From: Sasha Levin Date: Sat, 13 Aug 2022 20:26:04 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.15.61~134 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cf4f6bc2d92d78c124dbe06e5e8c712a53de2c04;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/acpi-ec-remove-duplicate-thinkpad-x1-carbon-6th-entr.patch b/queue-5.4/acpi-ec-remove-duplicate-thinkpad-x1-carbon-6th-entr.patch new file mode 100644 index 00000000000..448f680aed5 --- /dev/null +++ b/queue-5.4/acpi-ec-remove-duplicate-thinkpad-x1-carbon-6th-entr.patch @@ -0,0 +1,42 @@ +From f733fcb7f469c4ee7d4a5ab740a8f34b0ff65377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 11:25:43 +0200 +Subject: ACPI: EC: Remove duplicate ThinkPad X1 Carbon 6th entry from DMI + quirks + +From: Hans de Goede + +[ Upstream commit 0dd6db359e5f206cbf1dd1fd40dd211588cd2725 ] + +Somehow the "ThinkPad X1 Carbon 6th" entry ended up twice in the +struct dmi_system_id acpi_ec_no_wakeup[] array. Remove one of +the entries. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/ec.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index e5b92958c299..defc5796b508 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2118,13 +2118,6 @@ static const struct dmi_system_id acpi_ec_no_wakeup[] = { + DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"), + }, + }, +- { +- .ident = "ThinkPad X1 Carbon 6th", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Carbon 6th"), +- }, +- }, + { + .ident = "ThinkPad X1 Yoga 3rd", + .matches = { +-- +2.35.1 + diff --git a/queue-5.4/acpi-lpss-fix-missing-check-in-register_device_clock.patch b/queue-5.4/acpi-lpss-fix-missing-check-in-register_device_clock.patch new file mode 100644 index 00000000000..ec7e63fcc45 --- /dev/null +++ b/queue-5.4/acpi-lpss-fix-missing-check-in-register_device_clock.patch @@ -0,0 +1,36 @@ +From e858f05f726252a2d3fe1b41fd5c61b461493766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jun 2022 21:21:27 +0800 +Subject: ACPI: LPSS: Fix missing check in register_device_clock() + +From: huhai + +[ Upstream commit b4f1f61ed5928b1128e60e38d0dffa16966f06dc ] + +register_device_clock() misses a check for platform_device_register_simple(). +Add a check to fix it. + +Signed-off-by: huhai +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_lpss.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 751ed38f2a10..b939a6736d0b 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -401,6 +401,9 @@ static int register_device_clock(struct acpi_device *adev, + if (!lpss_clk_dev) + lpt_register_clock_device(); + ++ if (IS_ERR(lpss_clk_dev)) ++ return PTR_ERR(lpss_clk_dev); ++ + clk_data = platform_get_drvdata(lpss_clk_dev); + if (!clk_data) + return -ENODEV; +-- +2.35.1 + diff --git a/queue-5.4/acpi-pm-save-nvs-memory-for-lenovo-g40-45.patch b/queue-5.4/acpi-pm-save-nvs-memory-for-lenovo-g40-45.patch new file mode 100644 index 00000000000..50a1f6c8983 --- /dev/null +++ b/queue-5.4/acpi-pm-save-nvs-memory-for-lenovo-g40-45.patch @@ -0,0 +1,44 @@ +From 8c1725000db310cbba37d23a16cf7e0fcc9ed7af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 15:42:48 +0800 +Subject: ACPI: PM: save NVS memory for Lenovo G40-45 + +From: Manyi Li + +[ Upstream commit 4b7ef7b05afcde44142225c184bf43a0cd9e2178 ] + +[821d6f0359b0614792ab8e2fb93b503e25a65079] is to make machines +produced from 2012 to now not saving NVS region to accelerate S3. + +But, Lenovo G40-45, a platform released in 2015, still needs NVS memory +saving during S3. A quirk is introduced for this platform. + +Signed-off-by: Manyi Li +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/sleep.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 34966128293b..b9d203569ac1 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -361,6 +361,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "80E3"), + }, + }, ++ { ++ .callback = init_nvs_save_s3, ++ .ident = "Lenovo G40-45", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "80E1"), ++ }, ++ }, + /* + * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using + * the Low Power S0 Idle firmware interface (see +-- +2.35.1 + diff --git a/queue-5.4/arm-bcm-fix-refcount-leak-in-bcm_kona_smc_init.patch b/queue-5.4/arm-bcm-fix-refcount-leak-in-bcm_kona_smc_init.patch new file mode 100644 index 00000000000..16fc9f58237 --- /dev/null +++ b/queue-5.4/arm-bcm-fix-refcount-leak-in-bcm_kona_smc_init.patch @@ -0,0 +1,36 @@ +From 1a658ae4d6df4e4540ab2f73867d599fa1d13652 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 12:13:25 +0400 +Subject: ARM: bcm: Fix refcount leak in bcm_kona_smc_init + +From: Miaoqian Lin + +[ Upstream commit cb23389a2458c2e4bfd6c86a513cbbe1c4d35e76 ] + +of_find_matching_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: b8eb35fd594a ("ARM: bcm281xx: Add L2 cache enable code") +Signed-off-by: Miaoqian Lin +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/mach-bcm/bcm_kona_smc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_smc.c +index 541e850a736c..9175c130967e 100644 +--- a/arch/arm/mach-bcm/bcm_kona_smc.c ++++ b/arch/arm/mach-bcm/bcm_kona_smc.c +@@ -54,6 +54,7 @@ int __init bcm_kona_smc_init(void) + return -ENODEV; + + prop_val = of_get_address(node, 0, &prop_size, NULL); ++ of_node_put(node); + if (!prop_val) + return -EINVAL; + +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-ast2500-evb-fix-board-compatible.patch b/queue-5.4/arm-dts-ast2500-evb-fix-board-compatible.patch new file mode 100644 index 00000000000..d1a5a4d6833 --- /dev/null +++ b/queue-5.4/arm-dts-ast2500-evb-fix-board-compatible.patch @@ -0,0 +1,35 @@ +From 305c7f04fe8b90c89e6acf4fd287137875b3acc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 May 2022 12:49:25 +0200 +Subject: ARM: dts: ast2500-evb: fix board compatible + +From: Krzysztof Kozlowski + +[ Upstream commit 30b276fca5c0644f3cb17bceb1bd6a626c670184 ] + +The AST2500 EVB board should have dedicated compatible. + +Fixes: 02440622656d ("arm/dst: Add Aspeed ast2500 device tree") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220529104928.79636-4-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-ast2500-evb.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/aspeed-ast2500-evb.dts b/arch/arm/boot/dts/aspeed-ast2500-evb.dts +index c9d88c90135e..9db4d42d0deb 100644 +--- a/arch/arm/boot/dts/aspeed-ast2500-evb.dts ++++ b/arch/arm/boot/dts/aspeed-ast2500-evb.dts +@@ -5,7 +5,7 @@ + + / { + model = "AST2500 EVB"; +- compatible = "aspeed,ast2500"; ++ compatible = "aspeed,ast2500-evb", "aspeed,ast2500"; + + aliases { + serial4 = &uart5; +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-ast2600-evb-fix-board-compatible.patch b/queue-5.4/arm-dts-ast2600-evb-fix-board-compatible.patch new file mode 100644 index 00000000000..82cb6ef48e6 --- /dev/null +++ b/queue-5.4/arm-dts-ast2600-evb-fix-board-compatible.patch @@ -0,0 +1,35 @@ +From 8fb3aa9193cd451ddd7308f313589414b836f5bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 May 2022 12:49:26 +0200 +Subject: ARM: dts: ast2600-evb: fix board compatible + +From: Krzysztof Kozlowski + +[ Upstream commit aa5e06208500a0db41473caebdee5a2e81d5a277 ] + +The AST2600 EVB board should have dedicated compatible. + +Fixes: 2ca5646b5c2f ("ARM: dts: aspeed: Add AST2600 and EVB") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220529104928.79636-5-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-ast2600-evb.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/aspeed-ast2600-evb.dts b/arch/arm/boot/dts/aspeed-ast2600-evb.dts +index 9870553919b7..f00b19ad4fa6 100644 +--- a/arch/arm/boot/dts/aspeed-ast2600-evb.dts ++++ b/arch/arm/boot/dts/aspeed-ast2600-evb.dts +@@ -7,7 +7,7 @@ + + / { + model = "AST2600 EVB"; +- compatible = "aspeed,ast2600"; ++ compatible = "aspeed,ast2600-evb-a1", "aspeed,ast2600"; + + aliases { + serial4 = &uart5; +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-imx6ul-add-missing-properties-for-sram.patch b/queue-5.4/arm-dts-imx6ul-add-missing-properties-for-sram.patch new file mode 100644 index 00000000000..d9cdec45257 --- /dev/null +++ b/queue-5.4/arm-dts-imx6ul-add-missing-properties-for-sram.patch @@ -0,0 +1,39 @@ +From d68cfc9168aef6d9354e1b7a4898c84931374304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 14:33:51 +0200 +Subject: ARM: dts: imx6ul: add missing properties for sram + +From: Alexander Stein + +[ Upstream commit 5655699cf5cff9f4c4ee703792156bdd05d1addf ] + +All 3 properties are required by sram.yaml. Fixes the dtbs_check +warning: +sram@900000: '#address-cells' is a required property +sram@900000: '#size-cells' is a required property +sram@900000: 'ranges' is a required property + +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ul.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi +index f008036e9294..630643013bdc 100644 +--- a/arch/arm/boot/dts/imx6ul.dtsi ++++ b/arch/arm/boot/dts/imx6ul.dtsi +@@ -157,6 +157,9 @@ soc { + ocram: sram@900000 { + compatible = "mmio-sram"; + reg = <0x00900000 0x20000>; ++ ranges = <0 0x00900000 0x20000>; ++ #address-cells = <1>; ++ #size-cells = <1>; + }; + + intc: interrupt-controller@a01000 { +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-imx6ul-change-operating-points-to-uint32-mat.patch b/queue-5.4/arm-dts-imx6ul-change-operating-points-to-uint32-mat.patch new file mode 100644 index 00000000000..f937f431f6e --- /dev/null +++ b/queue-5.4/arm-dts-imx6ul-change-operating-points-to-uint32-mat.patch @@ -0,0 +1,63 @@ +From 52178b8b28ae7becf13fb5f8948b294593be7991 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 14:33:52 +0200 +Subject: ARM: dts: imx6ul: change operating-points to uint32-matrix + +From: Alexander Stein + +[ Upstream commit edb67843983bbdf61b4c8c3c50618003d38bb4ae ] + +operating-points is a uint32-matrix as per opp-v1.yaml. Change it +accordingly. While at it, change fsl,soc-operating-points as well, +although there is no bindings file (yet). But they should have the same +format. Fixes the dt_binding_check warning: +cpu@0: operating-points:0: [696000, 1275000, 528000, 1175000, 396000, +1025000, 198000, 950000] is too long +cpu@0: operating-points:0: Additional items are not allowed (528000, +1175000, 396000, 1025000, 198000, 950000 were unexpected) + +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ul.dtsi | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi +index 630643013bdc..baf4a41a9aa9 100644 +--- a/arch/arm/boot/dts/imx6ul.dtsi ++++ b/arch/arm/boot/dts/imx6ul.dtsi +@@ -62,20 +62,18 @@ cpu0: cpu@0 { + clock-frequency = <696000000>; + clock-latency = <61036>; /* two CLK32 periods */ + #cooling-cells = <2>; +- operating-points = < ++ operating-points = + /* kHz uV */ +- 696000 1275000 +- 528000 1175000 +- 396000 1025000 +- 198000 950000 +- >; +- fsl,soc-operating-points = < ++ <696000 1275000>, ++ <528000 1175000>, ++ <396000 1025000>, ++ <198000 950000>; ++ fsl,soc-operating-points = + /* KHz uV */ +- 696000 1275000 +- 528000 1175000 +- 396000 1175000 +- 198000 1175000 +- >; ++ <696000 1275000>, ++ <528000 1175000>, ++ <396000 1175000>, ++ <198000 1175000>; + clocks = <&clks IMX6UL_CLK_ARM>, + <&clks IMX6UL_CLK_PLL2_BUS>, + <&clks IMX6UL_CLK_PLL2_PFD2>, +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-imx6ul-fix-csi-node-compatible.patch b/queue-5.4/arm-dts-imx6ul-fix-csi-node-compatible.patch new file mode 100644 index 00000000000..3f26aaa84eb --- /dev/null +++ b/queue-5.4/arm-dts-imx6ul-fix-csi-node-compatible.patch @@ -0,0 +1,40 @@ +From dccf70d7a48f9276700f497d84380ae3a694172a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 14:33:55 +0200 +Subject: ARM: dts: imx6ul: fix csi node compatible + +From: Alexander Stein + +[ Upstream commit e0aca931a2c7c29c88ebf37f9c3cd045e083483d ] + +"fsl,imx6ul-csi" was never listed as compatible to "fsl,imx7-csi", neither +in yaml bindings, nor previous txt binding. Remove the imx7 part. Fixes +the dt schema check warning: +csi@21c4000: compatible: 'oneOf' conditional failed, one must be fixed: +['fsl,imx6ul-csi', 'fsl,imx7-csi'] is too long +Additional items are not allowed ('fsl,imx7-csi' was unexpected) +'fsl,imx8mm-csi' was expected + +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ul.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi +index baf4a41a9aa9..3fd02e10170a 100644 +--- a/arch/arm/boot/dts/imx6ul.dtsi ++++ b/arch/arm/boot/dts/imx6ul.dtsi +@@ -967,7 +967,7 @@ cpu_speed_grade: speed-grade@10 { + }; + + csi: csi@21c4000 { +- compatible = "fsl,imx6ul-csi", "fsl,imx7-csi"; ++ compatible = "fsl,imx6ul-csi"; + reg = <0x021c4000 0x4000>; + interrupts = ; + clocks = <&clks IMX6UL_CLK_CSI>; +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-imx6ul-fix-lcdif-node-compatible.patch b/queue-5.4/arm-dts-imx6ul-fix-lcdif-node-compatible.patch new file mode 100644 index 00000000000..247e0c77257 --- /dev/null +++ b/queue-5.4/arm-dts-imx6ul-fix-lcdif-node-compatible.patch @@ -0,0 +1,42 @@ +From 104ea90f82d664a1d9d15b46687a0ecb19ccbf4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 14:33:56 +0200 +Subject: ARM: dts: imx6ul: fix lcdif node compatible + +From: Alexander Stein + +[ Upstream commit 1a884d17ca324531634cce82e9f64c0302bdf7de ] + +In yaml binding "fsl,imx6ul-lcdif" is listed as compatible to imx6sx-lcdif, +but not imx28-lcdif. Change the list accordingly. Fixes the +dt_binding_check warning: +lcdif@21c8000: compatible: 'oneOf' conditional failed, one must be fixed: +['fsl,imx6ul-lcdif', 'fsl,imx28-lcdif'] is too long +Additional items are not allowed ('fsl,imx28-lcdif' was unexpected) +'fsl,imx6ul-lcdif' is not one of ['fsl,imx23-lcdif', 'fsl,imx28-lcdif', +'fsl,imx6sx-lcdif'] +'fsl,imx6sx-lcdif' was expected + +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ul.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi +index 3fd02e10170a..58671c6e9f31 100644 +--- a/arch/arm/boot/dts/imx6ul.dtsi ++++ b/arch/arm/boot/dts/imx6ul.dtsi +@@ -976,7 +976,7 @@ csi: csi@21c4000 { + }; + + lcdif: lcdif@21c8000 { +- compatible = "fsl,imx6ul-lcdif", "fsl,imx28-lcdif"; ++ compatible = "fsl,imx6ul-lcdif", "fsl,imx6sx-lcdif"; + reg = <0x021c8000 0x4000>; + interrupts = ; + clocks = <&clks IMX6UL_CLK_LCDIF_PIX>, +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-imx6ul-fix-qspi-node-compatible.patch b/queue-5.4/arm-dts-imx6ul-fix-qspi-node-compatible.patch new file mode 100644 index 00000000000..e68efcc129c --- /dev/null +++ b/queue-5.4/arm-dts-imx6ul-fix-qspi-node-compatible.patch @@ -0,0 +1,42 @@ +From 6450656f9a2f544cb12c806a46c12762b1cb61b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 14:33:57 +0200 +Subject: ARM: dts: imx6ul: fix qspi node compatible + +From: Alexander Stein + +[ Upstream commit 0c6cf86e1ab433b2d421880fdd9c6e954f404948 ] + +imx6ul is not compatible to imx6sx, both have different erratas. +Fixes the dt_binding_check warning: +spi@21e0000: compatible: 'oneOf' conditional failed, one must be fixed: +['fsl,imx6ul-qspi', 'fsl,imx6sx-qspi'] is too long +Additional items are not allowed ('fsl,imx6sx-qspi' was unexpected) +'fsl,imx6ul-qspi' is not one of ['fsl,ls1043a-qspi'] +'fsl,imx6ul-qspi' is not one of ['fsl,imx8mq-qspi'] +'fsl,ls1021a-qspi' was expected +'fsl,imx7d-qspi' was expected + +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ul.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi +index 58671c6e9f31..ae0722b93b9d 100644 +--- a/arch/arm/boot/dts/imx6ul.dtsi ++++ b/arch/arm/boot/dts/imx6ul.dtsi +@@ -997,7 +997,7 @@ pxp: pxp@21cc000 { + qspi: spi@21e0000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "fsl,imx6ul-qspi", "fsl,imx6sx-qspi"; ++ compatible = "fsl,imx6ul-qspi"; + reg = <0x021e0000 0x4000>, <0x60000000 0x10000000>; + reg-names = "QuadSPI", "QuadSPI-memory"; + interrupts = ; +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-qcom-mdm9615-add-missing-pmic-gpio-reg.patch b/queue-5.4/arm-dts-qcom-mdm9615-add-missing-pmic-gpio-reg.patch new file mode 100644 index 00000000000..4ba6c2979e1 --- /dev/null +++ b/queue-5.4/arm-dts-qcom-mdm9615-add-missing-pmic-gpio-reg.patch @@ -0,0 +1,36 @@ +From e1495958192ed274df73b6eb79e799fefcbe2167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 May 2022 21:49:12 +0200 +Subject: ARM: dts: qcom: mdm9615: add missing PMIC GPIO reg + +From: Krzysztof Kozlowski + +[ Upstream commit dc590cdc31f636ea15658f1206c3e380a53fb78e ] + +'reg' property is required in SSBI children: + qcom-mdm9615-wp8548-mangoh-green.dtb: gpio@150: 'reg' is a required property + +Fixes: 2c5e596524e7 ("ARM: dts: Add MDM9615 dtsi") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220507194913.261121-11-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-mdm9615.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/qcom-mdm9615.dtsi b/arch/arm/boot/dts/qcom-mdm9615.dtsi +index 356e9535f7a6..ffb4dcdb62d2 100644 +--- a/arch/arm/boot/dts/qcom-mdm9615.dtsi ++++ b/arch/arm/boot/dts/qcom-mdm9615.dtsi +@@ -323,6 +323,7 @@ rtc@11d { + + pmicgpio: gpio@150 { + compatible = "qcom,pm8018-gpio", "qcom,ssbi-gpio"; ++ reg = <0x150>; + interrupt-controller; + #interrupt-cells = <2>; + gpio-controller; +-- +2.35.1 + diff --git a/queue-5.4/arm-dts-qcom-pm8841-add-required-thermal-sensor-cell.patch b/queue-5.4/arm-dts-qcom-pm8841-add-required-thermal-sensor-cell.patch new file mode 100644 index 00000000000..847ce3237c1 --- /dev/null +++ b/queue-5.4/arm-dts-qcom-pm8841-add-required-thermal-sensor-cell.patch @@ -0,0 +1,35 @@ +From 2c6f37cb0d17b31426ecbb0f8f44c05c2a4a999a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 13:27:02 +0200 +Subject: ARM: dts: qcom: pm8841: add required thermal-sensor-cells + +From: Krzysztof Kozlowski + +[ Upstream commit e2759fa0676c9a32bbddb9aff955b54bb35066ad ] + +The PM8841 temperature sensor has to define thermal-sensor-cells. + +Fixes: dab8134ca072 ("ARM: dts: qcom: Add PM8841 functions device nodes") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220608112702.80873-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-pm8841.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/qcom-pm8841.dtsi b/arch/arm/boot/dts/qcom-pm8841.dtsi +index 2fd59c440903..c73e5b149ac5 100644 +--- a/arch/arm/boot/dts/qcom-pm8841.dtsi ++++ b/arch/arm/boot/dts/qcom-pm8841.dtsi +@@ -25,6 +25,7 @@ temp-alarm@2400 { + compatible = "qcom,spmi-temp-alarm"; + reg = <0x2400>; + interrupts = <4 0x24 0 IRQ_TYPE_EDGE_RISING>; ++ #thermal-sensor-cells = <0>; + }; + }; + +-- +2.35.1 + diff --git a/queue-5.4/arm-findbit-fix-overflowing-offset.patch b/queue-5.4/arm-findbit-fix-overflowing-offset.patch new file mode 100644 index 00000000000..387ac5bb54f --- /dev/null +++ b/queue-5.4/arm-findbit-fix-overflowing-offset.patch @@ -0,0 +1,76 @@ +From aa3a468cfd7d7cea65edd6a4117389038cf5172a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 23:51:48 +0100 +Subject: ARM: findbit: fix overflowing offset + +From: Russell King (Oracle) + +[ Upstream commit ec85bd369fd2bfaed6f45dd678706429d4f75b48 ] + +When offset is larger than the size of the bit array, we should not +attempt to access the array as we can perform an access beyond the +end of the array. Fix this by changing the pre-condition. + +Using "cmp r2, r1; bhs ..." covers us for the size == 0 case, since +this will always take the branch when r1 is zero, irrespective of +the value of r2. This means we can fix this bug without adding any +additional code! + +Tested-by: Guenter Roeck +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/lib/findbit.S | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S +index b5e8b9ae4c7d..7fd3600db8ef 100644 +--- a/arch/arm/lib/findbit.S ++++ b/arch/arm/lib/findbit.S +@@ -40,8 +40,8 @@ ENDPROC(_find_first_zero_bit_le) + * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset) + */ + ENTRY(_find_next_zero_bit_le) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + ARM( ldrb r3, [r0, r2, lsr #3] ) +@@ -81,8 +81,8 @@ ENDPROC(_find_first_bit_le) + * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset) + */ + ENTRY(_find_next_bit_le) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + ARM( ldrb r3, [r0, r2, lsr #3] ) +@@ -115,8 +115,8 @@ ENTRY(_find_first_zero_bit_be) + ENDPROC(_find_first_zero_bit_be) + + ENTRY(_find_next_zero_bit_be) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + eor r3, r2, #0x18 @ big endian byte ordering +@@ -149,8 +149,8 @@ ENTRY(_find_first_bit_be) + ENDPROC(_find_first_bit_be) + + ENTRY(_find_next_bit_be) +- teq r1, #0 +- beq 3b ++ cmp r2, r1 ++ bhs 3b + ands ip, r2, #7 + beq 1b @ If new byte, goto old routine + eor r3, r2, #0x18 @ big endian byte ordering +-- +2.35.1 + diff --git a/queue-5.4/arm-omap2-display-fix-refcount-leak-bug.patch b/queue-5.4/arm-omap2-display-fix-refcount-leak-bug.patch new file mode 100644 index 00000000000..bb95ec30609 --- /dev/null +++ b/queue-5.4/arm-omap2-display-fix-refcount-leak-bug.patch @@ -0,0 +1,36 @@ +From aa7b8cf451d5e9ca93f079c871faa60c609b8f06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 22:58:03 +0800 +Subject: ARM: OMAP2+: display: Fix refcount leak bug + +From: Liang He + +[ Upstream commit 50b87a32a79bca6e275918a711fb8cc55e16d739 ] + +In omapdss_init_fbdev(), of_find_node_by_name() will return a node +pointer with refcount incremented. We should use of_node_put() when +it is not used anymore. + +Signed-off-by: Liang He +Message-Id: <20220617145803.4050918-1-windhl@126.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/display.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c +index 1bd64f6ba8cf..d3b531d5d920 100644 +--- a/arch/arm/mach-omap2/display.c ++++ b/arch/arm/mach-omap2/display.c +@@ -211,6 +211,7 @@ static int __init omapdss_init_fbdev(void) + node = of_find_node_by_name(NULL, "omap4_padconf_global"); + if (node) + omap4_dsi_mux_syscon = syscon_node_to_regmap(node); ++ of_node_put(node); + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.4/arm-omap2-fix-refcount-leak-in-omap3xxx_prm_late_ini.patch b/queue-5.4/arm-omap2-fix-refcount-leak-in-omap3xxx_prm_late_ini.patch new file mode 100644 index 00000000000..60f15f0caa3 --- /dev/null +++ b/queue-5.4/arm-omap2-fix-refcount-leak-in-omap3xxx_prm_late_ini.patch @@ -0,0 +1,37 @@ +From c7920643711c442891bdeb2e27fab1b9cbfdf9f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 11:37:24 +0400 +Subject: ARM: OMAP2+: Fix refcount leak in omap3xxx_prm_late_init + +From: Miaoqian Lin + +[ Upstream commit 942228fbf5d4901112178b93d41225be7c0dd9de ] + +of_find_matching_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 1e037794f7f0 ("ARM: OMAP3+: PRM: register interrupt information from DT") +Signed-off-by: Miaoqian Lin +Message-Id: <20220526073724.21169-1-linmq006@gmail.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/prm3xxx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap2/prm3xxx.c b/arch/arm/mach-omap2/prm3xxx.c +index 1b442b128569..63e73e9b82bc 100644 +--- a/arch/arm/mach-omap2/prm3xxx.c ++++ b/arch/arm/mach-omap2/prm3xxx.c +@@ -708,6 +708,7 @@ static int omap3xxx_prm_late_init(void) + } + + irq_num = of_irq_get(np, 0); ++ of_node_put(np); + if (irq_num == -EPROBE_DEFER) + return irq_num; + +-- +2.35.1 + diff --git a/queue-5.4/arm-omap2-fix-refcount-leak-in-omapdss_init_of.patch b/queue-5.4/arm-omap2-fix-refcount-leak-in-omapdss_init_of.patch new file mode 100644 index 00000000000..3c24b6ed852 --- /dev/null +++ b/queue-5.4/arm-omap2-fix-refcount-leak-in-omapdss_init_of.patch @@ -0,0 +1,45 @@ +From e32f1dc4e2312855fb3439ba9ae97f627b2417a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 08:48:58 +0400 +Subject: ARM: OMAP2+: Fix refcount leak in omapdss_init_of + +From: Miaoqian Lin + +[ Upstream commit 9705db1eff38d6b9114121f9e253746199b759c9 ] + +omapdss_find_dss_of_node() calls of_find_compatible_node() to get device +node. of_find_compatible_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +Add missing of_node_put() in later error path and normal path. + +Fixes: e0c827aca0730 ("drm/omap: Populate DSS children in omapdss driver") +Signed-off-by: Miaoqian Lin +Message-Id: <20220601044858.3352-1-linmq006@gmail.com> +Reviewed-by: Laurent Pinchart +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/display.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c +index d3b531d5d920..1de25166414e 100644 +--- a/arch/arm/mach-omap2/display.c ++++ b/arch/arm/mach-omap2/display.c +@@ -260,11 +260,13 @@ static int __init omapdss_init_of(void) + + if (!pdev) { + pr_err("Unable to find DSS platform device\n"); ++ of_node_put(node); + return -ENODEV; + } + + r = of_platform_populate(node, NULL, NULL, &pdev->dev); + put_device(&pdev->dev); ++ of_node_put(node); + if (r) { + pr_err("Unable to populate DSS submodule devices\n"); + return r; +-- +2.35.1 + diff --git a/queue-5.4/arm-shmobile-rcar-gen2-increase-refcount-for-new-ref.patch b/queue-5.4/arm-shmobile-rcar-gen2-increase-refcount-for-new-ref.patch new file mode 100644 index 00000000000..d7bc085f154 --- /dev/null +++ b/queue-5.4/arm-shmobile-rcar-gen2-increase-refcount-for-new-ref.patch @@ -0,0 +1,60 @@ +From fe9058c1811d0515f5baf1e049b8ee45ecaa576d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 20:18:04 +0800 +Subject: ARM: shmobile: rcar-gen2: Increase refcount for new reference + +From: Liang He + +[ Upstream commit 75a185fb92e58ccd3670258d8d3b826bd2fa6d29 ] + +In rcar_gen2_regulator_quirk(), for_each_matching_node_and_match() will +automatically increase and decrease the refcount. However, we should +call of_node_get() for the new reference created in 'quirk->np'. +Besides, we also should call of_node_put() before the 'quirk' being +freed. + +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220701121804.234223-1-windhl@126.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +index 09ef73b99dd8..ba44cec5e59a 100644 +--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c ++++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +@@ -125,6 +125,7 @@ static int regulator_quirk_notify(struct notifier_block *nb, + + list_for_each_entry_safe(pos, tmp, &quirk_list, list) { + list_del(&pos->list); ++ of_node_put(pos->np); + kfree(pos); + } + +@@ -174,11 +175,12 @@ static int __init rcar_gen2_regulator_quirk(void) + memcpy(&quirk->i2c_msg, id->data, sizeof(quirk->i2c_msg)); + + quirk->id = id; +- quirk->np = np; ++ quirk->np = of_node_get(np); + quirk->i2c_msg.addr = addr; + + ret = of_irq_parse_one(np, 0, argsa); + if (ret) { /* Skip invalid entry and continue */ ++ of_node_put(np); + kfree(quirk); + continue; + } +@@ -225,6 +227,7 @@ static int __init rcar_gen2_regulator_quirk(void) + err_mem: + list_for_each_entry_safe(pos, tmp, &quirk_list, list) { + list_del(&pos->list); ++ of_node_put(pos->np); + kfree(pos); + } + +-- +2.35.1 + diff --git a/queue-5.4/arm64-do-not-forget-syscall-when-starting-a-new-thre.patch b/queue-5.4/arm64-do-not-forget-syscall-when-starting-a-new-thre.patch new file mode 100644 index 00000000000..a13055d639f --- /dev/null +++ b/queue-5.4/arm64-do-not-forget-syscall-when-starting-a-new-thre.patch @@ -0,0 +1,40 @@ +From b9ce7285a6c5136e36193b8bafb7dbf4c1193599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 17:24:46 +0100 +Subject: arm64: Do not forget syscall when starting a new thread. + +From: Francis Laniel + +[ Upstream commit de6921856f99c11d3986c6702d851e1328d4f7f6 ] + +Enable tracing of the execve*() system calls with the +syscalls:sys_exit_execve tracepoint by removing the call to +forget_syscall() when starting a new thread and preserving the value of +regs->syscallno across exec. + +Signed-off-by: Francis Laniel +Link: https://lore.kernel.org/r/20220608162447.666494-2-flaniel@linux.microsoft.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/processor.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h +index 5623685c7d13..65834b84f0e1 100644 +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -184,8 +184,9 @@ void tls_preserve_current_state(void); + + static inline void start_thread_common(struct pt_regs *regs, unsigned long pc) + { ++ s32 previous_syscall = regs->syscallno; + memset(regs, 0, sizeof(*regs)); +- forget_syscall(regs); ++ regs->syscallno = previous_syscall; + regs->pc = pc; + + if (system_uses_irq_prio_masking()) +-- +2.35.1 + diff --git a/queue-5.4/arm64-dts-allwinner-a64-orangepi-win-fix-led-node-na.patch b/queue-5.4/arm64-dts-allwinner-a64-orangepi-win-fix-led-node-na.patch new file mode 100644 index 00000000000..5c225947146 --- /dev/null +++ b/queue-5.4/arm64-dts-allwinner-a64-orangepi-win-fix-led-node-na.patch @@ -0,0 +1,37 @@ +From 2e8b0b9b71d01461ba021541a40f9fefad2712f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Jul 2022 08:28:15 -0500 +Subject: arm64: dts: allwinner: a64: orangepi-win: Fix LED node name + +From: Samuel Holland + +[ Upstream commit b8eb2df19fbf97aa1e950cf491232c2e3bef8357 ] + +"status" does not match any pattern in the gpio-leds binding. Rename the +node to the preferred pattern. This fixes a `make dtbs_check` error. + +Signed-off-by: Samuel Holland +Reviewed-by: Jernej Skrabec +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20220702132816.46456-1-samuel@sholland.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts +index a0db02504b69..963a7c505e30 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts +@@ -78,7 +78,7 @@ hdmi_con_in: endpoint { + leds { + compatible = "gpio-leds"; + +- status { ++ led-0 { + label = "orangepi:green:status"; + gpios = <&pio 7 11 GPIO_ACTIVE_HIGH>; /* PH11 */ + }; +-- +2.35.1 + diff --git a/queue-5.4/arm64-dts-mt7622-fix-bpi-r64-wps-button.patch b/queue-5.4/arm64-dts-mt7622-fix-bpi-r64-wps-button.patch new file mode 100644 index 00000000000..1d8158fccaf --- /dev/null +++ b/queue-5.4/arm64-dts-mt7622-fix-bpi-r64-wps-button.patch @@ -0,0 +1,52 @@ +From dac9da31c295191403a0067044047694847e12b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 13:16:57 +0200 +Subject: arm64: dts: mt7622: fix BPI-R64 WPS button + +From: Nick Hainke + +[ Upstream commit c98e6e683632386a3bd284acda4342e68aec4c41 ] + +The bananapi R64 (BPI-R64) experiences wrong WPS button signals. +In OpenWrt pushing the WPS button while powering on the device will set +it to recovery mode. Currently, this also happens without any user +interaction. In particular, the wrong signals appear while booting the +device or restarting it, e.g. after doing a system upgrade. If the +device is in recovery mode the user needs to manually power cycle or +restart it. + +The official BPI-R64 sources set the WPS button to GPIO_ACTIVE_LOW in +the device tree. This setting seems to suppress the unwanted WPS button +press signals. So this commit changes the button from GPIO_ACTIVE_HIGH to +GPIO_ACTIVE_LOW. + +The official BPI-R64 sources can be found on +https://github.com/BPI-SINOVOIP/BPI-R64-openwrt + +Fixes: 0b6286dd96c0 ("arm64: dts: mt7622: add bananapi BPI-R64 board") + +Suggested-by: INAGAKI Hiroshi +Signed-off-by: Nick Hainke +Link: https://lore.kernel.org/r/20220630111746.4098-1-vincent@systemli.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +index 83e10591e0e5..81215cc3759a 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts ++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts +@@ -49,7 +49,7 @@ factory { + wps { + label = "wps"; + linux,code = ; +- gpios = <&pio 102 GPIO_ACTIVE_HIGH>; ++ gpios = <&pio 102 GPIO_ACTIVE_LOW>; + }; + }; + +-- +2.35.1 + diff --git a/queue-5.4/arm64-dts-qcom-ipq8074-fix-nand-node-name.patch b/queue-5.4/arm64-dts-qcom-ipq8074-fix-nand-node-name.patch new file mode 100644 index 00000000000..659359459c3 --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-ipq8074-fix-nand-node-name.patch @@ -0,0 +1,37 @@ +From cb3fc777fa2ecc17a229de568ba79a639735a9e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jun 2022 14:06:42 +0200 +Subject: arm64: dts: qcom: ipq8074: fix NAND node name + +From: Robert Marko + +[ Upstream commit b39961659ffc3c3a9e3d0d43b0476547b5f35d49 ] + +Per schema it should be nand-controller@79b0000 instead of nand@79b0000. +Fix it to match nand-controller.yaml requirements. + +Signed-off-by: Robert Marko +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220621120642.518575-1-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 7822592664ff..1e9fa049c550 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -253,7 +253,7 @@ qpic_bam: dma@7984000 { + status = "disabled"; + }; + +- qpic_nand: nand@79b0000 { ++ qpic_nand: nand-controller@79b0000 { + compatible = "qcom,ipq8074-nand"; + reg = <0x79b0000 0x10000>; + #address-cells = <1>; +-- +2.35.1 + diff --git a/queue-5.4/arm64-fix-oops-in-concurrently-setting-insn_emulatio.patch b/queue-5.4/arm64-fix-oops-in-concurrently-setting-insn_emulatio.patch new file mode 100644 index 00000000000..042c170778f --- /dev/null +++ b/queue-5.4/arm64-fix-oops-in-concurrently-setting-insn_emulatio.patch @@ -0,0 +1,93 @@ +From 0f9e6948e359d7833455ad606814d209ee9d0541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Jul 2022 05:43:19 +0000 +Subject: arm64: fix oops in concurrently setting insn_emulation sysctls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: haibinzhang (张海斌) + +[ Upstream commit af483947d472eccb79e42059276c4deed76f99a6 ] + +emulation_proc_handler() changes table->data for proc_dointvec_minmax +and can generate the following Oops if called concurrently with itself: + + | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 + | Internal error: Oops: 96000006 [#1] SMP + | Call trace: + | update_insn_emulation_mode+0xc0/0x148 + | emulation_proc_handler+0x64/0xb8 + | proc_sys_call_handler+0x9c/0xf8 + | proc_sys_write+0x18/0x20 + | __vfs_write+0x20/0x48 + | vfs_write+0xe4/0x1d0 + | ksys_write+0x70/0xf8 + | __arm64_sys_write+0x20/0x28 + | el0_svc_common.constprop.0+0x7c/0x1c0 + | el0_svc_handler+0x2c/0xa0 + | el0_svc+0x8/0x200 + +To fix this issue, keep the table->data as &insn->current_mode and +use container_of() to retrieve the insn pointer. Another mutex is +used to protect against the current_mode update but not for retrieving +insn_emulation as table->data is no longer changing. + +Co-developed-by: hewenliang +Signed-off-by: hewenliang +Signed-off-by: Haibin Zhang +Reviewed-by: Catalin Marinas +Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei.com +Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencent.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/armv8_deprecated.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c +index bcb14d11232f..fbf66e0973aa 100644 +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -59,6 +59,7 @@ struct insn_emulation { + static LIST_HEAD(insn_emulation); + static int nr_insn_emulated __initdata; + static DEFINE_RAW_SPINLOCK(insn_emulation_lock); ++static DEFINE_MUTEX(insn_emulation_mutex); + + static void register_emulation_hooks(struct insn_emulation_ops *ops) + { +@@ -207,10 +208,10 @@ static int emulation_proc_handler(struct ctl_table *table, int write, + loff_t *ppos) + { + int ret = 0; +- struct insn_emulation *insn = (struct insn_emulation *) table->data; ++ struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode); + enum insn_emulation_mode prev_mode = insn->current_mode; + +- table->data = &insn->current_mode; ++ mutex_lock(&insn_emulation_mutex); + ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + + if (ret || !write || prev_mode == insn->current_mode) +@@ -223,7 +224,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write, + update_insn_emulation_mode(insn, INSN_UNDEF); + } + ret: +- table->data = insn; ++ mutex_unlock(&insn_emulation_mutex); + return ret; + } + +@@ -247,7 +248,7 @@ static void __init register_insn_emulation_sysctl(void) + sysctl->maxlen = sizeof(int); + + sysctl->procname = insn->ops->name; +- sysctl->data = insn; ++ sysctl->data = &insn->current_mode; + sysctl->extra1 = &insn->min; + sysctl->extra2 = &insn->max; + sysctl->proc_handler = emulation_proc_handler; +-- +2.35.1 + diff --git a/queue-5.4/asoc-audio-graph-card-add-of_node_put-in-fail-path.patch b/queue-5.4/asoc-audio-graph-card-add-of_node_put-in-fail-path.patch new file mode 100644 index 00000000000..16b7f3b30ee --- /dev/null +++ b/queue-5.4/asoc-audio-graph-card-add-of_node_put-in-fail-path.patch @@ -0,0 +1,40 @@ +From 7c748c77aed39eae09e14b135150e93d35da5426 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 22:43:08 +0800 +Subject: ASoC: audio-graph-card: Add of_node_put() in fail path + +From: Liang He + +[ Upstream commit 65fb8e2ef3531a6e950060fca6e551c923fb0f0e ] + +In asoc_simple_parse_dai(), we should call of_node_put() for the +reference returned by of_graph_get_port_parent() in fail path. + +Fixes: ae30a694da4c ("ASoC: simple-card-utils: add asoc_simple_card_parse_dai()") +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220721144308.1301587-1-windhl@126.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/audio-graph-card.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c +index 1bc498124689..96aa2c015572 100644 +--- a/sound/soc/generic/audio-graph-card.c ++++ b/sound/soc/generic/audio-graph-card.c +@@ -149,8 +149,10 @@ static int asoc_simple_parse_dai(struct device_node *ep, + * if he unbinded CPU or Codec. + */ + ret = snd_soc_get_dai_name(&args, &dlc->dai_name); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(node); + return ret; ++ } + + dlc->of_node = node; + +-- +2.35.1 + diff --git a/queue-5.4/asoc-codecs-da7210-add-check-for-i2c_add_driver.patch b/queue-5.4/asoc-codecs-da7210-add-check-for-i2c_add_driver.patch new file mode 100644 index 00000000000..a07ab8dfdf7 --- /dev/null +++ b/queue-5.4/asoc-codecs-da7210-add-check-for-i2c_add_driver.patch @@ -0,0 +1,41 @@ +From 451de7c5855dc7fc3edf1633d98398c3e599a1ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 17:47:12 +0800 +Subject: ASoC: codecs: da7210: add check for i2c_add_driver + +From: Jiasheng Jiang + +[ Upstream commit 82fa8f581a954ddeec1602bed9f8b4a09d100e6e ] + +As i2c_add_driver could return error if fails, it should be +better to check the return value. +However, if the CONFIG_I2C and CONFIG_SPI_MASTER are both true, +the return value of i2c_add_driver will be covered by +spi_register_driver. +Therefore, it is necessary to add check and return error if fails. + +Fixes: aa0e25caafb7 ("ASoC: da7210: Add support for spi regmap") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220531094712.2376759-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/da7210.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/da7210.c b/sound/soc/codecs/da7210.c +index e172913d04a4..efc5049c0796 100644 +--- a/sound/soc/codecs/da7210.c ++++ b/sound/soc/codecs/da7210.c +@@ -1333,6 +1333,8 @@ static int __init da7210_modinit(void) + int ret = 0; + #if IS_ENABLED(CONFIG_I2C) + ret = i2c_add_driver(&da7210_i2c_driver); ++ if (ret) ++ return ret; + #endif + #if defined(CONFIG_SPI_MASTER) + ret = spi_register_driver(&da7210_spi_driver); +-- +2.35.1 + diff --git a/queue-5.4/asoc-codecs-msm8916-wcd-digital-move-gains-from-sx_t.patch b/queue-5.4/asoc-codecs-msm8916-wcd-digital-move-gains-from-sx_t.patch new file mode 100644 index 00000000000..537d441fa0f --- /dev/null +++ b/queue-5.4/asoc-codecs-msm8916-wcd-digital-move-gains-from-sx_t.patch @@ -0,0 +1,102 @@ +From 5186ce4ae372400eceb52d05baaa5cbcdf52ba4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 12:19:00 +0100 +Subject: ASoC: codecs: msm8916-wcd-digital: move gains from SX_TLV to S8_TLV + +From: Srinivas Kandagatla + +[ Upstream commit 5babb012c847beb6c8c7108fd78f650b7a2c6054 ] + +move all the digital gains form using SX_TLV to S8_TLV, these gains are +actually 8 bit gains with 7th signed bit and ranges from -84dB to +40dB + +rest of the Qualcomm wcd codecs uses these properly. + +Fixes: ef8a4757a6db ("ASoC: msm8916-wcd-digital: Add sidetone support") +Fixes: 150db8c5afa1 ("ASoC: codecs: Add msm8916-wcd digital codec") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220609111901.318047-2-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/msm8916-wcd-digital.c | 46 +++++++++++++------------- + 1 file changed, 23 insertions(+), 23 deletions(-) + +diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c +index e4cde214b7b2..6e5bce4f5eb2 100644 +--- a/sound/soc/codecs/msm8916-wcd-digital.c ++++ b/sound/soc/codecs/msm8916-wcd-digital.c +@@ -328,8 +328,8 @@ static const struct snd_kcontrol_new rx1_mix2_inp1_mux = SOC_DAPM_ENUM( + static const struct snd_kcontrol_new rx2_mix2_inp1_mux = SOC_DAPM_ENUM( + "RX2 MIX2 INP1 Mux", rx2_mix2_inp1_chain_enum); + +-/* Digital Gain control -38.4 dB to +38.4 dB in 0.3 dB steps */ +-static const DECLARE_TLV_DB_SCALE(digital_gain, -3840, 30, 0); ++/* Digital Gain control -84 dB to +40 dB in 1 dB steps */ ++static const DECLARE_TLV_DB_SCALE(digital_gain, -8400, 100, -8400); + + /* Cutoff Freq for High Pass Filter at -3dB */ + static const char * const hpf_cutoff_text[] = { +@@ -510,15 +510,15 @@ static int wcd_iir_filter_info(struct snd_kcontrol *kcontrol, + + static const struct snd_kcontrol_new msm8916_wcd_digital_snd_controls[] = { + SOC_SINGLE_S8_TLV("RX1 Digital Volume", LPASS_CDC_RX1_VOL_CTL_B2_CTL, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_SINGLE_S8_TLV("RX2 Digital Volume", LPASS_CDC_RX2_VOL_CTL_B2_CTL, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_SINGLE_S8_TLV("RX3 Digital Volume", LPASS_CDC_RX3_VOL_CTL_B2_CTL, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_SINGLE_S8_TLV("TX1 Digital Volume", LPASS_CDC_TX1_VOL_CTL_GAIN, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_SINGLE_S8_TLV("TX2 Digital Volume", LPASS_CDC_TX2_VOL_CTL_GAIN, +- -128, 127, digital_gain), ++ -84, 40, digital_gain), + SOC_ENUM("TX1 HPF Cutoff", tx1_hpf_cutoff_enum), + SOC_ENUM("TX2 HPF Cutoff", tx2_hpf_cutoff_enum), + SOC_SINGLE("TX1 HPF Switch", LPASS_CDC_TX1_MUX_CTL, 3, 1, 0), +@@ -553,22 +553,22 @@ static const struct snd_kcontrol_new msm8916_wcd_digital_snd_controls[] = { + WCD_IIR_FILTER_CTL("IIR2 Band3", IIR2, BAND3), + WCD_IIR_FILTER_CTL("IIR2 Band4", IIR2, BAND4), + WCD_IIR_FILTER_CTL("IIR2 Band5", IIR2, BAND5), +- SOC_SINGLE_SX_TLV("IIR1 INP1 Volume", LPASS_CDC_IIR1_GAIN_B1_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR1 INP2 Volume", LPASS_CDC_IIR1_GAIN_B2_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR1 INP3 Volume", LPASS_CDC_IIR1_GAIN_B3_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR1 INP4 Volume", LPASS_CDC_IIR1_GAIN_B4_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR2 INP1 Volume", LPASS_CDC_IIR2_GAIN_B1_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR2 INP2 Volume", LPASS_CDC_IIR2_GAIN_B2_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR2 INP3 Volume", LPASS_CDC_IIR2_GAIN_B3_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("IIR2 INP4 Volume", LPASS_CDC_IIR2_GAIN_B4_CTL, +- 0, -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR1 INP1 Volume", LPASS_CDC_IIR1_GAIN_B1_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR1 INP2 Volume", LPASS_CDC_IIR1_GAIN_B2_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR1 INP3 Volume", LPASS_CDC_IIR1_GAIN_B3_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR1 INP4 Volume", LPASS_CDC_IIR1_GAIN_B4_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR2 INP1 Volume", LPASS_CDC_IIR2_GAIN_B1_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR2 INP2 Volume", LPASS_CDC_IIR2_GAIN_B2_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR2 INP3 Volume", LPASS_CDC_IIR2_GAIN_B3_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("IIR2 INP4 Volume", LPASS_CDC_IIR2_GAIN_B4_CTL, ++ -84, 40, digital_gain), + + }; + +-- +2.35.1 + diff --git a/queue-5.4/asoc-codecs-wcd9335-move-gains-from-sx_tlv-to-s8_tlv.patch b/queue-5.4/asoc-codecs-wcd9335-move-gains-from-sx_tlv-to-s8_tlv.patch new file mode 100644 index 00000000000..1f667c3a01d --- /dev/null +++ b/queue-5.4/asoc-codecs-wcd9335-move-gains-from-sx_tlv-to-s8_tlv.patch @@ -0,0 +1,118 @@ +From 851fdea22e2e05ba33f0f24d296b79cb79c9f5e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 12:19:01 +0100 +Subject: ASoC: codecs: wcd9335: move gains from SX_TLV to S8_TLV + +From: Srinivas Kandagatla + +[ Upstream commit 2fbe0953732e06b471cdedbf6f615b84235580d8 ] + +move all the digital gains form using SX_TLV to S8_TLV, these gains are +actually 8 bit gains with 7th signed bit and ranges from -84dB to +40dB + +rest of the Qualcomm wcd codecs uses these properly. + +Fixes: 8c4f021d806a ("ASoC: wcd9335: add basic controls") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220609111901.318047-3-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd9335.c | 81 +++++++++++++++++--------------------- + 1 file changed, 36 insertions(+), 45 deletions(-) + +diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c +index 016aff97e2fb..c01c69613f63 100644 +--- a/sound/soc/codecs/wcd9335.c ++++ b/sound/soc/codecs/wcd9335.c +@@ -2252,51 +2252,42 @@ static int wcd9335_rx_hph_mode_put(struct snd_kcontrol *kc, + + static const struct snd_kcontrol_new wcd9335_snd_controls[] = { + /* -84dB min - 40dB max */ +- SOC_SINGLE_SX_TLV("RX0 Digital Volume", WCD9335_CDC_RX0_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX1 Digital Volume", WCD9335_CDC_RX1_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX2 Digital Volume", WCD9335_CDC_RX2_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX3 Digital Volume", WCD9335_CDC_RX3_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX4 Digital Volume", WCD9335_CDC_RX4_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX5 Digital Volume", WCD9335_CDC_RX5_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX6 Digital Volume", WCD9335_CDC_RX6_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX7 Digital Volume", WCD9335_CDC_RX7_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX8 Digital Volume", WCD9335_CDC_RX8_RX_VOL_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX0 Mix Digital Volume", +- WCD9335_CDC_RX0_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX1 Mix Digital Volume", +- WCD9335_CDC_RX1_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX2 Mix Digital Volume", +- WCD9335_CDC_RX2_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX3 Mix Digital Volume", +- WCD9335_CDC_RX3_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX4 Mix Digital Volume", +- WCD9335_CDC_RX4_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX5 Mix Digital Volume", +- WCD9335_CDC_RX5_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX6 Mix Digital Volume", +- WCD9335_CDC_RX6_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX7 Mix Digital Volume", +- WCD9335_CDC_RX7_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), +- SOC_SINGLE_SX_TLV("RX8 Mix Digital Volume", +- WCD9335_CDC_RX8_RX_VOL_MIX_CTL, +- 0, -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX0 Digital Volume", WCD9335_CDC_RX0_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX1 Digital Volume", WCD9335_CDC_RX1_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX2 Digital Volume", WCD9335_CDC_RX2_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX3 Digital Volume", WCD9335_CDC_RX3_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX4 Digital Volume", WCD9335_CDC_RX4_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX5 Digital Volume", WCD9335_CDC_RX5_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX6 Digital Volume", WCD9335_CDC_RX6_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX7 Digital Volume", WCD9335_CDC_RX7_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX8 Digital Volume", WCD9335_CDC_RX8_RX_VOL_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX0 Mix Digital Volume", WCD9335_CDC_RX0_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX1 Mix Digital Volume", WCD9335_CDC_RX1_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX2 Mix Digital Volume", WCD9335_CDC_RX2_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX3 Mix Digital Volume", WCD9335_CDC_RX3_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX4 Mix Digital Volume", WCD9335_CDC_RX4_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX5 Mix Digital Volume", WCD9335_CDC_RX5_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX6 Mix Digital Volume", WCD9335_CDC_RX6_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX7 Mix Digital Volume", WCD9335_CDC_RX7_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), ++ SOC_SINGLE_S8_TLV("RX8 Mix Digital Volume", WCD9335_CDC_RX8_RX_VOL_MIX_CTL, ++ -84, 40, digital_gain), + SOC_ENUM("RX INT0_1 HPF cut off", cf_int0_1_enum), + SOC_ENUM("RX INT0_2 HPF cut off", cf_int0_2_enum), + SOC_ENUM("RX INT1_1 HPF cut off", cf_int1_1_enum), +-- +2.35.1 + diff --git a/queue-5.4/asoc-mediatek-mt8173-fix-refcount-leak-in-mt8173_rt5.patch b/queue-5.4/asoc-mediatek-mt8173-fix-refcount-leak-in-mt8173_rt5.patch new file mode 100644 index 00000000000..ddec0de349c --- /dev/null +++ b/queue-5.4/asoc-mediatek-mt8173-fix-refcount-leak-in-mt8173_rt5.patch @@ -0,0 +1,67 @@ +From e6782a790ca8f2e4636d6c9bbedf20cbb797371a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 07:41:42 +0400 +Subject: ASoC: mediatek: mt8173: Fix refcount leak in + mt8173_rt5650_rt5676_dev_probe + +From: Miaoqian Lin + +[ Upstream commit ae4f11c1ed2d67192fdf3d89db719ee439827c11 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Fix missing of_node_put() in error paths. + +Fixes: 94319ba10eca ("ASoC: mediatek: Use platform_of_node for machine drivers") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220602034144.60159-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +index 727ff0f7f20b..8e1e60a9b45c 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +@@ -256,14 +256,16 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_rt5676_dais[DAI_LINK_CODEC_I2S].codecs[0].