-4.14/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch @@ -0,0 +1,39 @@ +From 1eca918a1eb6964097045768c69f35e878ca3c82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 22:57:19 +0800 +Subject: usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe + +From: Zhang Qilong + +[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ] + +The pm_runtime_enable will decrement the power disable depth. Imbalance +depth will resulted in enabling runtime PM of device fails later. Thus +a pairing decrement must be needed on the error handling path to keep it +balanced. + +Fixes: 6c984b066d84b ("ARM: OMAP: USBHOST: Replace usbhs core driver APIs by Runtime pm APIs") +Acked-by: Alan Stern +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201123145719.1455849-1-zhangqilong3@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ehci-omap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c +index 4d308533bc835..a6b738139cd21 100644 +--- a/drivers/usb/host/ehci-omap.c ++++ b/drivers/usb/host/ehci-omap.c +@@ -237,6 +237,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev) + + err_pm_runtime: + pm_runtime_put_sync(dev); ++ pm_runtime_disable(dev); + + err_phy: + for (i = 0; i < omap->nports; i++) { +-- +2.27.0 + diff --git a/queue-4.14/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch b/queue-4.14/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch new file mode 100644 index 00000000000..9745e47fb4b --- /dev/null +++ b/queue-4.14/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch @@ -0,0 +1,42 @@ +From 8e117f4832f52565206696fcef8049d4fa7d93df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 22:58:09 +0800 +Subject: usb: oxu210hp-hcd: Fix memory leak in oxu_create + +From: Zhang Qilong + +[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ] + +usb_create_hcd will alloc memory for hcd, and we should +call usb_put_hcd to free it when adding fails to prevent +memory leak. + +Fixes: b92a78e582b1a ("usb host: Oxford OXU210HP HCD driver") +Reported-by: Hulk Robot +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201123145809.1456541-1-zhangqilong3@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/oxu210hp-hcd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c +index ed20fb34c897f..1d3a79c2eba2f 100644 +--- a/drivers/usb/host/oxu210hp-hcd.c ++++ b/drivers/usb/host/oxu210hp-hcd.c +@@ -3732,8 +3732,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev, + oxu->is_otg = otg; + + ret = usb_add_hcd(hcd, irq, IRQF_SHARED); +- if (ret < 0) ++ if (ret < 0) { ++ usb_put_hcd(hcd); + return ERR_PTR(ret); ++ } + + device_wakeup_enable(hcd->self.controller); + return hcd; +-- +2.27.0 + diff --git a/queue-4.14/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch b/queue-4.14/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch new file mode 100644 index 00000000000..ff9d5abe02e --- /dev/null +++ b/queue-4.14/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch @@ -0,0 +1,46 @@ +From 9ed4e5660322746b38f3aa6bcd0b390cd5f55913 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 12:34:58 -0400 +Subject: vfio-pci: Use io_remap_pfn_range() for PCI IO memory + +From: Jason Gunthorpe + +[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ] + +commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set +pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped +BAR space into userspace to work correctly on AMD SME systems that default +to all memory encrypted. + +Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it +should be calling io_remap_pfn_range() otherwise it will not work on SME +systems. + +Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking") +Signed-off-by: Jason Gunthorpe +Acked-by: Peter Xu +Tested-by: Tom Lendacky +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index ac1c54bcfe8fb..6fceefcab81db 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -1380,8 +1380,8 @@ static int vfio_pci_mmap_fault(struct vm_fault *vmf) + + mutex_unlock(&vdev->vma_lock); + +- if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, +- vma->vm_end - vma->vm_start, vma->vm_page_prot)) ++ if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, ++ vma->vm_end - vma->vm_start, vma->vm_page_prot)) + ret = VM_FAULT_SIGBUS; + + up_out: +-- +2.27.0 + diff --git a/queue-4.14/watchdog-coh901327-add-common_clk-dependency.patch b/queue-4.14/watchdog-coh901327-add-common_clk-dependency.patch new file mode 100644 index 00000000000..70962e5db95 --- /dev/null +++ b/queue-4.14/watchdog-coh901327-add-common_clk-dependency.patch @@ -0,0 +1,45 @@ +From 336cb0bbaffb5f6777d242c0359a35a23e5ba3eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 23:33:42 +0100 +Subject: watchdog: coh901327: add COMMON_CLK dependency + +From: Arnd Bergmann + +[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ] + +clang produces a build failure in configurations without COMMON_CLK +when a timeout calculation goes wrong: + +arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable': +coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay' + +Add a Kconfig dependency to only do build testing when COMMON_CLK +is enabled. + +Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible") +Signed-off-by: Arnd Bergmann +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20201203223358.1269372-1-arnd@kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index 529b0527bf2e2..de228669a2c8b 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -495,7 +495,7 @@ config SUNXI_WATCHDOG + + config COH901327_WATCHDOG + bool "ST-Ericsson COH 901 327 watchdog" +- depends on ARCH_U300 || (ARM && COMPILE_TEST) ++ depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST) + default y if MACH_U300 + select WATCHDOG_CORE + help +-- +2.27.0 + diff --git a/queue-4.14/watchdog-qcom-avoid-context-switch-in-restart-handle.patch b/queue-4.14/watchdog-qcom-avoid-context-switch-in-restart-handle.patch new file mode 100644 index 00000000000..b091a04bde7 --- /dev/null +++ b/queue-4.14/watchdog-qcom-avoid-context-switch-in-restart-handle.patch @@ -0,0 +1,69 @@ +From 10cca1c6a49a600319c6bf580f223c221a96b07f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 11:30:05 +0530 +Subject: watchdog: qcom: Avoid context switch in restart handler + +From: Manivannan Sadhasivam + +[ Upstream commit 7948fab26bcc468aa2a76462f441291b5fb0d5c7 ] + +The use of msleep() in the restart handler will cause scheduler to +induce a context switch which is not desirable. This generates below +warning on SDX55 when WDT is the only available restart source: + +[ 39.800188] reboot: Restarting system +[ 39.804115] ------------[ cut here ]------------ +[ 39.807855] WARNING: CPU: 0 PID: 678 at kernel/rcu/tree_plugin.h:297 rcu_note_context_switch+0x190/0x764 +[ 39.812538] Modules linked in: +[ 39.821954] CPU: 0 PID: 678 Comm: reboot Not tainted 5.10.0-rc1-00063-g33a9990d1d66-dirty #47 +[ 39.824854] Hardware name: Generic DT based system +[ 39.833470] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 39.838154] [] (show_stack) from [] (dump_stack+0x8c/0xa0) +[ 39.846049] [] (dump_stack) from [] (__warn+0xd8/0xf0) +[ 39.853058] [] (__warn) from [] (warn_slowpath_fmt+0x64/0xc8) +[ 39.859925] [] (warn_slowpath_fmt) from [] (rcu_note_context_switch+0x190/0x764) +[ 39.867503] [] (rcu_note_context_switch) from [] (__schedule+0x84/0x640) +[ 39.876685] [] (__schedule) from [] (schedule+0x58/0x10c) +[ 39.885095] [] (schedule) from [] (schedule_timeout+0x1e8/0x3d4) +[ 39.892135] [] (schedule_timeout) from [] (msleep+0x2c/0x38) +[ 39.899947] [] (msleep) from [] (qcom_wdt_restart+0xc4/0xcc) +[ 39.907319] [] (qcom_wdt_restart) from [] (watchdog_restart_notifier+0x18/0x28) +[ 39.914715] [] (watchdog_restart_notifier) from [] (atomic_notifier_call_chain+0x60/0x84) +[ 39.923487] [] (atomic_notifier_call_chain) from [] (machine_restart+0x78/0x7c) +[ 39.933551] [] (machine_restart) from [] (__do_sys_reboot+0xdc/0x1e0) +[ 39.942397] [] (__do_sys_reboot) from [] (ret_fast_syscall+0x0/0x54) +[ 39.950721] Exception stack(0xc3e0bfa8 to 0xc3e0bff0) +[ 39.958855] bfa0: 0001221c bed2fe24 fee1dead 28121969 01234567 00000000 +[ 39.963832] bfc0: 0001221c bed2fe24 00000003 00000058 000225e0 00000000 00000000 00000000 +[ 39.971985] bfe0: b6e62560 bed2fc84 00010fd8 b6e62580 +[ 39.980124] ---[ end trace 3f578288bad866e4 ]--- + +Hence, replace msleep() with mdelay() to fix this issue. + +Fixes: 05e487d905ab ("watchdog: qcom: register a restart notifier") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20201207060005.21293-1-manivannan.sadhasivam@linaro.org +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/qcom-wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c +index 780971318810d..1a0005a8fadb2 100644 +--- a/drivers/watchdog/qcom-wdt.c ++++ b/drivers/watchdog/qcom-wdt.c +@@ -121,7 +121,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action, + */ + wmb(); + +- msleep(150); ++ mdelay(150); + return 0; + } + +-- +2.27.0 + diff --git a/queue-4.14/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch b/queue-4.14/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch new file mode 100644 index 00000000000..2223a8a55fb --- /dev/null +++ b/queue-4.14/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch @@ -0,0 +1,41 @@ +From 2f2d0075738d4465c781548ced4a0ff14faee089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 08:25:50 -0800 +Subject: watchdog: sirfsoc: Add missing dependency on HAS_IOMEM + +From: Guenter Roeck + +[ Upstream commit 8ae2511112d2e18bc7d324b77f965d34083a25a2 ] + +If HAS_IOMEM