From: Greg Kroah-Hartman Date: Sat, 18 Apr 2020 10:42:04 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.19.117~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cdc3e5dac6b9ae5a4e3958bcfaa916609e75d1ea;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch ext4-fix-incorrect-inodes-per-group-in-error-message.patch jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch --- diff --git a/queue-4.4/alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch b/queue-4.4/alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch new file mode 100644 index 00000000000..9441e491b63 --- /dev/null +++ b/queue-4.4/alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch @@ -0,0 +1,36 @@ +From 3507245b82b4362dc9721cbc328644905a3efa22 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 12 Apr 2020 10:13:29 +0200 +Subject: ALSA: usb-audio: Don't override ignore_ctl_error value from the map + +From: Takashi Iwai + +commit 3507245b82b4362dc9721cbc328644905a3efa22 upstream. + +The mapping table may contain also ignore_ctl_error flag for devices +that are known to behave wild. Since this flag always writes the +card's own ignore_ctl_error flag, it overrides the value already set +by the module option, so it doesn't follow user's expectation. +Let's fix the code not to clear the flag that has been set by user. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206873 +Cc: +Link: https://lore.kernel.org/r/20200412081331.4742-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/mixer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -2269,7 +2269,7 @@ static int snd_usb_mixer_controls(struct + if (map->id == state.chip->usb_id) { + state.map = map->map; + state.selector_map = map->selector_map; +- mixer->ignore_ctl_error = map->ignore_ctl_error; ++ mixer->ignore_ctl_error |= map->ignore_ctl_error; + break; + } + } diff --git a/queue-4.4/asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch b/queue-4.4/asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch new file mode 100644 index 00000000000..638d4ffee39 --- /dev/null +++ b/queue-4.4/asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch @@ -0,0 +1,35 @@ +From f5e056e1e46fcbb5f74ce560792aeb7d57ce79e6 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 19 Nov 2019 11:36:40 +0000 +Subject: ASoC: Intel: mrfld: fix incorrect check on p->sink + +From: Colin Ian King + +commit f5e056e1e46fcbb5f74ce560792aeb7d57ce79e6 upstream. + +The check on p->sink looks bogus, I believe it should be p->source +since the following code blocks are related to p->source. Fix +this by replacing p->sink with p->source. + +Fixes: 24c8d14192cc ("ASoC: Intel: mrfld: add DSP core controls") +Signed-off-by: Colin Ian King +Addresses-Coverity: ("Copy-paste error") +Link: https://lore.kernel.org/r/20191119113640.166940-1-colin.king@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/atom/sst-atom-controls.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/intel/atom/sst-atom-controls.c ++++ b/sound/soc/intel/atom/sst-atom-controls.c +@@ -1318,7 +1318,7 @@ int sst_send_pipe_gains(struct snd_soc_d + dai->capture_widget->name); + w = dai->capture_widget; + snd_soc_dapm_widget_for_each_source_path(w, p) { +- if (p->connected && !p->connected(w, p->sink)) ++ if (p->connected && !p->connected(w, p->source)) + continue; + + if (p->connect && p->source->power && diff --git a/queue-4.4/asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch b/queue-4.4/asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch new file mode 100644 index 00000000000..945ffba6160 --- /dev/null +++ b/queue-4.4/asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch @@ -0,0 +1,38 @@ +From 3025571edd9df653e1ad649f0638368a39d1bbb5 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Sat, 8 Feb 2020 22:07:20 +0000 +Subject: ASoC: Intel: mrfld: return error codes when an error occurs + +From: Colin Ian King + +commit 3025571edd9df653e1ad649f0638368a39d1bbb5 upstream. + +Currently function sst_platform_get_resources always returns zero and +error return codes set by the function are never returned. Fix this +by returning the error return code in variable ret rather than the +hard coded zero. + +Addresses-Coverity: ("Unused value") +Fixes: f533a035e4da ("ASoC: Intel: mrfld - create separate module for pci part") +Signed-off-by: Colin Ian King +Acked-by: Cezary Rojewski +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200208220720.36657-1-colin.king@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/atom/sst/sst_pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/intel/atom/sst/sst_pci.c ++++ b/sound/soc/intel/atom/sst/sst_pci.c +@@ -107,7 +107,7 @@ static int sst_platform_get_resources(st + dev_dbg(ctx->dev, "DRAM Ptr %p\n", ctx->dram); + do_release_regions: + pci_release_regions(pci); +- return 0; ++ return ret; + } + + /* diff --git a/queue-4.4/ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch b/queue-4.4/ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch new file mode 100644 index 00000000000..d2aaf4613f1 --- /dev/null +++ b/queue-4.4/ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch @@ -0,0 +1,39 @@ +From df41460a21b06a76437af040d90ccee03888e8e5 Mon Sep 17 00:00:00 2001 +From: Josh Triplett +Date: Sat, 28 Mar 2020 14:54:01 -0700 +Subject: ext4: fix incorrect group count in ext4_fill_super error message + +From: Josh Triplett + +commit df41460a21b06a76437af040d90ccee03888e8e5 upstream. + +ext4_fill_super doublechecks the number of groups before mounting; if +that check fails, the resulting error message prints the group count +from the ext4_sb_info sbi, which hasn't been set yet. Print the freshly +computed group count instead (which at that point has just been computed +in "blocks_count"). + +Signed-off-by: Josh Triplett +Fixes: 4ec1102813798 ("ext4: Add sanity checks for the superblock before mounting the filesystem") +Link: https://lore.kernel.org/r/8b957cd1513fcc4550fe675c10bcce2175c33a49.1585431964.git.josh@joshtriplett.org +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3791,9 +3791,9 @@ static int ext4_fill_super(struct super_ + EXT4_BLOCKS_PER_GROUP(sb) - 1); + do_div(blocks_count, EXT4_BLOCKS_PER_GROUP(sb)); + if (blocks_count > ((uint64_t)1<<32) - EXT4_DESC_PER_BLOCK(sb)) { +- ext4_msg(sb, KERN_WARNING, "groups count too large: %u " ++ ext4_msg(sb, KERN_WARNING, "groups count too large: %llu " + "(block count %llu, first data block %u, " +- "blocks per group %lu)", sbi->s_groups_count, ++ "blocks per group %lu)", blocks_count, + ext4_blocks_count(es), + le32_to_cpu(es->s_first_data_block), + EXT4_BLOCKS_PER_GROUP(sb)); diff --git a/queue-4.4/ext4-fix-incorrect-inodes-per-group-in-error-message.patch b/queue-4.4/ext4-fix-incorrect-inodes-per-group-in-error-message.patch new file mode 100644 index 00000000000..a0556cc1452 --- /dev/null +++ b/queue-4.4/ext4-fix-incorrect-inodes-per-group-in-error-message.patch @@ -0,0 +1,35 @@ +From b9c538da4e52a7b79dfcf4cfa487c46125066dfb Mon Sep 17 00:00:00 2001 +From: Josh Triplett +Date: Sat, 28 Mar 2020 15:34:15 -0700 +Subject: ext4: fix incorrect inodes per group in error message + +From: Josh Triplett + +commit b9c538da4e52a7b79dfcf4cfa487c46125066dfb upstream. + +If ext4_fill_super detects an invalid number of inodes per group, the +resulting error message printed the number of blocks per group, rather +than the number of inodes per group. Fix it to print the correct value. + +Fixes: cd6bb35bf7f6d ("ext4: use more strict checks for inodes_per_block on mount") +Link: https://lore.kernel.org/r/8be03355983a08e5d4eed480944613454d7e2550.1585434649.git.josh@joshtriplett.org +Reviewed-by: Andreas Dilger +Signed-off-by: Josh Triplett +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3660,7 +3660,7 @@ static int ext4_fill_super(struct super_ + if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > blocksize * 8) { + ext4_msg(sb, KERN_ERR, "invalid inodes per group: %lu\n", +- sbi->s_blocks_per_group); ++ sbi->s_inodes_per_group); + goto failed_mount; + } + sbi->s_itb_per_group = sbi->s_inodes_per_group / diff --git a/queue-4.4/jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch b/queue-4.4/jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch new file mode 100644 index 00000000000..83cd244f2e8 --- /dev/null +++ b/queue-4.4/jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch @@ -0,0 +1,41 @@ +From 780f66e59231fcf882f36c63f287252ee47cc75a Mon Sep 17 00:00:00 2001 +From: "zhangyi (F)" +Date: Mon, 17 Feb 2020 19:27:06 +0800 +Subject: jbd2: improve comments about freeing data buffers whose page mapping is NULL + +From: zhangyi (F) + +commit 780f66e59231fcf882f36c63f287252ee47cc75a upstream. + +Improve comments in jbd2_journal_commit_transaction() to describe why +we don't need to clear the buffer_mapped bit for freeing file mapping +buffers whose page mapping is NULL. + +Link: https://lore.kernel.org/r/20200217112706.20085-1-yi.zhang@huawei.com +Fixes: c96dceeabf76 ("jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer") +Suggested-by: Jan Kara +Reviewed-by: Jan Kara +Signed-off-by: zhangyi (F) +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/commit.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -1008,9 +1008,10 @@ restart_loop: + * journalled data) we need to unmap buffer and clear + * more bits. We also need to be careful about the check + * because the data page mapping can get cleared under +- * out hands, which alse need not to clear more bits +- * because the page and buffers will be freed and can +- * never be reused once we are done with them. ++ * our hands. Note that if mapping == NULL, we don't ++ * need to make buffer unmapped because the page is ++ * already detached from the mapping and buffers cannot ++ * get reused. + */ + mapping = READ_ONCE(bh->b_page->mapping); + if (mapping && !sb_is_blkdev_sb(mapping->host->i_sb)) { diff --git a/queue-4.4/mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch b/queue-4.4/mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch new file mode 100644 index 00000000000..a6e6406ff34 --- /dev/null +++ b/queue-4.4/mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch @@ -0,0 +1,68 @@ +From 7ea862048317aa76d0f22334202779a25530980c Mon Sep 17 00:00:00 2001 +From: Tuomas Tynkkynen +Date: Fri, 10 Apr 2020 15:32:57 +0300 +Subject: mac80211_hwsim: Use kstrndup() in place of kasprintf() + +From: Tuomas Tynkkynen + +commit 7ea862048317aa76d0f22334202779a25530980c upstream. + +syzbot reports a warning: + +precision 33020 too large +WARNING: CPU: 0 PID: 9618 at lib/vsprintf.c:2471 set_precision+0x150/0x180 lib/vsprintf.c:2471 + vsnprintf+0xa7b/0x19a0 lib/vsprintf.c:2547 + kvasprintf+0xb2/0x170 lib/kasprintf.c:22 + kasprintf+0xbb/0xf0 lib/kasprintf.c:59 + hwsim_del_radio_nl+0x63a/0x7e0 drivers/net/wireless/mac80211_hwsim.c:3625 + genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline] + ... + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Thus it seems that kasprintf() with "%.*s" format can not be used for +duplicating a string with arbitrary length. Replace it with kstrndup(). + +Note that later this string is limited to NL80211_WIPHY_NAME_MAXLEN == 64, +but the code is simpler this way. + +Reported-by: syzbot+6693adf1698864d21734@syzkaller.appspotmail.com +Reported-by: syzbot+a4aee3f42d7584d76761@syzkaller.appspotmail.com +Cc: stable@kernel.org +Signed-off-by: Tuomas Tynkkynen +Link: https://lore.kernel.org/r/20200410123257.14559-1-tuomas.tynkkynen@iki.fi +[johannes: add note about length limit] +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mac80211_hwsim.