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + mt8173_rt5650_rt5676_dais[DAI_LINK_CODEC_I2S].codecs[1].of_node = + of_parse_phandle(pdev->dev.of_node, "mediatek,audio-codec", 1); + if (!mt8173_rt5650_rt5676_dais[DAI_LINK_CODEC_I2S].codecs[1].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + mt8173_rt5650_rt5676_codec_conf[0].of_node = + mt8173_rt5650_rt5676_dais[DAI_LINK_CODEC_I2S].codecs[1].of_node; +@@ -276,7 +278,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_rt5676_dais[DAI_LINK_HDMI_I2S].codecs->of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_node; + } + + card->dev = &pdev->dev; +@@ -286,6 +289,7 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_node: + of_node_put(platform_node); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.4/asoc-mediatek-mt8173-rt5650-fix-refcount-leak-in-mt8.patch b/queue-5.4/asoc-mediatek-mt8173-rt5650-fix-refcount-leak-in-mt8.patch new file mode 100644 index 00000000000..12c63b1b8db --- /dev/null +++ b/queue-5.4/asoc-mediatek-mt8173-rt5650-fix-refcount-leak-in-mt8.patch @@ -0,0 +1,67 @@ +From dbcda25f85f5e414a7332b20c58e90e73f54fff8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 16:42:41 +0400 +Subject: ASoC: mediatek: mt8173-rt5650: Fix refcount leak in + mt8173_rt5650_dev_probe + +From: Miaoqian Lin + +[ Upstream commit efe2178d1a32492f99e7f1f2568eea5c88a85729 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Fix refcount leak in some error paths. + +Fixes: 0f83f9296d5c ("ASoC: mediatek: Add machine driver for ALC5650 codec") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220603124243.31358-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8173/mt8173-rt5650.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c +index 21e7d4d3ded5..cdfc697ad94e 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c +@@ -266,7 +266,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_dais[DAI_LINK_CODEC_I2S].codecs[0].of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + mt8173_rt5650_dais[DAI_LINK_CODEC_I2S].codecs[1].of_node = + mt8173_rt5650_dais[DAI_LINK_CODEC_I2S].codecs[0].of_node; +@@ -279,7 +280,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "%s codec_capture_dai name fail %d\n", + __func__, ret); +- return ret; ++ goto put_platform_node; + } + mt8173_rt5650_dais[DAI_LINK_CODEC_I2S].codecs[1].dai_name = + codec_capture_dai; +@@ -301,7 +302,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + if (!mt8173_rt5650_dais[DAI_LINK_HDMI_I2S].codecs->of_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + card->dev = &pdev->dev; + +@@ -310,6 +312,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_platform_node: + of_node_put(platform_node); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.4/asoc-mt6797-mt6351-fix-refcount-leak-in-mt6797_mt635.patch b/queue-5.4/asoc-mt6797-mt6351-fix-refcount-leak-in-mt6797_mt635.patch new file mode 100644 index 00000000000..544a84825fe --- /dev/null +++ b/queue-5.4/asoc-mt6797-mt6351-fix-refcount-leak-in-mt6797_mt635.patch @@ -0,0 +1,49 @@ +From faeeddf90310ae78383c1a7b535ff5048edc41e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 12:34:15 +0400 +Subject: ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe + +From: Miaoqian Lin + +[ Upstream commit 7472eb8d7dd12b6b9b1a4f4527719cc9c7f5965f ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: f0ab0bf250da ("ASoC: add mt6797-mt6351 driver and config option") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220603083417.9011-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt6797/mt6797-mt6351.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/mediatek/mt6797/mt6797-mt6351.c b/sound/soc/mediatek/mt6797/mt6797-mt6351.c +index 496f32bcfb5e..d2f6213a6bfc 100644 +--- a/sound/soc/mediatek/mt6797/mt6797-mt6351.c ++++ b/sound/soc/mediatek/mt6797/mt6797-mt6351.c +@@ -217,7 +217,8 @@ static int mt6797_mt6351_dev_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for_each_card_prelinks(card, i, dai_link) { + if (dai_link->codecs->name) +@@ -230,6 +231,9 @@ static int mt6797_mt6351_dev_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++ of_node_put(codec_node); ++put_platform_node: ++ of_node_put(platform_node); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.4/asoc-qcom-q6dsp-fix-an-off-by-one-in-q6adm_alloc_cop.patch b/queue-5.4/asoc-qcom-q6dsp-fix-an-off-by-one-in-q6adm_alloc_cop.patch new file mode 100644 index 00000000000..5e01ad4f034 --- /dev/null +++ b/queue-5.4/asoc-qcom-q6dsp-fix-an-off-by-one-in-q6adm_alloc_cop.patch @@ -0,0 +1,37 @@ +From f922014dc2bb2fd1058e57d321c0fc4d92623495 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 11:02:22 +0200 +Subject: ASoC: qcom: q6dsp: Fix an off-by-one in q6adm_alloc_copp() + +From: Christophe JAILLET + +[ Upstream commit 673f58f62ca6fc98979d1cf3fe89c3ff33f29b2e ] + +find_first_zero_bit() returns MAX_COPPS_PER_PORT at max here. +So 'idx' should be tested with ">=" or the test can't match. + +Fixes: 7b20b2be51e1 ("ASoC: qdsp6: q6adm: Add q6adm driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/0fca3271649736053eb9649d87e1ca01b056be40.1658394124.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/qdsp6/q6adm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/qcom/qdsp6/q6adm.c b/sound/soc/qcom/qdsp6/q6adm.c +index da242515e146..8e3539941fad 100644 +--- a/sound/soc/qcom/qdsp6/q6adm.c ++++ b/sound/soc/qcom/qdsp6/q6adm.c +@@ -217,7 +217,7 @@ static struct q6copp *q6adm_alloc_copp(struct q6adm *adm, int port_idx) + idx = find_first_zero_bit(&adm->copp_bitmap[port_idx], + MAX_COPPS_PER_PORT); + +- if (idx > MAX_COPPS_PER_PORT) ++ if (idx >= MAX_COPPS_PER_PORT) + return ERR_PTR(-EBUSY); + + c = kzalloc(sizeof(*c), GFP_ATOMIC); +-- +2.35.1 + diff --git a/queue-5.4/ath10k-do-not-enforce-interrupt-trigger-type.patch b/queue-5.4/ath10k-do-not-enforce-interrupt-trigger-type.patch new file mode 100644 index 00000000000..08820aa399c --- /dev/null +++ b/queue-5.4/ath10k-do-not-enforce-interrupt-trigger-type.patch @@ -0,0 +1,58 @@ +From c3936281be7e43676815386e138de4fd2ee879fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 10:27:26 +0300 +Subject: ath10k: do not enforce interrupt trigger type + +From: Krzysztof Kozlowski + +[ Upstream commit 1ee6c5abebd3cacf2ac4378d0ed4f57fd4850421 ] + +Interrupt line can be configured on different hardware in different way, +even inverted. Therefore driver should not enforce specific trigger +type - edge rising - but instead rely on Devicetree to configure it. + +All Qualcomm DTSI with WCN3990 define the interrupt type as level high, +so the mismatch between DTSI and driver causes rebind issues: + + $ echo 18800000.wifi > /sys/bus/platform/drivers/ath10k_snoc/unbind + $ echo 18800000.wifi > /sys/bus/platform/drivers/ath10k_snoc/bind + [ 44.763114] irq: type mismatch, failed to map hwirq-446 for interrupt-controller@17a00000! + [ 44.763130] ath10k_snoc 18800000.wifi: error -ENXIO: IRQ index 0 not found + [ 44.763140] ath10k_snoc 18800000.wifi: failed to initialize resource: -6 + +Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.0.c8-00009-QCAHLSWSC8180XMTPLZ-1 +Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 + +Fixes: c963a683e701 ("ath10k: add resource init and deinit for WCN3990") +Signed-off-by: Krzysztof Kozlowski +Tested-by: Steev Klimaszewski +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220513151516.357549-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/snoc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c +index d4589b2ab3b6..b6762fe2efe2 100644 +--- a/drivers/net/wireless/ath/ath10k/snoc.c ++++ b/drivers/net/wireless/ath/ath10k/snoc.c +@@ -1192,13 +1192,12 @@ static void ath10k_snoc_init_napi(struct ath10k *ar) + static int ath10k_snoc_request_irq(struct ath10k *ar) + { + struct ath10k_snoc *ar_snoc = ath10k_snoc_priv(ar); +- int irqflags = IRQF_TRIGGER_RISING; + int ret, id; + + for (id = 0; id < CE_COUNT_MAX; id++) { + ret = request_irq(ar_snoc->ce_irqs[id].irq_line, +- ath10k_snoc_per_engine_handler, +- irqflags, ce_name[id], ar); ++ ath10k_snoc_per_engine_handler, 0, ++ ce_name[id], ar); + if (ret) { + ath10k_err(ar, + "failed to register IRQ handler for CE %d: %d", +-- +2.35.1 + diff --git a/queue-5.4/ath9k-fix-use-after-free-in-ath9k_hif_usb_rx_cb.patch b/queue-5.4/ath9k-fix-use-after-free-in-ath9k_hif_usb_rx_cb.patch new file mode 100644 index 00000000000..37111930589 --- /dev/null +++ b/queue-5.4/ath9k-fix-use-after-free-in-ath9k_hif_usb_rx_cb.patch @@ -0,0 +1,94 @@ +From 645af018a964e380b709c92a2298c1dcc44c2621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 21:43:59 +0300 +Subject: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pavel Skripkin + +[ Upstream commit 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 ] + +Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The +problem was in incorrect htc_handle->drv_priv initialization. + +Probable call trace which can trigger use-after-free: + +ath9k_htc_probe_device() + /* htc_handle->drv_priv = priv; */ + ath9k_htc_wait_for_target() <--- Failed + ieee80211_free_hw() <--- priv pointer is freed + + +... +ath9k_hif_usb_rx_cb() + ath9k_hif_usb_rx_stream() + RX_STAT_INC() <--- htc_handle->drv_priv access + +In order to not add fancy protection for drv_priv we can move +htc_handle->drv_priv initialization at the end of the +ath9k_htc_probe_device() and add helper macro to make +all *_STAT_* macros NULL safe, since syzbot has reported related NULL +deref in that macros [1] + +Link: https://syzkaller.appspot.com/bug?id=6ead44e37afb6866ac0c7dd121b4ce07cb665f60 [0] +Link: https://syzkaller.appspot.com/bug?id=b8101ffcec107c0567a0cd8acbbacec91e9ee8de [1] +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-and-tested-by: syzbot+03110230a11411024147@syzkaller.appspotmail.com +Reported-and-tested-by: syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/d57bbedc857950659bfacac0ab48790c1eda00c8.1655145743.git.paskripkin@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc.h | 10 +++++----- + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 3 ++- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h +index 9f64e32381f9..81107100e368 100644 +--- a/drivers/net/wireless/ath/ath9k/htc.h ++++ b/drivers/net/wireless/ath/ath9k/htc.h +@@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) + } + + #ifdef CONFIG_ATH9K_HTC_DEBUGFS +- +-#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) +-#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) +-#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) +-#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) ++#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) ++#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) ++#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) ++#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) ++#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) + #define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ + + #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++) +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 11054c17a9b5..eaaafa64a3ee 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -944,7 +944,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, + priv->hw = hw; + priv->htc = htc_handle; + priv->dev = dev; +- htc_handle->drv_priv = priv; + SET_IEEE80211_DEV(hw, priv->dev); + + ret = ath9k_htc_wait_for_target(priv); +@@ -965,6 +964,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, + if (ret) + goto err_init; + ++ htc_handle->drv_priv = priv; ++ + return 0; + + err_init: +-- +2.35.1 + diff --git a/queue-5.4/blk-mq-don-t-create-hctx-debugfs-dir-until-q-debugfs.patch b/queue-5.4/blk-mq-don-t-create-hctx-debugfs-dir-until-q-debugfs.patch new file mode 100644 index 00000000000..eb7a4552faf --- /dev/null +++ b/queue-5.4/blk-mq-don-t-create-hctx-debugfs-dir-until-q-debugfs.patch @@ -0,0 +1,44 @@ +From a49e2a610c21b02fe6616903e1b490c1d7d02b1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:08:08 +0800 +Subject: blk-mq: don't create hctx debugfs dir until q->debugfs_dir is created + +From: Ming Lei + +[ Upstream commit f3ec5d11554778c24ac8915e847223ed71d104fc ] + +blk_mq_debugfs_register_hctx() can be called by blk_mq_update_nr_hw_queues +when gendisk isn't added yet, such as nvme tcp. + +Fixes the warning of 'debugfs: Directory 'hctx0' with parent '/' already present!' +which can be observed reliably when running blktests nvme/005. + +Fixes: 6cfc0081b046 ("blk-mq: no need to check return value of debugfs_create functions") +Reported-by: Yi Zhang +Signed-off-by: Ming Lei +Tested-by: Yi Zhang +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220711090808.259682-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-debugfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index 121f4c1e0697..772a6c6b1634 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -883,6 +883,9 @@ void blk_mq_debugfs_register_hctx(struct request_queue *q, + char name[20]; + int i; + ++ if (!q->debugfs_dir) ++ return; ++ + snprintf(name, sizeof(name), "hctx%u", hctx->queue_num); + hctx->debugfs_dir = debugfs_create_dir(name, q->debugfs_dir); + +-- +2.35.1 + diff --git a/queue-5.4/bluetooth-hci_intel-add-check-for-platform_driver_re.patch b/queue-5.4/bluetooth-hci_intel-add-check-for-platform_driver_re.patch new file mode 100644 index 00000000000..a008e24345a --- /dev/null +++ b/queue-5.4/bluetooth-hci_intel-add-check-for-platform_driver_re.patch @@ -0,0 +1,41 @@ +From f8f0279987a8b606a3db40ef982b4ce4b07b737b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 09:24:36 +0800 +Subject: Bluetooth: hci_intel: Add check for platform_driver_register + +From: Jiasheng Jiang + +[ Upstream commit ab2d2a982ff721f4b029282d9a40602ea46a745e ] + +As platform_driver_register() could fail, it should be better +to deal with the return value in order to maintain the code +consisitency. + +Fixes: 1ab1f239bf17 ("Bluetooth: hci_intel: Add support for platform driver") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_intel.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c +index 31f25153087d..02c96c603768 100644 +--- a/drivers/bluetooth/hci_intel.c ++++ b/drivers/bluetooth/hci_intel.c +@@ -1230,7 +1230,11 @@ static struct platform_driver intel_driver = { + + int __init intel_init(void) + { +- platform_driver_register(&intel_driver); ++ int err; ++ ++ err = platform_driver_register(&intel_driver); ++ if (err) ++ return err; + + return hci_uart_register_proto(&intel_proto); + } +-- +2.35.1 + diff --git a/queue-5.4/bus-hisi_lpc-fix-missing-platform_device_put-in-hisi.patch b/queue-5.4/bus-hisi_lpc-fix-missing-platform_device_put-in-hisi.patch new file mode 100644 index 00000000000..1719f5ea3cf --- /dev/null +++ b/queue-5.4/bus-hisi_lpc-fix-missing-platform_device_put-in-hisi.patch @@ -0,0 +1,75 @@ +From 0e146655a112b23393cb4eda158c292a5aaa708d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 17:43:52 +0800 +Subject: bus: hisi_lpc: fix missing platform_device_put() in + hisi_lpc_acpi_probe() + +From: Yang Yingliang + +[ Upstream commit 54872fea6a5ac967ec2272aea525d1438ac6735a ] + +In error case in hisi_lpc_acpi_probe() after calling platform_device_add(), +hisi_lpc_acpi_remove() can't release the failed 'pdev', so it will be leak, +call platform_device_put() to fix this problem. +I'v constructed this error case and tested this patch on D05 board. + +Fixes: 99c0228d6ff1 ("HISI LPC: Re-Add ACPI child enumeration support") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Acked-by: John Garry +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/bus/hisi_lpc.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/bus/hisi_lpc.c b/drivers/bus/hisi_lpc.c +index 2e9252d37a18..0922cbe8900b 100644 +--- a/drivers/bus/hisi_lpc.c ++++ b/drivers/bus/hisi_lpc.c +@@ -504,13 +504,13 @@ static int hisi_lpc_acpi_probe(struct device *hostdev) + { + struct acpi_device *adev = ACPI_COMPANION(hostdev); + struct acpi_device *child; ++ struct platform_device *pdev; + int ret; + + /* Only consider the children of the host */ + list_for_each_entry(child, &adev->children, node) { + const char *hid = acpi_device_hid(child); + const struct hisi_lpc_acpi_cell *cell; +- struct platform_device *pdev; + const struct resource *res; + bool found = false; + int num_res; +@@ -572,22 +572,24 @@ static int hisi_lpc_acpi_probe(struct device *hostdev) + + ret = platform_device_add_resources(pdev, res, num_res); + if (ret) +- goto fail; ++ goto fail_put_device; + + ret = platform_device_add_data(pdev, cell->pdata, + cell->pdata_size); + if (ret) +- goto fail; ++ goto fail_put_device; + + ret = platform_device_add(pdev); + if (ret) +- goto fail; ++ goto fail_put_device; + + acpi_device_set_enumerated(child); + } + + return 0; + ++fail_put_device: ++ platform_device_put(pdev); + fail: + hisi_lpc_acpi_remove(hostdev); + return ret; +-- +2.35.1 + diff --git a/queue-5.4/can-error-specify-the-values-of-data-5.7-of-can-erro.patch b/queue-5.4/can-error-specify-the-values-of-data-5.7-of-can-erro.patch new file mode 100644 index 00000000000..83f00de6b2d --- /dev/null +++ b/queue-5.4/can-error-specify-the-values-of-data-5.7-of-can-erro.patch @@ -0,0 +1,49 @@ +From ddb83f648461de4516f637e0a92084611bb93a77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:48 +0900 +Subject: can: error: specify the values of data[5..7] of CAN error frames + +From: Vincent Mailhol + +[ Upstream commit e70a3263a7eed768d5f947b8f2aff8d2a79c9d97 ] + +Currently, data[5..7] of struct can_frame, when used as a CAN error +frame, are defined as being "controller specific". Device specific +behaviours are problematic because it prevents someone from writing +code which is portable between devices. + +As a matter of fact, data[5] is never used, data[6] is always used to +report TX error counter and data[7] is always used to report RX error +counter. can-utils also relies on this. + +This patch updates the comment in the uapi header to specify that +data[5] is reserved (and thus should not be used) and that data[6..7] +are used for error counters. + +Fixes: 0d66548a10cb ("[CAN]: Add PF_CAN core module") +Link: https://lore.kernel.org/all/20220719143550.3681-11-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + include/uapi/linux/can/error.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/include/uapi/linux/can/error.h b/include/uapi/linux/can/error.h +index 34633283de64..a1000cb63063 100644 +--- a/include/uapi/linux/can/error.h ++++ b/include/uapi/linux/can/error.h +@@ -120,6 +120,9 @@ + #define CAN_ERR_TRX_CANL_SHORT_TO_GND 0x70 /* 0111 0000 */ + #define CAN_ERR_TRX_CANL_SHORT_TO_CANH 0x80 /* 1000 0000 */ + +-/* controller specific additional information / data[5..7] */ ++/* data[5] is reserved (do not use) */ ++ ++/* TX error counter / data[6] */ ++/* RX error counter / data[7] */ + + #endif /* _UAPI_CAN_ERROR_H */ +-- +2.35.1 + diff --git a/queue-5.4/can-hi311x-do-not-report-txerr-and-rxerr-during-bus-.patch b/queue-5.4/can-hi311x-do-not-report-txerr-and-rxerr-during-bus-.patch new file mode 100644 index 00000000000..4f90b222401 --- /dev/null +++ b/queue-5.4/can-hi311x-do-not-report-txerr-and-rxerr-during-bus-.patch @@ -0,0 +1,47 @@ +From e93eee3bb474ca05e09f358d0f962cbb4f05e28c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:43 +0900 +Subject: can: hi311x: do not report txerr and rxerr during bus-off + +From: Vincent Mailhol + +[ Upstream commit a22bd630cfff496b270211745536e50e98eb3a45 ] + +During bus off, the error count is greater than 255 and can not fit in +a u8. + +Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver") +Link: https://lore.kernel.org/all/20220719143550.3681-6-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/hi311x.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 7d2315c8cacb..28273e84171a 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -670,8 +670,6 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) + + txerr = hi3110_read(spi, HI3110_READ_TEC); + rxerr = hi3110_read(spi, HI3110_READ_REC); +- cf->data[6] = txerr; +- cf->data[7] = rxerr; + tx_state = txerr >= rxerr ? new_state : 0; + rx_state = txerr <= rxerr ? new_state : 0; + can_change_state(net, cf, tx_state, rx_state); +@@ -684,6 +682,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) + hi3110_hw_sleep(spi); + break; + } ++ } else { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; + } + } + +-- +2.35.1 + diff --git a/queue-5.4/can-kvaser_usb_hydra-do-not-report-txerr-and-rxerr-d.patch b/queue-5.4/can-kvaser_usb_hydra-do-not-report-txerr-and-rxerr-d.patch new file mode 100644 index 00000000000..43bb886a048 --- /dev/null +++ b/queue-5.4/can-kvaser_usb_hydra-do-not-report-txerr-and-rxerr-d.patch @@ -0,0 +1,55 @@ +From 7126891afa8b5490cd0b022c991e30137423ef97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:45 +0900 +Subject: can: kvaser_usb_hydra: do not report txerr and rxerr during bus-off + +From: Vincent Mailhol + +[ Upstream commit 936e90595376e64b6247c72d3ea8b8b164b7ac96 ] + +During bus off, the error count is greater than 255 and can not fit in +a u8. + +Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") +Link: https://lore.kernel.org/all/20220719143550.3681-8-mailhol.vincent@wanadoo.fr +CC: Jimmy Assarsson +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index a7c408acb0c0..01d4a731b579 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -890,8 +890,10 @@ static void kvaser_usb_hydra_update_state(struct kvaser_usb_net_priv *priv, + new_state < CAN_STATE_BUS_OFF) + priv->can.can_stats.restarts++; + +- cf->data[6] = bec->txerr; +- cf->data[7] = bec->rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = bec->txerr; ++ cf->data[7] = bec->rxerr; ++ } + + stats = &netdev->stats; + stats->rx_packets++; +@@ -1045,8 +1047,10 @@ kvaser_usb_hydra_error_frame(struct kvaser_usb_net_priv *priv, + shhwtstamps->hwtstamp = hwtstamp; + + cf->can_id |= CAN_ERR_BUSERROR; +- cf->data[6] = bec.txerr; +- cf->data[7] = bec.rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = bec.txerr; ++ cf->data[7] = bec.rxerr; ++ } + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +-- +2.35.1 + diff --git a/queue-5.4/can-kvaser_usb_leaf-do-not-report-txerr-and-rxerr-du.patch b/queue-5.4/can-kvaser_usb_leaf-do-not-report-txerr-and-rxerr-du.patch new file mode 100644 index 00000000000..e09c68cc3c6 --- /dev/null +++ b/queue-5.4/can-kvaser_usb_leaf-do-not-report-txerr-and-rxerr-du.patch @@ -0,0 +1,42 @@ +From bdc10457ebad64abf2eba30655f2068dac5329d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:46 +0900 +Subject: can: kvaser_usb_leaf: do not report txerr and rxerr during bus-off + +From: Vincent Mailhol + +[ Upstream commit a57732084e06791d37ea1ea447cca46220737abd ] + +During bus off, the error count is greater than 255 and can not fit in +a u8. + +Fixes: 7259124eac7d1 ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c") +Link: https://lore.kernel.org/all/20220719143550.3681-9-mailhol.vincent@wanadoo.fr +CC: Jimmy Assarsson +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 0e0403dd0550..5e281249ad5f 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -857,8 +857,10 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev, + break; + } + +- cf->data[6] = es->txerr; +- cf->data[7] = es->rxerr; ++ if (new_state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = es->txerr; ++ cf->data[7] = es->rxerr; ++ } + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +-- +2.35.1 + diff --git a/queue-5.4/can-pch_can-do-not-report-txerr-and-rxerr-during-bus.patch b/queue-5.4/can-pch_can-do-not-report-txerr-and-rxerr-during-bus.patch new file mode 100644 index 00000000000..64eeacc0626 --- /dev/null +++ b/queue-5.4/can-pch_can-do-not-report-txerr-and-rxerr-during-bus.patch @@ -0,0 +1,48 @@ +From e0c9473f5755f23dbf35154892fe134dea9dbe93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:39 +0900 +Subject: can: pch_can: do not report txerr and rxerr during bus-off + +From: Vincent Mailhol + +[ Upstream commit 3a5c7e4611ddcf0ef37a3a17296b964d986161a6 ] + +During bus off, the error count is greater than 255 and can not fit in +a u8. + +Fixes: 0c78ab76a05c ("pch_can: Add setting TEC/REC statistics processing") +Link: https://lore.kernel.org/all/20220719143550.3681-2-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/pch_can.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c +index e90651f7b2ea..b148572e4a74 100644 +--- a/drivers/net/can/pch_can.c ++++ b/drivers/net/can/pch_can.c +@@ -496,6 +496,9 @@ static void pch_can_error(struct net_device *ndev, u32 status) + cf->can_id |= CAN_ERR_BUSOFF; + priv->can.can_stats.bus_off++; + can_bus_off(ndev); ++ } else { ++ cf->data[6] = errc & PCH_TEC; ++ cf->data[7] = (errc & PCH_REC) >> 8; + } + + errc = ioread32(&priv->regs->errc); +@@ -556,9 +559,6 @@ static void pch_can_error(struct net_device *ndev, u32 status) + break; + } + +- cf->data[6] = errc & PCH_TEC; +- cf->data[7] = (errc & PCH_REC) >> 8; +- + priv->can.state = state; + netif_receive_skb(skb); + +-- +2.35.1 + diff --git a/queue-5.4/can-pch_can-pch_can_error-initialize-errc-before-usi.patch b/queue-5.4/can-pch_can-pch_can_error-initialize-errc-before-usi.patch new file mode 100644 index 00000000000..814899484c6 --- /dev/null +++ b/queue-5.4/can-pch_can-pch_can_error-initialize-errc-before-usi.patch @@ -0,0 +1,58 @@ +From 89e56abf17f13ca4b8659a41f3b9b2f91b5aef8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jul 2022 01:00:32 +0900 +Subject: can: pch_can: pch_can_error(): initialize errc before using it + +From: Vincent Mailhol + +[ Upstream commit 9950f11211331180269867aef848c7cf56861742 ] + +After commit 3a5c7e4611dd, the variable errc is accessed before being +initialized, c.f. below W=2 warning: + +| In function 'pch_can_error', +| inlined from 'pch_can_poll' at drivers/net/can/pch_can.c:739:4: +| drivers/net/can/pch_can.c:501:29: warning: 'errc' may be used uninitialized [-Wmaybe-uninitialized] +| 501 | cf->data[6] = errc & PCH_TEC; +| | ^ +| drivers/net/can/pch_can.c: In function 'pch_can_poll': +| drivers/net/can/pch_can.c:484:13: note: 'errc' was declared here +| 484 | u32 errc, lec; +| | ^~~~ + +Moving errc initialization up solves this issue. + +Fixes: 3a5c7e4611dd ("can: pch_can: do not report txerr and rxerr during bus-off") +Reported-by: Nathan Chancellor +Signed-off-by: Vincent Mailhol +Reviewed-by: Nathan Chancellor +Link: https://lore.kernel.org/all/20220721160032.9348-1-mailhol.vincent@wanadoo.fr +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/pch_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c +index b148572e4a74..586bda050d28 100644 +--- a/drivers/net/can/pch_can.c ++++ b/drivers/net/can/pch_can.c +@@ -489,6 +489,7 @@ static void pch_can_error(struct net_device *ndev, u32 status) + if (!skb) + return; + ++ errc = ioread32(&priv->regs->errc); + if (status & PCH_BUS_OFF) { + pch_can_set_tx_all(priv, 0); + pch_can_set_rx_all(priv, 0); +@@ -501,7 +502,6 @@ static void pch_can_error(struct net_device *ndev, u32 status) + cf->data[7] = (errc & PCH_REC) >> 8; + } + +- errc = ioread32(&priv->regs->errc); + /* Warning interrupt. */ + if (status & PCH_EWARN) { + state = CAN_STATE_ERROR_WARNING; +-- +2.35.1 + diff --git a/queue-5.4/can-rcar_can-do-not-report-txerr-and-rxerr-during-bu.patch b/queue-5.4/can-rcar_can-do-not-report-txerr-and-rxerr-during-bu.patch new file mode 100644 index 00000000000..d1e41b0b9fa --- /dev/null +++ b/queue-5.4/can-rcar_can-do-not-report-txerr-and-rxerr-during-bu.patch @@ -0,0 +1,51 @@ +From 812366fc2e6184a295f8243a1ff6fb3ed36f9979 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:40 +0900 +Subject: can: rcar_can: do not report txerr and rxerr during bus-off + +From: Vincent Mailhol + +[ Upstream commit a37b7245e831a641df360ca41db6a71c023d3746 ] + +During bus off, the error count is greater than 255 and can not fit in +a u8. + +Fixes: fd1159318e55 ("can: add Renesas R-Car CAN driver") +Link: https://lore.kernel.org/all/20220719143550.3681-3-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar/rcar_can.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c +index ac52288fa3bf..b99b1b235348 100644 +--- a/drivers/net/can/rcar/rcar_can.c ++++ b/drivers/net/can/rcar/rcar_can.c +@@ -235,11 +235,8 @@ static void rcar_can_error(struct net_device *ndev) + if (eifr & (RCAR_CAN_EIFR_EWIF | RCAR_CAN_EIFR_EPIF)) { + txerr = readb(&priv->regs->tecr); + rxerr = readb(&priv->regs->recr); +- if (skb) { ++ if (skb) + cf->can_id |= CAN_ERR_CRTL; +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } + } + if (eifr & RCAR_CAN_EIFR_BEIF) { + int rx_errors = 0, tx_errors = 0; +@@ -339,6 +336,9 @@ static void rcar_can_error(struct net_device *ndev) + can_bus_off(ndev); + if (skb) + cf->can_id |= CAN_ERR_BUSOFF; ++ } else if (skb) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; + } + if (eifr & RCAR_CAN_EIFR_ORIF) { + netdev_dbg(priv->ndev, "Receive overrun error interrupt\n"); +-- +2.35.1 + diff --git a/queue-5.4/can-sja1000-do-not-report-txerr-and-rxerr-during-bus.patch b/queue-5.4/can-sja1000-do-not-report-txerr-and-rxerr-during-bus.patch new file mode 100644 index 00000000000..e47975aa383 --- /dev/null +++ b/queue-5.4/can-sja1000-do-not-report-txerr-and-rxerr-during-bus.patch @@ -0,0 +1,49 @@ +From 521b866bcc0a624c0167c4f225900742d9b96d16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:41 +0900 +Subject: can: sja1000: do not report txerr and rxerr during bus-off + +From: Vincent Mailhol + +[ Upstream commit 164d7cb2d5a30f1b3a5ab4fab1a27731fb1494a8 ] + +During bus off, the error count is greater than 255 and can not fit in +a u8. + +Fixes: 215db1856e83 ("can: sja1000: Consolidate and unify state change handling") +Link: https://lore.kernel.org/all/20220719143550.3681-4-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/sja1000/sja1000.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c +index 9f107798f904..e7327ceabb76 100644 +--- a/drivers/net/can/sja1000/sja1000.c ++++ b/drivers/net/can/sja1000/sja1000.c +@@ -405,9 +405,6 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status) + txerr = priv->read_reg(priv, SJA1000_TXERR); + rxerr = priv->read_reg(priv, SJA1000_RXERR); + +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- + if (isrc & IRQ_DOI) { + /* data overrun interrupt */ + netdev_dbg(dev, "data overrun interrupt\n"); +@@ -429,6 +426,10 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status) + else + state = CAN_STATE_ERROR_ACTIVE; + } ++ if (state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + if (isrc & IRQ_BEI) { + /* bus error interrupt */ + priv->can.can_stats.bus_error++; +-- +2.35.1 + diff --git a/queue-5.4/can-sun4i_can-do-not-report-txerr-and-rxerr-during-b.patch b/queue-5.4/can-sun4i_can-do-not-report-txerr-and-rxerr-during-b.patch new file mode 100644 index 00000000000..621223478c4 --- /dev/null +++ b/queue-5.4/can-sun4i_can-do-not-report-txerr-and-rxerr-during-b.patch @@ -0,0 +1,52 @@ +From d3dd56e6457537a96ea933d95858dc5b42123ee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:44 +0900 +Subject: can: sun4i_can: do not report txerr and rxerr during bus-off + +From: Vincent Mailhol + +[ Upstream commit 0ac15a8f661b941519379831d09bfb12271b23ee ] + +During bus off, the error count is greater than 255 and can not fit in +a u8. + +Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module") +Link: https://lore.kernel.org/all/20220719143550.3681-7-mailhol.vincent@wanadoo.fr +CC: Chen-Yu Tsai +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/sun4i_can.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c +index f4cd88196404..c519b6f63b33 100644 +--- a/drivers/net/can/sun4i_can.c ++++ b/drivers/net/can/sun4i_can.c +@@ -525,11 +525,6 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) + rxerr = (errc >> 16) & 0xFF; + txerr = errc & 0xFF; + +- if (skb) { +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } +- + if (isrc & SUN4I_INT_DATA_OR) { + /* data overrun interrupt */ + netdev_dbg(dev, "data overrun interrupt\n"); +@@ -560,6 +555,10 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) + else + state = CAN_STATE_ERROR_ACTIVE; + } ++ if (skb && state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + if (isrc & SUN4I_INT_BUS_ERR) { + /* bus error interrupt */ + netdev_dbg(dev, "bus error interrupt\n"); +-- +2.35.1 + diff --git a/queue-5.4/can-usb_8dev-do-not-report-txerr-and-rxerr-during-bu.patch b/queue-5.4/can-usb_8dev-do-not-report-txerr-and-rxerr-during-bu.patch new file mode 100644 index 00000000000..87ad8f8b1f1 --- /dev/null +++ b/queue-5.4/can-usb_8dev-do-not-report-txerr-and-rxerr-during-bu.patch @@ -0,0 +1,42 @@ +From 036ddea0bd56a981628af95acc94c56cee9737c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 23:35:47 +0900 +Subject: can: usb_8dev: do not report txerr and rxerr during bus-off + +From: Vincent Mailhol + +[ Upstream commit aebe8a2433cd090ccdc222861f44bddb75eb01de ] + +During bus off, the error count is greater than 255 and can not fit in +a u8. + +Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") +Link: https://lore.kernel.org/all/20220719143550.3681-10-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/usb_8dev.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c +index b514b2eaa318..89a94c16fc08 100644 +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -442,9 +442,10 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *priv, + + if (rx_errors) + stats->rx_errors++; +- +- cf->data[6] = txerr; +- cf->data[7] = rxerr; ++ if (priv->can.state != CAN_STATE_BUS_OFF) { ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } + + priv->bec.txerr = txerr; + priv->bec.rxerr = rxerr; +-- +2.35.1 + diff --git a/queue-5.4/clk-mediatek-reset-fix-written-reset-bit-offset.patch b/queue-5.4/clk-mediatek-reset-fix-written-reset-bit-offset.patch new file mode 100644 index 00000000000..f877a63a365 --- /dev/null +++ b/queue-5.4/clk-mediatek-reset-fix-written-reset-bit-offset.patch @@ -0,0 +1,56 @@ +From e2d6603c89ceb461b7a9cec5e91f78344108597e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 May 2022 17:33:29 +0800 +Subject: clk: mediatek: reset: Fix written reset bit offset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rex-BC Chen + +[ Upstream commit edabcf71d100fd433a0fc2d0c97057c446c33b2a ] + +Original assert/deassert bit is BIT(0), but it's more resonable to modify +them to BIT(id % 32) which is based on id. + +This patch will not influence any previous driver because the reset is +only used for thermal. The id (MT8183_INFRACFG_AO_THERM_SW_RST) is 0. + +Fixes: 64ebb57a3df6 ("clk: reset: Modify reset-controller driver") +Signed-off-by: Rex-BC Chen +Reviewed-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20220523093346.28493-3-rex-bc.chen@mediatek.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/reset.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/mediatek/reset.c b/drivers/clk/mediatek/reset.c +index cb939c071b0c..89916acf0bc3 100644 +--- a/drivers/clk/mediatek/reset.c ++++ b/drivers/clk/mediatek/reset.c +@@ -25,7 +25,7 @@ static int mtk_reset_assert_set_clr(struct reset_controller_dev *rcdev, + struct mtk_reset *data = container_of(rcdev, struct mtk_reset, rcdev); + unsigned int reg = data->regofs + ((id / 32) << 4); + +- return regmap_write(data->regmap, reg, 1); ++ return regmap_write(data->regmap, reg, BIT(id % 32)); + } + + static int mtk_reset_deassert_set_clr(struct reset_controller_dev *rcdev, +@@ -34,7 +34,7 @@ static int mtk_reset_deassert_set_clr(struct reset_controller_dev *rcdev, + struct mtk_reset *data = container_of(rcdev, struct mtk_reset, rcdev); + unsigned int reg = data->regofs + ((id / 32) << 4) + 0x4; + +- return regmap_write(data->regmap, reg, 1); ++ return regmap_write(data->regmap, reg, BIT(id % 32)); + } + + static int mtk_reset_assert(struct reset_controller_dev *rcdev, +-- +2.35.1 + diff --git a/queue-5.4/clk-qcom-camcc-sdm845-fix-topology-around-titan_top-.patch b/queue-5.4/clk-qcom-camcc-sdm845-fix-topology-around-titan_top-.patch new file mode 100644 index 00000000000..5839abed4f0 --- /dev/null +++ b/queue-5.4/clk-qcom-camcc-sdm845-fix-topology-around-titan_top-.patch @@ -0,0 +1,55 @@ +From 475a009093d2eea124c24277ab5f1698bdab89c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 00:41:32 +0300 +Subject: clk: qcom: camcc-sdm845: Fix topology around titan_top power domain + +From: Vladimir Zapolskiy + +[ Upstream commit 103dd2338bbff567bce7acd00fc5a09c806b38ec ] + +On SDM845 two found VFE GDSC power domains shall not be operated, if +titan top is turned off, thus the former power domains will be set as +subdomains by a GDSC registration routine. + +Fixes: 78412c262004 ("clk: qcom: Add camera clock controller driver for SDM845") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Robert Foss +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220519214133.1728979-2-vladimir.zapolskiy@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-sdm845.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/clk/qcom/camcc-sdm845.c b/drivers/clk/qcom/camcc-sdm845.c +index 1b2cefef7431..a8a2cfa83290 100644 +--- a/drivers/clk/qcom/camcc-sdm845.c ++++ b/drivers/clk/qcom/camcc-sdm845.c +@@ -1521,6 +1521,8 @@ static struct clk_branch cam_cc_sys_tmr_clk = { + }, + }; + ++static struct gdsc titan_top_gdsc; ++ + static struct gdsc bps_gdsc = { + .gdscr = 0x6004, + .pd = { +@@ -1554,6 +1556,7 @@ static struct gdsc ife_0_gdsc = { + .name = "ife_0_gdsc", + }, + .flags = POLL_CFG_GDSCR, ++ .parent = &titan_top_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, + }; + +@@ -1563,6 +1566,7 @@ static struct gdsc ife_1_gdsc = { + .name = "ife_1_gdsc", + }, + .flags = POLL_CFG_GDSCR, ++ .parent = &titan_top_gdsc.pd, + .pwrsts = PWRSTS_OFF_ON, + }; + +-- +2.35.1 + diff --git a/queue-5.4/clk-qcom-clk-krait-unlock-spin-after-mux-completion.patch b/queue-5.4/clk-qcom-clk-krait-unlock-spin-after-mux-completion.patch new file mode 100644 index 00000000000..775736cadba --- /dev/null +++ b/queue-5.4/clk-qcom-clk-krait-unlock-spin-after-mux-completion.patch @@ -0,0 +1,47 @@ +From fae0a51d8d1782d4468473fd8cdb046e6533fd99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Apr 2022 07:44:57 +0200 +Subject: clk: qcom: clk-krait: unlock spin after mux completion + +From: Ansuel Smith + +[ Upstream commit df83d2c9e72910416f650ade1e07cc314ff02731 ] + +Unlock spinlock after the mux switch is completed to prevent any corner +case of mux request while the switch still needs to be done. + +Fixes: 4d7dc77babfe ("clk: qcom: Add support for Krait clocks") +Signed-off-by: Ansuel Smith +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220430054458.31321-3-ansuelsmth@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-krait.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/clk-krait.c b/drivers/clk/qcom/clk-krait.c +index 59f1af415b58..90046428693c 100644 +--- a/drivers/clk/qcom/clk-krait.c ++++ b/drivers/clk/qcom/clk-krait.c +@@ -32,11 +32,16 @@ static void __krait_mux_set_sel(struct krait_mux_clk *mux, int sel) + regval |= (sel & mux->mask) << (mux->shift + LPL_SHIFT); + } + krait_set_l2_indirect_reg(mux->offset, regval); +- spin_unlock_irqrestore(&krait_clock_reg_lock, flags); + + /* Wait for switch to complete. */ + mb(); + udelay(1); ++ ++ /* ++ * Unlock now to make sure the mux register is not ++ * modified while switching to the new parent. ++ */ ++ spin_unlock_irqrestore(&krait_clock_reg_lock, flags); + } + + static int krait_mux_set_parent(struct clk_hw *hw, u8 index) +-- +2.35.1 + diff --git a/queue-5.4/clk-qcom-ipq8074-fix-nss-port-frequency-tables.patch b/queue-5.4/clk-qcom-ipq8074-fix-nss-port-frequency-tables.patch new file mode 100644 index 00000000000..822b99eb8c2 --- /dev/null +++ b/queue-5.4/clk-qcom-ipq8074-fix-nss-port-frequency-tables.patch @@ -0,0 +1,76 @@ +From 323497dd44b38af9321c74561e2c7cd6af452e2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 May 2022 23:00:40 +0200 +Subject: clk: qcom: ipq8074: fix NSS port frequency tables + +From: Robert Marko + +[ Upstream commit 0e9e61a2815b5cd34f1b495b2d72e8127ce9b794 ] + +NSS port 5 and 6 frequency tables are currently broken and are causing a +wide ranges of issue like 1G not working at all on port 6 or port 5 being +clocked with 312 instead of 125 MHz as UNIPHY1 gets selected. + +So, update the frequency tables with the ones from the downstream QCA 5.4 +based kernel which has already fixed this. + +Fixes: 7117a51ed303 ("clk: qcom: ipq8074: add NSS ethernet port clocks") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220515210048.483898-3-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index de48ba7eba3a..735a1cb59ffa 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -1788,8 +1788,10 @@ static struct clk_regmap_div nss_port4_tx_div_clk_src = { + static const struct freq_tbl ftbl_nss_port5_rx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(25000000, P_UNIPHY1_RX, 12.5, 0, 0), ++ F(25000000, P_UNIPHY0_RX, 5, 0, 0), + F(78125000, P_UNIPHY1_RX, 4, 0, 0), + F(125000000, P_UNIPHY1_RX, 2.5, 0, 0), ++ F(125000000, P_UNIPHY0_RX, 1, 0, 0), + F(156250000, P_UNIPHY1_RX, 2, 0, 0), + F(312500000, P_UNIPHY1_RX, 1, 0, 0), + { } +@@ -1828,8 +1830,10 @@ static struct clk_regmap_div nss_port5_rx_div_clk_src = { + static const struct freq_tbl ftbl_nss_port5_tx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(25000000, P_UNIPHY1_TX, 12.5, 0, 0), ++ F(25000000, P_UNIPHY0_TX, 5, 0, 0), + F(78125000, P_UNIPHY1_TX, 4, 0, 0), + F(125000000, P_UNIPHY1_TX, 2.5, 0, 0), ++ F(125000000, P_UNIPHY0_TX, 1, 0, 0), + F(156250000, P_UNIPHY1_TX, 2, 0, 0), + F(312500000, P_UNIPHY1_TX, 1, 0, 0), + { } +@@ -1867,8 +1871,10 @@ static struct clk_regmap_div nss_port5_tx_div_clk_src = { + + static const struct freq_tbl ftbl_nss_port6_rx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ F(25000000, P_UNIPHY2_RX, 5, 0, 0), + F(25000000, P_UNIPHY2_RX, 12.5, 0, 0), + F(78125000, P_UNIPHY2_RX, 4, 0, 0), ++ F(125000000, P_UNIPHY2_RX, 1, 0, 0), + F(125000000, P_UNIPHY2_RX, 2.5, 0, 0), + F(156250000, P_UNIPHY2_RX, 2, 0, 0), + F(312500000, P_UNIPHY2_RX, 1, 0, 0), +@@ -1907,8 +1913,10 @@ static struct clk_regmap_div nss_port6_rx_div_clk_src = { + + static const struct freq_tbl ftbl_nss_port6_tx_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ F(25000000, P_UNIPHY2_TX, 5, 0, 0), + F(25000000, P_UNIPHY2_TX, 12.5, 0, 0), + F(78125000, P_UNIPHY2_TX, 4, 0, 0), ++ F(125000000, P_UNIPHY2_TX, 1, 0, 0), + F(125000000, P_UNIPHY2_TX, 2.5, 0, 0), + F(156250000, P_UNIPHY2_TX, 2, 0, 0), + F(312500000, P_UNIPHY2_TX, 1, 0, 0), +-- +2.35.1 + diff --git a/queue-5.4/clk-qcom-ipq8074-set-branch_halt_delay-flag-for-ubi-.patch b/queue-5.4/clk-qcom-ipq8074-set-branch_halt_delay-flag-for-ubi-.patch new file mode 100644 index 00000000000..44326829fb2 --- /dev/null +++ b/queue-5.4/clk-qcom-ipq8074-set-branch_halt_delay-flag-for-ubi-.patch @@ -0,0 +1,113 @@ +From bc0c7cf52bed2cba56a86cea4cf4d7ee9ec1ee1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 May 2022 23:00:43 +0200 +Subject: clk: qcom: ipq8074: set BRANCH_HALT_DELAY flag for UBI clocks + +From: Robert Marko + +[ Upstream commit 2bd357e698207e2e65db03007e4be65bf9d6a7b3 ] + +Currently, attempting to enable the UBI clocks will cause the stuck at +off warning to be printed and clk_enable will fail. + +[ 14.936694] gcc_ubi1_ahb_clk status stuck at 'off' + +Downstream 5.4 QCA kernel has fixed this by seting the BRANCH_HALT_DELAY +flag on UBI clocks, so lets do the same. + +Fixes: 5736294aef83 ("clk: qcom: ipq8074: add NSS clocks") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220515210048.483898-6-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index 735a1cb59ffa..68fe80a0a92f 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -3354,6 +3354,7 @@ static struct clk_branch gcc_nssnoc_ubi1_ahb_clk = { + + static struct clk_branch gcc_ubi0_ahb_clk = { + .halt_reg = 0x6820c, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x6820c, + .enable_mask = BIT(0), +@@ -3371,6 +3372,7 @@ static struct clk_branch gcc_ubi0_ahb_clk = { + + static struct clk_branch gcc_ubi0_axi_clk = { + .halt_reg = 0x68200, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68200, + .enable_mask = BIT(0), +@@ -3388,6 +3390,7 @@ static struct clk_branch gcc_ubi0_axi_clk = { + + static struct clk_branch gcc_ubi0_nc_axi_clk = { + .halt_reg = 0x68204, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68204, + .enable_mask = BIT(0), +@@ -3405,6 +3408,7 @@ static struct clk_branch gcc_ubi0_nc_axi_clk = { + + static struct clk_branch gcc_ubi0_core_clk = { + .halt_reg = 0x68210, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68210, + .enable_mask = BIT(0), +@@ -3422,6 +3426,7 @@ static struct clk_branch gcc_ubi0_core_clk = { + + static struct clk_branch gcc_ubi0_mpt_clk = { + .halt_reg = 0x68208, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68208, + .enable_mask = BIT(0), +@@ -3439,6 +3444,7 @@ static struct clk_branch gcc_ubi0_mpt_clk = { + + static struct clk_branch gcc_ubi1_ahb_clk = { + .halt_reg = 0x6822c, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x6822c, + .enable_mask = BIT(0), +@@ -3456,6 +3462,7 @@ static struct clk_branch gcc_ubi1_ahb_clk = { + + static struct clk_branch gcc_ubi1_axi_clk = { + .halt_reg = 0x68220, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68220, + .enable_mask = BIT(0), +@@ -3473,6 +3480,7 @@ static struct clk_branch gcc_ubi1_axi_clk = { + + static struct clk_branch gcc_ubi1_nc_axi_clk = { + .halt_reg = 0x68224, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68224, + .enable_mask = BIT(0), +@@ -3490,6 +3498,7 @@ static struct clk_branch gcc_ubi1_nc_axi_clk = { + + static struct clk_branch gcc_ubi1_core_clk = { + .halt_reg = 0x68230, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68230, + .enable_mask = BIT(0), +@@ -3507,6 +3516,7 @@ static struct clk_branch gcc_ubi1_core_clk = { + + static struct clk_branch gcc_ubi1_mpt_clk = { + .halt_reg = 0x68228, ++ .halt_check = BRANCH_HALT_DELAY, + .clkr = { + .enable_reg = 0x68228, + .enable_mask = BIT(0), +-- +2.35.1 + diff --git a/queue-5.4/clk-renesas-r9a06g032-fix-uart-clkgrp-bitsel.patch b/queue-5.4/clk-renesas-r9a06g032-fix-uart-clkgrp-bitsel.patch new file mode 100644 index 00000000000..b2b8ad39ec5 --- /dev/null +++ b/queue-5.4/clk-renesas-r9a06g032-fix-uart-clkgrp-bitsel.patch @@ -0,0 +1,54 @@ +From ef8fe2d14c6412b1ded4a6e68428d622047c2598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 14:25:27 -0400 +Subject: clk: renesas: r9a06g032: Fix UART clkgrp bitsel + +From: Ralph Siemsen + +[ Upstream commit 2dee50ab9e72a3cae75b65e5934c8dd3e9bf01bc ] + +There are two UART clock groups, each having a mux to select its +upstream clock source. The register/bit definitions for accessing these +two muxes appear to have been reversed since introduction. Correct them +so as to match the hardware manual. + +Fixes: 4c3d88526eba ("clk: renesas: Renesas R9A06G032 clock driver") + +Signed-off-by: Ralph Siemsen +Reviewed-by: Phil Edworthy +Link: https://lore.kernel.org/r/20220518182527.1693156-1-ralph.siemsen@linaro.