is not defined and SIRFSOC_WATCHDOG is enabled, +the build fails with the following error. + +drivers/watchdog/sirfsoc_wdt.o: in function `sirfsoc_wdt_probe': +sirfsoc_wdt.c:(.text+0x112): + undefined reference to `devm_platform_ioremap_resource' + +Reported-by: Necip Fazil Yildiran +Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible") +Link: https://lore.kernel.org/r/20201108162550.27660-2-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index fa15a683ae2d4..529b0527bf2e2 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -620,6 +620,7 @@ config MOXART_WDT + + config SIRFSOC_WATCHDOG + tristate "SiRFSOC watchdog" ++ depends on HAS_IOMEM + depends on ARCH_SIRF || COMPILE_TEST + select WATCHDOG_CORE + default y +-- +2.27.0 + diff --git a/queue-4.14/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch b/queue-4.14/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch new file mode 100644 index 00000000000..4996d49157b --- /dev/null +++ b/queue-4.14/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch @@ -0,0 +1,46 @@ +From 9b181b9957fcc910ddc9b649790662e865f93531 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 23:31:10 +0900 +Subject: x86/kprobes: Restore BTF if the single-stepping is cancelled + +From: Masami Hiramatsu + +[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ] + +Fix to restore BTF if single-stepping causes a page fault and +it is cancelled. + +Usually the BTF flag was restored when the single stepping is done +(in resume_execution()). However, if a page fault happens on the +single stepping instruction, the fault handler is invoked and +the single stepping is cancelled. Thus, the BTF flag is not +restored. + +Fixes: 1ecc798c6764 ("x86: debugctlmsr kprobes") +Signed-off-by: Masami Hiramatsu +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/160389546985.106936.12727996109376240993.stgit@devnote2 +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/kprobes/core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 02665ffef0506..700d434f5bda9 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -1022,6 +1022,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr) + * So clear it by resetting the current kprobe: + */ + regs->flags &= ~X86_EFLAGS_TF; ++ /* ++ * Since the single step (trap) has been cancelled, ++ * we need to restore BTF here. ++ */ ++ restore_btf(); + + /* + * If the TF flag was set before the kprobe hit, +-- +2.27.0 + diff --git a/queue-4.14/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch b/queue-4.14/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch new file mode 100644 index 00000000000..2668ab43114 --- /dev/null +++ b/queue-4.14/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch @@ -0,0 +1,73 @@ +From c77eb90bcb1e06c4aeb2adb9c48d9173cfee059f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 19:06:48 -0400 +Subject: x86/mm/ident_map: Check for errors from ident_pud_init() + +From: Arvind Sankar + +[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ] + +Commit + + ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support") + +added ident_p4d_init() to support 5-level paging, but this function +doesn't check and return errors from ident_pud_init(). + +For example, the decompressor stub uses this code to create an identity +mapping. If it runs out of pages while trying to allocate a PMD +pagetable, the error will be currently ignored. + +Fix this to propagate errors. + + [ bp: Space out statements for better readability. ] + +Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support") +Signed-off-by: Arvind Sankar +Signed-off-by: Borislav Petkov +Reviewed-by: Joerg Roedel +Acked-by: Kirill A. Shutemov +Link: https://lkml.kernel.org/r/20201027230648.1885111-1-nivedita@alum.mit.edu +Signed-off-by: Sasha Levin +--- + arch/x86/mm/ident_map.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c +index ab33a32df2a8e..407fa1df470e0 100644 +--- a/arch/x86/mm/ident_map.c ++++ b/arch/x86/mm/ident_map.c +@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page, + unsigned long addr, unsigned long end) + { + unsigned long next; ++ int result; + + for (; addr < end; addr = next) { + p4d_t *p4d = p4d_page + p4d_index(addr); +@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page, + + if (p4d_present(*p4d)) { + pud = pud_offset(p4d, 0); +- ident_pud_init(info, pud, addr, next); ++ result = ident_pud_init(info, pud, addr, next); ++ if (result) ++ return result; ++ + continue; + } + pud = (pud_t *)info->alloc_pgt_page(info->context); + if (!pud) + return -ENOMEM; +- ident_pud_init(info, pud, addr, next); ++ ++ result = ident_pud_init(info, pud, addr, next); ++ if (result) ++ return result; ++ + set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag)); + } + +-- +2.27.0 +