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -2901,9 +2901,9 @@ static int hwsim_new_radio_nl(struct sk_ + param.no_vif = true; + + if (info->attrs[HWSIM_ATTR_RADIO_NAME]) { +- hwname = kasprintf(GFP_KERNEL, "%.*s", +- nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), +- (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME])); ++ hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ GFP_KERNEL); + if (!hwname) + return -ENOMEM; + param.hwname = hwname; +@@ -2942,9 +2942,9 @@ static int hwsim_del_radio_nl(struct sk_ + if (info->attrs[HWSIM_ATTR_RADIO_ID]) { + idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]); + } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) { +- hwname = kasprintf(GFP_KERNEL, "%.*s", +- nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), +- (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME])); ++ hwname = kstrndup((char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ GFP_KERNEL); + if (!hwname) + return -ENOMEM; + } else diff --git a/queue-4.4/scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch b/queue-4.4/scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch new file mode 100644 index 00000000000..398f7a8271d --- /dev/null +++ b/queue-4.4/scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch @@ -0,0 +1,43 @@ +From c63d6099a7959ecc919b2549dc6b71f53521f819 Mon Sep 17 00:00:00 2001 +From: Can Guo +Date: Mon, 10 Feb 2020 19:40:48 -0800 +Subject: scsi: ufs: Fix ufshcd_hold() caused scheduling while atomic + +From: Can Guo + +commit c63d6099a7959ecc919b2549dc6b71f53521f819 upstream. + +The async version of ufshcd_hold(async == true), which is only called in +queuecommand path as for now, is expected to work in atomic context, thus +it should not sleep or schedule out. When it runs into the condition that +clocks are ON but link is still in hibern8 state, it should bail out +without flushing the clock ungate work. + +Fixes: f2a785ac2312 ("scsi: ufshcd: Fix race between clk scaling and ungate work") +Link: https://lore.kernel.org/r/1581392451-28743-6-git-send-email-cang@codeaurora.org +Reviewed-by: Hongwu Su +Reviewed-by: Asutosh Das +Reviewed-by: Bean Huo +Reviewed-by: Stanley Chu +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/ufs/ufshcd.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -595,6 +595,11 @@ start: + */ + if (ufshcd_can_hibern8_during_gating(hba) && + ufshcd_is_link_hibern8(hba)) { ++ if (async) { ++ rc = -EAGAIN; ++ hba->clk_gating.active_reqs--; ++ break; ++ } + spin_unlock_irqrestore(hba->host->host_lock, flags); + flush_work(&hba->clk_gating.ungate_work); + spin_lock_irqsave(hba->host->host_lock, flags); diff --git a/queue-4.4/series b/queue-4.4/series index 6f552251262..dfbeec81984 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -55,3 +55,11 @@ misc-echo-remove-unnecessary-parentheses-and-simplif.patch mfd-dln2-fix-sanity-checking-for-endpoints.patch net-ipv4-devinet-fix-crash-when-add-del-multicast-ip-with-autojoin.patch net-ipv6-do-not-consider-routes-via-gateways-for-anycast-address-check.patch +scsi-ufs-fix-ufshcd_hold-caused-scheduling-while-atomic.patch +jbd2-improve-comments-about-freeing-data-buffers-whose-page-mapping-is-null.patch +ext4-fix-incorrect-group-count-in-ext4_fill_super-error-message.patch +ext4-fix-incorrect-inodes-per-group-in-error-message.patch +asoc-intel-mrfld-fix-incorrect-check-on-p-sink.patch +asoc-intel-mrfld-return-error-codes-when-an-error-occurs.patch +alsa-usb-audio-don-t-override-ignore_ctl_error-value-from-the-map.patch +mac80211_hwsim-use-kstrndup-in-place-of-kasprintf.patch