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r9a06g032-clocks.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c +index f2dc625b745d..80df4eb041cc 100644 +--- a/drivers/clk/renesas/r9a06g032-clocks.c ++++ b/drivers/clk/renesas/r9a06g032-clocks.c +@@ -286,8 +286,8 @@ static const struct r9a06g032_clkdesc r9a06g032_clocks[] = { + .name = "uart_group_012", + .type = K_BITSEL, + .source = 1 + R9A06G032_DIV_UART, +- /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG1_PR2 */ +- .dual.sel = ((0xec / 4) << 5) | 24, ++ /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG0_0 */ ++ .dual.sel = ((0x34 / 4) << 5) | 30, + .dual.group = 0, + }, + { +@@ -295,8 +295,8 @@ static const struct r9a06g032_clkdesc r9a06g032_clocks[] = { + .name = "uart_group_34567", + .type = K_BITSEL, + .source = 1 + R9A06G032_DIV_P2_PG, +- /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG0_0 */ +- .dual.sel = ((0x34 / 4) << 5) | 30, ++ /* R9A06G032_SYSCTRL_REG_PWRCTRL_PG1_PR2 */ ++ .dual.sel = ((0xec / 4) << 5) | 24, + .dual.group = 1, + }, + D_UGATE(CLK_UART0, "clk_uart0", UART_GROUP_012, 0, 0, 0x1b2, 0x1b3, 0x1b4, 0x1b5), +-- +2.35.1 + diff --git a/queue-5.4/cpufreq-zynq-fix-refcount-leak-in-zynq_get_revision.patch b/queue-5.4/cpufreq-zynq-fix-refcount-leak-in-zynq_get_revision.patch new file mode 100644 index 00000000000..1fdf04f1dfa --- /dev/null +++ b/queue-5.4/cpufreq-zynq-fix-refcount-leak-in-zynq_get_revision.patch @@ -0,0 +1,37 @@ +From 16ab58691b92c26202882d57a33b9ad4c420c85d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jun 2022 12:28:07 +0400 +Subject: cpufreq: zynq: Fix refcount leak in zynq_get_revision + +From: Miaoqian Lin + +[ Upstream commit d1ff2559cef0f6f8d97fba6337b28adb10689e16 ] + +of_find_compatible_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 00f7dc636366 ("ARM: zynq: Add support for SOC_BUS") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220605082807.21526-1-linmq006@gmail.com +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + arch/arm/mach-zynq/common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c +index 3a4248fd7962..25530ddae1fa 100644 +--- a/arch/arm/mach-zynq/common.c ++++ b/arch/arm/mach-zynq/common.c +@@ -77,6 +77,7 @@ static int __init zynq_get_revision(void) + } + + zynq_devcfg_base = of_iomap(np, 0); ++ of_node_put(np); + if (!zynq_devcfg_base) { + pr_err("%s: Unable to map I/O memory\n", __func__); + return -1; +-- +2.35.1 + diff --git a/queue-5.4/crypto-arm64-gcm-select-aead-for-ghash_arm64_ce.patch b/queue-5.4/crypto-arm64-gcm-select-aead-for-ghash_arm64_ce.patch new file mode 100644 index 00000000000..43854b70339 --- /dev/null +++ b/queue-5.4/crypto-arm64-gcm-select-aead-for-ghash_arm64_ce.patch @@ -0,0 +1,39 @@ +From e855d46b684ead8d601339acf330a0b38a382bbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 07:13:38 -0400 +Subject: crypto: arm64/gcm - Select AEAD for GHASH_ARM64_CE + +From: Qian Cai + +[ Upstream commit fac76f2260893dde5aa05bb693b4c13e8ed0454b ] + +Otherwise, we could fail to compile. + +ld: arch/arm64/crypto/ghash-ce-glue.o: in function 'ghash_ce_mod_exit': +ghash-ce-glue.c:(.exit.text+0x24): undefined reference to 'crypto_unregister_aead' +ld: arch/arm64/crypto/ghash-ce-glue.o: in function 'ghash_ce_mod_init': +ghash-ce-glue.c:(.init.text+0x34): undefined reference to 'crypto_register_aead' + +Fixes: 537c1445ab0b ("crypto: arm64/gcm - implement native driver using v8 Crypto Extensions") +Signed-off-by: Qian Cai +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/arm64/crypto/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/crypto/Kconfig b/arch/arm64/crypto/Kconfig +index 4922c4451e7c..99cddf1145c2 100644 +--- a/arch/arm64/crypto/Kconfig ++++ b/arch/arm64/crypto/Kconfig +@@ -59,6 +59,7 @@ config CRYPTO_GHASH_ARM64_CE + select CRYPTO_HASH + select CRYPTO_GF128MUL + select CRYPTO_LIB_AES ++ select CRYPTO_AEAD + + config CRYPTO_CRCT10DIF_ARM64_CE + tristate "CRCT10DIF digest algorithm using PMULL instructions" +-- +2.35.1 + diff --git a/queue-5.4/crypto-hisilicon-kunpeng916-crypto-driver-don-t-slee.patch b/queue-5.4/crypto-hisilicon-kunpeng916-crypto-driver-don-t-slee.patch new file mode 100644 index 00000000000..53dd555b14f --- /dev/null +++ b/queue-5.4/crypto-hisilicon-kunpeng916-crypto-driver-don-t-slee.patch @@ -0,0 +1,97 @@ +From 701f04337cbaffcb7fc6f0a432703dd484c9175d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 09:59:54 +0800 +Subject: crypto: hisilicon - Kunpeng916 crypto driver don't sleep when in + softirq + +From: Zhengchao Shao + +[ Upstream commit 68740ab505431f268dc1ee26a54b871e75f0ddaa ] + +When kunpeng916 encryption driver is used to deencrypt and decrypt +packets during the softirq, it is not allowed to use mutex lock. + +Fixes: 915e4e8413da ("crypto: hisilicon - SEC security accelerator driver") +Signed-off-by: Zhengchao Shao +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec/sec_algs.c | 14 +++++++------- + drivers/crypto/hisilicon/sec/sec_drv.h | 2 +- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c +index 4ad4ffd90cee..2402941a7f2f 100644 +--- a/drivers/crypto/hisilicon/sec/sec_algs.c ++++ b/drivers/crypto/hisilicon/sec/sec_algs.c +@@ -449,7 +449,7 @@ static void sec_skcipher_alg_callback(struct sec_bd_info *sec_resp, + */ + } + +- mutex_lock(&ctx->queue->queuelock); ++ spin_lock_bh(&ctx->queue->queuelock); + /* Put the IV in place for chained cases */ + switch (ctx->cipher_alg) { + case SEC_C_AES_CBC_128: +@@ -509,7 +509,7 @@ static void sec_skcipher_alg_callback(struct sec_bd_info *sec_resp, + list_del(&backlog_req->backlog_head); + } + } +- mutex_unlock(&ctx->queue->queuelock); ++ spin_unlock_bh(&ctx->queue->queuelock); + + mutex_lock(&sec_req->lock); + list_del(&sec_req_el->head); +@@ -798,7 +798,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + */ + + /* Grab a big lock for a long time to avoid concurrency issues */ +- mutex_lock(&queue->queuelock); ++ spin_lock_bh(&queue->queuelock); + + /* + * Can go on to queue if we have space in either: +@@ -814,15 +814,15 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, + ret = -EBUSY; + if ((skreq->base.flags & CRYPTO_TFM_REQ_MAY_BACKLOG)) { + list_add_tail(&sec_req->backlog_head, &ctx->backlog); +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + goto out; + } + +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + goto err_free_elements; + } + ret = sec_send_request(sec_req, queue); +- mutex_unlock(&queue->queuelock); ++ spin_unlock_bh(&queue->queuelock); + if (ret) + goto err_free_elements; + +@@ -881,7 +881,7 @@ static int sec_alg_skcipher_init(struct crypto_skcipher *tfm) + if (IS_ERR(ctx->queue)) + return PTR_ERR(ctx->queue); + +- mutex_init(&ctx->queue->queuelock); ++ spin_lock_init(&ctx->queue->queuelock); + ctx->queue->havesoftqueue = false; + + return 0; +diff --git a/drivers/crypto/hisilicon/sec/sec_drv.h b/drivers/crypto/hisilicon/sec/sec_drv.h +index 4d9063a8b10b..0bf4d7c3856c 100644 +--- a/drivers/crypto/hisilicon/sec/sec_drv.h ++++ b/drivers/crypto/hisilicon/sec/sec_drv.h +@@ -347,7 +347,7 @@ struct sec_queue { + DECLARE_BITMAP(unprocessed, SEC_QUEUE_LEN); + DECLARE_KFIFO_PTR(softqueue, typeof(struct sec_request_el *)); + bool havesoftqueue; +- struct mutex queuelock; ++ spinlock_t queuelock; + void *shadow[SEC_QUEUE_LEN]; + }; + +-- +2.35.1 + diff --git a/queue-5.4/crypto-inside-secure-add-missing-module_device_table.patch b/queue-5.4/crypto-inside-secure-add-missing-module_device_table.patch new file mode 100644 index 00000000000..ba0e0fc72a2 --- /dev/null +++ b/queue-5.4/crypto-inside-secure-add-missing-module_device_table.patch @@ -0,0 +1,41 @@ +From ad2f3cdbb5a0d1c9497f385819925d029562985e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 09:54:03 +0200 +Subject: crypto: inside-secure - Add missing MODULE_DEVICE_TABLE for of +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit fa4d57b85786ec0e16565c75a51c208834b0c24d ] + +Without MODULE_DEVICE_TABLE, crypto_safexcel.ko module is not automatically +loaded on platforms where inside-secure crypto HW is specified in device +tree (e.g. Armada 3720). So add missing MODULE_DEVICE_TABLE for of. + +Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver") +Signed-off-by: Pali Rohár +Acked-by: Marek Behún +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/inside-secure/safexcel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c +index 4d9d97c59ee3..9534f52210af 100644 +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -1658,6 +1658,8 @@ static const struct of_device_id safexcel_of_match_table[] = { + {}, + }; + ++MODULE_DEVICE_TABLE(of, safexcel_of_match_table); ++ + static struct platform_driver crypto_safexcel = { + .probe = safexcel_probe, + .remove = safexcel_remove, +-- +2.35.1 + diff --git a/queue-5.4/dccp-put-dccp_qpolicy_full-and-dccp_qpolicy_push-in-.patch b/queue-5.4/dccp-put-dccp_qpolicy_full-and-dccp_qpolicy_push-in-.patch new file mode 100644 index 00000000000..90299f67a52 --- /dev/null +++ b/queue-5.4/dccp-put-dccp_qpolicy_full-and-dccp_qpolicy_push-in-.patch @@ -0,0 +1,71 @@ +From 9d682186e7b4f4045e5fbeece08aede453af280a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jul 2022 19:00:27 +0800 +Subject: dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same + lock + +From: Hangyu Hua + +[ Upstream commit a41b17ff9dacd22f5f118ee53d82da0f3e52d5e3 ] + +In the case of sk->dccps_qpolicy == DCCPQ_POLICY_PRIO, dccp_qpolicy_full +will drop a skb when qpolicy is full. And the lock in dccp_sendmsg is +released before sock_alloc_send_skb and then relocked after +sock_alloc_send_skb. The following conditions may lead dccp_qpolicy_push +to add skb to an already full sk_write_queue: + +thread1--->lock +thread1--->dccp_qpolicy_full: queue is full. drop a skb +thread1--->unlock +thread2--->lock +thread2--->dccp_qpolicy_full: queue is not full. no need to drop. +thread2--->unlock +thread1--->lock +thread1--->dccp_qpolicy_push: add a skb. queue is full. +thread1--->unlock +thread2--->lock +thread2--->dccp_qpolicy_push: add a skb! +thread2--->unlock + +Fix this by moving dccp_qpolicy_full. + +Fixes: b1308dc015eb ("[DCCP]: Set TX Queue Length Bounds via Sysctl") +Signed-off-by: Hangyu Hua +Link: https://lore.kernel.org/r/20220729110027.40569-1-hbh25y@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/dccp/proto.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index cb61a9d281f6..951cbdf05ffe 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -765,11 +765,6 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + lock_sock(sk); + +- if (dccp_qpolicy_full(sk)) { +- rc = -EAGAIN; +- goto out_release; +- } +- + timeo = sock_sndtimeo(sk, noblock); + + /* +@@ -788,6 +783,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + if (skb == NULL) + goto out_release; + ++ if (dccp_qpolicy_full(sk)) { ++ rc = -EAGAIN; ++ goto out_discard; ++ } ++ + if (sk->sk_state == DCCP_CLOSED) { + rc = -ENOTCONN; + goto out_discard; +-- +2.35.1 + diff --git a/queue-5.4/dm-return-early-from-dm_pr_call-if-dm-device-is-susp.patch b/queue-5.4/dm-return-early-from-dm_pr_call-if-dm-device-is-susp.patch new file mode 100644 index 00000000000..7e23bf8d1f8 --- /dev/null +++ b/queue-5.4/dm-return-early-from-dm_pr_call-if-dm-device-is-susp.patch @@ -0,0 +1,38 @@ +From d5a9e95b1eac758cfdab22319f33d26b87f51460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jul 2022 15:31:23 -0400 +Subject: dm: return early from dm_pr_call() if DM device is suspended + +From: Mike Snitzer + +[ Upstream commit e120a5f1e78fab6223544e425015f393d90d6f0d ] + +Otherwise PR ops may be issued while the broader DM device is being +reconfigured, etc. + +Fixes: 9c72bad1f31a ("dm: call PR reserve/unreserve on each underlying device") +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 77e28f77c59f..d4cebb38709b 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -3080,6 +3080,11 @@ static int dm_call_pr(struct block_device *bdev, iterate_devices_callout_fn fn, + goto out; + ti = dm_table_get_target(table, 0); + ++ if (dm_suspended_md(md)) { ++ ret = -EAGAIN; ++ goto out; ++ } ++ + ret = -EINVAL; + if (!ti->type->iterate_devices) + goto out; +-- +2.35.1 + diff --git a/queue-5.4/driver-core-fix-potential-deadlock-in-__driver_attac.patch b/queue-5.4/driver-core-fix-potential-deadlock-in-__driver_attac.patch new file mode 100644 index 00000000000..f5d9416e30d --- /dev/null +++ b/queue-5.4/driver-core-fix-potential-deadlock-in-__driver_attac.patch @@ -0,0 +1,120 @@ +From 1eee81738eef4337d0c5cdd6a272a816dfc31586 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 15:43:27 +0800 +Subject: driver core: fix potential deadlock in __driver_attach + +From: Zhang Wensheng + +[ Upstream commit 70fe758352cafdee72a7b13bf9db065f9613ced8 ] + +In __driver_attach function, There are also AA deadlock problem, +like the commit b232b02bf3c2 ("driver core: fix deadlock in +__device_attach"). + +stack like commit b232b02bf3c2 ("driver core: fix deadlock in +__device_attach"). +list below: + In __driver_attach function, The lock holding logic is as follows: + ... + __driver_attach + if (driver_allows_async_probing(drv)) + device_lock(dev) // get lock dev + async_schedule_dev(__driver_attach_async_helper, dev); // func + async_schedule_node + async_schedule_node_domain(func) + entry = kzalloc(sizeof(struct async_entry), GFP_ATOMIC); + /* when fail or work limit, sync to execute func, but + __driver_attach_async_helper will get lock dev as + will, which will lead to A-A deadlock. */ + if (!entry || atomic_read(&entry_count) > MAX_WORK) { + func; + else + queue_work_node(node, system_unbound_wq, &entry->work) + device_unlock(dev) + + As above show, when it is allowed to do async probes, because of + out of memory or work limit, async work is not be allowed, to do + sync execute instead. it will lead to A-A deadlock because of + __driver_attach_async_helper getting lock dev. + +Reproduce: +and it can be reproduce by make the condition +(if (!entry || atomic_read(&entry_count) > MAX_WORK)) untenable, like +below: + +[ 370.785650] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables +this message. +[ 370.787154] task:swapper/0 state:D stack: 0 pid: 1 ppid: +0 flags:0x00004000 +[ 370.788865] Call Trace: +[ 370.789374] +[ 370.789841] __schedule+0x482/0x1050 +[ 370.790613] schedule+0x92/0x1a0 +[ 370.791290] schedule_preempt_disabled+0x2c/0x50 +[ 370.792256] __mutex_lock.isra.0+0x757/0xec0 +[ 370.793158] __mutex_lock_slowpath+0x1f/0x30 +[ 370.794079] mutex_lock+0x50/0x60 +[ 370.794795] __device_driver_lock+0x2f/0x70 +[ 370.795677] ? driver_probe_device+0xd0/0xd0 +[ 370.796576] __driver_attach_async_helper+0x1d/0xd0 +[ 370.797318] ? driver_probe_device+0xd0/0xd0 +[ 370.797957] async_schedule_node_domain+0xa5/0xc0 +[ 370.798652] async_schedule_node+0x19/0x30 +[ 370.799243] __driver_attach+0x246/0x290 +[ 370.799828] ? driver_allows_async_probing+0xa0/0xa0 +[ 370.800548] bus_for_each_dev+0x9d/0x130 +[ 370.801132] driver_attach+0x22/0x30 +[ 370.801666] bus_add_driver+0x290/0x340 +[ 370.802246] driver_register+0x88/0x140 +[ 370.802817] ? virtio_scsi_init+0x116/0x116 +[ 370.803425] scsi_register_driver+0x1a/0x30 +[ 370.804057] init_sd+0x184/0x226 +[ 370.804533] do_one_initcall+0x71/0x3a0 +[ 370.805107] kernel_init_freeable+0x39a/0x43a +[ 370.805759] ? rest_init+0x150/0x150 +[ 370.806283] kernel_init+0x26/0x230 +[ 370.806799] ret_from_fork+0x1f/0x30 + +To fix the deadlock, move the async_schedule_dev outside device_lock, +as we can see, in async_schedule_node_domain, the parameter of +queue_work_node is system_unbound_wq, so it can accept concurrent +operations. which will also not change the code logic, and will +not lead to deadlock. + +Fixes: ef0ff68351be ("driver core: Probe devices asynchronously instead of the driver") +Signed-off-by: Zhang Wensheng +Link: https://lore.kernel.org/r/20220622074327.497102-1-zhangwensheng5@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/dd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 6f85280fef8d..4e45c87ed177 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -1037,6 +1037,7 @@ static void __driver_attach_async_helper(void *_dev, async_cookie_t cookie) + static int __driver_attach(struct device *dev, void *data) + { + struct device_driver *drv = data; ++ bool async = false; + int ret; + + /* +@@ -1074,9 +1075,11 @@ static int __driver_attach(struct device *dev, void *data) + if (!dev->driver) { + get_device(dev); + dev->p->async_driver = drv; +- async_schedule_dev(__driver_attach_async_helper, dev); ++ async = true; + } + device_unlock(dev); ++ if (async) ++ async_schedule_dev(__driver_attach_async_helper, dev); + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.4/drm-adv7511-override-i2c-address-of-cec-before-acces.patch b/queue-5.4/drm-adv7511-override-i2c-address-of-cec-before-acces.patch new file mode 100644 index 00000000000..acab5bcc9de --- /dev/null +++ b/queue-5.4/drm-adv7511-override-i2c-address-of-cec-before-acces.patch @@ -0,0 +1,63 @@ +From 647a7b4d3157a4a8666722b0219a7fadaf57e6b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 23:31:44 +0200 +Subject: drm: adv7511: override i2c address of cec before accessing it + +From: Antonio Borneo + +[ Upstream commit 9cc4853e4781bf0dd0f35355dc92d97c9da02f5d ] + +Commit 680532c50bca ("drm: adv7511: Add support for +i2c_new_secondary_device") allows a device tree node to override +the default addresses of the secondary i2c devices. This is useful +for solving address conflicts on the i2c bus. + +In adv7511_init_cec_regmap() the new i2c address of cec device is +read from device tree and immediately accessed, well before it is +written in the proper register to override the default address. +This can cause an i2c error during probe and a consequent probe +failure. + +Once the new i2c address is read from the device tree, override +the default address before any attempt to access the cec. + +Tested with adv7533 and stm32mp157f. + +Signed-off-by: Antonio Borneo +Fixes: 680532c50bca ("drm: adv7511: Add support for i2c_new_secondary_device") +Reviewed-by: Kieran Bingham +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220607213144.427177-1-antonio.borneo@foss.st.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index e7bf32f234d7..e2f84e2d5d3c 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -985,6 +985,10 @@ static int adv7511_init_cec_regmap(struct adv7511 *adv) + ADV7511_CEC_I2C_ADDR_DEFAULT); + if (IS_ERR(adv->i2c_cec)) + return PTR_ERR(adv->i2c_cec); ++ ++ regmap_write(adv->regmap, ADV7511_REG_CEC_I2C_ADDR, ++ adv->i2c_cec->addr << 1); ++ + i2c_set_clientdata(adv->i2c_cec, adv); + + adv->regmap_cec = devm_regmap_init_i2c(adv->i2c_cec, +@@ -1189,9 +1193,6 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + if (ret) + goto err_i2c_unregister_packet; + +- regmap_write(adv7511->regmap, ADV7511_REG_CEC_I2C_ADDR, +- adv7511->i2c_cec->addr << 1); +- + INIT_WORK(&adv7511->hpd_work, adv7511_hpd_work); + + if (i2c->irq) { +-- +2.35.1 + diff --git a/queue-5.4/drm-bridge-adv7511-add-check-for-mipi_dsi_driver_reg.patch b/queue-5.4/drm-bridge-adv7511-add-check-for-mipi_dsi_driver_reg.patch new file mode 100644 index 00000000000..ffaa8723b95 --- /dev/null +++ b/queue-5.4/drm-bridge-adv7511-add-check-for-mipi_dsi_driver_reg.patch @@ -0,0 +1,57 @@ +From 741ffd9ebfacb1b43ecacdd8afb9ddd18803fa70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 18:34:01 +0800 +Subject: drm: bridge: adv7511: Add check for mipi_dsi_driver_register + +From: Jiasheng Jiang + +[ Upstream commit 831463667b5f4f1e5bce9c3b94e9e794d2bc8923 ] + +As mipi_dsi_driver_register could return error if fails, +it should be better to check the return value and return error +if fails. +Moreover, if i2c_add_driver fails, mipi_dsi_driver_register +should be reverted. + +Fixes: 1e4d58cd7f88 ("drm/bridge: adv7533: Create a MIPI DSI device") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Laurent Pinchart +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20220602103401.2980938-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index e2f84e2d5d3c..62ef603627b7 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1302,10 +1302,21 @@ static struct i2c_driver adv7511_driver = { + + static int __init adv7511_init(void) + { +- if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) +- mipi_dsi_driver_register(&adv7533_dsi_driver); ++ int ret; ++ ++ if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) { ++ ret = mipi_dsi_driver_register(&adv7533_dsi_driver); ++ if (ret) ++ return ret; ++ } + +- return i2c_add_driver(&adv7511_driver); ++ ret = i2c_add_driver(&adv7511_driver); ++ if (ret) { ++ if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) ++ mipi_dsi_driver_unregister(&adv7533_dsi_driver); ++ } ++ ++ return ret; + } + module_init(adv7511_init); + +-- +2.35.1 + diff --git a/queue-5.4/drm-bridge-sii8620-fix-possible-off-by-one.patch b/queue-5.4/drm-bridge-sii8620-fix-possible-off-by-one.patch new file mode 100644 index 00000000000..7b0279fdf69 --- /dev/null +++ b/queue-5.4/drm-bridge-sii8620-fix-possible-off-by-one.patch @@ -0,0 +1,52 @@ +From 8ad72e142dd7ba33f386d82b62d3fa933e2c6e59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 14:58:56 +0800 +Subject: drm: bridge: sii8620: fix possible off-by-one + +From: Hangyu Hua + +[ Upstream commit 21779cc21c732c5eff8ea1624be6590450baa30f ] + +The next call to sii8620_burst_get_tx_buf will result in off-by-one +When ctx->burst.tx_count + size == ARRAY_SIZE(ctx->burst.tx_buf). The same +thing happens in sii8620_burst_get_rx_buf. + +This patch also change tx_count and tx_buf to rx_count and rx_buf in +sii8620_burst_get_rx_buf. It is unreasonable to check tx_buf's size and +use rx_buf. + +Fixes: e19e9c692f81 ("drm/bridge/sii8620: add support for burst eMSC transmissions") +Signed-off-by: Hangyu Hua +Reviewed-by: Andrzej Hajda +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220518065856.18936-1-hbh25y@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/sil-sii8620.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index fb0b64c965b7..970bc00d2aaf 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -604,7 +604,7 @@ static void *sii8620_burst_get_tx_buf(struct sii8620 *ctx, int len) + u8 *buf = &ctx->burst.tx_buf[ctx->burst.tx_count]; + int size = len + 2; + +- if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) { ++ if (ctx->burst.tx_count + size >= ARRAY_SIZE(ctx->burst.tx_buf)) { + dev_err(ctx->dev, "TX-BLK buffer exhausted\n"); + ctx->error = -EINVAL; + return NULL; +@@ -621,7 +621,7 @@ static u8 *sii8620_burst_get_rx_buf(struct sii8620 *ctx, int len) + u8 *buf = &ctx->burst.rx_buf[ctx->burst.rx_count]; + int size = len + 1; + +- if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) { ++ if (ctx->burst.rx_count + size >= ARRAY_SIZE(ctx->burst.rx_buf)) { + dev_err(ctx->dev, "RX-BLK buffer exhausted\n"); + ctx->error = -EINVAL; + return NULL; +-- +2.35.1 + diff --git a/queue-5.4/drm-exynos-exynos7_drm_decon-free-resources-when-clk.patch b/queue-5.4/drm-exynos-exynos7_drm_decon-free-resources-when-clk.patch new file mode 100644 index 00000000000..4d775c1c6bc --- /dev/null +++ b/queue-5.4/drm-exynos-exynos7_drm_decon-free-resources-when-clk.patch @@ -0,0 +1,75 @@ +From c053bd639a6786077fb1e93894c0853d258d2e0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 13:56:11 +0900 +Subject: drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() + failed. + +From: Jian Zhang + +[ Upstream commit 48b927770f8ad3f8cf4a024a552abf272af9f592 ] + +In exynos7_decon_resume, When it fails, we must use clk_disable_unprepare() +to free resource that have been used. + +Fixes: 6f83d20838c09 ("drm/exynos: use DRM_DEV_ERROR to print out error +message") +Reported-by: Hulk Robot +Signed-off-by: Jian Zhang +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos7_drm_decon.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos7_drm_decon.c b/drivers/gpu/drm/exynos/exynos7_drm_decon.c +index 6fd40410dfd2..afca5fc46020 100644 +--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c +@@ -800,31 +800,40 @@ static int exynos7_decon_resume(struct device *dev) + if (ret < 0) { + DRM_DEV_ERROR(dev, "Failed to prepare_enable the pclk [%d]\n", + ret); +- return ret; ++ goto err_pclk_enable; + } + + ret = clk_prepare_enable(ctx->aclk); + if (ret < 0) { + DRM_DEV_ERROR(dev, "Failed to prepare_enable the aclk [%d]\n", + ret); +- return ret; ++ goto err_aclk_enable; + } + + ret = clk_prepare_enable(ctx->eclk); + if (ret < 0) { + DRM_DEV_ERROR(dev, "Failed to prepare_enable the eclk [%d]\n", + ret); +- return ret; ++ goto err_eclk_enable; + } + + ret = clk_prepare_enable(ctx->vclk); + if (ret < 0) { + DRM_DEV_ERROR(dev, "Failed to prepare_enable the vclk [%d]\n", + ret); +- return ret; ++ goto err_vclk_enable; + } + + return 0; ++ ++err_vclk_enable: ++ clk_disable_unprepare(ctx->eclk); ++err_eclk_enable: ++ clk_disable_unprepare(ctx->aclk); ++err_aclk_enable: ++ clk_disable_unprepare(ctx->pclk); ++err_pclk_enable: ++ return ret; + } + #endif + +-- +2.35.1 + diff --git a/queue-5.4/drm-mcde-fix-refcount-leak-in-mcde_dsi_bind.patch b/queue-5.4/drm-mcde-fix-refcount-leak-in-mcde_dsi_bind.patch new file mode 100644 index 00000000000..9001acdc744 --- /dev/null +++ b/queue-5.4/drm-mcde-fix-refcount-leak-in-mcde_dsi_bind.patch @@ -0,0 +1,38 @@ +From c66273e618e411ca43cf782fd45154937c57f8d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 15:54:11 +0400 +Subject: drm/mcde: Fix refcount leak in mcde_dsi_bind + +From: Miaoqian Lin + +[ Upstream commit 3a149169e4a2f9127022fec6ef5d71b4e804b3b9 ] + +Every iteration of for_each_available_child_of_node() decrements +the reference counter of the previous node. There is no decrement +when break out from the loop and results in refcount leak. +Add missing of_node_put() to fix this. + +Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE") +Signed-off-by: Miaoqian Lin +Signed-off-by: Linus Walleij +Link: https://patchwork.freedesktop.org/patch/msgid/20220525115411.65455-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mcde/mcde_dsi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mcde/mcde_dsi.c b/drivers/gpu/drm/mcde/mcde_dsi.c +index 8c8c92fc82e9..a580b9cadb0c 100644 +--- a/drivers/gpu/drm/mcde/mcde_dsi.c ++++ b/drivers/gpu/drm/mcde/mcde_dsi.c +@@ -942,6 +942,7 @@ static int mcde_dsi_bind(struct device *dev, struct device *master, + bridge = of_drm_find_bridge(child); + if (!bridge) { + dev_err(dev, "failed to find bridge\n"); ++ of_node_put(child); + return -EINVAL; + } + } +-- +2.35.1 + diff --git a/queue-5.4/drm-mediatek-add-pull-down-mipi-operation-in-mtk_dsi.patch b/queue-5.4/drm-mediatek-add-pull-down-mipi-operation-in-mtk_dsi.patch new file mode 100644 index 00000000000..06b477abf98 --- /dev/null +++ b/queue-5.4/drm-mediatek-add-pull-down-mipi-operation-in-mtk_dsi.patch @@ -0,0 +1,49 @@ +From ff3773195598a436ab300b2c0eef7f75d149d773 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 10:00:07 +0800 +Subject: drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff + function + +From: Xinlei Lee + +[ Upstream commit fa5d0a0205c34734c5b8daa77e39ac2817f63a10 ] + +In the dsi_enable function, mtk_dsi_rxtx_control is to +pull up the MIPI signal operation. Before dsi_disable, +MIPI should also be pulled down by writing a register +instead of disabling dsi. + +If disable dsi without pulling the mipi signal low, the value of +the register will still maintain the setting of the mipi signal being +pulled high. +After resume, even if the mipi signal is not pulled high, it will still +be in the high state. + +Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver") + +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1653012007-11854-5-git-send-email-xinlei.lee@mediatek.com/ +Signed-off-by: Jitao Shi +Signed-off-by: Xinlei Lee +Reviewed-by: Rex-BC Chen +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 224afb666881..e82705a33acf 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -645,6 +645,8 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi) + mtk_dsi_reset_engine(dsi); + mtk_dsi_lane0_ulp_mode_enter(dsi); + mtk_dsi_clk_ulp_mode_enter(dsi); ++ /* set the lane number as 0 to pull down mipi */ ++ writel(0, dsi->regs + DSI_TXRX_CTRL); + + mtk_dsi_disable(dsi); + +-- +2.35.1 + diff --git a/queue-5.4/drm-mediatek-dpi-only-enable-dpi-after-the-bridge-is.patch b/queue-5.4/drm-mediatek-dpi-only-enable-dpi-after-the-bridge-is.patch new file mode 100644 index 00000000000..c66339575d9 --- /dev/null +++ b/queue-5.4/drm-mediatek-dpi-only-enable-dpi-after-the-bridge-is.patch @@ -0,0 +1,48 @@ +From 165efeba087ed30d0d0c6b64acd3e27c46835b99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 11:58:44 +0800 +Subject: drm/mediatek: dpi: Only enable dpi after the bridge is enabled + +From: Guillaume Ranquet + +[ Upstream commit aed61ef6beb911cc043af0f2f291167663995065 ] + +Enabling the dpi too early causes glitches on screen. + +Move the call to mtk_dpi_enable() at the end of the bridge_enable +callback to ensure everything is setup properly before enabling dpi. + +Fixes: 9e629c17aa8d ("drm/mediatek: Add DPI sub driver") +Signed-off-by: Guillaume Ranquet +Signed-off-by: Bo-Chen Chen +Tested-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20220701035845.16458-16-rex-bc.chen@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c +index 8f4a9f245a9a..4a64d8aed9da 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dpi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dpi.c +@@ -394,7 +394,6 @@ static int mtk_dpi_power_on(struct mtk_dpi *dpi) + if (dpi->pinctrl && dpi->pins_dpi) + pinctrl_select_state(dpi->pinctrl, dpi->pins_dpi); + +- mtk_dpi_enable(dpi); + return 0; + + err_pixel: +@@ -538,6 +537,7 @@ static void mtk_dpi_encoder_enable(struct drm_encoder *encoder) + + mtk_dpi_power_on(dpi); + mtk_dpi_set_display_mode(dpi, &dpi->mode); ++ mtk_dpi_enable(dpi); + } + + static int mtk_dpi_atomic_check(struct drm_encoder *encoder, +-- +2.35.1 + diff --git a/queue-5.4/drm-mediatek-dpi-remove-output-format-of-yuv.patch b/queue-5.4/drm-mediatek-dpi-remove-output-format-of-yuv.patch new file mode 100644 index 00000000000..0ae1a4f7db2 --- /dev/null +++ b/queue-5.4/drm-mediatek-dpi-remove-output-format-of-yuv.patch @@ -0,0 +1,73 @@ +From 407133f808ab4153a4c45e23171fd9587a80e12e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 11:58:33 +0800 +Subject: drm/mediatek: dpi: Remove output format of YUV + +From: Bo-Chen Chen + +[ Upstream commit c9ed0713b3c35fc45677707ba47f432cad95da56 ] + +DPI is not support output format as YUV, but there is the setting of +configuring output YUV. Therefore, remove them in this patch. + +Fixes: 9e629c17aa8d ("drm/mediatek: Add DPI sub driver") +Signed-off-by: Bo-Chen Chen +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20220701035845.16458-5-rex-bc.chen@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dpi.c | 31 ++++++------------------------ + 1 file changed, 6 insertions(+), 25 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c +index 48de07e9059e..8f4a9f245a9a 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dpi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dpi.c +@@ -50,13 +50,7 @@ enum mtk_dpi_out_channel_swap { + }; + + enum mtk_dpi_out_color_format { +- MTK_DPI_COLOR_FORMAT_RGB, +- MTK_DPI_COLOR_FORMAT_RGB_FULL, +- MTK_DPI_COLOR_FORMAT_YCBCR_444, +- MTK_DPI_COLOR_FORMAT_YCBCR_422, +- MTK_DPI_COLOR_FORMAT_XV_YCC, +- MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL, +- MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL ++ MTK_DPI_COLOR_FORMAT_RGB + }; + + struct mtk_dpi { +@@ -355,24 +349,11 @@ static void mtk_dpi_config_disable_edge(struct mtk_dpi *dpi) + static void mtk_dpi_config_color_format(struct mtk_dpi *dpi, + enum mtk_dpi_out_color_format format) + { +- if ((format == MTK_DPI_COLOR_FORMAT_YCBCR_444) || +- (format == MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL)) { +- mtk_dpi_config_yuv422_enable(dpi, false); +- mtk_dpi_config_csc_enable(dpi, true); +- mtk_dpi_config_swap_input(dpi, false); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_BGR); +- } else if ((format == MTK_DPI_COLOR_FORMAT_YCBCR_422) || +- (format == MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL)) { +- mtk_dpi_config_yuv422_enable(dpi, true); +- mtk_dpi_config_csc_enable(dpi, true); +- mtk_dpi_config_swap_input(dpi, true); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); +- } else { +- mtk_dpi_config_yuv422_enable(dpi, false); +- mtk_dpi_config_csc_enable(dpi, false); +- mtk_dpi_config_swap_input(dpi, false); +- mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); +- } ++ /* only support RGB888 */ ++ mtk_dpi_config_yuv422_enable(dpi, false); ++ mtk_dpi_config_csc_enable(dpi, false); ++ mtk_dpi_config_swap_input(dpi, false); ++ mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); + } + + static void mtk_dpi_power_off(struct mtk_dpi *dpi) +-- +2.35.1 + diff --git a/queue-5.4/drm-mipi-dbi-align-max_chunk-to-2-in-spi_transfer.patch b/queue-5.4/drm-mipi-dbi-align-max_chunk-to-2-in-spi_transfer.patch new file mode 100644 index 00000000000..737836ae9e8 --- /dev/null +++ b/queue-5.4/drm-mipi-dbi-align-max_chunk-to-2-in-spi_transfer.patch @@ -0,0 +1,51 @@ +From 6c19ab13082b913b1aecaeb8c385f39215142f4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 11:02:19 +0800 +Subject: drm/mipi-dbi: align max_chunk to 2 in spi_transfer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yunhao Tian + +[ Upstream commit 435c249008cba04ed6a7975e9411f3b934620204 ] + +In __spi_validate, there's a validation that no partial transfers +are accepted (xfer->len % w_size must be zero). When +max_chunk is not a multiple of bpw (e.g. max_chunk = 65535, +bpw = 16), the transfer will be rejected. + +This patch aligns max_chunk to 2 bytes (the maximum value of bpw is 16), +so that no partial transfer will occur. + +Fixes: d23d4d4dac01 ("drm/tinydrm: Move tinydrm_spi_transfer()") + +Signed-off-by: Yunhao Tian +Signed-off-by: Noralf Trønnes +Link: https://patchwork.freedesktop.org/patch/msgid/20220510030219.2486687-1-t123yh.xyz@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_mipi_dbi.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c +index 4042f5b39765..2a7ef1051b39 100644 +--- a/drivers/gpu/drm/drm_mipi_dbi.c ++++ b/drivers/gpu/drm/drm_mipi_dbi.c +@@ -1156,6 +1156,13 @@ int mipi_dbi_spi_transfer(struct spi_device *spi, u32 speed_hz, + size_t chunk; + int ret; + ++ /* In __spi_validate, there's a validation that no partial transfers ++ * are accepted (xfer->len % w_size must be zero). ++ * Here we align max_chunk to multiple of 2 (16bits), ++ * to prevent transfers from being rejected. ++ */ ++ max_chunk = ALIGN_DOWN(max_chunk, 2); ++ + spi_message_init_with_transfers(&m, &tr, 1); + + while (len) { +-- +2.35.1 + diff --git a/queue-5.4/drm-msm-hdmi-enable-core-vcc-core-vdda-supply-for-89.patch b/queue-5.4/drm-msm-hdmi-enable-core-vcc-core-vdda-supply-for-89.patch new file mode 100644 index 00000000000..9bdaf60ba71 --- /dev/null +++ b/queue-5.4/drm-msm-hdmi-enable-core-vcc-core-vdda-supply-for-89.patch @@ -0,0 +1,40 @@ +From b441512a99e199c37beddefe9b15b65e0a165a21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 15:23:43 +0300 +Subject: drm/msm/hdmi: enable core-vcc/core-vdda-supply for 8996 platform + +From: Dmitry Baryshkov + +[ Upstream commit 1f88301794595ff4c28a1f1befe690e8dbac72a2 ] + +DB820c makes use of core-vcc-supply and core-vdda-supply, however the +driver code doesn't support these regulators. Enable them for HDMI on +8996 platform. + +Fixes: 0afbe59edd3f ("drm/msm/hdmi: Add basic HDMI support for msm8996") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Stephen Boyd +Patchwork: https://patchwork.freedesktop.org/patch/488857/ +Link: https://lore.kernel.org/r/20220609122350.3157529-8-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c +index e4c9ff934e5b..370fcc64d8a8 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -413,7 +413,7 @@ static struct hdmi_platform_config hdmi_tx_8994_config = { + }; + + static struct hdmi_platform_config hdmi_tx_8996_config = { +- HDMI_CFG(pwr_reg, none), ++ HDMI_CFG(pwr_reg, 8x74), + HDMI_CFG(hpd_reg, none), + HDMI_CFG(pwr_clk, 8x74), + HDMI_CFG(hpd_clk, 8x74), +-- +2.35.1 + diff --git a/queue-5.4/drm-msm-mdp5-fix-global-state-lock-backoff.patch b/queue-5.4/drm-msm-mdp5-fix-global-state-lock-backoff.patch new file mode 100644 index 00000000000..611a28cbdd3 --- /dev/null +++ b/queue-5.4/drm-msm-mdp5-fix-global-state-lock-backoff.patch @@ -0,0 +1,85 @@ +From 5d865d843fafb8ae4071d9d044174e03a6528361 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 09:20:37 -0700 +Subject: drm/msm/mdp5: Fix global state lock backoff + +From: Rob Clark + +[ Upstream commit 92ef86ab513593c6329d04146e61f9a670e72fc5 ] + +We need to grab the lock after the early return for !hwpipe case. +Otherwise, we could have hit contention yet still returned 0. + +Fixes an issue that the new CONFIG_DRM_DEBUG_MODESET_LOCK stuff flagged +in CI: + + WARNING: CPU: 0 PID: 282 at drivers/gpu/drm/drm_modeset_lock.c:296 drm_modeset_lock+0xf8/0x154 + Modules linked in: + CPU: 0 PID: 282 Comm: kms_cursor_lega Tainted: G W 5.19.0-rc2-15930-g875cc8bc536a #1 + Hardware name: Qualcomm Technologies, Inc. DB820c (DT) + pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : drm_modeset_lock+0xf8/0x154 + lr : drm_atomic_get_private_obj_state+0x84/0x170 + sp : ffff80000cfab6a0 + x29: ffff80000cfab6a0 x28: 0000000000000000 x27: ffff000083bc4d00 + x26: 0000000000000038 x25: 0000000000000000 x24: ffff80000957ca58 + x23: 0000000000000000 x22: ffff000081ace080 x21: 0000000000000001 + x20: ffff000081acec18 x19: ffff80000cfabb80 x18: 0000000000000038 + x17: 0000000000000000 x16: 0000000000000000 x15: fffffffffffea0d0 + x14: 0000000000000000 x13: 284e4f5f4e524157 x12: 5f534b434f4c5f47 + x11: ffff80000a386aa8 x10: 0000000000000029 x9 : ffff80000cfab610 + x8 : 0000000000000029 x7 : 0000000000000014 x6 : 0000000000000000 + x5 : 0000000000000001 x4 : ffff8000081ad904 x3 : 0000000000000029 + x2 : ffff0000801db4c0 x1 : ffff80000cfabb80 x0 : ffff000081aceb58 + Call trace: + drm_modeset_lock+0xf8/0x154 + drm_atomic_get_private_obj_state+0x84/0x170 + mdp5_get_global_state+0x54/0x6c + mdp5_pipe_release+0x2c/0xd4 + mdp5_plane_atomic_check+0x2ec/0x414 + drm_atomic_helper_check_planes+0xd8/0x210 + drm_atomic_helper_check+0x54/0xb0 + ... + ---[ end trace 0000000000000000 ]--- + drm_modeset_lock attempting to lock a contended lock without backoff: + drm_modeset_lock+0x148/0x154 + mdp5_get_global_state+0x30/0x6c + mdp5_pipe_release+0x2c/0xd4 + mdp5_plane_atomic_check+0x290/0x414 + drm_atomic_helper_check_planes+0xd8/0x210 + drm_atomic_helper_check+0x54/0xb0 + drm_atomic_check_only+0x4b0/0x8f4 + drm_atomic_commit+0x68/0xe0 + +Fixes: d59be579fa93 ("drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected") +Signed-off-by: Rob Clark +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/492701/ +Link: https://lore.kernel.org/r/20220707162040.1594855-1-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +index a4f5cb90f3e8..e4b8a789835a 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +@@ -123,12 +123,13 @@ int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) + { + struct msm_drm_private *priv = s->dev->dev_private; + struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); +- struct mdp5_global_state *state = mdp5_get_global_state(s); ++ struct mdp5_global_state *state; + struct mdp5_hw_pipe_state *new_state; + + if (!hwpipe) + return 0; + ++ state = mdp5_get_global_state(s); + if (IS_ERR(state)) + return PTR_ERR(state); + +-- +2.35.1 + diff --git a/queue-5.4/drm-radeon-fix-potential-buffer-overflow-in-ni_set_m.patch b/queue-5.4/drm-radeon-fix-potential-buffer-overflow-in-ni_set_m.patch new file mode 100644 index 00000000000..2fe68a7bad0 --- /dev/null +++ b/queue-5.4/drm-radeon-fix-potential-buffer-overflow-in-ni_set_m.patch @@ -0,0 +1,61 @@ +From c6d33f101129ec868c4b8d2d99cc3da958fcd84d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 16:50:54 +0300 +Subject: drm/radeon: fix potential buffer overflow in + ni_set_mc_special_registers() + +From: Alexey Kodanev + +[ Upstream commit 136f614931a2bb73616b292cf542da3a18daefd5 ] + +The last case label can write two buffers 'mc_reg_address[j]' and +'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE +since there are no checks for this value in both case labels after the +last 'j++'. + +Instead of changing '>' to '>=' there, add the bounds check at the start +of the second 'case' (the first one already has it). + +Also, remove redundant last checks for 'j' index bigger than array size. +The expression is always false. Moreover, before or after the patch +'table->last' can be equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE and it +seems it can be a valid value. + +Detected using the static analysis tool - Svace. +Fixes: 69e0b57a91ad ("drm/radeon/kms: add dpm support for cayman (v5)") +Signed-off-by: Alexey Kodanev +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/ni_dpm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dpm.c +index bd2e577c701f..288ec3039bc2 100644 +--- a/drivers/gpu/drm/radeon/ni_dpm.c ++++ b/drivers/gpu/drm/radeon/ni_dpm.c +@@ -2740,10 +2740,10 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev, + table->mc_reg_table_entry[k].mc_data[j] |= 0x100; + } + j++; +- if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) +- return -EINVAL; + break; + case MC_SEQ_RESERVE_M >> 2: ++ if (j >= SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) ++ return -EINVAL; + temp_reg = RREG32(MC_PMG_CMD_MRS1); + table->mc_reg_address[j].s1 = MC_PMG_CMD_MRS1 >> 2; + table->mc_reg_address[j].s0 = MC_SEQ_PMG_CMD_MRS1_LP >> 2; +@@ -2752,8 +2752,6 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev, + (temp_reg & 0xffff0000) | + (table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff); + j++; +- if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) +- return -EINVAL; + break; + default: + break; +-- +2.35.1 + diff --git a/queue-5.4/drm-rockchip-fix-an-error-handling-path-rockchip_dp_.patch b/queue-5.4/drm-rockchip-fix-an-error-handling-path-rockchip_dp_.patch new file mode 100644 index 00000000000..f1569c0fdc1 --- /dev/null +++ b/queue-5.4/drm-rockchip-fix-an-error-handling-path-rockchip_dp_.patch @@ -0,0 +1,45 @@ +From 2245e9a43afbda2c7f5a268bd5b78cfae3b6d851 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 19:08:05 +0200 +Subject: drm/rockchip: Fix an error handling path rockchip_dp_probe() + +From: Christophe JAILLET + +[ Upstream commit 5074376822fe99fa4ce344b851c5016d00c0444f ] + +Should component_add() fail, we should call analogix_dp_remove() in the +error handling path, as already done in the remove function. + +Fixes: 152cce0006ab ("drm/bridge: analogix_dp: Split bind() into probe() and real bind()") +Signed-off-by: Christophe JAILLET +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/b719d9061bb97eb85145fbd3c5e63f4549f2e13e.1655572071.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +index ce98c08aa8b4..48281e29b5d4 100644 +--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c ++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +@@ -401,7 +401,15 @@ static int rockchip_dp_probe(struct platform_device *pdev) + if (IS_ERR(dp->adp)) + return PTR_ERR(dp->adp); + +- return component_add(dev, &rockchip_dp_component_ops); ++ ret = component_add(dev, &rockchip_dp_component_ops); ++ if (ret) ++ goto err_dp_remove; ++ ++ return 0; ++ ++err_dp_remove: ++ analogix_dp_remove(dp->adp); ++ return ret; + } + + static int rockchip_dp_remove(struct platform_device *pdev) +-- +2.35.1 + diff --git a/queue-5.4/drm-rockchip-vop-don-t-crash-for-invalid-duplicate_s.patch b/queue-5.4/drm-rockchip-vop-don-t-crash-for-invalid-duplicate_s.patch new file mode 100644 index 00000000000..cab00bf744b --- /dev/null +++ b/queue-5.4/drm-rockchip-vop-don-t-crash-for-invalid-duplicate_s.patch @@ -0,0 +1,42 @@ +From 722692e55bd2c9fe9df47088a40f7e75118acafc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 17:26:52 -0700 +Subject: drm/rockchip: vop: Don't crash for invalid duplicate_state() + +From: Brian Norris + +[ Upstream commit 1449110b0dade8b638d2c17ab7c5b0ff696bfccb ] + +It's possible for users to try to duplicate the CRTC state even when the +state doesn't exist. drm_atomic_helper_crtc_duplicate_state() (and other +users of __drm_atomic_helper_crtc_duplicate_state()) already guard this +with a WARN_ON() instead of crashing, so let's do that here too. + +Fixes: 4e257d9eee23 ("drm/rockchip: get rid of rockchip_drm_crtc_mode_config") +Signed-off-by: Brian Norris +Reviewed-by: Sean Paul +Reviewed-by: Douglas Anderson +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20220617172623.1.I62db228170b1559ada60b8d3e1637e1688424926@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index 2e4e1933a43c..57e0396662c3 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -1288,6 +1288,9 @@ static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc) + { + struct rockchip_crtc_state *rockchip_state; + ++ if (WARN_ON(!crtc->state)) ++ return NULL; ++ + rockchip_state = kzalloc(sizeof(*rockchip_state), GFP_KERNEL); + if (!rockchip_state) + return NULL; +-- +2.35.1 + diff --git a/queue-5.4/drm-vc4-dsi-correct-dsi-divider-calculations.patch b/queue-5.4/drm-vc4-dsi-correct-dsi-divider-calculations.patch new file mode 100644 index 00000000000..ceb1a44a162 --- /dev/null +++ b/queue-5.4/drm-vc4-dsi-correct-dsi-divider-calculations.patch @@ -0,0 +1,51 @@ +From 7a3eabf1998455ed19a8678ae4a18643a157f715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 16:47:39 +0200 +Subject: drm/vc4: dsi: Correct DSI divider calculations + +From: Dave Stevenson + +[ Upstream commit 3b45eee87da171caa28f61240ddb5c21170cda53 ] + +The divider calculations tried to find the divider just faster than the +clock requested. However if it required a divider of 7 then the for loop +aborted without handling the "error" case, and could end up with a clock +lower than requested. + +The integer divider from parent PLL to DSI clock is also capable of +going up to /255, not just /7 that the driver was trying. This allows +for slower link frequencies on the DSI bus where the resolution permits. + +Correct the loop so that we always have a clock greater than requested, +and covering the whole range of dividers. + +Fixes: 86c1b9eff3f2 ("drm/vc4: Adjust modes in DSI to work around the integer PLL divider.") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20220613144800.326124-13-maxime@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_dsi.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c +index 0983949cc8c9..e249ab378700 100644 +--- a/drivers/gpu/drm/vc4/vc4_dsi.c ++++ b/drivers/gpu/drm/vc4/vc4_dsi.c +@@ -791,11 +791,9 @@ static bool vc4_dsi_encoder_mode_fixup(struct drm_encoder *encoder, + /* Find what divider gets us a faster clock than the requested + * pixel clock. + */ +- for (divider = 1; divider < 8; divider++) { +- if (parent_rate / divider < pll_clock) { +- divider--; ++ for (divider = 1; divider < 255; divider++) { ++ if (parent_rate / (divider + 1) < pll_clock) + break; +- } + } + + /* Now that we've picked a PLL divider, calculate back to its +-- +2.35.1 + diff --git a/queue-5.4/drm-vc4-plane-fix-margin-calculations-for-the-right-.patch b/queue-5.4/drm-vc4-plane-fix-margin-calculations-for-the-right-.patch new file mode 100644 index 00000000000..5f31f6ba53a --- /dev/null +++ b/queue-5.4/drm-vc4-plane-fix-margin-calculations-for-the-right-.patch @@ -0,0 +1,51 @@ +From 81be912778c6e2fe4e99cdc4a218cbb5f2552811 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 16:47:32 +0200 +Subject: drm/vc4: plane: Fix margin calculations for the right/bottom edges + +From: Dave Stevenson + +[ Upstream commit b7c3d6821627861f4ea3e1f2b595d0ed9e80aac8 ] + +The current plane margin calculation code clips the right and bottom +edges of the range based using the left and top margins. + +This is obviously wrong, so let's fix it. + +Fixes: 666e73587f90 ("drm/vc4: Take margin setup into account when updating planes") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20220613144800.326124-6-maxime@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_plane.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 6e787f684e52..cdcd19698b3c 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -288,16 +288,16 @@ static int vc4_plane_margins_adj(struct drm_plane_state *pstate) + adjhdisplay, + crtc_state->mode.hdisplay); + vc4_pstate->crtc_x += left; +- if (vc4_pstate->crtc_x > crtc_state->mode.hdisplay - left) +- vc4_pstate->crtc_x = crtc_state->mode.hdisplay - left; ++ if (vc4_pstate->crtc_x > crtc_state->mode.hdisplay - right) ++ vc4_pstate->crtc_x = crtc_state->mode.hdisplay - right; + + adjvdisplay = crtc_state->mode.vdisplay - (top + bottom); + vc4_pstate->crtc_y = DIV_ROUND_CLOSEST(vc4_pstate->crtc_y * + adjvdisplay, + crtc_state->mode.vdisplay); + vc4_pstate->crtc_y += top; +- if (vc4_pstate->crtc_y > crtc_state->mode.vdisplay - top) +- vc4_pstate->crtc_y = crtc_state->mode.vdisplay - top; ++ if (vc4_pstate->crtc_y > crtc_state->mode.vdisplay - bottom) ++ vc4_pstate->crtc_y = crtc_state->mode.vdisplay - bottom; + + vc4_pstate->crtc_w = DIV_ROUND_CLOSEST(vc4_pstate->crtc_w * + adjhdisplay, +-- +2.35.1 + diff --git a/queue-5.4/drm-vc4-plane-remove-subpixel-positioning-check.patch b/queue-5.4/drm-vc4-plane-remove-subpixel-positioning-check.patch new file mode 100644 index 00000000000..bc67cd03314 --- /dev/null +++ b/queue-5.4/drm-vc4-plane-remove-subpixel-positioning-check.patch @@ -0,0 +1,76 @@ +From d59704ff8ea5a5ee688108b2253b7df93e444363 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 16:47:31 +0200 +Subject: drm/vc4: plane: Remove subpixel positioning check + +From: Dom Cobley + +[ Upstream commit 517db1ab1566dba3093dbdb8de4263ba4aa66416 ] + +There is little harm in ignoring fractional coordinates +(they just get truncated). + +Without this: +modetest -M vc4 -F tiles,gradient -s 32:1920x1080-60 -P89@74:1920x1080*.1.1@XR24 + +is rejected. We have the same issue in Kodi when trying to +use zoom options on video. + +Note: even if all coordinates are fully integer. e.g. +src:[0,0,1920,1080] dest:[-10,-10,1940,1100] + +it will still get rejected as drm_atomic_helper_check_plane_state +uses drm_rect_clip_scaled which transforms this to fractional src coords + +Fixes: 21af94cf1a4c ("drm/vc4: Add support for scaling of display planes.") +Signed-off-by: Dom Cobley +Link: https://lore.kernel.org/r/20220613144800.326124-5-maxime@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_plane.c | 22 +++++++++------------- + 1 file changed, 9 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 363f456ea713..6e787f684e52 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -317,7 +317,6 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + struct vc4_plane_state *vc4_state = to_vc4_plane_state(state); + struct drm_framebuffer *fb = state->fb; + struct drm_gem_cma_object *bo = drm_fb_cma_get_gem_obj(fb, 0); +- u32 subpixel_src_mask = (1 << 16) - 1; + int num_planes = fb->format->num_planes; + struct drm_crtc_state *crtc_state; + u32 h_subsample = fb->format->hsub; +@@ -339,18 +338,15 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + for (i = 0; i < num_planes; i++) + vc4_state->offsets[i] = bo->paddr + fb->offsets[i]; + +- /* We don't support subpixel source positioning for scaling. */ +- if ((state->src.x1 & subpixel_src_mask) || +- (state->src.x2 & subpixel_src_mask) || +- (state->src.y1 & subpixel_src_mask) || +- (state->src.y2 & subpixel_src_mask)) { +- return -EINVAL; +- } +- +- vc4_state->src_x = state->src.x1 >> 16; +- vc4_state->src_y = state->src.y1 >> 16; +- vc4_state->src_w[0] = (state->src.x2 - state->src.x1) >> 16; +- vc4_state->src_h[0] = (state->src.y2 - state->src.y1) >> 16; ++ /* ++ * We don't support subpixel source positioning for scaling, ++ * but fractional coordinates can be generated by clipping ++ * so just round for now ++ */ ++ vc4_state->src_x = DIV_ROUND_CLOSEST(state->src.x1, 1 << 16); ++ vc4_state->src_y = DIV_ROUND_CLOSEST(state->src.y1, 1 << 16); ++ vc4_state->src_w[0] = DIV_ROUND_CLOSEST(state->src.x2, 1 << 16) - vc4_state->src_x; ++ vc4_state->src_h[0] = DIV_ROUND_CLOSEST(state->src.y2, 1 << 16) - vc4_state->src_y; + + vc4_state->crtc_x = state->dst.x1; + vc4_state->crtc_y = state->dst.y1; +-- +2.35.1 + diff --git a/queue-5.4/erofs-avoid-consecutive-detection-for-highmem-memory.patch b/queue-5.4/erofs-avoid-consecutive-detection-for-highmem-memory.patch new file mode 100644 index 00000000000..d759dc1a41e --- /dev/null +++ b/queue-5.4/erofs-avoid-consecutive-detection-for-highmem-memory.patch @@ -0,0 +1,59 @@ +From 75a14374123fad9e7584965f3f1bde250690c952 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 18:10:01 +0800 +Subject: erofs: avoid consecutive detection for Highmem memory + +From: Gao Xiang + +[ Upstream commit 448b5a1548d87c246c3d0c3df8480d3c6eb6c11a ] + +Currently, vmap()s are avoided if physical addresses are +consecutive for decompressed buffers. + +I observed that is very common for 4KiB pclusters since the +numbers of decompressed pages are almost 2 or 3. + +However, such detection doesn't work for Highmem pages on +32-bit machines, let's fix it now. + +Reported-by: Liu Jinbao +Fixes: 7fc45dbc938a ("staging: erofs: introduce generic decompression backend") +Link: https://lore.kernel.org/r/20220708101001.21242-1-hsiangkao@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/decompressor.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c +index 23b74b8e8f96..38eeec5e3032 100644 +--- a/fs/erofs/decompressor.c ++++ b/fs/erofs/decompressor.c +@@ -56,14 +56,18 @@ static int z_erofs_lz4_prepare_destpages(struct z_erofs_decompress_req *rq, + + if (page) { + __clear_bit(j, bounced); +- if (kaddr) { +- if (kaddr + PAGE_SIZE == page_address(page)) ++ if (!PageHighMem(page)) { ++ if (!i) { ++ kaddr = page_address(page); ++ continue; ++ } ++ if (kaddr && ++ kaddr + PAGE_SIZE == page_address(page)) { + kaddr += PAGE_SIZE; +- else +- kaddr = NULL; +- } else if (!i) { +- kaddr = page_address(page); ++ continue; ++ } + } ++ kaddr = NULL; + continue; + } + kaddr = NULL; +-- +2.35.1 + diff --git a/queue-5.4/ext2-add-more-validity-checks-for-inode-counts.patch b/queue-5.4/ext2-add-more-validity-checks-for-inode-counts.patch new file mode 100644 index 00000000000..607f1d883a0 --- /dev/null +++ b/queue-5.4/ext2-add-more-validity-checks-for-inode-counts.patch @@ -0,0 +1,55 @@ +From 1fe0c007dfc292ee80a028a3aaca39ae8d02b86c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 13:13:50 +0200 +Subject: ext2: Add more validity checks for inode counts + +From: Jan Kara + +[ Upstream commit fa78f336937240d1bc598db817d638086060e7e9 ] + +Add checks verifying number of inodes stored in the superblock matches +the number computed from number of inodes per group. Also verify we have +at least one block worth of inodes per group. This prevents crashes on +corrupted filesystems. + +Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/ext2/super.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index db403c01d4d5..644c83c115bc 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -1077,9 +1077,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_frags_per_group); + goto failed_mount; + } +- if (sbi->s_inodes_per_group > sb->s_blocksize * 8) { ++ if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || ++ sbi->s_inodes_per_group > sb->s_blocksize * 8) { + ext2_msg(sb, KERN_ERR, +- "error: #inodes per group too big: %lu", ++ "error: invalid #inodes per group: %lu", + sbi->s_inodes_per_group); + goto failed_mount; + } +@@ -1089,6 +1090,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_groups_count = ((le32_to_cpu(es->s_blocks_count) - + le32_to_cpu(es->s_first_data_block) - 1) + / EXT2_BLOCKS_PER_GROUP(sb)) + 1; ++ if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group != ++ le32_to_cpu(es->s_inodes_count)) { ++ ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu", ++ le32_to_cpu(es->s_inodes_count), ++ (u64)sbi->s_groups_count * sbi->s_inodes_per_group); ++ goto failed_mount; ++ } + db_count = (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / + EXT2_DESC_PER_BLOCK(sb); + sbi->s_group_desc = kmalloc_array (db_count, +-- +2.35.1 + diff --git a/queue-5.4/ext4-recover-csum-seed-of-tmp_inode-after-migrating-.patch b/queue-5.4/ext4-recover-csum-seed-of-tmp_inode-after-migrating-.patch new file mode 100644 index 00000000000..343bdc6a90c --- /dev/null +++ b/queue-5.4/ext4-recover-csum-seed-of-tmp_inode-after-migrating-.patch @@ -0,0 +1,76 @@ +From 3ac2abadcc8d6dba64af190b12743c2f7ec7b285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 14:25:15 +0800 +Subject: ext4: recover csum seed of tmp_inode after migrating to extents + +From: Li Lingfeng + +[ Upstream commit 07ea7a617d6b278fb7acedb5cbe1a81ce2de7d0c ] + +When migrating to extents, the checksum seed of temporary inode +need to be replaced by inode's, otherwise the inode checksums +will be incorrect when swapping the inodes data. + +However, the temporary inode can not match it's checksum to +itself since it has lost it's own checksum seed. + +mkfs.ext4 -F /dev/sdc +mount /dev/sdc /mnt/sdc +xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/sdc/testfile +chattr -e /mnt/sdc/testfile +chattr +e /mnt/sdc/testfile +umount /dev/sdc +fsck -fn /dev/sdc + +======== +... +Pass 1: Checking inodes, blocks, and sizes +Inode 13 passes checks, but checksum does not match inode. Fix? no +... +======== + +The fix is simple, save the checksum seed of temporary inode, and +recover it after migrating to extents. + +Fixes: e81c9302a6c3 ("ext4: set csum seed in tmp inode while migrating to extents") +Signed-off-by: Li Lingfeng +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20220617062515.2113438-1-lilingfeng3@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/migrate.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c +index c5b2ea1a9372..1faa8e4ffb9d 100644 +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -435,7 +435,7 @@ int ext4_ext_migrate(struct inode *inode) + struct inode *tmp_inode = NULL; + struct migrate_struct lb; + unsigned long max_entries; +- __u32 goal; ++ __u32 goal, tmp_csum_seed; + uid_t owner[2]; + + /* +@@ -483,6 +483,7 @@ int ext4_ext_migrate(struct inode *inode) + * the migration. + */ + ei = EXT4_I(inode); ++ tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed; + EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; + i_size_write(tmp_inode, i_size_read(inode)); + /* +@@ -593,6 +594,7 @@ int ext4_ext_migrate(struct inode *inode) + * the inode is not visible to user space. + */ + tmp_inode->i_blocks = 0; ++ EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed; + + /* Reset the extent details */ + ext4_ext_tree_init(handle, tmp_inode); +-- +2.35.1 + diff --git a/queue-5.4/fpga-altera-pr-ip-fix-unsigned-comparison-with-less-.patch b/queue-5.4/fpga-altera-pr-ip-fix-unsigned-comparison-with-less-.patch new file mode 100644 index 00000000000..f007532d9fd --- /dev/null +++ b/queue-5.4/fpga-altera-pr-ip-fix-unsigned-comparison-with-less-.patch @@ -0,0 +1,40 @@ +From b5e4c1ef3d4b6400af617c9741402fdf5013b3a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 16:05:19 +0200 +Subject: fpga: altera-pr-ip: fix unsigned comparison with less than zero + +From: Marco Pagani + +[ Upstream commit 2df84a757d87fd62869fc401119d429735377ec5 ] + +Fix the "comparison with less than zero" warning reported by +cppcheck for the unsigned (size_t) parameter count of the +alt_pr_fpga_write() function. + +Fixes: d201cc17a8a3 ("fpga pr ip: Core driver support for Altera Partial Reconfiguration IP") +Reviewed-by: Tom Rix +Acked-by: Xu Yilun +Signed-off-by: Marco Pagani +Link: https://lore.kernel.org/r/20220609140520.42662-1-marpagan@redhat.com +Signed-off-by: Xu Yilun +Signed-off-by: Sasha Levin +--- + drivers/fpga/altera-pr-ip-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fpga/altera-pr-ip-core.c b/drivers/fpga/altera-pr-ip-core.c +index 2cf25fd5e897..75b4b3ec933a 100644 +--- a/drivers/fpga/altera-pr-ip-core.c ++++ b/drivers/fpga/altera-pr-ip-core.c +@@ -108,7 +108,7 @@ static int alt_pr_fpga_write(struct fpga_manager *mgr, const char *buf, + u32 *buffer_32 = (u32 *)buf; + size_t i = 0; + +- if (count <= 0) ++ if (!count) + return -EINVAL; + + /* Write out the complete 32-bit chunks */ +-- +2.35.1 + diff --git a/queue-5.4/fs-check-fmode_lseek-to-control-internal-pipe-splici.patch b/queue-5.4/fs-check-fmode_lseek-to-control-internal-pipe-splici.patch new file mode 100644 index 00000000000..8006e2b6968 --- /dev/null +++ b/queue-5.4/fs-check-fmode_lseek-to-control-internal-pipe-splici.patch @@ -0,0 +1,58 @@ +From 6703ec9308ec4361eb2f2646ce76b802d9955287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jun 2022 15:06:58 +0200 +Subject: fs: check FMODE_LSEEK to control internal pipe splicing + +From: Jason A. Donenfeld + +[ Upstream commit 97ef77c52b789ec1411d360ed99dca1efe4b2c81 ] + +The original direct splicing mechanism from Jens required the input to +be a regular file because it was avoiding the special socket case. It +also recognized blkdevs as being close enough to a regular file. But it +forgot about chardevs, which behave the same way and work fine here. + +This is an okayish heuristic, but it doesn't totally work. For example, +a few chardevs should be spliceable here. And a few regular files +shouldn't. This patch fixes this by instead checking whether FMODE_LSEEK +is set, which represents decently enough what we need rewinding for when +splicing to internal pipes. + +Fixes: b92ce5589374 ("[PATCH] splice: add direct fd <-> fd splicing support") +Cc: Jens Axboe +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/splice.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/fs/splice.c b/fs/splice.c +index e509239d7e06..ae5623244d5e 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -895,17 +895,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, + { + struct pipe_inode_info *pipe; + long ret, bytes; +- umode_t i_mode; + size_t len; + int i, flags, more; + + /* +- * We require the input being a regular file, as we don't want to +- * randomly drop data for eg socket -> socket splicing. Use the +- * piped splicing for that! ++ * We require the input to be seekable, as we don't want to randomly ++ * drop data for eg socket -> socket splicing. Use the piped splicing ++ * for that! + */ +- i_mode = file_inode(in)->i_mode; +- if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode))) ++ if (unlikely(!(in->f_mode & FMODE_LSEEK))) + return -EINVAL; + + /* +-- +2.35.1 + diff --git a/queue-5.4/fuse-remove-the-control-interface-for-virtio-fs.patch b/queue-5.4/fuse-remove-the-control-interface-for-virtio-fs.patch new file mode 100644 index 00000000000..d9e6746e434 --- /dev/null +++ b/queue-5.4/fuse-remove-the-control-interface-for-virtio-fs.patch @@ -0,0 +1,50 @@ +From f03c6c18ba5ae5d41b5aa0ce3378855dfc7e0676 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 16:50:12 +0800 +Subject: fuse: Remove the control interface for virtio-fs + +From: Xie Yongji + +[ Upstream commit c64797809a64c73497082aa05e401a062ec1af34 ] + +The commit 15c8e72e88e0 ("fuse: allow skipping control interface and forced +unmount") tries to remove the control interface for virtio-fs since it does +not support aborting requests which are being processed. But it doesn't +work now. + +This patch fixes it by skipping creating the control interface if +fuse_conn->no_control is set. + +Fixes: 15c8e72e88e0 ("fuse: allow skipping control interface and forced unmount") +Signed-off-by: Xie Yongji +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/control.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/fuse/control.c b/fs/fuse/control.c +index c23f6f243ad4..2742d74cedda 100644 +--- a/fs/fuse/control.c ++++ b/fs/fuse/control.c +@@ -265,7 +265,7 @@ int fuse_ctl_add_conn(struct fuse_conn *fc) + struct dentry *parent; + char name[32]; + +- if (!fuse_control_sb) ++ if (!fuse_control_sb || fc->no_control) + return 0; + + parent = fuse_control_sb->s_root; +@@ -303,7 +303,7 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc) + { + int i; + +- if (!fuse_control_sb) ++ if (!fuse_control_sb || fc->no_control) + return; + + for (i = fc->ctl_ndents - 1; i >= 0; i--) { +-- +2.35.1 + diff --git a/queue-5.4/genelf-use-have_libcrypto_support-not-the-never-defi.patch b/queue-5.4/genelf-use-have_libcrypto_support-not-the-never-defi.patch new file mode 100644 index 00000000000..c7cea3a497c --- /dev/null +++ b/queue-5.4/genelf-use-have_libcrypto_support-not-the-never-defi.patch @@ -0,0 +1,59 @@ +From 424ade12cabdbf696975644fe75ad639cb1c7f06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 15:13:22 -0300 +Subject: genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined + HAVE_LIBCRYPTO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 91cea6be90e436c55cde8770a15e4dac9d3032d0 ] + +When genelf was introduced it tested for HAVE_LIBCRYPTO not +HAVE_LIBCRYPTO_SUPPORT, which is the define the feature test for openssl +defines, fix it. + +This also adds disables the deprecation warning, someone has to fix this +to build with openssl 3.0 before the warning becomes a hard error. + +Fixes: 9b07e27f88b9cd78 ("perf inject: Add jitdump mmap injection support") +Reported-by: 谭梓煊 +Cc: Alexei Starovoitov +Cc: Andrii Nakryiko +Cc: Daniel Borkmann +Cc: Jiri Olsa +Cc: John Fastabend +Cc: KP Singh +Cc: Martin KaFai Lau +Cc: Nick Terrell +Cc: Song Liu +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/YulpPqXSOG0Q4J1o@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/genelf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c +index f9f18b8b1df9..17b74aba8b9a 100644 +--- a/tools/perf/util/genelf.c ++++ b/tools/perf/util/genelf.c +@@ -35,7 +35,11 @@ + + #define BUILD_ID_URANDOM /* different uuid for each run */ + +-#ifdef HAVE_LIBCRYPTO ++// FIXME, remove this and fix the deprecation warnings before its removed and ++// We'll break for good here... ++#pragma GCC diagnostic ignored "-Wdeprecated-declarations" ++ ++#ifdef HAVE_LIBCRYPTO_SUPPORT + + #define BUILD_ID_MD5 + #undef BUILD_ID_SHA /* does not seem to work well when linked with Java */ +-- +2.35.1 + diff --git a/queue-5.4/genirq-don-t-return-error-on-missing-optional-irq_re.patch b/queue-5.4/genirq-don-t-return-error-on-missing-optional-irq_re.patch new file mode 100644 index 00000000000..84b82751ccf --- /dev/null +++ b/queue-5.4/genirq-don-t-return-error-on-missing-optional-irq_re.patch @@ -0,0 +1,42 @@ +From cd0bf269b4bd3e831a0a1f44620e12f2091ce7f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 18:05:44 +0200 +Subject: genirq: Don't return error on missing optional + irq_request_resources() + +From: Antonio Borneo + +[ Upstream commit 95001b756467ecc9f5973eb5e74e97699d9bbdf1 ] + +Function irq_chip::irq_request_resources() is reported as optional +in the declaration of struct irq_chip. +If the parent irq_chip does not implement it, we should ignore it +and return. + +Don't return error if the functions is missing. + +Signed-off-by: Antonio Borneo +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220512160544.13561-1-antonio.borneo@foss.st.com +Signed-off-by: Sasha Levin +--- + kernel/irq/chip.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c +index 856f0297dc73..521121c2666c 100644 +--- a/kernel/irq/chip.c ++++ b/kernel/irq/chip.c +@@ -1484,7 +1484,8 @@ int irq_chip_request_resources_parent(struct irq_data *data) + if (data->chip->irq_request_resources) + return data->chip->irq_request_resources(data); + +- return -ENOSYS; ++ /* no error on missing optional irq_chip::irq_request_resources */ ++ return 0; + } + EXPORT_SYMBOL_GPL(irq_chip_request_resources_parent); + +-- +2.35.1 + diff --git a/queue-5.4/genirq-generic_irq_ipi-depends-on-smp.patch b/queue-5.4/genirq-generic_irq_ipi-depends-on-smp.patch new file mode 100644 index 00000000000..9ec67cbb86f --- /dev/null +++ b/queue-5.4/genirq-generic_irq_ipi-depends-on-smp.patch @@ -0,0 +1,51 @@ +From 1ac66168f6a589c3f91104eb692fab83bae9ed73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 15:00:50 -0500 +Subject: genirq: GENERIC_IRQ_IPI depends on SMP + +From: Samuel Holland + +[ Upstream commit 0f5209fee90b4544c58b4278d944425292789967 ] + +The generic IPI code depends on the IRQ affinity mask being allocated +and initialized. This will not be the case if SMP is disabled. Fix up +the remaining driver that selected GENERIC_IRQ_IPI in a non-SMP config. + +Reported-by: kernel test robot +Signed-off-by: Samuel Holland +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220701200056.46555-3-samuel@sholland.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/Kconfig | 2 +- + kernel/irq/Kconfig | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig +index 20f44ef9c4c9..e50b5516bbef 100644 +--- a/drivers/irqchip/Kconfig ++++ b/drivers/irqchip/Kconfig +@@ -178,7 +178,7 @@ config MADERA_IRQ + config IRQ_MIPS_CPU + bool + select GENERIC_IRQ_CHIP +- select GENERIC_IRQ_IPI if SYS_SUPPORTS_MULTITHREADING ++ select GENERIC_IRQ_IPI if SMP && SYS_SUPPORTS_MULTITHREADING + select IRQ_DOMAIN + select IRQ_DOMAIN_HIERARCHY if GENERIC_IRQ_IPI + select GENERIC_IRQ_EFFECTIVE_AFF_MASK +diff --git a/kernel/irq/Kconfig b/kernel/irq/Kconfig +index 4e11120265c7..3a8a631044f0 100644 +--- a/kernel/irq/Kconfig ++++ b/kernel/irq/Kconfig +@@ -81,6 +81,7 @@ config IRQ_FASTEOI_HIERARCHY_HANDLERS + # Generic IRQ IPI support + config GENERIC_IRQ_IPI + bool ++ depends on SMP + select IRQ_DOMAIN_HIERARCHY + + # Generic MSI interrupt support +-- +2.35.1 + diff --git a/queue-5.4/gpio-gpiolib-of-fix-refcount-bugs-in-of_mm_gpiochip_.patch b/queue-5.4/gpio-gpiolib-of-fix-refcount-bugs-in-of_mm_gpiochip_.patch new file mode 100644 index 00000000000..da275f7e9d9 --- /dev/null +++ b/queue-5.4/gpio-gpiolib-of-fix-refcount-bugs-in-of_mm_gpiochip_.patch @@ -0,0 +1,53 @@ +From f994b259e7ea9ab3fef589a92772267b3721f864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 20:52:38 +0800 +Subject: gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() + +From: Liang He + +[ Upstream commit 5d07a692f9562f9c06e62cce369e9dd108173a0f ] + +We should use of_node_get() when a new reference of device_node +is created. It is noted that the old reference stored in +'mm_gc->gc.of_node' should also be decreased. + +This patch is based on the fact that there is a call site in function +'qe_add_gpiochips()' of src file 'drivers\soc\fsl\qe\gpio.c'. In this +function, of_mm_gpiochip_add_data() is contained in an iteration of +for_each_compatible_node() which will automatically increase and +decrease the refcount. So we need additional of_node_get() for the +reference escape in of_mm_gpiochip_add_data(). + +Fixes: a19e3da5bc5f ("of/gpio: Kill of_gpio_chip and add members directly to gpio_chip") +Signed-off-by: Liang He +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-of.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index b1dcd2dd52e6..73807c897391 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -734,7 +734,8 @@ int of_mm_gpiochip_add_data(struct device_node *np, + if (mm_gc->save_regs) + mm_gc->save_regs(mm_gc); + +- mm_gc->gc.of_node = np; ++ of_node_put(mm_gc->gc.of_node); ++ mm_gc->gc.of_node = of_node_get(np); + + ret = gpiochip_add_data(gc, data); + if (ret) +@@ -742,6 +743,7 @@ int of_mm_gpiochip_add_data(struct device_node *np, + + return 0; + err2: ++ of_node_put(np); + iounmap(mm_gc->regs); + err1: + kfree(gc->label); +-- +2.35.1 + diff --git a/queue-5.4/hid-alps-declare-u1_unicorn_legacy-support.patch b/queue-5.4/hid-alps-declare-u1_unicorn_legacy-support.patch new file mode 100644 index 00000000000..ca15bc35334 --- /dev/null +++ b/queue-5.4/hid-alps-declare-u1_unicorn_legacy-support.patch @@ -0,0 +1,36 @@ +From 620a34e1b7b346f5e3f4fce9204236097fa70cb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 17:53:24 +0300 +Subject: HID: alps: Declare U1_UNICORN_LEGACY support + +From: Artem Borisov + +[ Upstream commit 1117d182c5d72abd7eb8b7d5e7b8c3373181c3ab ] + +U1_UNICORN_LEGACY id was added to the driver, but was not declared +in the device id table, making it impossible to use. + +Fixes: 640e403 ("HID: alps: Add AUI1657 device ID") +Signed-off-by: Artem Borisov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-alps.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index 2477b2a3f7c3..464a48906d01 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -831,6 +831,8 @@ static const struct hid_device_id alps_id[] = { + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_DUAL) }, + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1) }, ++ { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, ++ USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY) }, + { HID_DEVICE(HID_BUS_ANY, HID_GROUP_ANY, + USB_VENDOR_ID_ALPS_JP, HID_DEVICE_ID_ALPS_T4_BTNLESS) }, + { } +-- +2.35.1 + diff --git a/queue-5.4/hid-cp2112-prevent-a-buffer-overflow-in-cp2112_xfer.patch b/queue-5.4/hid-cp2112-prevent-a-buffer-overflow-in-cp2112_xfer.patch new file mode 100644 index 00000000000..1c1eccdf400 --- /dev/null +++ b/queue-5.4/hid-cp2112-prevent-a-buffer-overflow-in-cp2112_xfer.patch @@ -0,0 +1,47 @@ +From 579d7a117cf7fae2be6b0731294dc6d8a06ed2c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 05:26:09 -0700 +Subject: HID: cp2112: prevent a buffer overflow in cp2112_xfer() + +From: Harshit Mogalapalli + +[ Upstream commit 381583845d19cb4bd21c8193449385f3fefa9caf ] + +Smatch warnings: +drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() +'data->block[1]' too small (33 vs 255) +drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too +small (64 vs 255) + +The 'read_length' variable is provided by 'data->block[0]' which comes +from user and it(read_length) can take a value between 0-255. Add an +upper bound to 'read_length' variable to prevent a buffer overflow in +memcpy(). + +Fixes: 542134c0375b ("HID: cp2112: Fix I2C_BLOCK_DATA transactions") +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-cp2112.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c +index db1b55df0d13..340408f8c8ab 100644 +--- a/drivers/hid/hid-cp2112.c ++++ b/drivers/hid/hid-cp2112.c +@@ -787,6 +787,11 @@ static int cp2112_xfer(struct i2c_adapter *adap, u16 addr, + data->word = le16_to_cpup((__le16 *)buf); + break; + case I2C_SMBUS_I2C_BLOCK_DATA: ++ if (read_length > I2C_SMBUS_BLOCK_MAX) { ++ ret = -EINVAL; ++ goto power_normal; ++ } ++ + memcpy(data->block + 1, buf, read_length); + break; + case I2C_SMBUS_BLOCK_DATA: +-- +2.35.1 + diff --git a/queue-5.4/hwmon-sht15-fix-wrong-assumptions-in-device-remove-c.patch b/queue-5.4/hwmon-sht15-fix-wrong-assumptions-in-device-remove-c.patch new file mode 100644 index 00000000000..1d83bea88a2 --- /dev/null +++ b/queue-5.4/hwmon-sht15-fix-wrong-assumptions-in-device-remove-c.patch @@ -0,0 +1,78 @@ +From 4e5fae8cb030e8258f93f13aae690ddda1cbd985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 21:43:44 +0200 +Subject: hwmon: (sht15) Fix wrong assumptions in device remove callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 7d4edccc9bbfe1dcdff641343f7b0c6763fbe774 ] + +Taking a lock at the beginning of .remove() doesn't prevent new readers. +With the existing approach it can happen, that a read occurs just when +the lock was taken blocking the reader until the lock is released at the +end of the remove callback which then accessed *data that is already +freed then. + +To actually fix this problem the hwmon core needs some adaption. Until +this is implemented take the optimistic approach of assuming that all +readers are gone after hwmon_device_unregister() and +sysfs_remove_group() as most other drivers do. (And once the core +implements that, taking the lock would deadlock.) + +So drop the lock, move the reset to after device unregistration to keep +the device in a workable state until it's deregistered. Also add a error +message in case the reset fails and return 0 anyhow. (Returning an error +code, doesn't stop the platform device unregistration and only results +in a little helpful error message before the devm cleanup handlers are +called.) + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20220725194344.150098-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/sht15.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c +index 7f4a63959730..ae4d14257a11 100644 +--- a/drivers/hwmon/sht15.c ++++ b/drivers/hwmon/sht15.c +@@ -1020,25 +1020,20 @@ static int sht15_probe(struct platform_device *pdev) + static int sht15_remove(struct platform_device *pdev) + { + struct sht15_data *data = platform_get_drvdata(pdev); ++ int ret; + +- /* +- * Make sure any reads from the device are done and +- * prevent new ones beginning +- */ +- mutex_lock(&data->read_lock); +- if (sht15_soft_reset(data)) { +- mutex_unlock(&data->read_lock); +- return -EFAULT; +- } + hwmon_device_unregister(data->hwmon_dev); + sysfs_remove_group(&pdev->dev.kobj, &sht15_attr_group); ++ ++ ret = sht15_soft_reset(data); ++ if (ret) ++ dev_err(&pdev->dev, "Failed to reset device (%pe)\n", ERR_PTR(ret)); ++ + if (!IS_ERR(data->reg)) { + regulator_unregister_notifier(data->reg, &data->nb); + regulator_disable(data->reg); + } + +- mutex_unlock(&data->read_lock); +- + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.4/i2c-cadence-support-pec-for-smbus-block-read.patch b/queue-5.4/i2c-cadence-support-pec-for-smbus-block-read.patch new file mode 100644 index 00000000000..035c32dd8aa --- /dev/null +++ b/queue-5.4/i2c-cadence-support-pec-for-smbus-block-read.patch @@ -0,0 +1,77 @@ +From 1512f60591330d25effef2b4af1349f07d43d02a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Jul 2022 16:52:44 +0200 +Subject: i2c: cadence: Support PEC for SMBus block read + +From: Lars-Peter Clausen + +[ Upstream commit 9fdf6d97f03035ad5298e2d1635036c74c2090ed ] + +SMBus packet error checking (PEC) is implemented by appending one +additional byte of checksum data at the end of the message. This provides +additional protection and allows to detect data corruption on the I2C bus. + +SMBus block reads support variable length reads. The first byte in the read +message is the number of available data bytes. + +The combination of PEC and block read is currently not supported by the +Cadence I2C driver. + * When PEC is enabled the maximum transfer length for block reads + increases from 33 to 34 bytes. + * The I2C core smbus emulation layer relies on the driver updating the + `i2c_msg` `len` field with the number of received bytes. The updated + length is used when checking the PEC. + +Add support to the Cadence I2C driver for handling SMBus block reads with +PEC. To determine the maximum transfer length uses the initial `len` value +of the `i2c_msg`. When PEC is enabled this will be 2, when it is disabled +it will be 1. + +Once a read transfer is done also increment the `len` field by the amount +of received data bytes. + +This change has been tested with a UCM90320 PMBus power monitor, which +requires block reads to access certain data fields, but also has PEC +enabled by default. + +Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller") +Signed-off-by: Lars-Peter Clausen +Tested-by: Shubhrajyoti Datta +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index 8750e444f449..72699fdd5d11 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -348,8 +348,13 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) + ctrl_reg = cdns_i2c_readreg(CDNS_I2C_CR_OFFSET); + ctrl_reg |= CDNS_I2C_CR_RW | CDNS_I2C_CR_CLR_FIFO; + ++ /* ++ * Receive up to I2C_SMBUS_BLOCK_MAX data bytes, plus one message length ++ * byte, plus one checksum byte if PEC is enabled. p_msg->len will be 2 if ++ * PEC is enabled, otherwise 1. ++ */ + if (id->p_msg->flags & I2C_M_RECV_LEN) +- id->recv_count = I2C_SMBUS_BLOCK_MAX + 1; ++ id->recv_count = I2C_SMBUS_BLOCK_MAX + id->p_msg->len; + + id->curr_recv_count = id->recv_count; + +@@ -535,6 +540,9 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg, + if (id->err_status & CDNS_I2C_IXR_ARB_LOST) + return -EAGAIN; + ++ if (msg->flags & I2C_M_RECV_LEN) ++ msg->len += min_t(unsigned int, msg->buf[0], I2C_SMBUS_BLOCK_MAX); ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.4/i2c-fix-a-potential-use-after-free.patch b/queue-5.4/i2c-fix-a-potential-use-after-free.patch new file mode 100644 index 00000000000..2431be8df92 --- /dev/null +++ b/queue-5.4/i2c-fix-a-potential-use-after-free.patch @@ -0,0 +1,40 @@ +From 644ef6b1bde8817f2aca389b8e67f68d5ffa8207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2019 09:34:32 +0000 +Subject: i2c: Fix a potential use after free + +From: Xu Wang + +[ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] + +Free the adap structure only after we are done using it. +This patch just moves the put_device() down a bit to avoid the +use after free. + +Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") +Signed-off-by: Xu Wang +[wsa: added comment to the code, added Fixes tag] +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 1b93fae58ec7..964e8a29b27b 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -2358,8 +2358,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) + if (!adap) + return; + +- put_device(&adap->dev); + module_put(adap->owner); ++ /* Should be last, otherwise we risk use-after-free with 'adap' */ ++ put_device(&adap->dev); + } + EXPORT_SYMBOL(i2c_put_adapter); + +-- +2.35.1 + diff --git a/queue-5.4/i2c-mux-gpmux-add-of_node_put-when-breaking-out-of-l.patch b/queue-5.4/i2c-mux-gpmux-add-of_node_put-when-breaking-out-of-l.patch new file mode 100644 index 00000000000..5ed168cdc29 --- /dev/null +++ b/queue-5.4/i2c-mux-gpmux-add-of_node_put-when-breaking-out-of-l.patch @@ -0,0 +1,37 @@ +From 083d3a2db6727d8f92943526611ff39ea027f538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jul 2022 09:24:01 +0800 +Subject: i2c: mux-gpmux: Add of_node_put() when breaking out of loop + +From: Liang He + +[ Upstream commit 6435319c34704994e19b0767f6a4e6f37439867b ] + +In i2c_mux_probe(), we should call of_node_put() when breaking out +of for_each_child_of_node() which will automatically increase and +decrease the refcount. + +Fixes: ac8498f0ce53 ("i2c: i2c-mux-gpmux: new driver") +Signed-off-by: Liang He +Acked-by: Peter Rosin +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/muxes/i2c-mux-gpmux.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/muxes/i2c-mux-gpmux.c b/drivers/i2c/muxes/i2c-mux-gpmux.c +index f830535cff12..480ec74e6134 100644 +--- a/drivers/i2c/muxes/i2c-mux-gpmux.c ++++ b/drivers/i2c/muxes/i2c-mux-gpmux.c +@@ -138,6 +138,7 @@ static int i2c_mux_probe(struct platform_device *pdev) + return 0; + + err_children: ++ of_node_put(child); + i2c_mux_del_adapters(muxc); + err_parent: + i2c_put_adapter(parent); +-- +2.35.1 + diff --git a/queue-5.4/iavf-fix-max_rate-limiting.patch b/queue-5.4/iavf-fix-max_rate-limiting.patch new file mode 100644 index 00000000000..1ea3abf385c --- /dev/null +++ b/queue-5.4/iavf-fix-max_rate-limiting.patch @@ -0,0 +1,104 @@ +From 0cebc84b27426dc4c4640fd01463c90610fa58ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 18:41:23 -0400 +Subject: iavf: Fix max_rate limiting + +From: Przemyslaw Patynowski + +[ Upstream commit ec60d54cb9a3d43a02c5612a03093c18233e6601 ] + +Fix max_rate option in TC, check for proper quanta boundaries. +Check for minimum value provided and if it fits expected 50Mbps +quanta. + +Without this patch, iavf could send settings for max_rate limiting +that would be accepted from by PF even the max_rate option is less +than expected 50Mbps quanta. It results in no rate limiting +on traffic as rate limiting will be floored to 0. + +Example: +tc qdisc add dev $vf root mqprio num_tc 3 map 0 2 1 queues \ +2@0 2@2 2@4 hw 1 mode channel shaper bw_rlimit \ +max_rate 50Mbps 500Mbps 500Mbps + +Should limit TC0 to circa 50 Mbps + +tc qdisc add dev $vf root mqprio num_tc 3 map 0 2 1 queues \ +2@0 2@2 2@4 hw 1 mode channel shaper bw_rlimit \ +max_rate 0Mbps 100Kbit 500Mbps + +Should return error + +Fixes: d5b33d024496 ("i40evf: add ndo_setup_tc callback to i40evf") +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Jun Zhang +Tested-by: Bharathi Sreenivas +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf.h | 1 + + drivers/net/ethernet/intel/iavf/iavf_main.c | 25 +++++++++++++++++++-- + 2 files changed, 24 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index 81ca6472937d..85275b6ede4d 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -86,6 +86,7 @@ struct iavf_vsi { + #define IAVF_HKEY_ARRAY_SIZE ((IAVF_VFQF_HKEY_MAX_INDEX + 1) * 4) + #define IAVF_HLUT_ARRAY_SIZE ((IAVF_VFQF_HLUT_MAX_INDEX + 1) * 4) + #define IAVF_MBPS_DIVISOR 125000 /* divisor to convert to Mbps */ ++#define IAVF_MBPS_QUANTA 50 + + #define IAVF_VIRTCHNL_VF_RESOURCE_SIZE (sizeof(struct virtchnl_vf_resource) + \ + (IAVF_MAX_VF_VSI * \ +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index e8850ba5604c..4c41bb47fc1a 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2581,6 +2581,7 @@ static int iavf_validate_ch_config(struct iavf_adapter *adapter, + struct tc_mqprio_qopt_offload *mqprio_qopt) + { + u64 total_max_rate = 0; ++ u32 tx_rate_rem = 0; + int i, num_qps = 0; + u64 tx_rate = 0; + int ret = 0; +@@ -2595,12 +2596,32 @@ static int iavf_validate_ch_config(struct iavf_adapter *adapter, + return -EINVAL; + if (mqprio_qopt->min_rate[i]) { + dev_err(&adapter->pdev->dev, +- "Invalid min tx rate (greater than 0) specified\n"); ++ "Invalid min tx rate (greater than 0) specified for TC%d\n", ++ i); + return -EINVAL; + } +- /*convert to Mbps */ ++ ++ /* convert to Mbps */ + tx_rate = div_u64(mqprio_qopt->max_rate[i], + IAVF_MBPS_DIVISOR); ++ ++ if (mqprio_qopt->max_rate[i] && ++ tx_rate < IAVF_MBPS_QUANTA) { ++ dev_err(&adapter->pdev->dev, ++ "Invalid max tx rate for TC%d, minimum %dMbps\n", ++ i, IAVF_MBPS_QUANTA); ++ return -EINVAL; ++ } ++ ++ (void)div_u64_rem(tx_rate, IAVF_MBPS_QUANTA, &tx_rate_rem); ++ ++ if (tx_rate_rem != 0) { ++ dev_err(&adapter->pdev->dev, ++ "Invalid max tx rate for TC%d, not divisible by %d\n", ++ i, IAVF_MBPS_QUANTA); ++ return -EINVAL; ++ } ++ + total_max_rate += tx_rate; + num_qps += mqprio_qopt->qopt.count[i]; + } +-- +2.35.1 + diff --git a/queue-5.4/intel_th-fix-a-resource-leak-in-an-error-handling-pa.patch b/queue-5.4/intel_th-fix-a-resource-leak-in-an-error-handling-pa.patch new file mode 100644 index 00000000000..18d9ce2d1db --- /dev/null +++ b/queue-5.4/intel_th-fix-a-resource-leak-in-an-error-handling-pa.patch @@ -0,0 +1,55 @@ +From 52868dd33756f0bfb9657cb4327cdab31705d621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 11:26:32 +0300 +Subject: intel_th: Fix a resource leak in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 086c28ab7c5699256aced0049aae9c42f1410313 ] + +If an error occurs after calling 'pci_alloc_irq_vectors()', +'pci_free_irq_vectors()' must be called as already done in the remove +function. + +Fixes: 7b7036d47c35 ("intel_th: pci: Use MSI interrupt signalling") +Reviewed-by: Andy Shevchenko +Signed-off-by: Christophe JAILLET +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/r/20220705082637.59979-2-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/intel_th/pci.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index a723c8c33087..3910fafc4fc2 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -100,8 +100,10 @@ static int intel_th_pci_probe(struct pci_dev *pdev, + } + + th = intel_th_alloc(&pdev->dev, drvdata, resource, r); +- if (IS_ERR(th)) +- return PTR_ERR(th); ++ if (IS_ERR(th)) { ++ err = PTR_ERR(th); ++ goto err_free_irq; ++ } + + th->activate = intel_th_pci_activate; + th->deactivate = intel_th_pci_deactivate; +@@ -109,6 +111,10 @@ static int intel_th_pci_probe(struct pci_dev *pdev, + pci_set_master(pdev); + + return 0; ++ ++err_free_irq: ++ pci_free_irq_vectors(pdev); ++ return err; + } + + static void intel_th_pci_remove(struct pci_dev *pdev) +-- +2.35.1 + diff --git a/queue-5.4/intel_th-msu-fix-vmalloced-buffers.patch b/queue-5.4/intel_th-msu-fix-vmalloced-buffers.patch new file mode 100644 index 00000000000..6b7e2a5c91b --- /dev/null +++ b/queue-5.4/intel_th-msu-fix-vmalloced-buffers.patch @@ -0,0 +1,74 @@ +From 302c759318099f4625360b90947f6a6397d995c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 11:26:34 +0300 +Subject: intel_th: msu: Fix vmalloced buffers + +From: Alexander Shishkin + +[ Upstream commit ac12ad3ccf6d386e64a9d6a890595a2509d24edd ] + +After commit f5ff79fddf0e ("dma-mapping: remove CONFIG_DMA_REMAP") there's +a chance of DMA buffer getting allocated via vmalloc(), which messes up +the mmapping code: + +> RIP: msc_mmap_fault [intel_th_msu] +> Call Trace: +> +> __do_fault +> do_fault +... + +Fix this by accounting for vmalloc possibility. + +Fixes: ba39bd830605 ("intel_th: msu: Switch over to scatterlist") +Reviewed-by: Andy Shevchenko +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/r/20220705082637.59979-4-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/intel_th/msu.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c +index 3cd2489d398c..640b0aae7eb4 100644 +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -1050,6 +1050,16 @@ msc_buffer_set_uc(struct msc_window *win, unsigned int nr_segs) {} + static inline void msc_buffer_set_wb(struct msc_window *win) {} + #endif /* CONFIG_X86 */ + ++static struct page *msc_sg_page(struct scatterlist *sg) ++{ ++ void *addr = sg_virt(sg); ++ ++ if (is_vmalloc_addr(addr)) ++ return vmalloc_to_page(addr); ++ ++ return sg_page(sg); ++} ++ + /** + * msc_buffer_win_alloc() - alloc a window for a multiblock mode + * @msc: MSC device +@@ -1122,7 +1132,7 @@ static void __msc_buffer_win_free(struct msc *msc, struct msc_window *win) + int i; + + for_each_sg(win->sgt->sgl, sg, win->nr_segs, i) { +- struct page *page = sg_page(sg); ++ struct page *page = msc_sg_page(sg); + + page->mapping = NULL; + dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE, +@@ -1384,7 +1394,7 @@ static struct page *msc_buffer_get_page(struct msc *msc, unsigned long pgoff) + pgoff -= win->pgoff; + + for_each_sg(win->sgt->sgl, sg, win->nr_segs, blk) { +- struct page *page = sg_page(sg); ++ struct page *page = msc_sg_page(sg); + size_t pgsz = PFN_DOWN(sg->length); + + if (pgoff < pgsz) +-- +2.35.1 + diff --git a/queue-5.4/intel_th-msu-sink-potential-dereference-of-null-poin.patch b/queue-5.4/intel_th-msu-sink-potential-dereference-of-null-poin.patch new file mode 100644 index 00000000000..dd3e27d49e5 --- /dev/null +++ b/queue-5.4/intel_th-msu-sink-potential-dereference-of-null-poin.patch @@ -0,0 +1,41 @@ +From 5eecec68ca1232fca2e5896f412aebad12911b67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 11:26:33 +0300 +Subject: intel_th: msu-sink: Potential dereference of null pointer + +From: Jiasheng Jiang + +[ Upstream commit 82f76a4a720791d889de775b5f7541d601efc8bd ] + +The return value of dma_alloc_coherent() needs to be checked. +To avoid use of null pointer in sg_set_buf() in case of the failure of +alloc. + +Fixes: f220df66f676 ("intel_th: msu-sink: An example msu buffer "sink"") +Reviewed-by: Andy Shevchenko +Signed-off-by: Jiasheng Jiang +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/r/20220705082637.59979-3-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/intel_th/msu-sink.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hwtracing/intel_th/msu-sink.c b/drivers/hwtracing/intel_th/msu-sink.c +index 2c7f5116be12..891b28ea25fe 100644 +--- a/drivers/hwtracing/intel_th/msu-sink.c ++++ b/drivers/hwtracing/intel_th/msu-sink.c +@@ -71,6 +71,9 @@ static int msu_sink_alloc_window(void *data, struct sg_table **sgt, size_t size) + block = dma_alloc_coherent(priv->dev->parent->parent, + PAGE_SIZE, &sg_dma_address(sg_ptr), + GFP_KERNEL); ++ if (!block) ++ return -ENOMEM; ++ + sg_set_buf(sg_ptr, block, PAGE_SIZE); + } + +-- +2.35.1 + diff --git a/queue-5.4/iommu-arm-smmu-qcom_iommu-add-of_node_put-when-break.patch b/queue-5.4/iommu-arm-smmu-qcom_iommu-add-of_node_put-when-break.patch new file mode 100644 index 00000000000..2073865fd48 --- /dev/null +++ b/queue-5.4/iommu-arm-smmu-qcom_iommu-add-of_node_put-when-break.patch @@ -0,0 +1,45 @@ +From 7d0941c870e0e916cdfe4a8e52fcdc3d64e81cee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 20:49:55 +0800 +Subject: iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of + loop + +From: Liang He + +[ Upstream commit a91eb6803c1c715738682fece095145cbd68fe0b ] + +In qcom_iommu_has_secure_context(), we should call of_node_put() +for the reference 'child' when breaking out of for_each_child_of_node() +which will automatically increase and decrease the refcount. + +Fixes: d051f28c8807 ("iommu/qcom: Initialize secure page table") +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220719124955.1242171-1-windhl@126.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/qcom_iommu.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c +index 280de92b332e..b6e546b62a7c 100644 +--- a/drivers/iommu/qcom_iommu.c ++++ b/drivers/iommu/qcom_iommu.c +@@ -785,9 +785,12 @@ static bool qcom_iommu_has_secure_context(struct qcom_iommu_dev *qcom_iommu) + { + struct device_node *child; + +- for_each_child_of_node(qcom_iommu->dev->of_node, child) +- if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) ++ for_each_child_of_node(qcom_iommu->dev->of_node, child) { ++ if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) { ++ of_node_put(child); + return true; ++ } ++ } + + return false; + } +-- +2.35.1 + diff --git a/queue-5.4/iommu-exynos-handle-failed-iommu-device-registration.patch b/queue-5.4/iommu-exynos-handle-failed-iommu-device-registration.patch new file mode 100644 index 00000000000..d0302fb7057 --- /dev/null +++ b/queue-5.4/iommu-exynos-handle-failed-iommu-device-registration.patch @@ -0,0 +1,51 @@ +From 3b0bd8fba2e283c750aa193b99f1a69b205290d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 19:55:46 +0300 +Subject: iommu/exynos: Handle failed IOMMU device registration properly + +From: Sam Protsenko + +[ Upstream commit fce398d2d02c0a9a2bedf7c7201b123e153e8963 ] + +If iommu_device_register() fails in exynos_sysmmu_probe(), the previous +calls have to be cleaned up. In this case, the iommu_device_sysfs_add() +should be cleaned up, by calling its remove counterpart call. + +Fixes: d2c302b6e8b1 ("iommu/exynos: Make use of iommu_device_register interface") +Signed-off-by: Sam Protsenko +Reviewed-by: Krzysztof Kozlowski +Acked-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20220714165550.8884-3-semen.protsenko@linaro.org +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/exynos-iommu.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c +index 55ed857f804f..31a9b9885653 100644 +--- a/drivers/iommu/exynos-iommu.c ++++ b/drivers/iommu/exynos-iommu.c +@@ -635,7 +635,7 @@ static int exynos_sysmmu_probe(struct platform_device *pdev) + + ret = iommu_device_register(&data->iommu); + if (ret) +- return ret; ++ goto err_iommu_register; + + platform_set_drvdata(pdev, data); + +@@ -662,6 +662,10 @@ static int exynos_sysmmu_probe(struct platform_device *pdev) + pm_runtime_enable(dev); + + return 0; ++ ++err_iommu_register: ++ iommu_device_sysfs_remove(&data->iommu); ++ return ret; + } + + static int __maybe_unused exynos_sysmmu_suspend(struct device *dev) +-- +2.35.1 + diff --git a/queue-5.4/jbd2-fix-assertion-jh-b_frozen_data-null-failure-whe.patch b/queue-5.4/jbd2-fix-assertion-jh-b_frozen_data-null-failure-whe.patch new file mode 100644 index 00000000000..cd6341dfd40 --- /dev/null +++ b/queue-5.4/jbd2-fix-assertion-jh-b_frozen_data-null-failure-whe.patch @@ -0,0 +1,110 @@ +From 0a8636a419094688a2ded197139a8770bf4e2ad5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 20:51:52 +0800 +Subject: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal + aborted + +From: Zhihao Cheng + +[ Upstream commit 4a734f0869f970b8a9b65062ea40b09a5da9dba8 ] + +Following process will fail assertion 'jh->b_frozen_data == NULL' in +jbd2_journal_dirty_metadata(): + + jbd2_journal_commit_transaction +unlink(dir/a) + jh->b_transaction = trans1 + jh->b_jlist = BJ_Metadata + journal->j_running_transaction = NULL + trans1->t_state = T_COMMIT +unlink(dir/b) + handle->h_trans = trans2 + do_get_write_access + jh->b_modified = 0 + jh->b_frozen_data = frozen_buffer + jh->b_next_transaction = trans2 + jbd2_journal_dirty_metadata + is_handle_aborted + is_journal_aborted // return false + + --> jbd2 abort <-- + + while (commit_transaction->t_buffers) + if (is_journal_aborted) + jbd2_journal_refile_buffer + __jbd2_journal_refile_buffer + WRITE_ONCE(jh->b_transaction, + jh->b_next_transaction) + WRITE_ONCE(jh->b_next_transaction, NULL) + __jbd2_journal_file_buffer(jh, BJ_Reserved) + J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure ! + +The reproducer (See detail in [Link]) reports: + ------------[ cut here ]------------ + kernel BUG at fs/jbd2/transaction.c:1629! + invalid opcode: 0000 [#1] PREEMPT SMP + CPU: 2 PID: 584 Comm: unlink Tainted: G W + 5.19.0-rc6-00115-g4a57a8400075-dirty #697 + RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470 + RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 + Call Trace: + + __ext4_handle_dirty_metadata+0xa0/0x290 + ext4_handle_dirty_dirblock+0x10c/0x1d0 + ext4_delete_entry+0x104/0x200 + __ext4_unlink+0x22b/0x360 + ext4_unlink+0x275/0x390 + vfs_unlink+0x20b/0x4c0 + do_unlinkat+0x42f/0x4c0 + __x64_sys_unlink+0x37/0x50 + do_syscall_64+0x35/0x80 + +After journal aborting, __jbd2_journal_refile_buffer() is executed with +holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()' +into the area protected by @jh->b_state_lock. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216251 +Fixes: 470decc613ab20 ("[PATCH] jbd2: initial copy of files from jbd") +Signed-off-by: Zhihao Cheng +Link: https://lore.kernel.org/r/20220715125152.4022726-1-chengzhihao1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index be05fb96757c..e0bd73140415 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1375,8 +1375,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + struct journal_head *jh; + int ret = 0; + +- if (is_handle_aborted(handle)) +- return -EROFS; + if (!buffer_jbd(bh)) + return -EUCLEAN; + +@@ -1423,6 +1421,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + journal = transaction->t_journal; + jbd_lock_bh_state(bh); + ++ if (is_handle_aborted(handle)) { ++ /* ++ * Check journal aborting with @jh->b_state_lock locked, ++ * since 'jh->b_transaction' could be replaced with ++ * 'jh->b_next_transaction' during old transaction ++ * committing if journal aborted, which may fail ++ * assertion on 'jh->b_frozen_data == NULL'. ++ */ ++ ret = -EROFS; ++ goto out_unlock_bh; ++ } ++ + if (jh->b_modified == 0) { + /* + * This buffer's got modified and becoming part +-- +2.35.1 + diff --git a/queue-5.4/jbd2-fix-outstanding-credits-assert-in-jbd2_journal_.patch b/queue-5.4/jbd2-fix-outstanding-credits-assert-in-jbd2_journal_.patch new file mode 100644 index 00000000000..97a327c00a5 --- /dev/null +++ b/queue-5.4/jbd2-fix-outstanding-credits-assert-in-jbd2_journal_.patch @@ -0,0 +1,75 @@ +From f5a6db176989d242f9a6b511dd37b0a2ceaed176 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jun 2022 21:04:26 +0800 +Subject: jbd2: fix outstanding credits assert in + jbd2_journal_commit_transaction() + +From: Zhang Yi + +[ Upstream commit a89573ce4ad32f19f43ec669771726817e185be0 ] + +We catch an assert problem in jbd2_journal_commit_transaction() when +doing fsstress and request falut injection tests. The problem is +happened in a race condition between jbd2_journal_commit_transaction() +and ext4_end_io_end(). Firstly, ext4_writepages() writeback dirty pages +and start reserved handle, and then the journal was aborted due to some +previous metadata IO error, jbd2_journal_abort() start to commit current +running transaction, the committing procedure could be raced by +ext4_end_io_end() and lead to subtract j_reserved_credits twice from +commit_transaction->t_outstanding_credits, finally the +t_outstanding_credits is mistakenly smaller than t_nr_buffers and +trigger assert. + +kjournald2 kworker + +jbd2_journal_commit_transaction() + write_unlock(&journal->j_state_lock); + atomic_sub(j_reserved_credits, t_outstanding_credits); //sub once + + jbd2_journal_start_reserved() + start_this_handle() //detect aborted journal + jbd2_journal_free_reserved() //get running transaction + read_lock(&journal->j_state_lock) + __jbd2_journal_unreserve_handle() + atomic_sub(j_reserved_credits, t_outstanding_credits); + //sub again + read_unlock(&journal->j_state_lock); + + journal->j_running_transaction = NULL; + J_ASSERT(t_nr_buffers <= t_outstanding_credits) //bomb!!! + +Fix this issue by using journal->j_state_lock to protect the subtraction +in jbd2_journal_commit_transaction(). + +Fixes: 96f1e0974575 ("jbd2: avoid long hold times of j_state_lock while committing a transaction") +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20220611130426.2013258-1-yi.zhang@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/commit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c +index d45ceb2e2149..8d5aced7ed0c 100644 +--- a/fs/jbd2/commit.c ++++ b/fs/jbd2/commit.c +@@ -514,13 +514,13 @@ void jbd2_journal_commit_transaction(journal_t *journal) + */ + jbd2_journal_switch_revoke_table(journal); + ++ write_lock(&journal->j_state_lock); + /* + * Reserved credits cannot be claimed anymore, free them + */ + atomic_sub(atomic_read(&journal->j_reserved_credits), + &commit_transaction->t_outstanding_credits); + +- write_lock(&journal->j_state_lock); + trace_jbd2_commit_flushing(journal, commit_transaction); + stats.run.rs_flushing = jiffies; + stats.run.rs_locked = jbd2_time_diff(stats.run.rs_locked, +-- +2.35.1 + diff --git a/queue-5.4/kfifo-fix-kfifo_to_user-return-type.patch b/queue-5.4/kfifo-fix-kfifo_to_user-return-type.patch new file mode 100644 index 00000000000..651964155e0 --- /dev/null +++ b/queue-5.4/kfifo-fix-kfifo_to_user-return-type.patch @@ -0,0 +1,44 @@ +From 792e786ed431c74dbacd54a6059c6c0e60c8c316 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 08:30:04 +0300 +Subject: kfifo: fix kfifo_to_user() return type + +From: Dan Carpenter + +[ Upstream commit 045ed31e23aea840648c290dbde04797064960db ] + +The kfifo_to_user() macro is supposed to return zero for success or +negative error codes. Unfortunately, there is a signedness bug so it +returns unsigned int. This only affects callers which try to save the +result in ssize_t and as far as I can see the only place which does that +is line6_hwdep_read(). + +TL;DR: s/_uint/_int/. + +Link: https://lkml.kernel.org/r/YrVL3OJVLlNhIMFs@kili +Fixes: 144ecf310eb5 ("kfifo: fix kfifo_alloc() to return a signed int value") +Signed-off-by: Dan Carpenter +Cc: Stefani Seibold +Cc: Randy Dunlap +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/kfifo.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h +index fc4b0b10210f..d3e0f9dc2587 100644 +--- a/include/linux/kfifo.h ++++ b/include/linux/kfifo.h +@@ -615,7 +615,7 @@ __kfifo_uint_must_check_helper( \ + * writer, you don't need extra locking to use these macro. + */ + #define kfifo_to_user(fifo, to, len, copied) \ +-__kfifo_uint_must_check_helper( \ ++__kfifo_int_must_check_helper( \ + ({ \ + typeof((fifo) + 1) __tmp = (fifo); \ + void __user *__to = (to); \ +-- +2.35.1 + diff --git a/queue-5.4/kprobes-forbid-probing-on-trampoline-and-bpf-code-ar.patch b/queue-5.4/kprobes-forbid-probing-on-trampoline-and-bpf-code-ar.patch new file mode 100644 index 00000000000..2f7934b48b5 --- /dev/null +++ b/queue-5.4/kprobes-forbid-probing-on-trampoline-and-bpf-code-ar.patch @@ -0,0 +1,52 @@ +From dc96f2af02827f085e607499f73a01cf7aa05934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 11:37:19 +0800 +Subject: kprobes: Forbid probing on trampoline and BPF code areas + +From: Chen Zhongjin + +[ Upstream commit 28f6c37a2910f565b4f5960df52b2eccae28c891 ] + +kernel_text_address() treats ftrace_trampoline, kprobe_insn_slot +and bpf_text_address as valid kprobe addresses - which is not ideal. + +These text areas are removable and changeable without any notification +to kprobes, and probing on them can trigger unexpected behavior: + + https://lkml.org/lkml/2022/7/26/1148 + +Considering that jump_label and static_call text are already +forbiden to probe, kernel_text_address() should be replaced with +core_kernel_text() and is_module_text_address() to check other text +areas which are unsafe to kprobe. + +[ mingo: Rewrote the changelog. ] + +Fixes: 5b485629ba0d ("kprobes, extable: Identify kprobes trampolines as kernel text area") +Fixes: 74451e66d516 ("bpf: make jited programs visible in traces") +Signed-off-by: Chen Zhongjin +Signed-off-by: Ingo Molnar +Acked-by: Masami Hiramatsu (Google) +Link: https://lore.kernel.org/r/20220801033719.228248-1-chenzhongjin@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/kprobes.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index c93340bae3ac..671b51782182 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1594,7 +1594,8 @@ static int check_kprobe_address_safe(struct kprobe *p, + preempt_disable(); + + /* Ensure it is not in reserved area nor out of text */ +- if (!kernel_text_address((unsigned long) p->addr) || ++ if (!(core_kernel_text((unsigned long) p->addr) || ++ is_module_text_address((unsigned long) p->addr)) || + within_kprobe_blacklist((unsigned long) p->addr) || + jump_label_text_reserved(p->addr, p->addr) || + find_bug((unsigned long)p->addr)) { +-- +2.35.1 + diff --git a/queue-5.4/libbpf-fix-the-name-of-a-reused-map.patch b/queue-5.4/libbpf-fix-the-name-of-a-reused-map.patch new file mode 100644 index 00000000000..72107299cf0 --- /dev/null +++ b/queue-5.4/libbpf-fix-the-name-of-a-reused-map.patch @@ -0,0 +1,74 @@ +From a79392aa43430c7ba2c8ddb991764d6ab006b1e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 11:15:40 +0800 +Subject: libbpf: Fix the name of a reused map +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Anquan Wu + +[ Upstream commit bf3f00378524adae16628cbadbd11ba7211863bb ] + +BPF map name is limited to BPF_OBJ_NAME_LEN. +A map name is defined as being longer than BPF_OBJ_NAME_LEN, +it will be truncated to BPF_OBJ_NAME_LEN when a userspace program +calls libbpf to create the map. A pinned map also generates a path +in the /sys. If the previous program wanted to reuse the map， +it can not get bpf_map by name, because the name of the map is only +partially the same as the name which get from pinned path. + +The syscall information below show that map name "process_pinned_map" +is truncated to "process_pinned_". + + bpf(BPF_OBJ_GET, {pathname="/sys/fs/bpf/process_pinned_map", + bpf_fd=0, file_flags=0}, 144) = -1 ENOENT (No such file or directory) + + bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_HASH, key_size=4, + value_size=4,max_entries=1024, map_flags=0, inner_map_fd=0, + map_name="process_pinned_",map_ifindex=0, btf_fd=3, btf_key_type_id=6, + btf_value_type_id=10,btf_vmlinux_value_type_id=0}, 72) = 4 + +This patch check that if the name of pinned map are the same as the +actual name for the first (BPF_OBJ_NAME_LEN - 1), +bpf map still uses the name which is included in bpf object. + +Fixes: 26736eb9a483 ("tools: libbpf: allow map reuse") +Signed-off-by: Anquan Wu +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/OSZP286MB1725CEA1C95C5CB8E7CCC53FB8869@OSZP286MB1725.JPNP286.PROD.OUTLOOK.COM +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 2a1dbf52fc9a..b8849812449c 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1884,7 +1884,7 @@ static int bpf_map_find_btf_info(struct bpf_object *obj, struct bpf_map *map) + int bpf_map__reuse_fd(struct bpf_map *map, int fd) + { + struct bpf_map_info info = {}; +- __u32 len = sizeof(info); ++ __u32 len = sizeof(info), name_len; + int new_fd, err; + char *new_name; + +@@ -1892,7 +1892,12 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd) + if (err) + return err; + +- new_name = strdup(info.name); ++ name_len = strlen(info.name); ++ if (name_len == BPF_OBJ_NAME_LEN - 1 && strncmp(map->name, info.name, name_len) == 0) ++ new_name = strdup(map->name); ++ else ++ new_name = strdup(info.name); ++ + if (!new_name) + return -errno; + +-- +2.35.1 + diff --git a/queue-5.4/media-hdpvr-fix-error-value-returns-in-hdpvr_read.patch b/queue-5.4/media-hdpvr-fix-error-value-returns-in-hdpvr_read.patch new file mode 100644 index 00000000000..943813f3e75 --- /dev/null +++ b/queue-5.4/media-hdpvr-fix-error-value-returns-in-hdpvr_read.patch @@ -0,0 +1,44 @@ +From eadde2cc8654c7c0f8f27088171c24b8d91d4b14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 18:50:02 +0100 +Subject: media: hdpvr: fix error value returns in hdpvr_read + +From: Niels Dossche + +[ Upstream commit 359c27c6ddbde404f44a9c0d3ec88ccd1e2042f2 ] + +Error return values are supposed to be negative in hdpvr_read. Most +error returns are currently handled via an unsigned integer "ret". When +setting a negative error value to "ret", the value actually becomes a +large positive value, because "ret" is unsigned. Later on, the "ret" +value is returned. But as ssize_t is a 64-bit signed number, the error +return value stays a large positive integer instead of a negative +integer. This can cause an error value to be interpreted as the read +size, which can cause a buffer overread for applications relying on the +returned size. + +Fixes: 9aba42efe85b ("V4L/DVB (11096): V4L2 Driver for the Hauppauge HD PVR usb capture device") +Signed-off-by: Niels Dossche +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/hdpvr/hdpvr-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c +index 7849f1fbbcc4..4f1505b94338 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-video.c ++++ b/drivers/media/usb/hdpvr/hdpvr-video.c +@@ -409,7 +409,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count, + struct hdpvr_device *dev = video_drvdata(file); + struct hdpvr_buffer *buf = NULL; + struct urb *urb; +- unsigned int ret = 0; ++ int ret = 0; + int rem, cnt; + + if (*pos) +-- +2.35.1 + diff --git a/queue-5.4/media-platform-mtk-mdp-fix-mdp_ipi_comm-structure-al.patch b/queue-5.4/media-platform-mtk-mdp-fix-mdp_ipi_comm-structure-al.patch new file mode 100644 index 00000000000..8f0ae7518c4 --- /dev/null +++ b/queue-5.4/media-platform-mtk-mdp-fix-mdp_ipi_comm-structure-al.patch @@ -0,0 +1,57 @@ +From 835741a3f5304e7c4c2687af65784c4b246b1534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jun 2022 14:55:46 +0100 +Subject: media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment + +From: AngeloGioacchino Del Regno + +[ Upstream commit ab14c99c035da7156a3b66fa171171295bc4b89a ] + +The mdp_ipi_comm structure defines a command that is either +PROCESS (start processing) or DEINIT (destroy instance); we +are using this one to send PROCESS or DEINIT commands from Linux +to an MDP instance through a VPU write but, while the first wants +us to stay 4-bytes aligned, the VPU instead requires an 8-bytes +data alignment. + +Keeping in mind that these commands are executed immediately +after sending them (hence not chained with others before the +VPU/MDP "actually" start executing), it is fine to simply add +a padding of 4 bytes to this structure: this keeps the same +performance as before, as we're still stack-allocating it, +while avoiding hackery inside of mtk-vpu to ensure alignment +bringing a definitely bigger performance impact. + +Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Houlong Wei +Reviewed-by: Irui Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h +index 2cb8cecb3077..b810c96695c8 100644 +--- a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h ++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h +@@ -40,12 +40,14 @@ struct mdp_ipi_init { + * @ipi_id : IPI_MDP + * @ap_inst : AP mtk_mdp_vpu address + * @vpu_inst_addr : VPU MDP instance address ++ * @padding : Alignment padding + */ + struct mdp_ipi_comm { + uint32_t msg_id; + uint32_t ipi_id; + uint64_t ap_inst; + uint32_t vpu_inst_addr; ++ uint32_t padding; + }; + + /** +-- +2.35.1 + diff --git a/queue-5.4/media-tw686x-register-the-irq-at-the-end-of-probe.patch b/queue-5.4/media-tw686x-register-the-irq-at-the-end-of-probe.patch new file mode 100644 index 00000000000..9e333e8de12 --- /dev/null +++ b/queue-5.4/media-tw686x-register-the-irq-at-the-end-of-probe.patch @@ -0,0 +1,82 @@ +From f314dc92b5f5f4149132b8c8796fa28925b6271a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 May 2022 07:24:01 +0100 +Subject: media: tw686x: Register the irq at the end of probe + +From: Zheyu Ma + +[ Upstream commit fb730334e0f759d00f72168fbc555e5a95e35210 ] + +We got the following warning when booting the kernel: + +[ 3.243674] INFO: trying to register non-static key. +[ 3.243922] The code is fine but needs lockdep annotation, or maybe +[ 3.244230] you didn't initialize this object before use? +[ 3.245642] Call Trace: +[ 3.247836] lock_acquire+0xff/0x2d0 +[ 3.248727] tw686x_audio_irq+0x1a5/0xcc0 [tw686x] +[ 3.249211] tw686x_irq+0x1f9/0x480 [tw686x] + +The lock 'vc->qlock' will be initialized in tw686x_video_init(), but the +driver registers the irq before calling the tw686x_video_init(), and we +got the warning. + +Fix this by registering the irq at the end of probe + +Fixes: 704a84ccdbf1 ("[media] media: Support Intersil/Techwell TW686x-based video capture cards") +Signed-off-by: Zheyu Ma +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/tw686x/tw686x-core.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +diff --git a/drivers/media/pci/tw686x/tw686x-core.c b/drivers/media/pci/tw686x/tw686x-core.c +index 74ae4f0dcee7..8a25a0dac4ae 100644 +--- a/drivers/media/pci/tw686x/tw686x-core.c ++++ b/drivers/media/pci/tw686x/tw686x-core.c +@@ -315,13 +315,6 @@ static int tw686x_probe(struct pci_dev *pci_dev, + + spin_lock_init(&dev->lock); + +- err = request_irq(pci_dev->irq, tw686x_irq, IRQF_SHARED, +- dev->name, dev); +- if (err < 0) { +- dev_err(&pci_dev->dev, "unable to request interrupt\n"); +- goto iounmap; +- } +- + timer_setup(&dev->dma_delay_timer, tw686x_dma_delay, 0); + + /* +@@ -333,18 +326,23 @@ static int tw686x_probe(struct pci_dev *pci_dev, + err = tw686x_video_init(dev); + if (err) { + dev_err(&pci_dev->dev, "can't register video\n"); +- goto free_irq; ++ goto iounmap; + } + + err = tw686x_audio_init(dev); + if (err) + dev_warn(&pci_dev->dev, "can't register audio\n"); + ++ err = request_irq(pci_dev->irq, tw686x_irq, IRQF_SHARED, ++ dev->name, dev); ++ if (err < 0) { ++ dev_err(&pci_dev->dev, "unable to request interrupt\n"); ++ goto iounmap; ++ } ++ + pci_set_drvdata(pci_dev, dev); + return 0; + +-free_irq: +- free_irq(pci_dev->irq, dev); + iounmap: + pci_iounmap(pci_dev, dev->mmio); + free_region: +-- +2.35.1 + diff --git a/queue-5.4/mediatek-mt76-mac80211-fix-missing-of_node_put-in-mt.patch b/queue-5.4/mediatek-mt76-mac80211-fix-missing-of_node_put-in-mt.patch new file mode 100644 index 00000000000..88980b85f09 --- /dev/null +++ b/queue-5.4/mediatek-mt76-mac80211-fix-missing-of_node_put-in-mt.patch @@ -0,0 +1,36 @@ +From e3190c984b58b92f0075b0b2860c90821385fcd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Jul 2022 16:34:20 +0800 +Subject: mediatek: mt76: mac80211: Fix missing of_node_put() in + mt76_led_init() + +From: Liang He + +[ Upstream commit 0a14c1d0113f121151edf34333cdf212dd209190 ] + +We should use of_node_put() for the reference 'np' returned by +of_get_child_by_name() which will increase the refcount. + +Fixes: 17f1de56df05 ("mt76: add common code shared between multiple chipsets") +Signed-off-by: Liang He +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mac80211.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c +index 8bd191347b9f..179337eb39ba 100644 +--- a/drivers/net/wireless/mediatek/mt76/mac80211.c ++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c +@@ -103,6 +103,7 @@ static int mt76_led_init(struct mt76_dev *dev) + if (!of_property_read_u32(np, "led-sources", &led_pin)) + dev->led_pin = led_pin; + dev->led_al = of_property_read_bool(np, "led-active-low"); ++ of_node_put(np); + } + + return led_classdev_register(dev->dev, &dev->led_cdev); +-- +2.35.1 + diff --git a/queue-5.4/memstick-ms_block-fix-a-memory-leak.patch b/queue-5.4/memstick-ms_block-fix-a-memory-leak.patch new file mode 100644 index 00000000000..fad669d6359 --- /dev/null +++ b/queue-5.4/memstick-ms_block-fix-a-memory-leak.patch @@ -0,0 +1,39 @@ +From c1fd0ff2a130db8d19cfdfab5ece4bf195c25f02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jun 2022 14:55:56 +0200 +Subject: memstick/ms_block: Fix a memory leak + +From: Christophe JAILLET + +[ Upstream commit 54eb7a55be6779c4d0c25eaf5056498a28595049 ] + +'erased_blocks_bitmap' is never freed. As it is allocated at the same time +as 'used_blocks_bitmap', it is likely that it should be freed also at the +same time. + +Add the corresponding bitmap_free() in msb_data_clear(). + +Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/b3b78926569445962ea5c3b6e9102418a9effb88.1656155715.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/core/ms_block.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c +index 399510585245..6014fcb49d7e 100644 +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1954,6 +1954,7 @@ static void msb_data_clear(struct msb_data *msb) + { + kfree(msb->boot_page); + bitmap_free(msb->used_blocks_bitmap); ++ bitmap_free(msb->erased_blocks_bitmap); + kfree(msb->lba_to_pba_table); + kfree(msb->cache); + msb->card = NULL; +-- +2.35.1 + diff --git a/queue-5.4/memstick-ms_block-fix-some-incorrect-memory-allocati.patch b/queue-5.4/memstick-ms_block-fix-some-incorrect-memory-allocati.patch new file mode 100644 index 00000000000..ac539f7c6e8 --- /dev/null +++ b/queue-5.4/memstick-ms_block-fix-some-incorrect-memory-allocati.patch @@ -0,0 +1,65 @@ +From 9b45eaa3a66cb990360dd890c81ab4f471cad368 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jun 2022 14:55:25 +0200 +Subject: memstick/ms_block: Fix some incorrect memory allocation + +From: Christophe JAILLET + +[ Upstream commit 2e531bc3e0d86362fcd8a577b3278d9ef3cc2ba0 ] + +Some functions of the bitmap API take advantage of the fact that a bitmap +is an array of long. + +So, to make sure this assertion is correct, allocate bitmaps with +bitmap_zalloc() instead of kzalloc()+hand-computed number of bytes. + +While at it, also use bitmap_free() instead of kfree() to keep the +semantic. + +Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/dbf633c48c24ae6d95f852557e8d8b3bbdef65fe.1656155715.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/core/ms_block.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c +index 55907e4c36b1..399510585245 100644 +--- a/drivers/memstick/core/ms_block.c ++++ b/drivers/memstick/core/ms_block.c +@@ -1335,17 +1335,17 @@ static int msb_ftl_initialize(struct msb_data *msb) + msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE; + msb->logical_block_count = msb->zone_count * 496 - 2; + +- msb->used_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL); +- msb->erased_blocks_bitmap = kzalloc(msb->block_count / 8, GFP_KERNEL); ++ msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL); ++ msb->erased_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL); + msb->lba_to_pba_table = + kmalloc_array(msb->logical_block_count, sizeof(u16), + GFP_KERNEL); + + if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table || + !msb->erased_blocks_bitmap) { +- kfree(msb->used_blocks_bitmap); ++ bitmap_free(msb->used_blocks_bitmap); ++ bitmap_free(msb->erased_blocks_bitmap); + kfree(msb->lba_to_pba_table); +- kfree(msb->erased_blocks_bitmap); + return -ENOMEM; + } + +@@ -1953,7 +1953,7 @@ static int msb_bd_open(struct block_device *bdev, fmode_t mode) + static void msb_data_clear(struct msb_data *msb) + { + kfree(msb->boot_page); +- kfree(msb->used_blocks_bitmap); ++ bitmap_free(msb->used_blocks_bitmap); + kfree(msb->lba_to_pba_table); + kfree(msb->cache); + msb->card = NULL; +-- +2.35.1 + diff --git a/queue-5.4/meson-mx-socinfo-fix-refcount-leak-in-meson_mx_socin.patch b/queue-5.4/meson-mx-socinfo-fix-refcount-leak-in-meson_mx_socin.patch new file mode 100644 index 00000000000..6d8b74df3f4 --- /dev/null +++ b/queue-5.4/meson-mx-socinfo-fix-refcount-leak-in-meson_mx_socin.patch @@ -0,0 +1,38 @@ +From e9d3d88eab53ae4089b8e5a52dd0bf94b4e81d63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 10:57:29 +0400 +Subject: meson-mx-socinfo: Fix refcount leak in meson_mx_socinfo_init + +From: Miaoqian Lin + +[ Upstream commit a2106f38077e78afcb4bf98fdda3e162118cfb3d ] + +of_find_matching_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 5e68c0fc8df8 ("soc: amlogic: Add Meson6/Meson8/Meson8b/Meson8m2 SoC Information driver") +Signed-off-by: Miaoqian Lin +Reviewed-by: Martin Blumenstingl +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220524065729.33689-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/soc/amlogic/meson-mx-socinfo.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soc/amlogic/meson-mx-socinfo.c b/drivers/soc/amlogic/meson-mx-socinfo.c +index 78f0f1aeca57..92125dd65f33 100644 +--- a/drivers/soc/amlogic/meson-mx-socinfo.c ++++ b/drivers/soc/amlogic/meson-mx-socinfo.c +@@ -126,6 +126,7 @@ static int __init meson_mx_socinfo_init(void) + np = of_find_matching_node(NULL, meson_mx_socinfo_analog_top_ids); + if (np) { + analog_top_regmap = syscon_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(analog_top_regmap)) + return PTR_ERR(analog_top_regmap); + +-- +2.35.1 + diff --git a/queue-5.4/mfd-max77620-fix-refcount-leak-in-max77620_initialis.patch b/queue-5.4/mfd-max77620-fix-refcount-leak-in-max77620_initialis.patch new file mode 100644 index 00000000000..24b07a4ea12 --- /dev/null +++ b/queue-5.4/mfd-max77620-fix-refcount-leak-in-max77620_initialis.patch @@ -0,0 +1,42 @@ +From 930f78575e323ccbb85ccf4f5d485646d67b37f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 08:32:22 +0400 +Subject: mfd: max77620: Fix refcount leak in max77620_initialise_fps + +From: Miaoqian Lin + +[ Upstream commit 1520669c8255bd637c6b248b2be910e2688d38dd ] + +of_get_child_by_name() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 327156c59360 ("mfd: max77620: Add core driver for MAX77620/MAX20024") +Signed-off-by: Miaoqian Lin +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20220601043222.64441-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/max77620.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mfd/max77620.c b/drivers/mfd/max77620.c +index a851ff473a44..2bf5bcbc8852 100644 +--- a/drivers/mfd/max77620.c ++++ b/drivers/mfd/max77620.c +@@ -418,9 +418,11 @@ static int max77620_initialise_fps(struct max77620_chip *chip) + ret = max77620_config_fps(chip, fps_child); + if (ret < 0) { + of_node_put(fps_child); ++ of_node_put(fps_np); + return ret; + } + } ++ of_node_put(fps_np); + + config = chip->enable_global_lpm ? MAX77620_ONOFFCNFG2_SLP_LPM_MSK : 0; + ret = regmap_update_bits(chip->rmap, MAX77620_REG_ONOFFCNFG2, +-- +2.35.1 + diff --git a/queue-5.4/mfd-t7l66xb-drop-platform-disable-callback.patch b/queue-5.4/mfd-t7l66xb-drop-platform-disable-callback.patch new file mode 100644 index 00000000000..1f1d9c80d73 --- /dev/null +++ b/queue-5.4/mfd-t7l66xb-drop-platform-disable-callback.patch @@ -0,0 +1,70 @@ +From c0697a8f42b1c1054695d291b91a061c56744d40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 21:24:28 +0200 +Subject: mfd: t7l66xb: Drop platform disable callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 128ac294e1b437cb8a7f2ff8ede1cde9082bddbe ] + +None of the in-tree instantiations of struct t7l66xb_platform_data +provides a disable callback. So better don't dereference this function +pointer unconditionally. As there is no user, drop it completely instead +of calling it conditional. + +This is a preparation for making platform remove callbacks return void. + +Fixes: 1f192015ca5b ("mfd: driver for the T7L66XB TMIO SoC") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20220530192430.2108217-3-u.kleine-koenig@pengutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mfd/t7l66xb.c | 6 +----- + include/linux/mfd/t7l66xb.h | 1 - + 2 files changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c +index 70da0c4ae457..58811c5ab564 100644 +--- a/drivers/mfd/t7l66xb.c ++++ b/drivers/mfd/t7l66xb.c +@@ -405,11 +405,8 @@ static int t7l66xb_probe(struct platform_device *dev) + + static int t7l66xb_remove(struct platform_device *dev) + { +- struct t7l66xb_platform_data *pdata = dev_get_platdata(&dev->dev); + struct t7l66xb *t7l66xb = platform_get_drvdata(dev); +- int ret; + +- ret = pdata->disable(dev); + clk_disable_unprepare(t7l66xb->clk48m); + clk_put(t7l66xb->clk48m); + clk_disable_unprepare(t7l66xb->clk32k); +@@ -420,8 +417,7 @@ static int t7l66xb_remove(struct platform_device *dev) + mfd_remove_devices(&dev->dev); + kfree(t7l66xb); + +- return ret; +- ++ return 0; + } + + static struct platform_driver t7l66xb_platform_driver = { +diff --git a/include/linux/mfd/t7l66xb.h b/include/linux/mfd/t7l66xb.h +index 69632c1b07bd..ae3e7a5c5219 100644 +--- a/include/linux/mfd/t7l66xb.h ++++ b/include/linux/mfd/t7l66xb.h +@@ -12,7 +12,6 @@ + + struct t7l66xb_platform_data { + int (*enable)(struct platform_device *dev); +- int (*disable)(struct platform_device *dev); + int (*suspend)(struct platform_device *dev); + int (*resume)(struct platform_device *dev); + +-- +2.35.1 + diff --git a/queue-5.4/misc-rtsx-fix-an-error-handling-path-in-rtsx_pci_pro.patch b/queue-5.4/misc-rtsx-fix-an-error-handling-path-in-rtsx_pci_pro.patch new file mode 100644 index 00000000000..00534b1c991 --- /dev/null +++ b/queue-5.4/misc-rtsx-fix-an-error-handling-path-in-rtsx_pci_pro.patch @@ -0,0 +1,51 @@ +From dc59f6c19c567f14f2273c5b0e914f456675d871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 07:33:44 +0200 +Subject: misc: rtsx: Fix an error handling path in rtsx_pci_probe() + +From: Christophe JAILLET + +[ Upstream commit 44fd1917314e9d4f53dd95dd65df1c152f503d3a ] + +If an error occurs after a successful idr_alloc() call, the corresponding +resource must be released with idr_remove() as already done in the .remove +function. + +Update the error handling path to add the missing idr_remove() call. + +Fixes: ada8a8a13b13 ("mfd: Add realtek pcie card reader driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/e8dc41716cbf52fb37a12e70d8972848e69df6d6.1655271216.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cardreader/rtsx_pcr.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/cardreader/rtsx_pcr.c b/drivers/misc/cardreader/rtsx_pcr.c +index 4c707d8dc3eb..5807aefd4c88 100644 +--- a/drivers/misc/cardreader/rtsx_pcr.c ++++ b/drivers/misc/cardreader/rtsx_pcr.c +@@ -1485,7 +1485,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, + pcr->remap_addr = ioremap_nocache(base, len); + if (!pcr->remap_addr) { + ret = -ENOMEM; +- goto free_handle; ++ goto free_idr; + } + + pcr->rtsx_resv_buf = dma_alloc_coherent(&(pcidev->dev), +@@ -1547,6 +1547,10 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, + pcr->rtsx_resv_buf, pcr->rtsx_resv_buf_addr); + unmap: + iounmap(pcr->remap_addr); ++free_idr: ++ spin_lock(&rtsx_pci_lock); ++ idr_remove(&rtsx_pci_idr, pcr->id); ++ spin_unlock(&rtsx_pci_lock); + free_handle: + kfree(handle); + free_pcr: +-- +2.35.1 + diff --git a/queue-5.4/mm-mmap.c-fix-missing-call-to-vm_unacct_memory-in-mm.patch b/queue-5.4/mm-mmap.c-fix-missing-call-to-vm_unacct_memory-in-mm.patch new file mode 100644 index 00000000000..e9f1e07f5e8 --- /dev/null +++ b/queue-5.4/mm-mmap.c-fix-missing-call-to-vm_unacct_memory-in-mm.patch @@ -0,0 +1,40 @@ +From 1908b66a13d7be0077a2ceb16def8412490fad97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 16:20:27 +0800 +Subject: mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region + +From: Miaohe Lin + +[ Upstream commit 7f82f922319ede486540e8746769865b9508d2c2 ] + +Since the beginning, charged is set to 0 to avoid calling vm_unacct_memory +twice because vm_unacct_memory will be called by above unmap_region. But +since commit 4f74d2c8e827 ("vm: remove 'nr_accounted' calculations from +the unmap_vmas() interfaces"), unmap_region doesn't call vm_unacct_memory +anymore. So charged shouldn't be set to 0 now otherwise the calling to +paired vm_unacct_memory will be missed and leads to imbalanced account. + +Link: https://lkml.kernel.org/r/20220618082027.43391-1-linmiaohe@huawei.com +Fixes: 4f74d2c8e827 ("vm: remove 'nr_accounted' calculations from the unmap_vmas() interfaces") +Signed-off-by: Miaohe Lin +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/mmap.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/mm/mmap.c b/mm/mmap.c +index 88e686367776..8873ef114d28 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -1860,7 +1860,6 @@ unsigned long mmap_region(struct file *file, unsigned long addr, + + /* Undo any partial mapping done by a device driver. */ + unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); +- charged = 0; + if (vm_flags & VM_SHARED) + mapping_unmap_writable(file->f_mapping); + allow_write_and_free_vma: +-- +2.35.1 + diff --git a/queue-5.4/mmc-cavium-octeon-add-of_node_put-when-breaking-out-.patch b/queue-5.4/mmc-cavium-octeon-add-of_node_put-when-breaking-out-.patch new file mode 100644 index 00000000000..9dbac18e73a --- /dev/null +++ b/queue-5.4/mmc-cavium-octeon-add-of_node_put-when-breaking-out-.patch @@ -0,0 +1,38 @@ +From 239b89b0625423476be44061952b030a87bc0b41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 17:52:15 +0800 +Subject: mmc: cavium-octeon: Add of_node_put() when breaking out of loop + +From: Liang He + +[ Upstream commit 19bbb49acf8d7a03cb83e05624363741a4c3ec6f ] + +In octeon_mmc_probe(), we should call of_node_put() when breaking +out of for_each_child_of_node() which has increased and decreased +the refcount during each iteration. + +Fixes: 01d95843335c ("mmc: cavium: Add MMC support for Octeon SOCs.") +Signed-off-by: Liang He +Acked-by: Robert Richter +Link: https://lore.kernel.org/r/20220719095216.1241601-1-windhl@126.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/cavium-octeon.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-octeon.c +index 22aded1065ae..2245452a44c8 100644 +--- a/drivers/mmc/host/cavium-octeon.c ++++ b/drivers/mmc/host/cavium-octeon.c +@@ -288,6 +288,7 @@ static int octeon_mmc_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, "Error populating slots\n"); + octeon_mmc_set_shared_power(host, 0); ++ of_node_put(cn); + goto error; + } + i++; +-- +2.35.1 + diff --git a/queue-5.4/mmc-cavium-thunderx-add-of_node_put-when-breaking-ou.patch b/queue-5.4/mmc-cavium-thunderx-add-of_node_put-when-breaking-ou.patch new file mode 100644 index 00000000000..193ec5fb7f9 --- /dev/null +++ b/queue-5.4/mmc-cavium-thunderx-add-of_node_put-when-breaking-ou.patch @@ -0,0 +1,42 @@ +From 7267aefaa328a9292521cd3eef30dce7c90b23cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 17:52:16 +0800 +Subject: mmc: cavium-thunderx: Add of_node_put() when breaking out of loop + +From: Liang He + +[ Upstream commit 7ee480795e41db314f2c445c65ed854a5d6e8e32 ] + +In thunder_mmc_probe(), we should call of_node_put() when breaking +out of for_each_child_of_node() which has increased and decreased +the refcount during each iteration. + +Fixes: 166bac38c3c5 ("mmc: cavium: Add MMC PCI driver for ThunderX SOCs") +Signed-off-by: Liang He +Acked-by: Robert Richter +Link: https://lore.kernel.org/r/20220719095216.1241601-2-windhl@126.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/cavium-thunderx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c +index eee08d81b242..f79806e31e7e 100644 +--- a/drivers/mmc/host/cavium-thunderx.c ++++ b/drivers/mmc/host/cavium-thunderx.c +@@ -138,8 +138,10 @@ static int thunder_mmc_probe(struct pci_dev *pdev, + continue; + + ret = cvm_mmc_of_slot_probe(&host->slot_pdev[i]->dev, host); +- if (ret) ++ if (ret) { ++ of_node_put(child_node); + goto error; ++ } + } + i++; + } +-- +2.35.1 + diff --git a/queue-5.4/mmc-sdhci-of-at91-fix-set_uhs_signaling-rewriting-of.patch b/queue-5.4/mmc-sdhci-of-at91-fix-set_uhs_signaling-rewriting-of.patch new file mode 100644 index 00000000000..2e81b3c62f8 --- /dev/null +++ b/queue-5.4/mmc-sdhci-of-at91-fix-set_uhs_signaling-rewriting-of.patch @@ -0,0 +1,48 @@ +From 555577fc605d347b0308c5eab2dfc61c9a5cb59f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 12:09:26 +0300 +Subject: mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R + +From: Eugen Hristev + +[ Upstream commit 5987e6ded29d52e42fc7b06aa575c60a25eee38e ] + +In set_uhs_signaling, the DDR bit is being set by fully writing the MC1R +register. +This can lead to accidental erase of certain bits in this register. +Avoid this by doing a read-modify-write operation. + +Fixes: d0918764c17b ("mmc: sdhci-of-at91: fix MMC_DDR_52 timing selection") +Signed-off-by: Eugen Hristev +Tested-by: Karl Olsen +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20220630090926.15061-1-eugen.hristev@microchip.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-at91.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c +index 881f8138e7de..03698d78a402 100644 +--- a/drivers/mmc/host/sdhci-of-at91.c ++++ b/drivers/mmc/host/sdhci-of-at91.c +@@ -109,8 +109,13 @@ static void sdhci_at91_set_power(struct sdhci_host *host, unsigned char mode, + static void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, + unsigned int timing) + { +- if (timing == MMC_TIMING_MMC_DDR52) +- sdhci_writeb(host, SDMMC_MC1R_DDR, SDMMC_MC1R); ++ u8 mc1r; ++ ++ if (timing == MMC_TIMING_MMC_DDR52) { ++ mc1r = sdhci_readb(host, SDMMC_MC1R); ++ mc1r |= SDMMC_MC1R_DDR; ++ sdhci_writeb(host, mc1r, SDMMC_MC1R); ++ } + sdhci_set_uhs_signaling(host, timing); + } + +-- +2.35.1 + diff --git a/queue-5.4/mmc-sdhci-of-esdhc-fix-refcount-leak-in-esdhc_signal.patch b/queue-5.4/mmc-sdhci-of-esdhc-fix-refcount-leak-in-esdhc_signal.patch new file mode 100644 index 00000000000..daeaf1b67b1 --- /dev/null +++ b/queue-5.4/mmc-sdhci-of-esdhc-fix-refcount-leak-in-esdhc_signal.patch @@ -0,0 +1,38 @@ +From a143f2c2ad0f7353a8b4b6ee4338139a7aea760e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 May 2022 18:42:54 +0400 +Subject: mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch + +From: Miaoqian Lin + +[ Upstream commit b5899a3e2f783a27b268e38d37f9b24c71bddf45 ] + +of_find_matching_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. +of_node_put() checks null pointer. + +Fixes: ea35645a3c66 ("mmc: sdhci-of-esdhc: add support for signal voltage switch") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220523144255.10310-1-linmq006@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-esdhc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 0ff339004d8a..69c133e7ced0 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -844,6 +844,7 @@ static int esdhc_signal_voltage_switch(struct mmc_host *mmc, + scfg_node = of_find_matching_node(NULL, scfg_device_ids); + if (scfg_node) + scfg_base = of_iomap(scfg_node, 0); ++ of_node_put(scfg_node); + if (scfg_base) { + sdhciovselcr = SDHCIOVSELCR_TGLEN | + SDHCIOVSELCR_VSELVAL; +-- +2.35.1 + diff --git a/queue-5.4/mtd-maps-fix-refcount-leak-in-ap_flash_init.patch b/queue-5.4/mtd-maps-fix-refcount-leak-in-ap_flash_init.patch new file mode 100644 index 00000000000..ed9c6cc5b84 --- /dev/null +++ b/queue-5.4/mtd-maps-fix-refcount-leak-in-ap_flash_init.patch @@ -0,0 +1,38 @@ +From 27953438f703b5fd1212d112ffc1a48d8e078c0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 May 2022 18:32:55 +0400 +Subject: mtd: maps: Fix refcount leak in ap_flash_init + +From: Miaoqian Lin + +[ Upstream commit 77087a04c8fd554134bddcb8a9ff87b21f357926 ] + +of_find_matching_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: b0afd44bc192 ("mtd: physmap_of: add a hook for Versatile write protection") +Signed-off-by: Miaoqian Lin +Reviewed-by: Linus Walleij +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220523143255.4376-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/maps/physmap-versatile.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/maps/physmap-versatile.c b/drivers/mtd/maps/physmap-versatile.c +index 297a50957356..a1b8b7b25f88 100644 +--- a/drivers/mtd/maps/physmap-versatile.c ++++ b/drivers/mtd/maps/physmap-versatile.c +@@ -93,6 +93,7 @@ static int ap_flash_init(struct platform_device *pdev) + return -ENODEV; + } + ebi_base = of_iomap(ebi, 0); ++ of_node_put(ebi); + if (!ebi_base) + return -ENODEV; + +-- +2.35.1 + diff --git a/queue-5.4/mtd-maps-fix-refcount-leak-in-of_flash_probe_versati.patch b/queue-5.4/mtd-maps-fix-refcount-leak-in-of_flash_probe_versati.patch new file mode 100644 index 00000000000..5da19412e2c --- /dev/null +++ b/queue-5.4/mtd-maps-fix-refcount-leak-in-of_flash_probe_versati.patch @@ -0,0 +1,38 @@ +From defda4d9b53e1c8e272cb4eefee7d947be96de42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 May 2022 18:02:05 +0400 +Subject: mtd: maps: Fix refcount leak in of_flash_probe_versatile + +From: Miaoqian Lin + +[ Upstream commit 33ec82a6d2b119938f26e5c8040ed5d92378eb54 ] + +of_find_matching_node_and_match() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: b0afd44bc192 ("mtd: physmap_of: add a hook for Versatile write protection") +Signed-off-by: Miaoqian Lin +Reviewed-by: Linus Walleij +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220523140205.48625-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/maps/physmap-versatile.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/maps/physmap-versatile.c b/drivers/mtd/maps/physmap-versatile.c +index ad7cd9cfaee0..297a50957356 100644 +--- a/drivers/mtd/maps/physmap-versatile.c ++++ b/drivers/mtd/maps/physmap-versatile.c +@@ -207,6 +207,7 @@ int of_flash_probe_versatile(struct platform_device *pdev, + + versatile_flashprot = (enum versatile_flashprot)devid->data; + rmap = syscon_node_to_regmap(sysnp); ++ of_node_put(sysnp); + if (IS_ERR(rmap)) + return PTR_ERR(rmap); + +-- +2.35.1 + diff --git a/queue-5.4/mtd-partitions-fix-refcount-leak-in-parse_redboot_of.patch b/queue-5.4/mtd-partitions-fix-refcount-leak-in-parse_redboot_of.patch new file mode 100644 index 00000000000..a5c08c144cd --- /dev/null +++ b/queue-5.4/mtd-partitions-fix-refcount-leak-in-parse_redboot_of.patch @@ -0,0 +1,38 @@ +From 92b2e8da3ec362da8a08550cbbdcce8ec0627306 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 15:06:49 +0400 +Subject: mtd: partitions: Fix refcount leak in parse_redboot_of + +From: Miaoqian Lin + +[ Upstream commit 9f7e62815cf3cbbcb1b8cb21649fb4dfdb3aa016 ] + +of_get_child_by_name() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 237960880960 ("mtd: partitions: redboot: seek fis-index-block in the right node") +Signed-off-by: Miaoqian Lin +Reviewed-by: Linus Walleij +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220526110652.64849-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/parsers/redboot.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/parsers/redboot.c b/drivers/mtd/parsers/redboot.c +index 3ccd6363ee8c..4f3bcc59a638 100644 +--- a/drivers/mtd/parsers/redboot.c ++++ b/drivers/mtd/parsers/redboot.c +@@ -58,6 +58,7 @@ static void parse_redboot_of(struct mtd_info *master) + return; + + ret = of_property_read_u32(npart, "fis-index-block", &dirblock); ++ of_node_put(npart); + if (ret) + return; + +-- +2.35.1 + diff --git a/queue-5.4/mtd-rawnand-meson-fix-a-potential-double-free-issue.patch b/queue-5.4/mtd-rawnand-meson-fix-a-potential-double-free-issue.patch new file mode 100644 index 00000000000..5f358e67676 --- /dev/null +++ b/queue-5.4/mtd-rawnand-meson-fix-a-potential-double-free-issue.patch @@ -0,0 +1,46 @@ +From 2cf0dc61ebecc4ed7eabb1364ab5b8f7f5411aa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 18:41:40 +0200 +Subject: mtd: rawnand: meson: Fix a potential double free issue + +From: Christophe JAILLET + +[ Upstream commit ec0da06337751b18f6dee06b6526e0f0d6e80369 ] + +When meson_nfc_nand_chip_cleanup() is called, it will call: + meson_nfc_free_buffer(&meson_chip->nand); + nand_cleanup(&meson_chip->nand); + +nand_cleanup() in turn will call nand_detach() which calls the +.detach_chip() which is here meson_nand_detach_chip(). + +meson_nand_detach_chip() already calls meson_nfc_free_buffer(), so we +could double free some memory. + +Fix it by removing the unneeded explicit call to meson_nfc_free_buffer(). + +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Signed-off-by: Christophe JAILLET +Acked-by: Liang Yang +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/ec15c358b8063f7c50ff4cd628cf0d2e14e43f49.1653064877.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/meson_nand.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index ab7ab6a279aa..28dc26e1a20a 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -1304,7 +1304,6 @@ static int meson_nfc_nand_chip_cleanup(struct meson_nfc *nfc) + if (ret) + return ret; + +- meson_nfc_free_buffer(&meson_chip->nand); + nand_cleanup(&meson_chip->nand); + list_del(&meson_chip->node); + } +-- +2.35.1 + diff --git a/queue-5.4/mtd-sm_ftl-fix-deadlock-caused-by-cancel_work_sync-i.patch b/queue-5.4/mtd-sm_ftl-fix-deadlock-caused-by-cancel_work_sync-i.patch new file mode 100644 index 00000000000..1e24e70dca7 --- /dev/null +++ b/queue-5.4/mtd-sm_ftl-fix-deadlock-caused-by-cancel_work_sync-i.patch @@ -0,0 +1,53 @@ +From 77a3ac5e283d87e3d2aaa251fd3582c592bdf7be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 12:48:41 +0800 +Subject: mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release + +From: Duoming Zhou + +[ Upstream commit a61528d997619a518ee8c51cf0ef0513021afaff ] + +There is a deadlock between sm_release and sm_cache_flush_work +which is a work item. The cancel_work_sync in sm_release will +not return until sm_cache_flush_work is finished. If we hold +mutex_lock and use cancel_work_sync to wait the work item to +finish, the work item also requires mutex_lock. As a result, +the sm_release will be blocked forever. The race condition is +shown below: + + (Thread 1) | (Thread 2) +sm_release | + mutex_lock(&ftl->mutex) | sm_cache_flush_work + | mutex_lock(&ftl->mutex) + cancel_work_sync | ... + +This patch moves del_timer_sync and cancel_work_sync out of +mutex_lock in order to mitigate deadlock. + +Fixes: 7d17c02a01a1 ("mtd: Add new SmartMedia/xD FTL") +Signed-off-by: Duoming Zhou +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220524044841.10517-1-duoming@zju.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/mtd/sm_ftl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c +index 4744bf94ad9a..d4e72fd5e5b3 100644 +--- a/drivers/mtd/sm_ftl.c ++++ b/drivers/mtd/sm_ftl.c +@@ -1097,9 +1097,9 @@ static void sm_release(struct mtd_blktrans_dev *dev) + { + struct sm_ftl *ftl = dev->priv; + +- mutex_lock(&ftl->mutex); + del_timer_sync(&ftl->timer); + cancel_work_sync(&ftl->flush_work); ++ mutex_lock(&ftl->mutex); + sm_cache_flush(ftl); + mutex_unlock(&ftl->mutex); + } +-- +2.35.1 + diff --git a/queue-5.4/mtd-st_spi_fsm-add-a-clk_disable_unprepare-in-.probe.patch b/queue-5.4/mtd-st_spi_fsm-add-a-clk_disable_unprepare-in-.probe.patch new file mode 100644 index 00000000000..9dbd86c5555 --- /dev/null +++ b/queue-5.4/mtd-st_spi_fsm-add-a-clk_disable_unprepare-in-.probe.patch @@ -0,0 +1,49 @@ +From 3d7aed73b41aa84c8e93600bb5801c20cdb759f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 17:24:55 +0200 +Subject: mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error + path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 28607b426c3d050714f250d0faeb99d2e9106e90 ] + +For all but one error path clk_disable_unprepare() is already there. Add +it to the one location where it's missing. + +Fixes: 481815a6193b ("mtd: st_spi_fsm: Handle clk_prepare_enable/clk_disable_unprepare.") +Fixes: 69d5af8d016c ("mtd: st_spi_fsm: Obtain and use EMI clock") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220607152458.232847-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Sasha Levin +--- + drivers/mtd/devices/st_spi_fsm.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/mtd/devices/st_spi_fsm.c b/drivers/mtd/devices/st_spi_fsm.c +index f4d1667daaf9..41b5a236276b 100644 +--- a/drivers/mtd/devices/st_spi_fsm.c ++++ b/drivers/mtd/devices/st_spi_fsm.c +@@ -2116,10 +2116,12 @@ static int stfsm_probe(struct platform_device *pdev) + (long long)fsm->mtd.size, (long long)(fsm->mtd.size >> 20), + fsm->mtd.erasesize, (fsm->mtd.erasesize >> 10)); + +- return mtd_device_register(&fsm->mtd, NULL, 0); +- ++ ret = mtd_device_register(&fsm->mtd, NULL, 0); ++ if (ret) { + err_clk_unprepare: +- clk_disable_unprepare(fsm->clk); ++ clk_disable_unprepare(fsm->clk); ++ } ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.4/net-mlx5e-fix-the-value-of-mlx5e_max_rq_num_mtts.patch b/queue-5.4/net-mlx5e-fix-the-value-of-mlx5e_max_rq_num_mtts.patch new file mode 100644 index 00000000000..fc48166005a --- /dev/null +++ b/queue-5.4/net-mlx5e-fix-the-value-of-mlx5e_max_rq_num_mtts.patch @@ -0,0 +1,40 @@ +From 995dd8ac6687433c4907e3fefa210ecfa5ad5869 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 16:48:47 +0300 +Subject: net/mlx5e: Fix the value of MLX5E_MAX_RQ_NUM_MTTS + +From: Maxim Mikityanskiy + +[ Upstream commit 562696c3c62c7c23dd896e9447252ce9268cb812 ] + +MLX5E_MAX_RQ_NUM_MTTS should be the maximum value, so that +MLX5_MTT_OCTW(MLX5E_MAX_RQ_NUM_MTTS) fits into u16. The current value of +1 << 17 results in MLX5_MTT_OCTW(1 << 17) = 1 << 16, which doesn't fit +into u16. This commit replaces it with the maximum value that still +fits u16. + +Fixes: 73281b78a37a ("net/mlx5e: Derive Striding RQ size from MTU") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index b5c8afe8cd10..3209decdcff0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -101,7 +101,7 @@ struct page_pool; + #define MLX5E_LOG_ALIGNED_MPWQE_PPW (ilog2(MLX5E_REQUIRED_WQE_MTTS)) + #define MLX5E_REQUIRED_MTTS(wqes) (wqes * MLX5E_REQUIRED_WQE_MTTS) + #define MLX5E_MAX_RQ_NUM_MTTS \ +- ((1 << 16) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ ++ (ALIGN_DOWN(U16_MAX, 4) * 2) /* So that MLX5_MTT_OCTW(num_mtts) fits into u16 */ + #define MLX5E_ORDER2_MAX_PACKET_MTU (order_base_2(10 * 1024)) + #define MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW \ + (ilog2(MLX5E_MAX_RQ_NUM_MTTS / MLX5E_REQUIRED_WQE_MTTS)) +-- +2.35.1 + diff --git a/queue-5.4/net-rose-fix-netdev-reference-changes.patch b/queue-5.4/net-rose-fix-netdev-reference-changes.patch new file mode 100644 index 00000000000..21b200e6a13 --- /dev/null +++ b/queue-5.4/net-rose-fix-netdev-reference-changes.patch @@ -0,0 +1,110 @@ +From 8784a7a37d0d2c125ba0d454789ec0e26cda031f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jul 2022 09:12:32 +0000 +Subject: net: rose: fix netdev reference changes + +From: Eric Dumazet + +[ Upstream commit 931027820e4dafabc78aff82af59f8c1c4bd3128 ] + +Bernard reported that trying to unload rose module would lead +to infamous messages: + +unregistered_netdevice: waiting for rose0 to become free. Usage count = xx + +This patch solves the issue, by making sure each socket referring to +a netdevice holds a reference count on it, and properly releases it +in rose_release(). + +rose_dev_first() is also fixed to take a device reference +before leaving the rcu_read_locked section. + +Following patch will add ref_tracker annotations to ease +future bug hunting. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Bernard Pidoux +Signed-off-by: Eric Dumazet +Tested-by: Bernard Pidoux +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rose/af_rose.c | 11 +++++++++-- + net/rose/rose_route.c | 2 ++ + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 6a0df7c8a939..95dda29058a0 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -169,6 +169,7 @@ static void rose_kill_by_device(struct net_device *dev) + rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); + if (rose->neighbour) + rose->neighbour->use--; ++ dev_put(rose->device); + rose->device = NULL; + } + } +@@ -569,6 +570,8 @@ static struct sock *rose_make_new(struct sock *osk) + rose->idle = orose->idle; + rose->defer = orose->defer; + rose->device = orose->device; ++ if (rose->device) ++ dev_hold(rose->device); + rose->qbitincl = orose->qbitincl; + + return sk; +@@ -622,6 +625,7 @@ static int rose_release(struct socket *sock) + break; + } + ++ dev_put(rose->device); + sock->sk = NULL; + release_sock(sk); + sock_put(sk); +@@ -698,7 +702,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + struct rose_sock *rose = rose_sk(sk); + struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr; + unsigned char cause, diagnostic; +- struct net_device *dev; + ax25_uid_assoc *user; + int n, err = 0; + +@@ -755,9 +758,12 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + } + + if (sock_flag(sk, SOCK_ZAPPED)) { /* Must bind first - autobinding in this may or may not work */ ++ struct net_device *dev; ++ + sock_reset_flag(sk, SOCK_ZAPPED); + +- if ((dev = rose_dev_first()) == NULL) { ++ dev = rose_dev_first(); ++ if (!dev) { + err = -ENETUNREACH; + goto out_release; + } +@@ -765,6 +771,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le + user = ax25_findbyuid(current_euid()); + if (!user) { + err = -EINVAL; ++ dev_put(dev); + goto out_release; + } + +diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c +index 5f32113c9bbd..64d441d3b653 100644 +--- a/net/rose/rose_route.c ++++ b/net/rose/rose_route.c +@@ -613,6 +613,8 @@ struct net_device *rose_dev_first(void) + if (first == NULL || strncmp(dev->name, first->name, 3) < 0) + first = dev; + } ++ if (first) ++ dev_hold(first); + rcu_read_unlock(); + + return first; +-- +2.35.1 + diff --git a/queue-5.4/netdevsim-avoid-allocation-warnings-triggered-from-u.patch b/queue-5.4/netdevsim-avoid-allocation-warnings-triggered-from-u.patch new file mode 100644 index 00000000000..26f4483b13f --- /dev/null +++ b/queue-5.4/netdevsim-avoid-allocation-warnings-triggered-from-u.patch @@ -0,0 +1,54 @@ +From def65e8a4cdfe892f3784069fee0324b4e06e876 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 14:36:05 -0700 +Subject: netdevsim: Avoid allocation warnings triggered from user space + +From: Jakub Kicinski + +[ Upstream commit d0b80a9edb1a029ff913e81b47540e57ad034329 ] + +We need to suppress warnings from sily map sizes. Also switch +from GFP_USER to GFP_KERNEL_ACCOUNT, I'm pretty sure I misunderstood +the flags when writing this code. + +Fixes: 395cacb5f1a0 ("netdevsim: bpf: support fake map offload") +Reported-by: syzbot+ad24705d3fd6463b18c6@syzkaller.appspotmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20220726213605.154204-1-kuba@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/netdevsim/bpf.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c +index e0a4acc6144b..8e47755cc159 100644 +--- a/drivers/net/netdevsim/bpf.c ++++ b/drivers/net/netdevsim/bpf.c +@@ -347,10 +347,12 @@ nsim_map_alloc_elem(struct bpf_offloaded_map *offmap, unsigned int idx) + { + struct nsim_bpf_bound_map *nmap = offmap->dev_priv; + +- nmap->entry[idx].key = kmalloc(offmap->map.key_size, GFP_USER); ++ nmap->entry[idx].key = kmalloc(offmap->map.key_size, ++ GFP_KERNEL_ACCOUNT | __GFP_NOWARN); + if (!nmap->entry[idx].key) + return -ENOMEM; +- nmap->entry[idx].value = kmalloc(offmap->map.value_size, GFP_USER); ++ nmap->entry[idx].value = kmalloc(offmap->map.value_size, ++ GFP_KERNEL_ACCOUNT | __GFP_NOWARN); + if (!nmap->entry[idx].value) { + kfree(nmap->entry[idx].key); + nmap->entry[idx].key = NULL; +@@ -492,7 +494,7 @@ nsim_bpf_map_alloc(struct netdevsim *ns, struct bpf_offloaded_map *offmap) + if (offmap->map.map_flags) + return -EINVAL; + +- nmap = kzalloc(sizeof(*nmap), GFP_USER); ++ nmap = kzalloc(sizeof(*nmap), GFP_KERNEL_ACCOUNT); + if (!nmap) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-5.4/netfilter-nf_tables-add-rescheduling-points-during-l.patch b/queue-5.4/netfilter-nf_tables-add-rescheduling-points-during-l.patch new file mode 100644 index 00000000000..837b77f6a71 --- /dev/null +++ b/queue-5.4/netfilter-nf_tables-add-rescheduling-points-during-l.patch @@ -0,0 +1,53 @@ +From 3920173cb171191723ebb038ed1970da0e18f0fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 12:44:35 +0200 +Subject: netfilter: nf_tables: add rescheduling points during loop detection + walks + +From: Florian Westphal + +[ Upstream commit 81ea010667417ef3f218dfd99b69769fe66c2b67 ] + +Add explicit rescheduling points during ruleset walk. + +Switching to a faster algorithm is possible but this is a much +smaller change, suitable for nf tree. + +Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1460 +Signed-off-by: Florian Westphal +Acked-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 3f72e31b1c7f..eb39317580e1 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2685,6 +2685,8 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) + if (err < 0) + return err; + } ++ ++ cond_resched(); + } + + return 0; +@@ -7316,9 +7318,13 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx, + break; + } + } ++ ++ cond_resched(); + } + + list_for_each_entry(set, &ctx->table->sets, list) { ++ cond_resched(); ++ + if (!nft_is_active_next(ctx->net, set)) + continue; + if (!(set->flags & NFT_SET_MAP) || +-- +2.35.1 + diff --git a/queue-5.4/nohz-full-sched-rt-fix-missed-tick-reenabling-bug-in.patch b/queue-5.4/nohz-full-sched-rt-fix-missed-tick-reenabling-bug-in.patch new file mode 100644 index 00000000000..b61acbcd453 --- /dev/null +++ b/queue-5.4/nohz-full-sched-rt-fix-missed-tick-reenabling-bug-in.patch @@ -0,0 +1,118 @@ +From 81f204c4cce35a6ebaabf9e3d948ec182d25219f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jun 2022 11:22:59 +0200 +Subject: nohz/full, sched/rt: Fix missed tick-reenabling bug in + dequeue_task_rt() + +From: Nicolas Saenz Julienne + +[ Upstream commit 5c66d1b9b30f737fcef85a0b75bfe0590e16b62a ] + +dequeue_task_rt() only decrements 'rt_rq->rt_nr_running' after having +called sched_update_tick_dependency() preventing it from re-enabling the +tick on systems that no longer have pending SCHED_RT tasks but have +multiple runnable SCHED_OTHER tasks: + + dequeue_task_rt() + dequeue_rt_entity() + dequeue_rt_stack() + dequeue_top_rt_rq() + sub_nr_running() // decrements rq->nr_running + sched_update_tick_dependency() + sched_can_stop_tick() // checks rq->rt.rt_nr_running, + ... + __dequeue_rt_entity() + dec_rt_tasks() // decrements rq->rt.rt_nr_running + ... + +Every other scheduler class performs the operation in the opposite +order, and sched_update_tick_dependency() expects the values to be +updated as such. So avoid the misbehaviour by inverting the order in +which the above operations are performed in the RT scheduler. + +Fixes: 76d92ac305f2 ("sched: Migrate sched to use new tick dependency mask model") +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Valentin Schneider +Reviewed-by: Phil Auld +Link: https://lore.kernel.org/r/20220628092259.330171-1-nsaenzju@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/sched/rt.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 28c82dee13ea..c11d3d79d4c3 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -437,7 +437,7 @@ static inline void rt_queue_push_tasks(struct rq *rq) + #endif /* CONFIG_SMP */ + + static void enqueue_top_rt_rq(struct rt_rq *rt_rq); +-static void dequeue_top_rt_rq(struct rt_rq *rt_rq); ++static void dequeue_top_rt_rq(struct rt_rq *rt_rq, unsigned int count); + + static inline int on_rt_rq(struct sched_rt_entity *rt_se) + { +@@ -519,7 +519,7 @@ static void sched_rt_rq_dequeue(struct rt_rq *rt_rq) + rt_se = rt_rq->tg->rt_se[cpu]; + + if (!rt_se) { +- dequeue_top_rt_rq(rt_rq); ++ dequeue_top_rt_rq(rt_rq, rt_rq->rt_nr_running); + /* Kick cpufreq (see the comment in kernel/sched/sched.h). */ + cpufreq_update_util(rq_of_rt_rq(rt_rq), 0); + } +@@ -605,7 +605,7 @@ static inline void sched_rt_rq_enqueue(struct rt_rq *rt_rq) + + static inline void sched_rt_rq_dequeue(struct rt_rq *rt_rq) + { +- dequeue_top_rt_rq(rt_rq); ++ dequeue_top_rt_rq(rt_rq, rt_rq->rt_nr_running); + } + + static inline int rt_rq_throttled(struct rt_rq *rt_rq) +@@ -1004,7 +1004,7 @@ static void update_curr_rt(struct rq *rq) + } + + static void +-dequeue_top_rt_rq(struct rt_rq *rt_rq) ++dequeue_top_rt_rq(struct rt_rq *rt_rq, unsigned int count) + { + struct rq *rq = rq_of_rt_rq(rt_rq); + +@@ -1015,7 +1015,7 @@ dequeue_top_rt_rq(struct rt_rq *rt_rq) + + BUG_ON(!rq->nr_running); + +- sub_nr_running(rq, rt_rq->rt_nr_running); ++ sub_nr_running(rq, count); + rt_rq->rt_queued = 0; + + } +@@ -1294,18 +1294,21 @@ static void __dequeue_rt_entity(struct sched_rt_entity *rt_se, unsigned int flag + static void dequeue_rt_stack(struct sched_rt_entity *rt_se, unsigned int flags) + { + struct sched_rt_entity *back = NULL; ++ unsigned int rt_nr_running; + + for_each_sched_rt_entity(rt_se) { + rt_se->back = back; + back = rt_se; + } + +- dequeue_top_rt_rq(rt_rq_of_se(back)); ++ rt_nr_running = rt_rq_of_se(back)->rt_nr_running; + + for (rt_se = back; rt_se; rt_se = rt_se->back) { + if (on_rt_rq(rt_se)) + __dequeue_rt_entity(rt_se, flags); + } ++ ++ dequeue_top_rt_rq(rt_rq_of_se(back), rt_nr_running); + } + + static void enqueue_rt_entity(struct sched_rt_entity *rt_se, unsigned int flags) +-- +2.35.1 + diff --git a/queue-5.4/null_blk-fix-ida-error-handling-in-null_add_dev.patch b/queue-5.4/null_blk-fix-ida-error-handling-in-null_add_dev.patch new file mode 100644 index 00000000000..ba59b30caa7 --- /dev/null +++ b/queue-5.4/null_blk-fix-ida-error-handling-in-null_add_dev.patch @@ -0,0 +1,62 @@ +From ee622dea8fd80a82ec75ce0b0eded0b4a09f288f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 11:12:14 +0300 +Subject: null_blk: fix ida error handling in null_add_dev() + +From: Dan Carpenter + +[ Upstream commit ee452a8d984f94fa8e894f003a52e776e4572881 ] + +There needs to be some error checking if ida_simple_get() fails. +Also call ida_free() if there are errors later. + +Fixes: 94bc02e30fb8 ("nullb: use ida to manage index") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YtEhXsr6vJeoiYhd@kili +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk_main.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c +index 13eae973eaea..6cbdd8a691d2 100644 +--- a/drivers/block/null_blk_main.c ++++ b/drivers/block/null_blk_main.c +@@ -1711,8 +1711,13 @@ static int null_add_dev(struct nullb_device *dev) + blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, nullb->q); + + mutex_lock(&lock); +- nullb->index = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); +- dev->index = nullb->index; ++ rv = ida_simple_get(&nullb_indexes, 0, 0, GFP_KERNEL); ++ if (rv < 0) { ++ mutex_unlock(&lock); ++ goto out_cleanup_zone; ++ } ++ nullb->index = rv; ++ dev->index = rv; + mutex_unlock(&lock); + + blk_queue_logical_block_size(nullb->q, dev->blocksize); +@@ -1724,13 +1729,16 @@ static int null_add_dev(struct nullb_device *dev) + + rv = null_gendisk_register(nullb); + if (rv) +- goto out_cleanup_zone; ++ goto out_ida_free; + + mutex_lock(&lock); + list_add_tail(&nullb->list, &nullb_list); + mutex_unlock(&lock); + + return 0; ++ ++out_ida_free: ++ ida_free(&nullb_indexes, nullb->index); + out_cleanup_zone: + if (dev->zoned) + null_zone_exit(dev); +-- +2.35.1 + diff --git a/queue-5.4/opp-fix-error-check-in-dev_pm_opp_attach_genpd.patch b/queue-5.4/opp-fix-error-check-in-dev_pm_opp_attach_genpd.patch new file mode 100644 index 00000000000..16c9017b9d9 --- /dev/null +++ b/queue-5.4/opp-fix-error-check-in-dev_pm_opp_attach_genpd.patch @@ -0,0 +1,39 @@ +From 0d548cd4122cc91ae31cb77cd0495da269f7104f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 20:31:51 +0800 +Subject: opp: Fix error check in dev_pm_opp_attach_genpd() + +From: Tang Bin + +[ Upstream commit 4ea9496cbc959eb5c78f3e379199aca9ef4e386b ] + +dev_pm_domain_attach_by_name() may return NULL in some cases, +so IS_ERR() doesn't meet the requirements. Thus fix it. + +Fixes: 6319aee10e53 ("opp: Attach genpds to devices from within OPP core") +Signed-off-by: Tang Bin +[ Viresh: Replace ENODATA with ENODEV ] +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 088c93dc0085..08f5d1c3d665 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -1881,8 +1881,8 @@ struct opp_table *dev_pm_opp_attach_genpd(struct device *dev, + } + + virt_dev = dev_pm_domain_attach_by_name(dev, *name); +- if (IS_ERR(virt_dev)) { +- ret = PTR_ERR(virt_dev); ++ if (IS_ERR_OR_NULL(virt_dev)) { ++ ret = PTR_ERR(virt_dev) ? : -ENODEV; + dev_err(dev, "Couldn't attach to pm_domain: %d\n", ret); + goto err; + } +-- +2.35.1 + diff --git a/queue-5.4/pci-portdrv-don-t-disable-aer-reporting-in-get_port_.patch b/queue-5.4/pci-portdrv-don-t-disable-aer-reporting-in-get_port_.patch new file mode 100644 index 00000000000..97dc7a2e170 --- /dev/null +++ b/queue-5.4/pci-portdrv-don-t-disable-aer-reporting-in-get_port_.patch @@ -0,0 +1,106 @@ +From 2f4f9f5cf15f56abb4c1efb0905162e33d851834 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 08:18:19 +0100 +Subject: PCI/portdrv: Don't disable AER reporting in + get_port_device_capability() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Roese + +[ Upstream commit 8795e182b02dc87e343c79e73af6b8b7f9c5e635 ] + +AER reporting is currently disabled in the DevCtl registers of all non Root +Port PCIe devices on systems using pcie_ports_native || host->native_aer, +disabling AER completely in such systems. This is because 2bd50dd800b5 +("PCI: PCIe: Disable PCIe port services during port initialization"), added +a call to pci_disable_pcie_error_reporting() *after* the AER setup was +completed for the PCIe device tree. + +Here a longer analysis about the current status of AER enabling / +disabling upon bootup provided by Bjorn: + + pcie_portdrv_probe + pcie_port_device_register + get_port_device_capability + pci_disable_pcie_error_reporting + clear CERE NFERE FERE URRE # <-- disable for RP USP DSP + pcie_device_init + device_register # new AER service device + aer_probe + aer_enable_rootport # RP only + set_downstream_devices_error_reporting + set_device_error_reporting # self (RP) + if (RP || USP || DSP) + pci_enable_pcie_error_reporting + set CERE NFERE FERE URRE # <-- enable for RP + pci_walk_bus + set_device_error_reporting + if (RP || USP || DSP) + pci_enable_pcie_error_reporting + set CERE NFERE FERE URRE # <-- enable for USP DSP + +In a typical Root Port -> Endpoint hierarchy, the above: + - Disables Error Reporting for the Root Port, + - Enables Error Reporting for the Root Port, + - Does NOT enable Error Reporting for the Endpoint because it is not a + Root Port or Switch Port. + +In a deeper Root Port -> Upstream Switch Port -> Downstream Switch +Port -> Endpoint hierarchy: + - Disables Error Reporting for the Root Port, + - Enables Error Reporting for the Root Port, + - Enables Error Reporting for both Switch Ports, + - Does NOT enable Error Reporting for the Endpoint because it is not a + Root Port or Switch Port, + - Disables Error Reporting for the Switch Ports when pcie_portdrv_probe() + claims them. AER does not re-enable it because these are not Root + Ports. + +Remove this call to pci_disable_pcie_error_reporting() from +get_port_device_capability(), leaving the already enabled AER configuration +intact. With this change, AER is enabled in the Root Port and the PCIe +switch upstream and downstream ports. Only the PCIe Endpoints don't have +AER enabled yet. A follow-up patch will take care of this Endpoint +enabling. + +Fixes: 2bd50dd800b5 ("PCI: PCIe: Disable PCIe port services during port initialization") +Link: https://lore.kernel.org/r/20220125071820.2247260-3-sr@denx.de +Signed-off-by: Stefan Roese +Signed-off-by: Bjorn Helgaas +Reviewed-by: Pali Rohár +Cc: Rafael J. Wysocki +Cc: Bharat Kumar Gogada +Cc: Michal Simek +Cc: Yao Hongbo +Cc: Naveen Naidu +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/portdrv_core.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c +index 8637f6068f9c..066406d6d0ee 100644 +--- a/drivers/pci/pcie/portdrv_core.c ++++ b/drivers/pci/pcie/portdrv_core.c +@@ -222,15 +222,8 @@ static int get_port_device_capability(struct pci_dev *dev) + + #ifdef CONFIG_PCIEAER + if (dev->aer_cap && pci_aer_available() && +- (pcie_ports_native || host->native_aer)) { ++ (pcie_ports_native || host->native_aer)) + services |= PCIE_PORT_SERVICE_AER; +- +- /* +- * Disable AER on this port in case it's been enabled by the +- * BIOS (the AER service driver will enable it when necessary). +- */ +- pci_disable_pcie_error_reporting(dev); +- } + #endif + + /* +-- +2.35.1 + diff --git a/queue-5.4/pci-tegra194-fix-link-up-retry-sequence.patch b/queue-5.4/pci-tegra194-fix-link-up-retry-sequence.patch new file mode 100644 index 00000000000..50565387f66 --- /dev/null +++ b/queue-5.4/pci-tegra194-fix-link-up-retry-sequence.patch @@ -0,0 +1,37 @@ +From 984f9f8a534ca723f47a6f0fc1ae6bc3a38e4336 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 19:50:50 +0530 +Subject: PCI: tegra194: Fix link up retry sequence + +From: Vidya Sagar + +[ Upstream commit e05fd6ae77c3e2cc0dba283005d24b6d56d2b1fa ] + +Add the missing DLF capability offset while clearing DL_FEATURE_EXCHANGE_EN +bit during link up retry. + +Link: https://lore.kernel.org/r/20220721142052.25971-15-vidyas@nvidia.com +Fixes: 56e15a238d92 ("PCI: tegra: Add Tegra194 PCIe support") +Signed-off-by: Vidya Sagar +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index c7ac61a6080b..120d64c1a27f 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -854,7 +854,7 @@ static int tegra_pcie_dw_host_init(struct pcie_port *pp) + offset = dw_pcie_find_ext_capability(pci, PCI_EXT_CAP_ID_DLF); + val = dw_pcie_readl_dbi(pci, offset + PCI_DLF_CAP); + val &= ~PCI_DLF_EXCHANGE_ENABLE; +- dw_pcie_writel_dbi(pci, offset, val); ++ dw_pcie_writel_dbi(pci, offset + PCI_DLF_CAP, val); + + tegra_pcie_prepare_host(pp); + +-- +2.35.1 + diff --git a/queue-5.4/pci-tegra194-fix-root-port-interrupt-handling.patch b/queue-5.4/pci-tegra194-fix-root-port-interrupt-handling.patch new file mode 100644 index 00000000000..e94d2a750d4 --- /dev/null +++ b/queue-5.4/pci-tegra194-fix-root-port-interrupt-handling.patch @@ -0,0 +1,115 @@ +From bcf0f25aa1fff02729390af85c587cd2b87dc4de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 19:50:46 +0530 +Subject: PCI: tegra194: Fix Root Port interrupt handling + +From: Vidya Sagar + +[ Upstream commit 6646e99bcec627e866bc84365af37942c72b4b76 ] + +As part of Root Port interrupt handling, level-0 register is read first and +based on the bits set in that, corresponding level-1 registers are read for +further interrupt processing. Since both these values are currently read +into the same 'val' variable, checking level-0 bits the second time around +is happening on the 'val' variable value of level-1 register contents +instead of freshly reading the level-0 value again. + +Fix by using different variables to store level-0 and level-1 registers +contents. + +Link: https://lore.kernel.org/r/20220721142052.25971-11-vidyas@nvidia.com +Fixes: 56e15a238d92 ("PCI: tegra: Add Tegra194 PCIe support") +Signed-off-by: Vidya Sagar +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 46 +++++++++++----------- + 1 file changed, 22 insertions(+), 24 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index c06b05ab9f78..c7ac61a6080b 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -345,15 +345,14 @@ static irqreturn_t tegra_pcie_rp_irq_handler(struct tegra_pcie_dw *pcie) + { + struct dw_pcie *pci = &pcie->pci; + struct pcie_port *pp = &pci->pp; +- u32 val, tmp; ++ u32 val, status_l0, status_l1; + u16 val_w; + +- val = appl_readl(pcie, APPL_INTR_STATUS_L0); +- if (val & APPL_INTR_STATUS_L0_LINK_STATE_INT) { +- val = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0); +- if (val & APPL_INTR_STATUS_L1_0_0_LINK_REQ_RST_NOT_CHGED) { +- appl_writel(pcie, val, APPL_INTR_STATUS_L1_0_0); +- ++ status_l0 = appl_readl(pcie, APPL_INTR_STATUS_L0); ++ if (status_l0 & APPL_INTR_STATUS_L0_LINK_STATE_INT) { ++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0); ++ appl_writel(pcie, status_l1, APPL_INTR_STATUS_L1_0_0); ++ if (status_l1 & APPL_INTR_STATUS_L1_0_0_LINK_REQ_RST_NOT_CHGED) { + /* SBR & Surprise Link Down WAR */ + val = appl_readl(pcie, APPL_CAR_RESET_OVRD); + val &= ~APPL_CAR_RESET_OVRD_CYA_OVERRIDE_CORE_RST_N; +@@ -369,15 +368,15 @@ static irqreturn_t tegra_pcie_rp_irq_handler(struct tegra_pcie_dw *pcie) + } + } + +- if (val & APPL_INTR_STATUS_L0_INT_INT) { +- val = appl_readl(pcie, APPL_INTR_STATUS_L1_8_0); +- if (val & APPL_INTR_STATUS_L1_8_0_AUTO_BW_INT_STS) { ++ if (status_l0 & APPL_INTR_STATUS_L0_INT_INT) { ++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_8_0); ++ if (status_l1 & APPL_INTR_STATUS_L1_8_0_AUTO_BW_INT_STS) { + appl_writel(pcie, + APPL_INTR_STATUS_L1_8_0_AUTO_BW_INT_STS, + APPL_INTR_STATUS_L1_8_0); + apply_bad_link_workaround(pp); + } +- if (val & APPL_INTR_STATUS_L1_8_0_BW_MGT_INT_STS) { ++ if (status_l1 & APPL_INTR_STATUS_L1_8_0_BW_MGT_INT_STS) { + appl_writel(pcie, + APPL_INTR_STATUS_L1_8_0_BW_MGT_INT_STS, + APPL_INTR_STATUS_L1_8_0); +@@ -389,25 +388,24 @@ static irqreturn_t tegra_pcie_rp_irq_handler(struct tegra_pcie_dw *pcie) + } + } + +- val = appl_readl(pcie, APPL_INTR_STATUS_L0); +- if (val & APPL_INTR_STATUS_L0_CDM_REG_CHK_INT) { +- val = appl_readl(pcie, APPL_INTR_STATUS_L1_18); +- tmp = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS); +- if (val & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_CMPLT) { ++ if (status_l0 & APPL_INTR_STATUS_L0_CDM_REG_CHK_INT) { ++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_18); ++ val = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS); ++ if (status_l1 & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_CMPLT) { + dev_info(pci->dev, "CDM check complete\n"); +- tmp |= PCIE_PL_CHK_REG_CHK_REG_COMPLETE; ++ val |= PCIE_PL_CHK_REG_CHK_REG_COMPLETE; + } +- if (val & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_CMP_ERR) { ++ if (status_l1 & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_CMP_ERR) { + dev_err(pci->dev, "CDM comparison mismatch\n"); +- tmp |= PCIE_PL_CHK_REG_CHK_REG_COMPARISON_ERROR; ++ val |= PCIE_PL_CHK_REG_CHK_REG_COMPARISON_ERROR; + } +- if (val & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_LOGIC_ERR) { ++ if (status_l1 & APPL_INTR_STATUS_L1_18_CDM_REG_CHK_LOGIC_ERR) { + dev_err(pci->dev, "CDM Logic error\n"); +- tmp |= PCIE_PL_CHK_REG_CHK_REG_LOGIC_ERROR; ++ val |= PCIE_PL_CHK_REG_CHK_REG_LOGIC_ERROR; + } +- dw_pcie_writel_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS, tmp); +- tmp = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_ERR_ADDR); +- dev_err(pci->dev, "CDM Error Address Offset = 0x%08X\n", tmp); ++ dw_pcie_writel_dbi(pci, PCIE_PL_CHK_REG_CONTROL_STATUS, val); ++ val = dw_pcie_readl_dbi(pci, PCIE_PL_CHK_REG_ERR_ADDR); ++ dev_err(pci->dev, "CDM Error Address Offset = 0x%08X\n", val); + } + + return IRQ_HANDLED; +-- +2.35.1 + diff --git a/queue-5.4/perf-symbol-fail-to-read-phdr-workaround.patch b/queue-5.4/perf-symbol-fail-to-read-phdr-workaround.patch new file mode 100644 index 00000000000..500a7c4d367 --- /dev/null +++ b/queue-5.4/perf-symbol-fail-to-read-phdr-workaround.patch @@ -0,0 +1,107 @@ +From d4c9f829035e67178d99e942dc77efd6b056b9bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Jul 2022 09:49:23 -0700 +Subject: perf symbol: Fail to read phdr workaround + +From: Ian Rogers + +[ Upstream commit 6d518ac7be6223811ab947897273b1bbef846180 ] + +The perf jvmti agent doesn't create program headers, in this case +fallback on section headers as happened previously. + +Committer notes: + +To test this, from a public post by Ian: + +1) download a Java workload dacapo-9.12-MR1-bach.jar from +https://sourceforge.net/projects/dacapobench/ + +2) build perf such as "make -C tools/perf O=/tmp/perf NO_LIBBFD=1" it +should detect Java and create /tmp/perf/libperf-jvmti.so + +3) run perf with the jvmti agent: + + perf record -k 1 java -agentpath:/tmp/perf/libperf-jvmti.so -jar dacapo-9.12-MR1-bach.jar -n 10 fop + +4) run perf inject: + + perf inject -i perf.data -o perf-injected.data -j + +5) run perf report + + perf report -i perf-injected.data | grep org.apache.fop + +With this patch reverted I see lots of symbols like: + + 0.00% java jitted-388040-4656.so [.] org.apache.fop.fo.FObj.bind(org.apache.fop.fo.PropertyList) + +With the patch (2d86612aacb7805f ("perf symbol: Correct address for bss +symbols")) I see lots of: + + dso__load_sym_internal: failed to find program header for symbol: + Lorg/apache/fop/fo/FObj;bind(Lorg/apache/fop/fo/PropertyList;)V + st_value: 0x40 + +Fixes: 2d86612aacb7805f ("perf symbol: Correct address for bss symbols") +Reviewed-by: Leo Yan +Signed-off-by: Ian Rogers +Tested-by: Leo Yan +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Leo Yan +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20220731164923.691193-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol-elf.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 0b185b1090ff..a04a7dfb8ec0 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -1159,16 +1159,29 @@ int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss, + + if (elf_read_program_header(syms_ss->elf, + (u64)sym.st_value, &phdr)) { +- pr_warning("%s: failed to find program header for " ++ pr_debug4("%s: failed to find program header for " + "symbol: %s st_value: %#" PRIx64 "\n", + __func__, elf_name, (u64)sym.st_value); +- continue; ++ pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " " ++ "sh_addr: %#" PRIx64 " sh_offset: %#" PRIx64 "\n", ++ __func__, (u64)sym.st_value, (u64)shdr.sh_addr, ++ (u64)shdr.sh_offset); ++ /* ++ * Fail to find program header, let's rollback ++ * to use shdr.sh_addr and shdr.sh_offset to ++ * calibrate symbol's file address, though this ++ * is not necessary for normal C ELF file, we ++ * still need to handle java JIT symbols in this ++ * case. ++ */ ++ sym.st_value -= shdr.sh_addr - shdr.sh_offset; ++ } else { ++ pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " " ++ "p_vaddr: %#" PRIx64 " p_offset: %#" PRIx64 "\n", ++ __func__, (u64)sym.st_value, (u64)phdr.p_vaddr, ++ (u64)phdr.p_offset); ++ sym.st_value -= phdr.p_vaddr - phdr.p_offset; + } +- pr_debug4("%s: adjusting symbol: st_value: %#" PRIx64 " " +- "p_vaddr: %#" PRIx64 " p_offset: %#" PRIx64 "\n", +- __func__, (u64)sym.st_value, (u64)phdr.p_vaddr, +- (u64)phdr.p_offset); +- sym.st_value -= phdr.p_vaddr - phdr.p_offset; + } + + demangled = demangle_sym(dso, kmodule, elf_name); +-- +2.35.1 + diff --git a/queue-5.4/platform-olpc-fix-uninitialized-data-in-debugfs-writ.patch b/queue-5.4/platform-olpc-fix-uninitialized-data-in-debugfs-writ.patch new file mode 100644 index 00000000000..1ee4d8bedff --- /dev/null +++ b/queue-5.4/platform-olpc-fix-uninitialized-data-in-debugfs-writ.patch @@ -0,0 +1,50 @@ +From e3f91c674c2dacf02ad73834d21f5d6ecbe9f9e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 21:23:38 +0300 +Subject: platform/olpc: Fix uninitialized data in debugfs write + +From: Dan Carpenter + +[ Upstream commit 40ec787e1adf302c11668d4cc69838f4d584187d ] + +The call to: + + size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size); + +will succeed if at least one byte is written to the "cmdbuf" buffer. +The "*ppos" value controls which byte is written. Another problem is +that this code does not check for errors so it's possible for the entire +buffer to be uninitialized. + +Inintialize the struct to zero to prevent reading uninitialized stack +data. + +Debugfs is normally only writable by root so the impact of this bug is +very minimal. + +Fixes: 6cca83d498bd ("Platform: OLPC: move debugfs support from x86 EC driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YthIKn+TfZSZMEcM@kili +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/olpc/olpc-ec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c +index 2db7113383fd..89d9fca02fe9 100644 +--- a/drivers/platform/olpc/olpc-ec.c ++++ b/drivers/platform/olpc/olpc-ec.c +@@ -265,7 +265,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, const char __user *buf, + int i, m; + unsigned char ec_cmd[EC_MAX_CMD_ARGS]; + unsigned int ec_cmd_int[EC_MAX_CMD_ARGS]; +- char cmdbuf[64]; ++ char cmdbuf[64] = ""; + int ec_cmd_bytes; + + mutex_lock(&ec_dbgfs_lock); +-- +2.35.1 + diff --git a/queue-5.4/pm-hibernate-defer-device-probing-when-resuming-from.patch b/queue-5.4/pm-hibernate-defer-device-probing-when-resuming-from.patch new file mode 100644 index 00000000000..48f69f4c399 --- /dev/null +++ b/queue-5.4/pm-hibernate-defer-device-probing-when-resuming-from.patch @@ -0,0 +1,106 @@ +From 343857d35dc5878919cf2b6771db469f0b71199d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 14:49:58 +0900 +Subject: PM: hibernate: defer device probing when resuming from hibernation + +From: Tetsuo Handa + +[ Upstream commit 8386c414e27caba8501119948e9551e52b527f59 ] + +syzbot is reporting hung task at misc_open() [1], for there is a race +window of AB-BA deadlock which involves probe_count variable. Currently +wait_for_device_probe() from snapshot_open() from misc_open() can sleep +forever with misc_mtx held if probe_count cannot become 0. + +When a device is probed by hub_event() work function, probe_count is +incremented before the probe function starts, and probe_count is +decremented after the probe function completed. + +There are three cases that can prevent probe_count from dropping to 0. + + (a) A device being probed stopped responding (i.e. broken/malicious + hardware). + + (b) A process emulating a USB device using /dev/raw-gadget interface + stopped responding for some reason. + + (c) New device probe requests keeps coming in before existing device + probe requests complete. + +The phenomenon syzbot is reporting is (b). A process which is holding +system_transition_mutex and misc_mtx is waiting for probe_count to become +0 inside wait_for_device_probe(), but the probe function which is called + from hub_event() work function is waiting for the processes which are +blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface. + +This patch mitigates (b) by deferring wait_for_device_probe() from +snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that +the possibility of (b) remains as long as any thread which is emulating a +USB device via /dev/raw-gadget interface can be blocked by uninterruptible +blocking operations (e.g. mutex_lock()). + +Please also note that (a) and (c) are not addressed. Regarding (c), we +should change the code to wait for only one device which contains the +image for resuming from hibernation. I don't know how to address (a), for +use of timeout for wait_for_device_probe() might result in loss of user +data in the image. Maybe we should require the userland to wait for the +image device before opening /dev/snapshot interface. + +Link: https://syzkaller.appspot.com/bug?extid=358c9ab4c93da7b7238c [1] +Reported-by: syzbot +Signed-off-by: Tetsuo Handa +Tested-by: syzbot +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/user.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/kernel/power/user.c b/kernel/power/user.c +index 77438954cc2b..672d4e28fa8a 100644 +--- a/kernel/power/user.c ++++ b/kernel/power/user.c +@@ -26,6 +26,7 @@ + + #include "power.h" + ++static bool need_wait; + + #define SNAPSHOT_MINOR 231 + +@@ -79,7 +80,7 @@ static int snapshot_open(struct inode *inode, struct file *filp) + * Resuming. We may need to wait for the image device to + * appear. + */ +- wait_for_device_probe(); ++ need_wait = true; + + data->swap = -1; + data->mode = O_WRONLY; +@@ -171,6 +172,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, + ssize_t res; + loff_t pg_offp = *offp & ~PAGE_MASK; + ++ if (need_wait) { ++ wait_for_device_probe(); ++ need_wait = false; ++ } ++ + lock_system_sleep(); + + data = filp->private_data; +@@ -206,6 +212,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd, + loff_t size; + sector_t offset; + ++ if (need_wait) { ++ wait_for_device_probe(); ++ need_wait = false; ++ } ++ + if (_IOC_TYPE(cmd) != SNAPSHOT_IOC_MAGIC) + return -ENOTTY; + if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR) +-- +2.35.1 + diff --git a/queue-5.4/powerpc-32-do-not-allow-selection-of-e5500-or-e6500-.patch b/queue-5.4/powerpc-32-do-not-allow-selection-of-e5500-or-e6500-.patch new file mode 100644 index 00000000000..b5c907dee43 --- /dev/null +++ b/queue-5.4/powerpc-32-do-not-allow-selection-of-e5500-or-e6500-.patch @@ -0,0 +1,48 @@ +From 0c1fa51278457b31c48fc025fdb4262576b28c78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 16:19:29 +0200 +Subject: powerpc/32: Do not allow selection of e5500 or e6500 CPUs on PPC32 + +From: Christophe Leroy + +[ Upstream commit 9be013b2a9ecb29b5168e4b9db0e48ed53acf37c ] + +Commit 0e00a8c9fd92 ("powerpc: Allow CPU selection also on PPC32") +enlarged the CPU selection logic to PPC32 by removing depend to +PPC64, and failed to restrict that depend to E5500_CPU and E6500_CPU. +Fortunately that got unnoticed because -mcpu=8540 will override the +-mcpu=e500mc64 or -mpcu=e6500 as they are ealier, but that's +fragile and may no be right in the future. + +Add back the depend PPC64 on E5500_CPU and E6500_CPU. + +Fixes: 0e00a8c9fd92 ("powerpc: Allow CPU selection also on PPC32") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/8abab4888da69ff78b73a56f64d9678a7bf684e9.1657549153.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/Kconfig.cputype | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype +index f0330ce498d1..a9b20aa1dfd4 100644 +--- a/arch/powerpc/platforms/Kconfig.cputype ++++ b/arch/powerpc/platforms/Kconfig.cputype +@@ -151,11 +151,11 @@ config POWER9_CPU + + config E5500_CPU + bool "Freescale e5500" +- depends on E500 ++ depends on PPC64 && E500 + + config E6500_CPU + bool "Freescale e6500" +- depends on E500 ++ depends on PPC64 && E500 + + config 860_CPU + bool "8xx family" +-- +2.35.1 + diff --git a/queue-5.4/powerpc-cell-axon_msi-fix-refcount-leak-in-setup_msi.patch b/queue-5.4/powerpc-cell-axon_msi-fix-refcount-leak-in-setup_msi.patch new file mode 100644 index 00000000000..783c42af7dd --- /dev/null +++ b/queue-5.4/powerpc-cell-axon_msi-fix-refcount-leak-in-setup_msi.patch @@ -0,0 +1,37 @@ +From ad20e067f3097b71de62a410b246f67e00e1fc42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jun 2022 10:51:29 +0400 +Subject: powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address + +From: Miaoqian Lin + +[ Upstream commit df5d4b616ee76abc97e5bd348e22659c2b095b1c ] + +of_get_next_parent() returns a node pointer with refcount incremented, +we should use of_node_put() on it when not need anymore. +Add missing of_node_put() in the error path to avoid refcount leak. + +Fixes: ce21b3c9648a ("[CELL] add support for MSI on Axon-based Cell systems") +Signed-off-by: Miaoqian Lin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220605065129.63906-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/cell/axon_msi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platforms/cell/axon_msi.c +index 57c4e0e86c88..ba33140e671d 100644 +--- a/arch/powerpc/platforms/cell/axon_msi.c ++++ b/arch/powerpc/platforms/cell/axon_msi.c +@@ -226,6 +226,7 @@ static int setup_msi_msg_address(struct pci_dev *dev, struct msi_msg *msg) + if (!prop) { + dev_dbg(&dev->dev, + "axon_msi: no msi-address-(32|64) properties found\n"); ++ of_node_put(dn); + return -ENOENT; + } + +-- +2.35.1 + diff --git a/queue-5.4/powerpc-pci-fix-phb-numbering-when-using-opal-phbid.patch b/queue-5.4/powerpc-pci-fix-phb-numbering-when-using-opal-phbid.patch new file mode 100644 index 00000000000..0edccba1563 --- /dev/null +++ b/queue-5.4/powerpc-pci-fix-phb-numbering-when-using-opal-phbid.patch @@ -0,0 +1,61 @@ +From f7145ea52bed0329fbcb23679ae4f1e2e23de58f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 20:38:32 +1000 +Subject: powerpc/pci: Fix PHB numbering when using opal-phbid +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit f4b39e88b42d13366b831270306326b5c20971ca ] + +The recent change to the PHB numbering logic has a logic error in the +handling of "ibm,opal-phbid". + +When an "ibm,opal-phbid" property is present, &prop is written to and +ret is set to zero. + +The following call to of_alias_get_id() is skipped because ret == 0. + +But then the if (ret >= 0) is true, and the body of that if statement +sets prop = ret which throws away the value that was just read from +"ibm,opal-phbid". + +Fix the logic by only doing the ret >= 0 check in the of_alias_get_id() +case. + +Fixes: 0fe1e96fef0a ("powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias") +Reviewed-by: Pali Rohár +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220802105723.1055178-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/pci-common.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c +index 1e827e3769a8..622463a88f05 100644 +--- a/arch/powerpc/kernel/pci-common.c ++++ b/arch/powerpc/kernel/pci-common.c +@@ -89,11 +89,13 @@ static int get_phb_number(struct device_node *dn) + } + if (ret) + ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop); +- if (ret) ++ ++ if (ret) { + ret = of_alias_get_id(dn, "pci"); +- if (ret >= 0) { +- prop = ret; +- ret = 0; ++ if (ret >= 0) { ++ prop = ret; ++ ret = 0; ++ } + } + if (ret) { + u32 prop_32; +-- +2.35.1 + diff --git a/queue-5.4/powerpc-pci-prefer-pci-domain-assignment-via-dt-linu.patch b/queue-5.4/powerpc-pci-prefer-pci-domain-assignment-via-dt-linu.patch new file mode 100644 index 00000000000..6200b929490 --- /dev/null +++ b/queue-5.4/powerpc-pci-prefer-pci-domain-assignment-via-dt-linu.patch @@ -0,0 +1,88 @@ +From 210d52f1125ad99b624bba6c88a9644d6790127a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 12:21:48 +0200 +Subject: powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' + and alias +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 0fe1e96fef0a5c53b4c0d1500d356f3906000f81 ] + +Other Linux architectures use DT property 'linux,pci-domain' for +specifying fixed PCI domain of PCI controller specified in Device-Tree. + +And lot of Freescale powerpc boards have defined numbered pci alias in +Device-Tree for every PCIe controller which number specify preferred PCI +domain. + +So prefer usage of DT property 'linux,pci-domain' (via function +of_get_pci_domain_nr()) and DT pci alias (via function +of_alias_get_id()) on powerpc architecture for assigning PCI domain to +PCI controller. + +Fixes: 63a72284b159 ("powerpc/pci: Assign fixed PHB number based on device-tree properties") +Signed-off-by: Pali Rohár +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220706102148.5060-2-pali@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/pci-common.c | 27 +++++++++++++++++++-------- + 1 file changed, 19 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c +index a2c258a8d736..1e827e3769a8 100644 +--- a/arch/powerpc/kernel/pci-common.c ++++ b/arch/powerpc/kernel/pci-common.c +@@ -73,16 +73,30 @@ void set_pci_dma_ops(const struct dma_map_ops *dma_ops) + static int get_phb_number(struct device_node *dn) + { + int ret, phb_id = -1; +- u32 prop_32; + u64 prop; + + /* + * Try fixed PHB numbering first, by checking archs and reading +- * the respective device-tree properties. Firstly, try powernv by +- * reading "ibm,opal-phbid", only present in OPAL environment. ++ * the respective device-tree properties. Firstly, try reading ++ * standard "linux,pci-domain", then try reading "ibm,opal-phbid" ++ * (only present in powernv OPAL environment), then try device-tree ++ * alias and as the last try to use lower bits of "reg" property. + */ +- ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop); ++ ret = of_get_pci_domain_nr(dn); ++ if (ret >= 0) { ++ prop = ret; ++ ret = 0; ++ } ++ if (ret) ++ ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop); ++ if (ret) ++ ret = of_alias_get_id(dn, "pci"); ++ if (ret >= 0) { ++ prop = ret; ++ ret = 0; ++ } + if (ret) { ++ u32 prop_32; + ret = of_property_read_u32_index(dn, "reg", 1, &prop_32); + prop = prop_32; + } +@@ -94,10 +108,7 @@ static int get_phb_number(struct device_node *dn) + if ((phb_id >= 0) && !test_and_set_bit(phb_id, phb_bitmap)) + return phb_id; + +- /* +- * If not pseries nor powernv, or if fixed PHB numbering tried to add +- * the same PHB number twice, then fallback to dynamic PHB numbering. +- */ ++ /* If everything fails then fallback to dynamic PHB numbering. */ + phb_id = find_first_zero_bit(phb_bitmap, MAX_PHBS); + BUG_ON(phb_id >= MAX_PHBS); + set_bit(phb_id, phb_bitmap); +-- +2.35.1 + diff --git a/queue-5.4/powerpc-spufs-fix-refcount-leak-in-spufs_init_isolat.patch b/queue-5.4/powerpc-spufs-fix-refcount-leak-in-spufs_init_isolat.patch new file mode 100644 index 00000000000..4851638c1b7 --- /dev/null +++ b/queue-5.4/powerpc-spufs-fix-refcount-leak-in-spufs_init_isolat.patch @@ -0,0 +1,38 @@ +From a9736ff32291e71de8663a8ac4dea437c75b0372 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 16:15:42 +0400 +Subject: powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader + +From: Miaoqian Lin + +[ Upstream commit 6ac059dacffa8ab2f7798f20e4bd3333890c541c ] + +of_find_node_by_path() returns remote device nodepointer with +refcount incremented, we should use of_node_put() on it when done. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 0afacde3df4c ("[POWERPC] spufs: allow isolated mode apps by starting the SPE loader") +Signed-off-by: Miaoqian Lin +Acked-by: Arnd Bergmann +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220603121543.22884-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/cell/spufs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c +index 2dd452a047cd..99e688498a9c 100644 +--- a/arch/powerpc/platforms/cell/spufs/inode.c ++++ b/arch/powerpc/platforms/cell/spufs/inode.c +@@ -671,6 +671,7 @@ spufs_init_isolated_loader(void) + return; + + loader = of_get_property(dn, "loader", &size); ++ of_node_put(dn); + if (!loader) + return; + +-- +2.35.1 + diff --git a/queue-5.4/powerpc-xive-fix-refcount-leak-in-xive_get_max_prio.patch b/queue-5.4/powerpc-xive-fix-refcount-leak-in-xive_get_max_prio.patch new file mode 100644 index 00000000000..399b560f1b8 --- /dev/null +++ b/queue-5.4/powerpc-xive-fix-refcount-leak-in-xive_get_max_prio.patch @@ -0,0 +1,37 @@ +From bdd077f7fe27d21e24c790857944e8e7f271a7c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jun 2022 09:32:23 +0400 +Subject: powerpc/xive: Fix refcount leak in xive_get_max_prio + +From: Miaoqian Lin + +[ Upstream commit 255b650cbec6849443ce2e0cdd187fd5e61c218c ] + +of_find_node_by_path() returns a node pointer with +refcount incremented, we should use of_node_put() on it when done. +Add missing of_node_put() to avoid refcount leak. + +Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrupt controller") +Signed-off-by: Miaoqian Lin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220605053225.56125-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/xive/spapr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c +index 3f15615712b5..b21d71badaec 100644 +--- a/arch/powerpc/sysdev/xive/spapr.c ++++ b/arch/powerpc/sysdev/xive/spapr.c +@@ -683,6 +683,7 @@ static bool xive_get_max_prio(u8 *max_prio) + } + + reg = of_get_property(rootdn, "ibm,plat-res-int-priorities", &len); ++ of_node_put(rootdn); + if (!reg) { + pr_err("Failed to read 'ibm,plat-res-int-priorities' property\n"); + return false; +-- +2.35.1 + diff --git a/queue-5.4/profiling-fix-shift-too-large-makes-kernel-panic.patch b/queue-5.4/profiling-fix-shift-too-large-makes-kernel-panic.patch new file mode 100644 index 00000000000..8392fcafb5e --- /dev/null +++ b/queue-5.4/profiling-fix-shift-too-large-makes-kernel-panic.patch @@ -0,0 +1,91 @@ +From c2fc093306914c3a7a4eb5a09644fccdd3deaf0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 09:28:54 +0800 +Subject: profiling: fix shift too large makes kernel panic + +From: Chen Zhongjin + +[ Upstream commit 0fe6ee8f123a4dfb529a5aff07536bb481f34043 ] + +2d186afd04d6 ("profiling: fix shift-out-of-bounds bugs") limits shift +value by [0, BITS_PER_LONG -1], which means [0, 63]. + +However, syzbot found that the max shift value should be the bit number of +(_etext - _stext). If shift is outside of this, the "buffer_bytes" will +be zero and will cause kzalloc(0). Then the kernel panics due to +dereferencing the returned pointer 16. + +This can be easily reproduced by passing a large number like 60 to enable +profiling and then run readprofile. + +LOGS: + BUG: kernel NULL pointer dereference, address: 0000000000000010 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD 6148067 P4D 6148067 PUD 6142067 PMD 0 + PREEMPT SMP + CPU: 4 PID: 184 Comm: readprofile Not tainted 5.18.0+ #162 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 + RIP: 0010:read_profile+0x104/0x220 + RSP: 0018:ffffc900006fbe80 EFLAGS: 00000202 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 + RDX: ffff888006150000 RSI: 0000000000000001 RDI: ffffffff82aba4a0 + RBP: 000000000188bb60 R08: 0000000000000010 R09: ffff888006151000 + R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82aba4a0 + R13: 0000000000000000 R14: ffffc900006fbf08 R15: 0000000000020c30 + FS: 000000000188a8c0(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000010 CR3: 0000000006144000 CR4: 00000000000006e0 + Call Trace: + + proc_reg_read+0x56/0x70 + vfs_read+0x9a/0x1b0 + ksys_read+0xa1/0xe0 + ? fpregs_assert_state_consistent+0x1e/0x40 + do_syscall_64+0x3a/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + RIP: 0033:0x4d4b4e + RSP: 002b:00007ffebb668d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 + RAX: ffffffffffffffda RBX: 000000000188a8a0 RCX: 00000000004d4b4e + RDX: 0000000000000400 RSI: 000000000188bb60 RDI: 0000000000000003 + RBP: 0000000000000003 R08: 000000000000006e R09: 0000000000000000 + R10: 0000000000000041 R11: 0000000000000246 R12: 000000000188bb60 + R13: 0000000000000400 R14: 0000000000000000 R15: 000000000188bb60 + + Modules linked in: + CR2: 0000000000000010 +Killed + ---[ end trace 0000000000000000 ]--- + +Check prof_len in profile_init() to prevent it be zero. + +Link: https://lkml.kernel.org/r/20220531012854.229439-1-chenzhongjin@huawei.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Chen Zhongjin +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/profile.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/kernel/profile.c b/kernel/profile.c +index e97e42aaf202..b5ce18b6f1b9 100644 +--- a/kernel/profile.c ++++ b/kernel/profile.c +@@ -109,6 +109,13 @@ int __ref profile_init(void) + + /* only text is profiled */ + prof_len = (_etext - _stext) >> prof_shift; ++ ++ if (!prof_len) { ++ pr_warn("profiling shift: %u too large\n", prof_shift); ++ prof_on = 0; ++ return -EINVAL; ++ } ++ + buffer_bytes = prof_len*sizeof(atomic_t); + + if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL)) +-- +2.35.1 + diff --git a/queue-5.4/rdma-hfi1-fix-potential-memory-leak-in-setup_base_ct.patch b/queue-5.4/rdma-hfi1-fix-potential-memory-leak-in-setup_base_ct.patch new file mode 100644 index 00000000000..2f01e05f9a0 --- /dev/null +++ b/queue-5.4/rdma-hfi1-fix-potential-memory-leak-in-setup_base_ct.patch @@ -0,0 +1,45 @@ +From ca7cc7ef66c92eaf5fc4311d7d8be0110ea29c20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 15:07:18 +0800 +Subject: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() + +From: Jianglei Nie + +[ Upstream commit aa2a1df3a2c85f855af7d54466ac10bd48645d63 ] + +setup_base_ctxt() allocates a memory chunk for uctxt->groups with +hfi1_alloc_ctxt_rcv_groups(). When init_user_ctxt() fails, uctxt->groups +is not released, which will lead to a memory leak. + +We should release the uctxt->groups with hfi1_free_ctxt_rcv_groups() +when init_user_ctxt() fails. + +Fixes: e87473bc1b6c ("IB/hfi1: Only set fd pointer when base context is completely initialized") +Link: https://lore.kernel.org/r/20220711070718.2318320-1-niejianglei2021@163.com +Signed-off-by: Jianglei Nie +Acked-by: Dennis Dalessandro +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/file_ops.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c +index 8c7ba7bad42b..efd977f70f9e 100644 +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -1224,8 +1224,10 @@ static int setup_base_ctxt(struct hfi1_filedata *fd, + goto done; + + ret = init_user_ctxt(fd, uctxt); +- if (ret) ++ if (ret) { ++ hfi1_free_ctxt_rcv_groups(uctxt); + goto done; ++ } + + user_init(uctxt); + +-- +2.35.1 + diff --git a/queue-5.4/rdma-hns-fix-incorrect-clearing-of-interrupt-status-.patch b/queue-5.4/rdma-hns-fix-incorrect-clearing-of-interrupt-status-.patch new file mode 100644 index 00000000000..1cada095f20 --- /dev/null +++ b/queue-5.4/rdma-hns-fix-incorrect-clearing-of-interrupt-status-.patch @@ -0,0 +1,41 @@ +From 9dd1b9d3b012e9d7de7d07a5217dbeddfd589ab3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 21:43:51 +0800 +Subject: RDMA/hns: Fix incorrect clearing of interrupt status register + +From: Haoyue Xu + +[ Upstream commit ecb4db5c3590aa956b4b2c352081a5b632d1f9f9 ] + +The driver will clear all the interrupts in the same area +when the driver handles the interrupt of type AEQ overflow. +It should only set the interrupt status bit of type AEQ overflow. + +Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08") +Link: https://lore.kernel.org/r/20220714134353.16700-4-liangwenpeng@huawei.com +Signed-off-by: Haoyue Xu +Signed-off-by: Wenpeng Liang +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index d01e3222c00c..28bbc4708fd4 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -5216,8 +5216,8 @@ static irqreturn_t hns_roce_v2_msix_interrupt_abn(int irq, void *dev_id) + + dev_err(dev, "AEQ overflow!\n"); + +- int_st |= 1 << HNS_ROCE_V2_VF_INT_ST_AEQ_OVERFLOW_S; +- roce_write(hr_dev, ROCEE_VF_ABN_INT_ST_REG, int_st); ++ roce_write(hr_dev, ROCEE_VF_ABN_INT_ST_REG, ++ 1 << HNS_ROCE_V2_VF_INT_ST_AEQ_OVERFLOW_S); + + /* Set reset level for reset_event() */ + if (ops->set_default_reset_request) +-- +2.35.1 + diff --git a/queue-5.4/rdma-rxe-fix-error-unwind-in-rxe_create_qp.patch b/queue-5.4/rdma-rxe-fix-error-unwind-in-rxe_create_qp.patch new file mode 100644 index 00000000000..c5e6c5b5738 --- /dev/null +++ b/queue-5.4/rdma-rxe-fix-error-unwind-in-rxe_create_qp.patch @@ -0,0 +1,69 @@ +From bf11e535cccc77982a0c0a281504d9f8e2d8f869 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Jul 2022 02:36:21 -0400 +Subject: RDMA/rxe: Fix error unwind in rxe_create_qp() + +From: Zhu Yanjun + +[ Upstream commit fd5382c5805c4bcb50fd25b7246247d3f7114733 ] + +In the function rxe_create_qp(), rxe_qp_from_init() is called to +initialize qp, internally things like the spin locks are not setup until +rxe_qp_init_req(). + +If an error occures before this point then the unwind will call +rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() +which will oops when trying to access the uninitialized spinlock. + +Move the spinlock initializations earlier before any failures. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20220731063621.298405-1-yanjun.zhu@linux.dev +Reported-by: syzbot+833061116fa28df97f3b@syzkaller.appspotmail.com +Signed-off-by: Zhu Yanjun +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 53166b9ae67e..57f111fe5443 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -211,6 +211,14 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp, + spin_lock_init(&qp->grp_lock); + spin_lock_init(&qp->state_lock); + ++ spin_lock_init(&qp->req.task.state_lock); ++ spin_lock_init(&qp->resp.task.state_lock); ++ spin_lock_init(&qp->comp.task.state_lock); ++ ++ spin_lock_init(&qp->sq.sq_lock); ++ spin_lock_init(&qp->rq.producer_lock); ++ spin_lock_init(&qp->rq.consumer_lock); ++ + atomic_set(&qp->ssn, 0); + atomic_set(&qp->skb_out, 0); + } +@@ -268,7 +276,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + qp->req.opcode = -1; + qp->comp.opcode = -1; + +- spin_lock_init(&qp->sq.sq_lock); + skb_queue_head_init(&qp->req_pkts); + + rxe_init_task(rxe, &qp->req.task, qp, +@@ -318,9 +325,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + } + } + +- spin_lock_init(&qp->rq.producer_lock); +- spin_lock_init(&qp->rq.consumer_lock); +- + skb_queue_head_init(&qp->resp_pkts); + + rxe_init_task(rxe, &qp->resp.task, qp, +-- +2.35.1 + diff --git a/queue-5.4/rdma-siw-fix-duplicated-reported-iw_cm_event_connect.patch b/queue-5.4/rdma-siw-fix-duplicated-reported-iw_cm_event_connect.patch new file mode 100644 index 00000000000..bacec229e58 --- /dev/null +++ b/queue-5.4/rdma-siw-fix-duplicated-reported-iw_cm_event_connect.patch @@ -0,0 +1,73 @@ +From 22280bf2f6fe975ad06513d92fbe8858ef9865e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 09:30:47 +0800 +Subject: RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event + +From: Cheng Xu + +[ Upstream commit 3056fc6c32e613b760422b94c7617ac9a24a4721 ] + +If siw_recv_mpa_rr returns -EAGAIN, it means that the MPA reply hasn't +been received completely, and should not report IW_CM_EVENT_CONNECT_REPLY +in this case. This may trigger a call trace in iw_cm. A simple way to +trigger this: + server: ib_send_lat + client: ib_send_lat -R + +The call trace looks like this: + + kernel BUG at drivers/infiniband/core/iwcm.c:894! + invalid opcode: 0000 [#1] PREEMPT SMP NOPTI + <...> + Workqueue: iw_cm_wq cm_work_handler [iw_cm] + Call Trace: + + cm_work_handler+0x1dd/0x370 [iw_cm] + process_one_work+0x1e2/0x3b0 + worker_thread+0x49/0x2e0 + ? rescuer_thread+0x370/0x370 + kthread+0xe5/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x1f/0x30 + + +Fixes: 6c52fdc244b5 ("rdma/siw: connection management") +Link: https://lore.kernel.org/r/dae34b5fd5c2ea2bd9744812c1d2653a34a94c67.1657706960.git.chengyou@linux.alibaba.com +Signed-off-by: Cheng Xu +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_cm.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c +index 3aed597103d3..69fcf21eaf52 100644 +--- a/drivers/infiniband/sw/siw/siw_cm.c ++++ b/drivers/infiniband/sw/siw/siw_cm.c +@@ -725,11 +725,11 @@ static int siw_proc_mpareply(struct siw_cep *cep) + enum mpa_v2_ctrl mpa_p2p_mode = MPA_V2_RDMA_NO_RTR; + + rv = siw_recv_mpa_rr(cep); +- if (rv != -EAGAIN) +- siw_cancel_mpatimer(cep); + if (rv) + goto out_err; + ++ siw_cancel_mpatimer(cep); ++ + rep = &cep->mpa.hdr; + + if (__mpa_rr_revision(rep->params.bits) > MPA_REVISION_2) { +@@ -895,7 +895,8 @@ static int siw_proc_mpareply(struct siw_cep *cep) + } + + out_err: +- siw_cm_upcall(cep, IW_CM_EVENT_CONNECT_REPLY, -EINVAL); ++ if (rv != -EAGAIN) ++ siw_cm_upcall(cep, IW_CM_EVENT_CONNECT_REPLY, -EINVAL); + + return rv; + } +-- +2.35.1 + diff --git a/queue-5.4/regulator-of-fix-refcount-leak-bug-in-of_get_regulat.patch b/queue-5.4/regulator-of-fix-refcount-leak-bug-in-of_get_regulat.patch new file mode 100644 index 00000000000..77c5dfab433 --- /dev/null +++ b/queue-5.4/regulator-of-fix-refcount-leak-bug-in-of_get_regulat.patch @@ -0,0 +1,43 @@ +From 6d11dde189b47c2b2d30b4d6bfa8ce82fdb89497 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 19:10:27 +0800 +Subject: regulator: of: Fix refcount leak bug in + of_get_regulation_constraints() + +From: Liang He + +[ Upstream commit 66efb665cd5ad69b27dca8571bf89fc6b9c628a4 ] + +We should call the of_node_put() for the reference returned by +of_get_child_by_name() which has increased the refcount. + +Fixes: 40e20d68bb3f ("regulator: of: Add support for parsing regulator_state for suspend state") +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220715111027.391032-1-windhl@126.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/of_regulator.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c +index 87637eb6bcbc..7a0a235e4465 100644 +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -206,8 +206,12 @@ static int of_get_regulation_constraints(struct device *dev, + } + + suspend_np = of_get_child_by_name(np, regulator_states[i]); +- if (!suspend_np || !suspend_state) ++ if (!suspend_np) + continue; ++ if (!suspend_state) { ++ of_node_put(suspend_np); ++ continue; ++ } + + if (!of_property_read_u32(suspend_np, "regulator-mode", + &pval)) { +-- +2.35.1 + diff --git a/queue-5.4/remoteproc-qcom-wcnss-fix-handling-of-irqs.patch b/queue-5.4/remoteproc-qcom-wcnss-fix-handling-of-irqs.patch new file mode 100644 index 00000000000..dc9d6d1c08b --- /dev/null +++ b/queue-5.4/remoteproc-qcom-wcnss-fix-handling-of-irqs.patch @@ -0,0 +1,60 @@ +From 40442f7b1c131a899bdd796e286d23e6adc947ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 19:47:39 +0530 +Subject: remoteproc: qcom: wcnss: Fix handling of IRQs + +From: Sireesh Kodali + +[ Upstream commit bed0adac1ded4cb486ba19a3a7e730fbd9a1c9c6 ] + +The wcnss_get_irq function is expected to return a value > 0 in the +event that an IRQ is succssfully obtained, but it instead returns 0. +This causes the stop and ready IRQs to never actually be used despite +being defined in the device-tree. This patch fixes that. + +Fixes: aed361adca9f ("remoteproc: qcom: Introduce WCNSS peripheral image loader") +Signed-off-by: Sireesh Kodali +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220526141740.15834-2-sireeshkodali1@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_wcnss.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c +index c72f1b3b6085..18431ac09822 100644 +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -407,6 +407,7 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, + irq_handler_t thread_fn) + { + int ret; ++ int irq_number; + + ret = platform_get_irq_byname(pdev, name); + if (ret < 0 && optional) { +@@ -417,14 +418,19 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, + return ret; + } + ++ irq_number = ret; ++ + ret = devm_request_threaded_irq(&pdev->dev, ret, + NULL, thread_fn, + IRQF_TRIGGER_RISING | IRQF_ONESHOT, + "wcnss", wcnss); +- if (ret) ++ if (ret) { + dev_err(&pdev->dev, "request %s IRQ failed\n", name); ++ return ret; ++ } + +- return ret; ++ /* Return the IRQ number if the IRQ was successfully acquired */ ++ return irq_number; + } + + static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss) +-- +2.35.1 + diff --git a/queue-5.4/rpmsg-qcom_smd-fix-refcount-leak-in-qcom_smd_parse_e.patch b/queue-5.4/rpmsg-qcom_smd-fix-refcount-leak-in-qcom_smd_parse_e.patch new file mode 100644 index 00000000000..b2d4970c090 --- /dev/null +++ b/queue-5.4/rpmsg-qcom_smd-fix-refcount-leak-in-qcom_smd_parse_e.patch @@ -0,0 +1,36 @@ +From 7f8fd9b9651ed558836d2e24c5f5638e757fdca8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:07:37 +0400 +Subject: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge + +From: Miaoqian Lin + +[ Upstream commit 65382585f067d4256ba087934f30f85c9b6984de ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. + +Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") +Signed-off-by: Miaoqian Lin +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220511120737.57374-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_smd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index a4db9f6100d2..0b1e853d8c91 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1364,6 +1364,7 @@ static int qcom_smd_parse_edge(struct device *dev, + } + + edge->ipc_regmap = syscon_node_to_regmap(syscon_np); ++ of_node_put(syscon_np); + if (IS_ERR(edge->ipc_regmap)) { + ret = PTR_ERR(edge->ipc_regmap); + goto put_node; +-- +2.35.1 + diff --git a/queue-5.4/s390-zcore-fix-race-when-reading-from-hardware-syste.patch b/queue-5.4/s390-zcore-fix-race-when-reading-from-hardware-syste.patch new file mode 100644 index 00000000000..7163bddaa5d --- /dev/null +++ b/queue-5.4/s390-zcore-fix-race-when-reading-from-hardware-syste.patch @@ -0,0 +1,84 @@ +From 1b785cc75d0cb20f0f202cc6555536b275575574 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 07:16:33 +0200 +Subject: s390/zcore: fix race when reading from hardware system area + +From: Alexander Gordeev + +[ Upstream commit 9ffed254d938c9e99eb7761c7f739294c84e0367 ] + +Memory buffer used for reading out data from hardware system +area is not protected against concurrent access. + +Reported-by: Matthew Wilcox +Fixes: 411ed3225733 ("[S390] zfcpdump support.") +Acked-by: Heiko Carstens +Tested-by: Alexander Egorenkov +Link: https://lore.kernel.org/r/e68137f0f9a0d2558f37becc20af18e2939934f6.1658206891.git.agordeev@linux.ibm.com +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/char/zcore.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c +index 08f812475f5e..c9d172510509 100644 +--- a/drivers/s390/char/zcore.c ++++ b/drivers/s390/char/zcore.c +@@ -53,6 +53,7 @@ static struct dentry *zcore_reipl_file; + static struct dentry *zcore_hsa_file; + static struct ipl_parameter_block *zcore_ipl_block; + ++static DEFINE_MUTEX(hsa_buf_mutex); + static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE); + + /* +@@ -69,19 +70,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count) + if (!hsa_available) + return -ENODATA; + ++ mutex_lock(&hsa_buf_mutex); + while (count) { + if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { + TRACE("sclp_sdias_copy() failed\n"); ++ mutex_unlock(&hsa_buf_mutex); + return -EIO; + } + offset = src % PAGE_SIZE; + bytes = min(PAGE_SIZE - offset, count); +- if (copy_to_user(dest, hsa_buf + offset, bytes)) ++ if (copy_to_user(dest, hsa_buf + offset, bytes)) { ++ mutex_unlock(&hsa_buf_mutex); + return -EFAULT; ++ } + src += bytes; + dest += bytes; + count -= bytes; + } ++ mutex_unlock(&hsa_buf_mutex); + return 0; + } + +@@ -99,9 +105,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) + if (!hsa_available) + return -ENODATA; + ++ mutex_lock(&hsa_buf_mutex); + while (count) { + if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { + TRACE("sclp_sdias_copy() failed\n"); ++ mutex_unlock(&hsa_buf_mutex); + return -EIO; + } + offset = src % PAGE_SIZE; +@@ -111,6 +119,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) + dest += bytes; + count -= bytes; + } ++ mutex_unlock(&hsa_buf_mutex); + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.4/scripts-faddr2line-fix-vmlinux-detection-on-arm64.patch b/queue-5.4/scripts-faddr2line-fix-vmlinux-detection-on-arm64.patch new file mode 100644 index 00000000000..2ef5941de96 --- /dev/null +++ b/queue-5.4/scripts-faddr2line-fix-vmlinux-detection-on-arm64.patch @@ -0,0 +1,47 @@ +From beac5f79f2da92a3c26b0c8ee1ea1e6091a27407 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 11:01:23 -0700 +Subject: scripts/faddr2line: Fix vmlinux detection on arm64 + +From: Josh Poimboeuf + +[ Upstream commit b6a5068854cfe372da7dee3224dcf023ed5b00cb ] + +Since commit dcea997beed6 ("faddr2line: Fix overlapping text section +failures, the sequel"), faddr2line is completely broken on arm64. + +For some reason, on arm64, the vmlinux ELF object file type is ET_DYN +rather than ET_EXEC. Check for both when determining whether the object +is vmlinux. + +Modules and vmlinux.o have type ET_REL on all arches. + +Fixes: dcea997beed6 ("faddr2line: Fix overlapping text section failures, the sequel") +Reported-by: John Garry +Signed-off-by: Josh Poimboeuf +Signed-off-by: Ingo Molnar +Tested-by: John Garry +Link: https://lore.kernel.org/r/dad1999737471b06d6188ce4cdb11329aa41682c.1658426357.git.jpoimboe@kernel.org +Signed-off-by: Sasha Levin +--- + scripts/faddr2line | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/scripts/faddr2line b/scripts/faddr2line +index 94ed98dd899f..57099687e5e1 100755 +--- a/scripts/faddr2line ++++ b/scripts/faddr2line +@@ -112,7 +112,9 @@ __faddr2line() { + # section offsets. + local file_type=$(${READELF} --file-header $objfile | + ${AWK} '$1 == "Type:" { print $2; exit }') +- [[ $file_type = "EXEC" ]] && is_vmlinux=1 ++ if [[ $file_type = "EXEC" ]] || [[ $file_type == "DYN" ]]; then ++ is_vmlinux=1 ++ fi + + # Go through each of the object's symbols which match the func name. + # In rare cases there might be duplicates, in which case we print all +-- +2.35.1 + diff --git a/queue-5.4/scsi-smartpqi-fix-dma-direction-for-raid-requests.patch b/queue-5.4/scsi-smartpqi-fix-dma-direction-for-raid-requests.patch new file mode 100644 index 00000000000..0649cc1bcc7 --- /dev/null +++ b/queue-5.4/scsi-smartpqi-fix-dma-direction-for-raid-requests.patch @@ -0,0 +1,68 @@ +From 29f3ec346f8556c4a3f203894fac9414831f38bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 13:47:36 -0500 +Subject: scsi: smartpqi: Fix DMA direction for RAID requests + +From: Mahesh Rajashekhara + +[ Upstream commit 69695aeaa6621bc49cdd7a8e5a8d1042461e496e ] + +Correct a SOP READ and WRITE DMA flags for some requests. + +This update corrects DMA direction issues with SCSI commands removed from +the controller's internal lookup table. + +Currently, SCSI READ BLOCK LIMITS (0x5) was removed from the controller +lookup table and exposed a DMA direction flag issue. + +SCSI READ BLOCK LIMITS was recently removed from our controller lookup +table so the controller uses the respective IU flag field to set the DMA +data direction. Since the DMA direction is incorrect the FW never completes +the request causing a hang. + +Some SCSI commands which use SCSI READ BLOCK LIMITS + + * sg_map + * mt -f /dev/stX status + +After updating controller firmware, users may notice their tape units +failing. This patch resolves the issue. + +Also, the AIO path DMA direction is correct. + +The DMA direction flag is a day-one bug with no reported BZ. + +Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver") +Link: https://lore.kernel.org/r/165730605618.177165.9054223644512926624.stgit@brunhilda +Reviewed-by: Scott Benesh +Reviewed-by: Scott Teel +Reviewed-by: Mike McGowen +Reviewed-by: Kevin Barnett +Signed-off-by: Mahesh Rajashekhara +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 80ff00025c03..540d6eb2cc48 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -5018,10 +5018,10 @@ static int pqi_raid_submit_scsi_cmd_with_io_request( + } + + switch (scmd->sc_data_direction) { +- case DMA_TO_DEVICE: ++ case DMA_FROM_DEVICE: + request->data_direction = SOP_READ_FLAG; + break; +- case DMA_FROM_DEVICE: ++ case DMA_TO_DEVICE: + request->data_direction = SOP_WRITE_FLAG; + break; + case DMA_NONE: +-- +2.35.1 + diff --git a/queue-5.4/selftests-bpf-fix-a-test-for-snprintf-overflow.patch b/queue-5.4/selftests-bpf-fix-a-test-for-snprintf-overflow.patch new file mode 100644 index 00000000000..efc085e3457 --- /dev/null +++ b/queue-5.4/selftests-bpf-fix-a-test-for-snprintf-overflow.patch @@ -0,0 +1,39 @@ +From b09faf8cc2e9007d5ad5906346e0e4e35bdc359c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 12:50:32 +0300 +Subject: selftests/bpf: fix a test for snprintf() overflow + +From: Dan Carpenter + +[ Upstream commit c5d22f4cfe8dfb93f1db0a1e7e2e7ebc41395d98 ] + +The snprintf() function returns the number of bytes which *would* +have been copied if there were space. In other words, it can be +> sizeof(pin_path). + +Fixes: c0fa1b6c3efc ("bpf: btf: Add BTF tests") +Signed-off-by: Dan Carpenter +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/r/YtZ+aD/tZMkgOUw+@kili +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_btf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c +index 3d617e806054..996eca57bc97 100644 +--- a/tools/testing/selftests/bpf/test_btf.c ++++ b/tools/testing/selftests/bpf/test_btf.c +@@ -4808,7 +4808,7 @@ static int do_test_pprint(int test_num) + ret = snprintf(pin_path, sizeof(pin_path), "%s/%s", + "/sys/fs/bpf", test->map_name); + +- if (CHECK(ret == sizeof(pin_path), "pin_path %s/%s is too long", ++ if (CHECK(ret >= sizeof(pin_path), "pin_path %s/%s is too long", + "/sys/fs/bpf", test->map_name)) { + err = -1; + goto done; +-- +2.35.1 + diff --git a/queue-5.4/selftests-timers-clocksource-switch-fix-passing-erro.patch b/queue-5.4/selftests-timers-clocksource-switch-fix-passing-erro.patch new file mode 100644 index 00000000000..2f31e43c525 --- /dev/null +++ b/queue-5.4/selftests-timers-clocksource-switch-fix-passing-erro.patch @@ -0,0 +1,43 @@ +From be2538c56ef78d3d542259e5abd7dc585f830e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 22:46:17 +0200 +Subject: selftests: timers: clocksource-switch: fix passing errors from child + +From: Wolfram Sang + +[ Upstream commit 4d8f52ac5fa9eede7b7aa2f2d67c841d9eeb655f ] + +The return value from system() is a waitpid-style integer. Do not return +it directly because with the implicit masking in exit() it will always +return 0. Access it with appropriate macros to really pass on errors. + +Fixes: 7290ce1423c3 ("selftests/timers: Add clocksource-switch test from timetest suite") +Signed-off-by: Wolfram Sang +Acked-by: John Stultz +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/timers/clocksource-switch.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/testing/selftests/timers/clocksource-switch.c +index bfc974b4572d..c18313a5f357 100644 +--- a/tools/testing/selftests/timers/clocksource-switch.c ++++ b/tools/testing/selftests/timers/clocksource-switch.c +@@ -110,10 +110,10 @@ int run_tests(int secs) + + sprintf(buf, "./inconsistency-check -t %i", secs); + ret = system(buf); +- if (ret) +- return ret; ++ if (WIFEXITED(ret) && WEXITSTATUS(ret)) ++ return WEXITSTATUS(ret); + ret = system("./nanosleep"); +- return ret; ++ return WIFEXITED(ret) ? WEXITSTATUS(ret) : 0; + } + + +-- +2.35.1 + diff --git a/queue-5.4/selftests-timers-valid-adjtimex-build-fix-for-newer-.patch b/queue-5.4/selftests-timers-valid-adjtimex-build-fix-for-newer-.patch new file mode 100644 index 00000000000..243eacc5fa1 --- /dev/null +++ b/queue-5.4/selftests-timers-valid-adjtimex-build-fix-for-newer-.patch @@ -0,0 +1,42 @@ +From a9822257dcc35f6a67b23ec6cc4f5b593c5e5efb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 22:46:13 +0200 +Subject: selftests: timers: valid-adjtimex: build fix for newer toolchains +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wolfram Sang + +[ Upstream commit 9a162977d20436be5678a8e21a8e58eb4616d86a ] + +Toolchains with an include file 'sys/timex.h' based on 3.18 will have a +'clock_adjtime' definition added, so it can't be static in the code: + +valid-adjtimex.c:43:12: error: static declaration of ‘clock_adjtime’ follows non-static declaration + +Fixes: e03a58c320e1 ("kselftests: timers: Add adjtimex SETOFFSET validity tests") +Signed-off-by: Wolfram Sang +Acked-by: John Stultz +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/timers/valid-adjtimex.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testing/selftests/timers/valid-adjtimex.c +index 5397de708d3c..48b9a803235a 100644 +--- a/tools/testing/selftests/timers/valid-adjtimex.c ++++ b/tools/testing/selftests/timers/valid-adjtimex.c +@@ -40,7 +40,7 @@ + #define ADJ_SETOFFSET 0x0100 + + #include +-static int clock_adjtime(clockid_t id, struct timex *tx) ++int clock_adjtime(clockid_t id, struct timex *tx) + { + return syscall(__NR_clock_adjtime, id, tx); + } +-- +2.35.1 + diff --git a/queue-5.4/selinux-add-boundary-check-in-put_entry.patch b/queue-5.4/selinux-add-boundary-check-in-put_entry.patch new file mode 100644 index 00000000000..26e445cb9cf --- /dev/null +++ b/queue-5.4/selinux-add-boundary-check-in-put_entry.patch @@ -0,0 +1,35 @@ +From 3d3580cc3ad3091c82ca074b718359ccdf1d3eb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 10:14:49 +0800 +Subject: selinux: Add boundary check in put_entry() + +From: Xiu Jianfeng + +[ Upstream commit 15ec76fb29be31df2bccb30fc09875274cba2776 ] + +Just like next_entry(), boundary check is necessary to prevent memory +out-of-bound access. + +Signed-off-by: Xiu Jianfeng +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/ss/policydb.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h +index 162d0e79b85b..b18bc405f820 100644 +--- a/security/selinux/ss/policydb.h ++++ b/security/selinux/ss/policydb.h +@@ -356,6 +356,8 @@ static inline int put_entry(const void *buf, size_t bytes, int num, struct polic + { + size_t len = bytes * num; + ++ if (len > fp->len) ++ return -EINVAL; + memcpy(fp->data, buf, len); + fp->data += len; + fp->len -= len; +-- +2.35.1 + diff --git a/queue-5.4/serial-8250_dw-store-lsr-into-lsr_saved_flags-in-dw8.patch b/queue-5.4/serial-8250_dw-store-lsr-into-lsr_saved_flags-in-dw8.patch new file mode 100644 index 00000000000..de6b4a19829 --- /dev/null +++ b/queue-5.4/serial-8250_dw-store-lsr-into-lsr_saved_flags-in-dw8.patch @@ -0,0 +1,54 @@ +From 1d4188cce8ba42e2c777dcdfff62acaaf60bf28f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 12:54:31 +0300 +Subject: serial: 8250_dw: Store LSR into lsr_saved_flags in + dw8250_tx_wait_empty() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit af14f3007e2dca0d112f10f6717ba43093f74e81 ] + +Make sure LSR flags are preserved in dw8250_tx_wait_empty(). This +function is called from a low-level out function and therefore cannot +call serial_lsr_in() as it would lead to infinite recursion. + +It is borderline if the flags need to be saved here at all since this +code relates to writing LCR register which usually implies no important +characters should be arriving. + +Fixes: 914eaf935ec7 ("serial: 8250_dw: Allow TX FIFO to drain before writing to UART_LCR") +Reviewed-by: Andy Shevchenko +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20220608095431.18376-7-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_dw.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 381c5117aec1..2d5a039229ac 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -110,12 +110,15 @@ static void dw8250_check_lcr(struct uart_port *p, int value) + /* Returns once the transmitter is empty or we run out of retries */ + static void dw8250_tx_wait_empty(struct uart_port *p) + { ++ struct uart_8250_port *up = up_to_u8250p(p); + unsigned int tries = 20000; + unsigned int delay_threshold = tries - 1000; + unsigned int lsr; + + while (tries--) { + lsr = readb (p->membase + (UART_LSR << p->regshift)); ++ up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS; ++ + if (lsr & UART_LSR_TEMT) + break; + +-- +2.35.1 + diff --git a/queue-5.4/series b/queue-5.4/series index eb8fa41c962..0a0fa7b9cab 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -51,3 +51,203 @@ netfilter-nf_tables-do-not-allow-set_id-to-refer-to-another-table.patch netfilter-nf_tables-do-not-allow-rule_id-to-refer-to-another-chain.patch netfilter-nf_tables-fix-null-deref-due-to-zeroed-list-head.patch epoll-autoremove-wakers-even-more-aggressively.patch +x86-handle-idle-nomwait-cmdline-properly-for-x86_idl.patch +arm64-do-not-forget-syscall-when-starting-a-new-thre.patch +arm64-fix-oops-in-concurrently-setting-insn_emulatio.patch +ext2-add-more-validity-checks-for-inode-counts.patch +genirq-don-t-return-error-on-missing-optional-irq_re.patch +genirq-generic_irq_ipi-depends-on-smp.patch +wait-fix-__wait_event_hrtimeout-for-rt-dl-tasks.patch +arm-dts-imx6ul-add-missing-properties-for-sram.patch +arm-dts-imx6ul-change-operating-points-to-uint32-mat.patch +arm-dts-imx6ul-fix-csi-node-compatible.patch +arm-dts-imx6ul-fix-lcdif-node-compatible.patch +arm-dts-imx6ul-fix-qspi-node-compatible.patch +spi-synquacer-add-missing-clk_disable_unprepare.patch +arm-omap2-display-fix-refcount-leak-bug.patch +acpi-ec-remove-duplicate-thinkpad-x1-carbon-6th-entr.patch +acpi-pm-save-nvs-memory-for-lenovo-g40-45.patch +acpi-lpss-fix-missing-check-in-register_device_clock.patch +arm64-dts-qcom-ipq8074-fix-nand-node-name.patch +arm64-dts-allwinner-a64-orangepi-win-fix-led-node-na.patch +arm-shmobile-rcar-gen2-increase-refcount-for-new-ref.patch +hwmon-sht15-fix-wrong-assumptions-in-device-remove-c.patch +pm-hibernate-defer-device-probing-when-resuming-from.patch +selinux-add-boundary-check-in-put_entry.patch +spi-spi-rspi-fix-pio-fallback-on-rz-platforms.patch +netfilter-nf_tables-add-rescheduling-points-during-l.patch +arm-findbit-fix-overflowing-offset.patch +meson-mx-socinfo-fix-refcount-leak-in-meson_mx_socin.patch +arm-bcm-fix-refcount-leak-in-bcm_kona_smc_init.patch +x86-pmem-fix-platform-device-leak-in-error-path.patch +arm-dts-ast2500-evb-fix-board-compatible.patch +arm-dts-ast2600-evb-fix-board-compatible.patch +soc-fsl-guts-machine-variable-might-be-unset.patch +arm-dts-qcom-mdm9615-add-missing-pmic-gpio-reg.patch +arm-omap2-fix-refcount-leak-in-omapdss_init_of.patch +arm-omap2-fix-refcount-leak-in-omap3xxx_prm_late_ini.patch +cpufreq-zynq-fix-refcount-leak-in-zynq_get_revision.patch +soc-qcom-aoss-fix-refcount-leak-in-qmp_cooling_devic.patch +arm-dts-qcom-pm8841-add-required-thermal-sensor-cell.patch +bus-hisi_lpc-fix-missing-platform_device_put-in-hisi.patch +arm64-dts-mt7622-fix-bpi-r64-wps-button.patch +erofs-avoid-consecutive-detection-for-highmem-memory.patch +blk-mq-don-t-create-hctx-debugfs-dir-until-q-debugfs.patch +regulator-of-fix-refcount-leak-bug-in-of_get_regulat.patch +nohz-full-sched-rt-fix-missed-tick-reenabling-bug-in.patch +thermal-tools-tmon-include-pthread-and-time-headers-.patch +dm-return-early-from-dm_pr_call-if-dm-device-is-susp.patch +ath10k-do-not-enforce-interrupt-trigger-type.patch +wifi-rtlwifi-fix-error-codes-in-rtl_debugfs_set_writ.patch +drm-mipi-dbi-align-max_chunk-to-2-in-spi_transfer.patch +drm-radeon-fix-potential-buffer-overflow-in-ni_set_m.patch +drm-mediatek-add-pull-down-mipi-operation-in-mtk_dsi.patch +drm-adv7511-override-i2c-address-of-cec-before-acces.patch +i2c-fix-a-potential-use-after-free.patch +media-tw686x-register-the-irq-at-the-end-of-probe.patch +ath9k-fix-use-after-free-in-ath9k_hif_usb_rx_cb.patch +wifi-iwlegacy-4965-fix-potential-off-by-one-overflow.patch +drm-bridge-adv7511-add-check-for-mipi_dsi_driver_reg.patch +drm-mcde-fix-refcount-leak-in-mcde_dsi_bind.patch +media-hdpvr-fix-error-value-returns-in-hdpvr_read.patch +drm-vc4-plane-remove-subpixel-positioning-check.patch +drm-vc4-plane-fix-margin-calculations-for-the-right-.patch +drm-vc4-dsi-correct-dsi-divider-calculations.patch +crypto-arm64-gcm-select-aead-for-ghash_arm64_ce.patch +drm-rockchip-vop-don-t-crash-for-invalid-duplicate_s.patch +drm-rockchip-fix-an-error-handling-path-rockchip_dp_.patch +drm-mediatek-dpi-remove-output-format-of-yuv.patch +drm-mediatek-dpi-only-enable-dpi-after-the-bridge-is.patch +drm-msm-hdmi-enable-core-vcc-core-vdda-supply-for-89.patch +drm-bridge-sii8620-fix-possible-off-by-one.patch +drm-msm-mdp5-fix-global-state-lock-backoff.patch +crypto-hisilicon-kunpeng916-crypto-driver-don-t-slee.patch +media-platform-mtk-mdp-fix-mdp_ipi_comm-structure-al.patch +mediatek-mt76-mac80211-fix-missing-of_node_put-in-mt.patch +drm-exynos-exynos7_drm_decon-free-resources-when-clk.patch +tcp-make-retransmitted-skb-fit-into-the-send-window.patch +libbpf-fix-the-name-of-a-reused-map.patch +selftests-timers-valid-adjtimex-build-fix-for-newer-.patch +selftests-timers-clocksource-switch-fix-passing-erro.patch +fs-check-fmode_lseek-to-control-internal-pipe-splici.patch +wifi-wil6210-debugfs-fix-info-leak-in-wil_write_file.patch +wifi-p54-fix-an-error-handling-path-in-p54spi_probe.patch +wifi-p54-add-missing-parentheses-in-p54_flush.patch +selftests-bpf-fix-a-test-for-snprintf-overflow.patch +can-pch_can-do-not-report-txerr-and-rxerr-during-bus.patch +can-rcar_can-do-not-report-txerr-and-rxerr-during-bu.patch +can-sja1000-do-not-report-txerr-and-rxerr-during-bus.patch +can-hi311x-do-not-report-txerr-and-rxerr-during-bus-.patch +can-sun4i_can-do-not-report-txerr-and-rxerr-during-b.patch +can-kvaser_usb_hydra-do-not-report-txerr-and-rxerr-d.patch +can-kvaser_usb_leaf-do-not-report-txerr-and-rxerr-du.patch +can-usb_8dev-do-not-report-txerr-and-rxerr-during-bu.patch +can-error-specify-the-values-of-data-5.7-of-can-erro.patch +can-pch_can-pch_can_error-initialize-errc-before-usi.patch +bluetooth-hci_intel-add-check-for-platform_driver_re.patch +i2c-cadence-support-pec-for-smbus-block-read.patch +i2c-mux-gpmux-add-of_node_put-when-breaking-out-of-l.patch +wifi-wil6210-debugfs-fix-uninitialized-variable-use-.patch +wifi-iwlwifi-mvm-fix-double-list_add-at-iwl_mvm_mac_.patch +wifi-libertas-fix-possible-refcount-leak-in-if_usb_p.patch +net-mlx5e-fix-the-value-of-mlx5e_max_rq_num_mtts.patch +crypto-inside-secure-add-missing-module_device_table.patch +iavf-fix-max_rate-limiting.patch +netdevsim-avoid-allocation-warnings-triggered-from-u.patch +net-rose-fix-netdev-reference-changes.patch +dccp-put-dccp_qpolicy_full-and-dccp_qpolicy_push-in-.patch +clk-renesas-r9a06g032-fix-uart-clkgrp-bitsel.patch +mtd-maps-fix-refcount-leak-in-of_flash_probe_versati.patch +mtd-maps-fix-refcount-leak-in-ap_flash_init.patch +mtd-rawnand-meson-fix-a-potential-double-free-issue.patch +hid-cp2112-prevent-a-buffer-overflow-in-cp2112_xfer.patch +mtd-sm_ftl-fix-deadlock-caused-by-cancel_work_sync-i.patch +mtd-partitions-fix-refcount-leak-in-parse_redboot_of.patch +mtd-st_spi_fsm-add-a-clk_disable_unprepare-in-.probe.patch +fpga-altera-pr-ip-fix-unsigned-comparison-with-less-.patch +usb-host-fix-refcount-leak-in-ehci_hcd_ppc_of_probe.patch +usb-ohci-nxp-fix-refcount-leak-in-ohci_hcd_nxp_probe.patch +usb-xhci-tegra-fix-error-check.patch +clk-mediatek-reset-fix-written-reset-bit-offset.patch +misc-rtsx-fix-an-error-handling-path-in-rtsx_pci_pro.patch +driver-core-fix-potential-deadlock-in-__driver_attac.patch +clk-qcom-clk-krait-unlock-spin-after-mux-completion.patch +usb-host-xhci-use-snprintf-in-xhci_decode_trb.patch +clk-qcom-ipq8074-fix-nss-port-frequency-tables.patch +clk-qcom-ipq8074-set-branch_halt_delay-flag-for-ubi-.patch +clk-qcom-camcc-sdm845-fix-topology-around-titan_top-.patch +soundwire-bus_type-fix-remove-and-shutdown-support.patch +intel_th-fix-a-resource-leak-in-an-error-handling-pa.patch +intel_th-msu-sink-potential-dereference-of-null-poin.patch +intel_th-msu-fix-vmalloced-buffers.patch +staging-rtl8192u-fix-sleep-in-atomic-context-bug-in-.patch +mmc-sdhci-of-esdhc-fix-refcount-leak-in-esdhc_signal.patch +memstick-ms_block-fix-some-incorrect-memory-allocati.patch +memstick-ms_block-fix-a-memory-leak.patch +mmc-sdhci-of-at91-fix-set_uhs_signaling-rewriting-of.patch +pci-portdrv-don-t-disable-aer-reporting-in-get_port_.patch +scsi-smartpqi-fix-dma-direction-for-raid-requests.patch +usb-gadget-udc-amd5536-depends-on-has_dma.patch +rdma-hns-fix-incorrect-clearing-of-interrupt-status-.patch +rdma-siw-fix-duplicated-reported-iw_cm_event_connect.patch +rdma-hfi1-fix-potential-memory-leak-in-setup_base_ct.patch +gpio-gpiolib-of-fix-refcount-bugs-in-of_mm_gpiochip_.patch +mmc-cavium-octeon-add-of_node_put-when-breaking-out-.patch +mmc-cavium-thunderx-add-of_node_put-when-breaking-ou.patch +hid-alps-declare-u1_unicorn_legacy-support.patch +pci-tegra194-fix-root-port-interrupt-handling.patch +pci-tegra194-fix-link-up-retry-sequence.patch +usb-serial-fix-tty-port-initialized-comments.patch +platform-olpc-fix-uninitialized-data-in-debugfs-writ.patch +mm-mmap.c-fix-missing-call-to-vm_unacct_memory-in-mm.patch +rdma-rxe-fix-error-unwind-in-rxe_create_qp.patch +null_blk-fix-ida-error-handling-in-null_add_dev.patch +jbd2-fix-outstanding-credits-assert-in-jbd2_journal_.patch +ext4-recover-csum-seed-of-tmp_inode-after-migrating-.patch +jbd2-fix-assertion-jh-b_frozen_data-null-failure-whe.patch +opp-fix-error-check-in-dev_pm_opp_attach_genpd.patch +asoc-mediatek-mt8173-fix-refcount-leak-in-mt8173_rt5.patch +asoc-mt6797-mt6351-fix-refcount-leak-in-mt6797_mt635.patch +asoc-codecs-da7210-add-check-for-i2c_add_driver.patch +asoc-mediatek-mt8173-rt5650-fix-refcount-leak-in-mt8.patch +serial-8250_dw-store-lsr-into-lsr_saved_flags-in-dw8.patch +asoc-codecs-msm8916-wcd-digital-move-gains-from-sx_t.patch +asoc-codecs-wcd9335-move-gains-from-sx_tlv-to-s8_tlv.patch +profiling-fix-shift-too-large-makes-kernel-panic.patch +tty-n_gsm-fix-non-flow-control-frames-during-mux-flo.patch +tty-n_gsm-fix-packet-re-transmission-without-open-co.patch +tty-n_gsm-fix-race-condition-in-gsmld_write.patch +remoteproc-qcom-wcnss-fix-handling-of-irqs.patch +vfio-ccw-do-not-change-fsm-state-in-subchannel-event.patch +tty-n_gsm-fix-wrong-t1-retry-count-handling.patch +tty-n_gsm-fix-dm-command.patch +tty-n_gsm-fix-missing-corner-cases-in-gsmld_poll.patch +iommu-exynos-handle-failed-iommu-device-registration.patch +rpmsg-qcom_smd-fix-refcount-leak-in-qcom_smd_parse_e.patch +kfifo-fix-kfifo_to_user-return-type.patch +mfd-t7l66xb-drop-platform-disable-callback.patch +mfd-max77620-fix-refcount-leak-in-max77620_initialis.patch +iommu-arm-smmu-qcom_iommu-add-of_node_put-when-break.patch +s390-zcore-fix-race-when-reading-from-hardware-syste.patch +asoc-qcom-q6dsp-fix-an-off-by-one-in-q6adm_alloc_cop.patch +fuse-remove-the-control-interface-for-virtio-fs.patch +asoc-audio-graph-card-add-of_node_put-in-fail-path.patch +watchdog-armada_37xx_wdt-check-the-return-value-of-d.patch +video-fbdev-amba-clcd-fix-refcount-leak-bugs.patch +video-fbdev-sis-fix-typos-in-sis_getmodeid.patch +powerpc-32-do-not-allow-selection-of-e5500-or-e6500-.patch +powerpc-pci-prefer-pci-domain-assignment-via-dt-linu.patch +powerpc-spufs-fix-refcount-leak-in-spufs_init_isolat.patch +powerpc-xive-fix-refcount-leak-in-xive_get_max_prio.patch +powerpc-cell-axon_msi-fix-refcount-leak-in-setup_msi.patch +perf-symbol-fail-to-read-phdr-workaround.patch +kprobes-forbid-probing-on-trampoline-and-bpf-code-ar.patch +powerpc-pci-fix-phb-numbering-when-using-opal-phbid.patch +genelf-use-have_libcrypto_support-not-the-never-defi.patch +scripts-faddr2line-fix-vmlinux-detection-on-arm64.patch +x86-numa-use-cpumask_available-instead-of-hardcoded-.patch +video-fbdev-arkfb-fix-a-divide-by-zero-bug-in-ark_se.patch +tools-thermal-fix-possible-path-truncations.patch +video-fbdev-vt8623fb-check-the-size-of-screen-before.patch +video-fbdev-arkfb-check-the-size-of-screen-before-me.patch +video-fbdev-s3fb-check-the-size-of-screen-before-mem.patch diff --git a/queue-5.4/soc-fsl-guts-machine-variable-might-be-unset.patch b/queue-5.4/soc-fsl-guts-machine-variable-might-be-unset.patch new file mode 100644 index 00000000000..33a1e2d48ff --- /dev/null +++ b/queue-5.4/soc-fsl-guts-machine-variable-might-be-unset.patch @@ -0,0 +1,37 @@ +From b3683c76147a99a94be1010d58ac4e089962f7bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 11:56:03 +0200 +Subject: soc: fsl: guts: machine variable might be unset + +From: Michael Walle + +[ Upstream commit ab3f045774f704c4e7b6a878102f4e9d4ae7bc74 ] + +If both the model and the compatible properties are missing, then +machine will not be set. Initialize it with NULL. + +Fixes: 34c1c21e94ac ("soc: fsl: fix section mismatch build warnings") +Signed-off-by: Michael Walle +Acked-by: Arnd Bergmann +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/guts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/fsl/guts.c b/drivers/soc/fsl/guts.c +index 34810f9bb2ee..2b7fb7a8805c 100644 +--- a/drivers/soc/fsl/guts.c ++++ b/drivers/soc/fsl/guts.c +@@ -142,7 +142,7 @@ static int fsl_guts_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct resource *res; + const struct fsl_soc_die_attr *soc_die; +- const char *machine; ++ const char *machine = NULL; + u32 svr; + + /* Initialize guts */ +-- +2.35.1 + diff --git a/queue-5.4/soc-qcom-aoss-fix-refcount-leak-in-qmp_cooling_devic.patch b/queue-5.4/soc-qcom-aoss-fix-refcount-leak-in-qmp_cooling_devic.patch new file mode 100644 index 00000000000..be893bef003 --- /dev/null +++ b/queue-5.4/soc-qcom-aoss-fix-refcount-leak-in-qmp_cooling_devic.patch @@ -0,0 +1,43 @@ +From 93b1ff64f0d3d5e350572d43db7d88b93c9eaef2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 10:42:52 +0400 +Subject: soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register + +From: Miaoqian Lin + +[ Upstream commit e6e0951414a314e7db3e9e24fd924b3e15515288 ] + +Every iteration of for_each_available_child_of_node() decrements +the reference count of the previous node. +When breaking early from a for_each_available_child_of_node() loop, +we need to explicitly call of_node_put() on the child node. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 05589b30b21a ("soc: qcom: Extend AOSS QMP driver to support resources that are used to wake up the SoC.") +Signed-off-by: Miaoqian Lin +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220606064252.42595-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/qcom_aoss.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c +index f16d6ec78064..bca98df55bc6 100644 +--- a/drivers/soc/qcom/qcom_aoss.c ++++ b/drivers/soc/qcom/qcom_aoss.c +@@ -489,8 +489,10 @@ static int qmp_cooling_devices_register(struct qmp *qmp) + continue; + ret = qmp_cooling_device_add(qmp, &qmp->cooling_devs[count++], + child); +- if (ret) ++ if (ret) { ++ of_node_put(child); + goto unroll; ++ } + } + + if (!count) +-- +2.35.1 + diff --git a/queue-5.4/soundwire-bus_type-fix-remove-and-shutdown-support.patch b/queue-5.4/soundwire-bus_type-fix-remove-and-shutdown-support.patch new file mode 100644 index 00000000000..19f50252c75 --- /dev/null +++ b/queue-5.4/soundwire-bus_type-fix-remove-and-shutdown-support.patch @@ -0,0 +1,54 @@ +From 6653d91a812808e98ff40d366d53c156a40923db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jun 2022 09:51:05 +0800 +Subject: soundwire: bus_type: fix remove and shutdown support + +From: Pierre-Louis Bossart + +[ Upstream commit df6407782964dc7e35ad84230abb38f46314b245 ] + +The bus sdw_drv_remove() and sdw_drv_shutdown() helpers are used +conditionally, if the driver provides these routines. + +These helpers already test if the driver provides a .remove or +.shutdown callback, so there's no harm in invoking the +sdw_drv_remove() and sdw_drv_shutdown() unconditionally. + +In addition, the current code is imbalanced with +dev_pm_domain_attach() called from sdw_drv_probe(), but +dev_pm_domain_detach() called from sdw_drv_remove() only if the driver +provides a .remove callback. + +Fixes: 9251345dca24b ("soundwire: Add SoundWire bus type") +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Rander Wang +Signed-off-by: Bard Liao +Link: https://lore.kernel.org/r/20220610015105.25987-1-yung-chuan.liao@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/bus_type.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/soundwire/bus_type.c b/drivers/soundwire/bus_type.c +index 4a465f55039f..2fe5a51918c8 100644 +--- a/drivers/soundwire/bus_type.c ++++ b/drivers/soundwire/bus_type.c +@@ -155,12 +155,8 @@ int __sdw_register_driver(struct sdw_driver *drv, struct module *owner) + + drv->driver.owner = owner; + drv->driver.probe = sdw_drv_probe; +- +- if (drv->remove) +- drv->driver.remove = sdw_drv_remove; +- +- if (drv->shutdown) +- drv->driver.shutdown = sdw_drv_shutdown; ++ drv->driver.remove = sdw_drv_remove; ++ drv->driver.shutdown = sdw_drv_shutdown; + + return driver_register(&drv->driver); + } +-- +2.35.1 + diff --git a/queue-5.4/spi-spi-rspi-fix-pio-fallback-on-rz-platforms.patch b/queue-5.4/spi-spi-rspi-fix-pio-fallback-on-rz-platforms.patch new file mode 100644 index 00000000000..22eb608ac34 --- /dev/null +++ b/queue-5.4/spi-spi-rspi-fix-pio-fallback-on-rz-platforms.patch @@ -0,0 +1,47 @@ +From babdc89bbd6c60c116b3440d6d2aee49ad0c335e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 15:34:49 +0100 +Subject: spi: spi-rspi: Fix PIO fallback on RZ platforms + +From: Biju Das + +[ Upstream commit b620aa3a7be346f04ae7789b165937615c6ee8d3 ] + +RSPI IP on RZ/{A, G2L} SoC's has the same signal for both interrupt +and DMA transfer request. Setting DMARS register for DMA transfer +makes the signal to work as a DMA transfer request signal and +subsequent interrupt requests to the interrupt controller +are masked. + +PIO fallback does not work as interrupt signal is disabled. + +This patch fixes this issue by re-enabling the interrupts by +calling dmaengine_synchronize(). + +Signed-off-by: Biju Das +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20220721143449.879257-1-biju.das.jz@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-rspi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c +index 0524741d73b9..8ae2ac40b4b2 100644 +--- a/drivers/spi/spi-rspi.c ++++ b/drivers/spi/spi-rspi.c +@@ -595,6 +595,10 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx, + rspi->dma_callbacked, HZ); + if (ret > 0 && rspi->dma_callbacked) { + ret = 0; ++ if (tx) ++ dmaengine_synchronize(rspi->ctlr->dma_tx); ++ if (rx) ++ dmaengine_synchronize(rspi->ctlr->dma_rx); + } else { + if (!ret) { + dev_err(&rspi->ctlr->dev, "DMA timeout\n"); +-- +2.35.1 + diff --git a/queue-5.4/spi-synquacer-add-missing-clk_disable_unprepare.patch b/queue-5.4/spi-synquacer-add-missing-clk_disable_unprepare.patch new file mode 100644 index 00000000000..456c733851a --- /dev/null +++ b/queue-5.4/spi-synquacer-add-missing-clk_disable_unprepare.patch @@ -0,0 +1,35 @@ +From 7d91a61717e8338ed194425c17348e659bfccfec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 08:56:14 +0800 +Subject: spi: synquacer: Add missing clk_disable_unprepare() + +From: Guo Mengqi + +[ Upstream commit 917e43de2a56d9b82576f1cc94748261f1988458 ] + +Add missing clk_disable_unprepare() in synquacer_spi_resume(). + +Reported-by: Hulk Robot +Signed-off-by: Guo Mengqi +Link: https://lore.kernel.org/r/20220624005614.49434-1-guomengqi3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-synquacer.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c +index 785e7c445123..1e10af6e10a9 100644 +--- a/drivers/spi/spi-synquacer.c ++++ b/drivers/spi/spi-synquacer.c +@@ -784,6 +784,7 @@ static int __maybe_unused synquacer_spi_resume(struct device *dev) + + ret = synquacer_spi_enable(master); + if (ret) { ++ clk_disable_unprepare(sspi->clk); + dev_err(dev, "failed to enable spi (%d)\n", ret); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.4/staging-rtl8192u-fix-sleep-in-atomic-context-bug-in-.patch b/queue-5.4/staging-rtl8192u-fix-sleep-in-atomic-context-bug-in-.patch new file mode 100644 index 00000000000..49fead05837 --- /dev/null +++ b/queue-5.4/staging-rtl8192u-fix-sleep-in-atomic-context-bug-in-.patch @@ -0,0 +1,150 @@ +From 8fb0ff42c7c822d0be19468c397607975a1651cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Jul 2022 18:30:02 +0800 +Subject: staging: rtl8192u: Fix sleep in atomic context bug in + dm_fsync_timer_callback + +From: Duoming Zhou + +[ Upstream commit 6a0c054930d554ad8f8044ef1fc856d9da391c81 ] + +There are sleep in atomic context bugs when dm_fsync_timer_callback is +executing. The root cause is that the memory allocation functions with +GFP_KERNEL or GFP_NOIO parameters are called in dm_fsync_timer_callback +which is a timer handler. The call paths that could trigger bugs are +shown below: + + (interrupt context) +dm_fsync_timer_callback + write_nic_byte + kzalloc(sizeof(data), GFP_KERNEL); //may sleep + usb_control_msg + kmalloc(.., GFP_NOIO); //may sleep + write_nic_dword + kzalloc(sizeof(data), GFP_KERNEL); //may sleep + usb_control_msg + kmalloc(.., GFP_NOIO); //may sleep + +This patch uses delayed work to replace timer and moves the operations +that may sleep into the delayed work in order to mitigate bugs. + +Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging") +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20220710103002.63283-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192u/r8192U.h | 2 +- + drivers/staging/rtl8192u/r8192U_dm.c | 38 +++++++++++++--------------- + drivers/staging/rtl8192u/r8192U_dm.h | 2 +- + 3 files changed, 20 insertions(+), 22 deletions(-) + +diff --git a/drivers/staging/rtl8192u/r8192U.h b/drivers/staging/rtl8192u/r8192U.h +index ec33fb9122e9..57badc1e91e3 100644 +--- a/drivers/staging/rtl8192u/r8192U.h ++++ b/drivers/staging/rtl8192u/r8192U.h +@@ -1013,7 +1013,7 @@ typedef struct r8192_priv { + bool bis_any_nonbepkts; + bool bcurrent_turbo_EDCA; + bool bis_cur_rdlstate; +- struct timer_list fsync_timer; ++ struct delayed_work fsync_work; + bool bfsync_processing; /* 500ms Fsync timer is active or not */ + u32 rate_record; + u32 rateCountDiffRecord; +diff --git a/drivers/staging/rtl8192u/r8192U_dm.c b/drivers/staging/rtl8192u/r8192U_dm.c +index c23e43b095d9..30b272da36f5 100644 +--- a/drivers/staging/rtl8192u/r8192U_dm.c ++++ b/drivers/staging/rtl8192u/r8192U_dm.c +@@ -2585,19 +2585,20 @@ static void dm_init_fsync(struct net_device *dev) + priv->ieee80211->fsync_seconddiff_ratethreshold = 200; + priv->ieee80211->fsync_state = Default_Fsync; + priv->framesyncMonitor = 1; /* current default 0xc38 monitor on */ +- timer_setup(&priv->fsync_timer, dm_fsync_timer_callback, 0); ++ INIT_DELAYED_WORK(&priv->fsync_work, dm_fsync_work_callback); + } + + static void dm_deInit_fsync(struct net_device *dev) + { + struct r8192_priv *priv = ieee80211_priv(dev); + +- del_timer_sync(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); + } + +-void dm_fsync_timer_callback(struct timer_list *t) ++void dm_fsync_work_callback(struct work_struct *work) + { +- struct r8192_priv *priv = from_timer(priv, t, fsync_timer); ++ struct r8192_priv *priv = ++ container_of(work, struct r8192_priv, fsync_work.work); + struct net_device *dev = priv->ieee80211->dev; + u32 rate_index, rate_count = 0, rate_count_diff = 0; + bool bSwitchFromCountDiff = false; +@@ -2664,17 +2665,16 @@ void dm_fsync_timer_callback(struct timer_list *t) + } + } + if (bDoubleTimeInterval) { +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval*priv->ieee80211->fsync_multiple_timeinterval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv ++ ->ieee80211->fsync_time_interval * ++ priv->ieee80211->fsync_multiple_timeinterval)); + } else { +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv ++ ->ieee80211->fsync_time_interval)); + } + } else { + /* Let Register return to default value; */ +@@ -2702,7 +2702,7 @@ static void dm_EndSWFsync(struct net_device *dev) + struct r8192_priv *priv = ieee80211_priv(dev); + + RT_TRACE(COMP_HALDM, "%s\n", __func__); +- del_timer_sync(&(priv->fsync_timer)); ++ cancel_delayed_work_sync(&priv->fsync_work); + + /* Let Register return to default value; */ + if (priv->bswitch_fsync) { +@@ -2744,11 +2744,9 @@ static void dm_StartSWFsync(struct net_device *dev) + if (priv->ieee80211->fsync_rate_bitmap & rateBitmap) + priv->rate_record += priv->stats.received_rate_histogram[1][rateIndex]; + } +- if (timer_pending(&priv->fsync_timer)) +- del_timer_sync(&priv->fsync_timer); +- priv->fsync_timer.expires = jiffies + +- msecs_to_jiffies(priv->ieee80211->fsync_time_interval); +- add_timer(&priv->fsync_timer); ++ cancel_delayed_work_sync(&priv->fsync_work); ++ schedule_delayed_work(&priv->fsync_work, ++ msecs_to_jiffies(priv->ieee80211->fsync_time_interval)); + + write_nic_dword(dev, rOFDM0_RxDetector2, 0x465c12cd); + +diff --git a/drivers/staging/rtl8192u/r8192U_dm.h b/drivers/staging/rtl8192u/r8192U_dm.h +index 0b2a1c688597..2159018b4e38 100644 +--- a/drivers/staging/rtl8192u/r8192U_dm.h ++++ b/drivers/staging/rtl8192u/r8192U_dm.h +@@ -166,7 +166,7 @@ void dm_force_tx_fw_info(struct net_device *dev, + void dm_init_edca_turbo(struct net_device *dev); + void dm_rf_operation_test_callback(unsigned long data); + void dm_rf_pathcheck_workitemcallback(struct work_struct *work); +-void dm_fsync_timer_callback(struct timer_list *t); ++void dm_fsync_work_callback(struct work_struct *work); + void dm_cck_txpower_adjust(struct net_device *dev, bool binch14); + void dm_shadow_init(struct net_device *dev); + void dm_initialize_txpower_tracking(struct net_device *dev); +-- +2.35.1 + diff --git a/queue-5.4/tcp-make-retransmitted-skb-fit-into-the-send-window.patch b/queue-5.4/tcp-make-retransmitted-skb-fit-into-the-send-window.patch new file mode 100644 index 00000000000..e632b78407a --- /dev/null +++ b/queue-5.4/tcp-make-retransmitted-skb-fit-into-the-send-window.patch @@ -0,0 +1,112 @@ +From a82ef37c64725a7a37d08f778ad3f94ee2098459 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 17:47:18 +0800 +Subject: tcp: make retransmitted SKB fit into the send window + +From: Yonglong Li + +[ Upstream commit 536a6c8e05f95e3d1118c40ae8b3022ee2d05d52 ] + +current code of __tcp_retransmit_skb only check TCP_SKB_CB(skb)->seq +in send window, and TCP_SKB_CB(skb)->seq_end maybe out of send window. +If receiver has shrunk his window, and skb is out of new window, it +should retransmit a smaller portion of the payload. + +test packetdrill script: + 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 + +0 fcntl(3, F_GETFL) = 0x2 (flags O_RDWR) + +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 + + +0 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress) + +0 > S 0:0(0) win 65535 + +.05 < S. 0:0(0) ack 1 win 6000 + +0 > . 1:1(0) ack 1 + + +0 write(3, ..., 10000) = 10000 + + +0 > . 1:2001(2000) ack 1 win 65535 + +0 > . 2001:4001(2000) ack 1 win 65535 + +0 > . 4001:6001(2000) ack 1 win 65535 + + +.05 < . 1:1(0) ack 4001 win 1001 + +and tcpdump show: +192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 1:2001, ack 1, win 65535, length 2000 +192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 2001:4001, ack 1, win 65535, length 2000 +192.168.226.67.55 > 192.0.2.1.8080: Flags [P.], seq 4001:5001, ack 1, win 65535, length 1000 +192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 5001:6001, ack 1, win 65535, length 1000 +192.0.2.1.8080 > 192.168.226.67.55: Flags [.], ack 4001, win 1001, length 0 +192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 5001:6001, ack 1, win 65535, length 1000 +192.168.226.67.55 > 192.0.2.1.8080: Flags [P.], seq 4001:5001, ack 1, win 65535, length 1000 + +when cient retract window to 1001, send window is [4001,5002], +but TLP send 5001-6001 packet which is out of send window. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yonglong Li +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/1657532838-20200-1-git-send-email-liyonglong@chinatelecom.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index ef749a47768a..fa7fb30e4b59 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2911,7 +2911,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + struct tcp_sock *tp = tcp_sk(sk); + unsigned int cur_mss; + int diff, len, err; +- ++ int avail_wnd; + + /* Inconclusive MTU probe */ + if (icsk->icsk_mtup.probe_size) +@@ -2941,17 +2941,25 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + return -EHOSTUNREACH; /* Routing failure or similar. */ + + cur_mss = tcp_current_mss(sk); ++ avail_wnd = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq; + + /* If receiver has shrunk his window, and skb is out of + * new window, do not retransmit it. The exception is the + * case, when window is shrunk to zero. In this case +- * our retransmit serves as a zero window probe. ++ * our retransmit of one segment serves as a zero window probe. + */ +- if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) && +- TCP_SKB_CB(skb)->seq != tp->snd_una) +- return -EAGAIN; ++ if (avail_wnd <= 0) { ++ if (TCP_SKB_CB(skb)->seq != tp->snd_una) ++ return -EAGAIN; ++ avail_wnd = cur_mss; ++ } + + len = cur_mss * segs; ++ if (len > avail_wnd) { ++ len = rounddown(avail_wnd, cur_mss); ++ if (!len) ++ len = avail_wnd; ++ } + if (skb->len > len) { + if (tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb, len, + cur_mss, GFP_ATOMIC)) +@@ -2965,8 +2973,9 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + diff -= tcp_skb_pcount(skb); + if (diff) + tcp_adjust_pcount(sk, skb, diff); +- if (skb->len < cur_mss) +- tcp_retrans_try_collapse(sk, skb, cur_mss); ++ avail_wnd = min_t(int, avail_wnd, cur_mss); ++ if (skb->len < avail_wnd) ++ tcp_retrans_try_collapse(sk, skb, avail_wnd); + } + + /* RFC3168, section 6.1.1.1. ECN fallback */ +-- +2.35.1 + diff --git a/queue-5.4/thermal-tools-tmon-include-pthread-and-time-headers-.patch b/queue-5.4/thermal-tools-tmon-include-pthread-and-time-headers-.patch new file mode 100644 index 00000000000..3ad3eea18c9 --- /dev/null +++ b/queue-5.4/thermal-tools-tmon-include-pthread-and-time-headers-.patch @@ -0,0 +1,62 @@ +From d8f2c5d530f7c3af316f28701724ed00e3ef6177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Jul 2022 20:10:39 -0700 +Subject: thermal/tools/tmon: Include pthread and time headers in tmon.h +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Markus Mayer + +[ Upstream commit 0cf51bfe999524377fbb71becb583b4ca6d07cfc ] + +Include sys/time.h and pthread.h in tmon.h, so that types +"pthread_mutex_t" and "struct timeval tv" are known when tmon.h +references them. + +Without these headers, compiling tmon against musl-libc will fail with +these errors: + +In file included from sysfs.c:31:0: +tmon.h:47:8: error: unknown type name 'pthread_mutex_t' + extern pthread_mutex_t input_lock; + ^~~~~~~~~~~~~~~ +make[3]: *** [: sysfs.o] Error 1 +make[3]: *** Waiting for unfinished jobs.... +In file included from tui.c:31:0: +tmon.h:54:17: error: field 'tv' has incomplete type + struct timeval tv; + ^~ +make[3]: *** [: tui.o] Error 1 +make[2]: *** [Makefile:83: tmon] Error 2 + +Signed-off-by: Markus Mayer +Acked-by: Florian Fainelli +Reviewed-by: Sumeet Pawnikar +Acked-by: Alejandro González +Tested-by: Alejandro González +Fixes: 94f69966faf8 ("tools/thermal: Introduce tmon, a tool for thermal subsystem") +Link: https://lore.kernel.org/r/20220718031040.44714-1-f.fainelli@gmail.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + tools/thermal/tmon/tmon.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/thermal/tmon/tmon.h b/tools/thermal/tmon/tmon.h +index c9066ec104dd..44d16d778f04 100644 +--- a/tools/thermal/tmon/tmon.h ++++ b/tools/thermal/tmon/tmon.h +@@ -27,6 +27,9 @@ + #define NR_LINES_TZDATA 1 + #define TMON_LOG_FILE "/var/tmp/tmon.log" + ++#include ++#include ++ + extern unsigned long ticktime; + extern double time_elapsed; + extern unsigned long target_temp_user; +-- +2.35.1 + diff --git a/queue-5.4/tools-thermal-fix-possible-path-truncations.patch b/queue-5.4/tools-thermal-fix-possible-path-truncations.patch new file mode 100644 index 00000000000..0065fa486b0 --- /dev/null +++ b/queue-5.4/tools-thermal-fix-possible-path-truncations.patch @@ -0,0 +1,109 @@ +From 0e25b4a8c84fc8e81ded2df87ae48e6a0f2f2927 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 10:37:54 -0700 +Subject: tools/thermal: Fix possible path truncations + +From: Florian Fainelli + +[ Upstream commit 6c58cf40e3a1d2f47c09d3489857e9476316788a ] + +A build with -D_FORTIFY_SOURCE=2 enabled will produce the following warnings: + +sysfs.c:63:30: warning: '%s' directive output may be truncated writing up to 255 bytes into a region of size between 0 and 255 [-Wformat-truncation=] + snprintf(filepath, 256, "%s/%s", path, filename); + ^~ +Bump up the buffer to PATH_MAX which is the limit and account for all of +the possible NUL and separators that could lead to exceeding the +allocated buffer sizes. + +Fixes: 94f69966faf8 ("tools/thermal: Introduce tmon, a tool for thermal subsystem") +Signed-off-by: Florian Fainelli +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/thermal/tmon/sysfs.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/tools/thermal/tmon/sysfs.c b/tools/thermal/tmon/sysfs.c +index b00b1bfd9d8e..cb1108bc9249 100644 +--- a/tools/thermal/tmon/sysfs.c ++++ b/tools/thermal/tmon/sysfs.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -33,9 +34,9 @@ int sysfs_set_ulong(char *path, char *filename, unsigned long val) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "w"); + if (!fd) { +@@ -57,9 +58,9 @@ static int sysfs_get_ulong(char *path, char *filename, unsigned long *p_ulong) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "r"); + if (!fd) { +@@ -76,9 +77,9 @@ static int sysfs_get_string(char *path, char *filename, char *str) + { + FILE *fd; + int ret = -1; +- char filepath[256]; ++ char filepath[PATH_MAX + 2]; /* NUL and '/' */ + +- snprintf(filepath, 256, "%s/%s", path, filename); ++ snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); + + fd = fopen(filepath, "r"); + if (!fd) { +@@ -199,8 +200,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + { + unsigned long trip_instance = 0; + char cdev_name_linked[256]; +- char cdev_name[256]; +- char cdev_trip_name[256]; ++ char cdev_name[PATH_MAX]; ++ char cdev_trip_name[PATH_MAX]; + int cdev_id; + + if (nl->d_type == DT_LNK) { +@@ -213,7 +214,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + return -EINVAL; + } + /* find the link to real cooling device record binding */ +- snprintf(cdev_name, 256, "%s/%s", tz_name, nl->d_name); ++ snprintf(cdev_name, sizeof(cdev_name) - 2, "%s/%s", ++ tz_name, nl->d_name); + memset(cdev_name_linked, 0, sizeof(cdev_name_linked)); + if (readlink(cdev_name, cdev_name_linked, + sizeof(cdev_name_linked) - 1) != -1) { +@@ -226,8 +228,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, + /* find the trip point in which the cdev is binded to + * in this tzone + */ +- snprintf(cdev_trip_name, 256, "%s%s", nl->d_name, +- "_trip_point"); ++ snprintf(cdev_trip_name, sizeof(cdev_trip_name) - 1, ++ "%s%s", nl->d_name, "_trip_point"); + sysfs_get_ulong(tz_name, cdev_trip_name, + &trip_instance); + /* validate trip point range, e.g. trip could return -1 +-- +2.35.1 + diff --git a/queue-5.4/tty-n_gsm-fix-dm-command.patch b/queue-5.4/tty-n_gsm-fix-dm-command.patch new file mode 100644 index 00000000000..b3df5af1416 --- /dev/null +++ b/queue-5.4/tty-n_gsm-fix-dm-command.patch @@ -0,0 +1,42 @@ +From 3130db43b966e9e5a11d3950fc246cfc82d094b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 13:32:21 +0200 +Subject: tty: n_gsm: fix DM command + +From: Daniel Starke + +[ Upstream commit 18a948c7d90995d127785e308fa7b701df4c499f ] + +n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. +See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516 +The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to +the newer 27.010 here. Chapter 5.3.3 defines the DM response. There exists +no DM command. However, the current implementation incorrectly sends DM as +command in case of unexpected UIH frames in gsm_queue(). +Correct this behavior by always sending DM as response. + +Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") +Signed-off-by: Daniel Starke +Link: https://lore.kernel.org/r/20220707113223.3685-2-daniel.starke@siemens.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index f4b5ac840222..39b6bcdc2c55 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1894,7 +1894,7 @@ static void gsm_queue(struct gsm_mux *gsm) + goto invalid; + #endif + if (dlci == NULL || dlci->state != DLCI_OPEN) { +- gsm_command(gsm, address, DM|PF); ++ gsm_response(gsm, address, DM|PF); + return; + } + dlci->data(dlci, gsm->buf, gsm->len); +-- +2.35.1 + diff --git a/queue-5.4/tty-n_gsm-fix-missing-corner-cases-in-gsmld_poll.patch b/queue-5.4/tty-n_gsm-fix-missing-corner-cases-in-gsmld_poll.patch new file mode 100644 index 00000000000..0cb46e3cc23 --- /dev/null +++ b/queue-5.4/tty-n_gsm-fix-missing-corner-cases-in-gsmld_poll.patch @@ -0,0 +1,49 @@ +From d66b4c53c229e6df90d9333fdb22c1c19f4eb067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 13:32:23 +0200 +Subject: tty: n_gsm: fix missing corner cases in gsmld_poll() + +From: Daniel Starke + +[ Upstream commit 7e5b4322cde067e1d0f1bf8f490e93f664a7c843 ] + +gsmld_poll() currently fails to handle the following corner cases correctly: +- remote party closed the associated tty + +Add the missing checks and map those to EPOLLHUP. +Reorder the checks to group them by their reaction. + +Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") +Signed-off-by: Daniel Starke +Link: https://lore.kernel.org/r/20220707113223.3685-4-daniel.starke@siemens.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 39b6bcdc2c55..22da64453054 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -2693,12 +2693,15 @@ static __poll_t gsmld_poll(struct tty_struct *tty, struct file *file, + + poll_wait(file, &tty->read_wait, wait); + poll_wait(file, &tty->write_wait, wait); ++ ++ if (gsm->dead) ++ mask |= EPOLLHUP; + if (tty_hung_up_p(file)) + mask |= EPOLLHUP; ++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) ++ mask |= EPOLLHUP; + if (!tty_is_writelocked(tty) && tty_write_room(tty) > 0) + mask |= EPOLLOUT | EPOLLWRNORM; +- if (gsm->dead) +- mask |= EPOLLHUP; + return mask; + } + +-- +2.35.1 + diff --git a/queue-5.4/tty-n_gsm-fix-non-flow-control-frames-during-mux-flo.patch b/queue-5.4/tty-n_gsm-fix-non-flow-control-frames-during-mux-flo.patch new file mode 100644 index 00000000000..97b4597c2c0 --- /dev/null +++ b/queue-5.4/tty-n_gsm-fix-non-flow-control-frames-during-mux-flo.patch @@ -0,0 +1,116 @@ +From d9241379be641db4ab7deecc7f897bf1b3529e8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 08:16:48 +0200 +Subject: tty: n_gsm: fix non flow control frames during mux flow off + +From: Daniel Starke + +[ Upstream commit bec0224816d19abe4fe503586d16d51890540615 ] + +n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. +See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516 +The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to +the newer 27.010 here. Chapter 5.4.6.3.6 states that FCoff stops the +transmission on all channels except the control channel. This is already +implemented in gsm_data_kick(). However, chapter 5.4.8.1 explains that this +shall result in the same behavior as software flow control on the ldisc in +advanced option mode. That means only flow control frames shall be sent +during flow off. The current implementation does not consider this case. + +Change gsm_data_kick() to send only flow control frames if constipated to +abide the standard. gsm_read_ea_val() and gsm_is_flow_ctrl_msg() are +introduced as helper functions for this. +It is planned to use gsm_read_ea_val() in later code cleanups for other +functions, too. + +Fixes: c01af4fec2c8 ("n_gsm : Flow control handling in Mux driver") +Signed-off-by: Daniel Starke +Link: https://lore.kernel.org/r/20220701061652.39604-5-daniel.starke@siemens.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 54 ++++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 53 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 907a4d0784ac..cab30df61196 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -410,6 +410,27 @@ static int gsm_read_ea(unsigned int *val, u8 c) + return c & EA; + } + ++/** ++ * gsm_read_ea_val - read a value until EA ++ * @val: variable holding value ++ * @data: buffer of data ++ * @dlen: length of data ++ * ++ * Processes an EA value. Updates the passed variable and ++ * returns the processed data length. ++ */ ++static unsigned int gsm_read_ea_val(unsigned int *val, const u8 *data, int dlen) ++{ ++ unsigned int len = 0; ++ ++ for (; dlen > 0; dlen--) { ++ len++; ++ if (gsm_read_ea(val, *data++)) ++ break; ++ } ++ return len; ++} ++ + /** + * gsm_encode_modem - encode modem data bits + * @dlci: DLCI to encode from +@@ -657,6 +678,37 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len, + return m; + } + ++/** ++ * gsm_is_flow_ctrl_msg - checks if flow control message ++ * @msg: message to check ++ * ++ * Returns true if the given message is a flow control command of the ++ * control channel. False is returned in any other case. ++ */ ++static bool gsm_is_flow_ctrl_msg(struct gsm_msg *msg) ++{ ++ unsigned int cmd; ++ ++ if (msg->addr > 0) ++ return false; ++ ++ switch (msg->ctrl & ~PF) { ++ case UI: ++ case UIH: ++ cmd = 0; ++ if (gsm_read_ea_val(&cmd, msg->data + 2, msg->len - 2) < 1) ++ break; ++ switch (cmd & ~PF) { ++ case CMD_FCOFF: ++ case CMD_FCON: ++ return true; ++ } ++ break; ++ } ++ ++ return false; ++} ++ + /** + * gsm_data_kick - poke the queue + * @gsm: GSM Mux +@@ -675,7 +727,7 @@ static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci) + int len; + + list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) { +- if (gsm->constipated && msg->addr) ++ if (gsm->constipated && !gsm_is_flow_ctrl_msg(msg)) + continue; + if (gsm->encoding != 0) { + gsm->txframe[0] = GSM1_SOF; +-- +2.35.1 + diff --git a/queue-5.4/tty-n_gsm-fix-packet-re-transmission-without-open-co.patch b/queue-5.4/tty-n_gsm-fix-packet-re-transmission-without-open-co.patch new file mode 100644 index 00000000000..dc33130f80e --- /dev/null +++ b/queue-5.4/tty-n_gsm-fix-packet-re-transmission-without-open-co.patch @@ -0,0 +1,40 @@ +From 75af74a4ddec338471b53e2b353b482cff111d63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 08:16:50 +0200 +Subject: tty: n_gsm: fix packet re-transmission without open control channel + +From: Daniel Starke + +[ Upstream commit 4fae831b3a71fc5a44cc5c7d0b8c1267ee7659f5 ] + +In the current implementation control packets are re-transmitted even if +the control channel closed down during T2. This is wrong. +Check whether the control channel is open before re-transmitting any +packets. Note that control channel open/close is handled by T1 and not T2 +and remains unaffected by this. + +Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") +Signed-off-by: Daniel Starke +Link: https://lore.kernel.org/r/20220701061652.39604-7-daniel.starke@siemens.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index cab30df61196..893d6f502c2e 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1382,7 +1382,7 @@ static void gsm_control_retransmit(struct timer_list *t) + spin_lock_irqsave(&gsm->control_lock, flags); + ctrl = gsm->pending_cmd; + if (ctrl) { +- if (gsm->cretries == 0) { ++ if (gsm->cretries == 0 || !gsm->dlci[0] || gsm->dlci[0]->dead) { + gsm->pending_cmd = NULL; + ctrl->error = -ETIMEDOUT; + ctrl->done = 1; +-- +2.35.1 + diff --git a/queue-5.4/tty-n_gsm-fix-race-condition-in-gsmld_write.patch b/queue-5.4/tty-n_gsm-fix-race-condition-in-gsmld_write.patch new file mode 100644 index 00000000000..4f5bc41a4b9 --- /dev/null +++ b/queue-5.4/tty-n_gsm-fix-race-condition-in-gsmld_write.patch @@ -0,0 +1,62 @@ +From daaa2026640ad7423dbe1588814802115078779b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 08:16:52 +0200 +Subject: tty: n_gsm: fix race condition in gsmld_write() + +From: Daniel Starke + +[ Upstream commit 32dd59f96924f45e33bc79854f7a00679c0fa28e ] + +The function may be used by the user directly and also by the n_gsm +internal functions. They can lead into a race condition which results in +interleaved frames if both are writing at the same time. The receiving side +is not able to decode those interleaved frames correctly. + +Add a lock around the low side tty write to avoid race conditions and frame +interleaving between user originated writes and n_gsm writes. + +Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") +Signed-off-by: Daniel Starke +Link: https://lore.kernel.org/r/20220701061652.39604-9-daniel.starke@siemens.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 893d6f502c2e..186f4633fd4a 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -2651,11 +2651,24 @@ static ssize_t gsmld_read(struct tty_struct *tty, struct file *file, + static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, + const unsigned char *buf, size_t nr) + { +- int space = tty_write_room(tty); ++ struct gsm_mux *gsm = tty->disc_data; ++ unsigned long flags; ++ int space; ++ int ret; ++ ++ if (!gsm) ++ return -ENODEV; ++ ++ ret = -ENOBUFS; ++ spin_lock_irqsave(&gsm->tx_lock, flags); ++ space = tty_write_room(tty); + if (space >= nr) +- return tty->ops->write(tty, buf, nr); +- set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); +- return -ENOBUFS; ++ ret = tty->ops->write(tty, buf, nr); ++ else ++ set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); ++ spin_unlock_irqrestore(&gsm->tx_lock, flags); ++ ++ return ret; + } + + /** +-- +2.35.1 + diff --git a/queue-5.4/tty-n_gsm-fix-wrong-t1-retry-count-handling.patch b/queue-5.4/tty-n_gsm-fix-wrong-t1-retry-count-handling.patch new file mode 100644 index 00000000000..47c3735bd50 --- /dev/null +++ b/queue-5.4/tty-n_gsm-fix-wrong-t1-retry-count-handling.patch @@ -0,0 +1,55 @@ +From a080980020a59e02e8f273fb203dec3fee660902 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 13:32:20 +0200 +Subject: tty: n_gsm: fix wrong T1 retry count handling + +From: Daniel Starke + +[ Upstream commit f30e10caa80aa1f35508bc17fc302dbbde9a833c ] + +n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. +See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516 +The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to +the newer 27.010 here. Chapter 5.7.3 states that the valid range for the +maximum number of retransmissions (N2) is from 0 to 255 (both including). +gsm_dlci_t1() handles this number incorrectly by performing N2 - 1 +retransmission attempts. Setting N2 to zero results in more than 255 +retransmission attempts. +Fix gsm_dlci_t1() to comply with 3GPP 27.010. + +Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") +Signed-off-by: Daniel Starke +Link: https://lore.kernel.org/r/20220707113223.3685-1-daniel.starke@siemens.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_gsm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 186f4633fd4a..f4b5ac840222 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1534,8 +1534,8 @@ static void gsm_dlci_t1(struct timer_list *t) + + switch (dlci->state) { + case DLCI_OPENING: +- dlci->retries--; + if (dlci->retries) { ++ dlci->retries--; + gsm_command(dlci->gsm, dlci->addr, SABM|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); + } else if (!dlci->addr && gsm->control == (DM | PF)) { +@@ -1550,8 +1550,8 @@ static void gsm_dlci_t1(struct timer_list *t) + + break; + case DLCI_CLOSING: +- dlci->retries--; + if (dlci->retries) { ++ dlci->retries--; + gsm_command(dlci->gsm, dlci->addr, DISC|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); + } else +-- +2.35.1 + diff --git a/queue-5.4/usb-gadget-udc-amd5536-depends-on-has_dma.patch b/queue-5.4/usb-gadget-udc-amd5536-depends-on-has_dma.patch new file mode 100644 index 00000000000..5eaed942425 --- /dev/null +++ b/queue-5.4/usb-gadget-udc-amd5536-depends-on-has_dma.patch @@ -0,0 +1,49 @@ +From 994c737149a8351c3a0f5c18096803c0d1926c94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 18:36:01 -0700 +Subject: usb: gadget: udc: amd5536 depends on HAS_DMA + +From: Randy Dunlap + +[ Upstream commit 8097cf2fb3b2205257f1c76f4808e3398d66b6d9 ] + +USB_AMD5536UDC should depend on HAS_DMA since it selects USB_SNP_CORE, +which depends on HAS_DMA and since 'select' does not follow any +dependency chains. + +Fixes this kconfig warning: + +WARNING: unmet direct dependencies detected for USB_SNP_CORE + Depends on [n]: USB_SUPPORT [=y] && USB_GADGET [=y] && (USB_AMD5536UDC [=y] || USB_SNP_UDC_PLAT [=n]) && HAS_DMA [=n] + Selected by [y]: + - USB_AMD5536UDC [=y] && USB_SUPPORT [=y] && USB_GADGET [=y] && USB_PCI [=y] + +Fixes: 97b3ffa233b9 ("usb: gadget: udc: amd5536: split core and PCI layer") +Cc: Raviteja Garimella +Cc: Felipe Balbi +Cc: linux-usb@vger.kernel.org +Cc: Greg Kroah-Hartman +Signed-off-by: Randy Dunlap +Link: https://lore.kernel.org/r/20220709013601.7536-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig +index f985bb4a42db..ccf2c736d495 100644 +--- a/drivers/usb/gadget/udc/Kconfig ++++ b/drivers/usb/gadget/udc/Kconfig +@@ -311,7 +311,7 @@ source "drivers/usb/gadget/udc/bdc/Kconfig" + + config USB_AMD5536UDC + tristate "AMD5536 UDC" +- depends on USB_PCI ++ depends on USB_PCI && HAS_DMA + select USB_SNP_CORE + help + The AMD5536 UDC is part of the AMD Geode CS5536, an x86 southbridge. +-- +2.35.1 + diff --git a/queue-5.4/usb-host-fix-refcount-leak-in-ehci_hcd_ppc_of_probe.patch b/queue-5.4/usb-host-fix-refcount-leak-in-ehci_hcd_ppc_of_probe.patch new file mode 100644 index 00000000000..93f2b07ad13 --- /dev/null +++ b/queue-5.4/usb-host-fix-refcount-leak-in-ehci_hcd_ppc_of_probe.patch @@ -0,0 +1,38 @@ +From 09f2358d7816862aa5f2a198ecc6f71dd1a66964 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 15:08:49 +0400 +Subject: usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe + +From: Miaoqian Lin + +[ Upstream commit b5c5b13cb45e2c88181308186b0001992cb41954 ] + +of_find_compatible_node() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 796bcae7361c ("USB: powerpc: Workaround for the PPC440EPX USBH_23 errata [take 3]") +Acked-by: Alan Stern +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220602110849.58549-1-linmq006@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ehci-ppc-of.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c +index 6bbaee74f7e7..28a19693c19f 100644 +--- a/drivers/usb/host/ehci-ppc-of.c ++++ b/drivers/usb/host/ehci-ppc-of.c +@@ -148,6 +148,7 @@ static int ehci_hcd_ppc_of_probe(struct platform_device *op) + } else { + ehci->has_amcc_usb23 = 1; + } ++ of_node_put(np); + } + + if (of_get_property(dn, "big-endian", NULL)) { +-- +2.35.1 + diff --git a/queue-5.4/usb-host-xhci-use-snprintf-in-xhci_decode_trb.patch b/queue-5.4/usb-host-xhci-use-snprintf-in-xhci_decode_trb.patch new file mode 100644 index 00000000000..9fa3062a295 --- /dev/null +++ b/queue-5.4/usb-host-xhci-use-snprintf-in-xhci_decode_trb.patch @@ -0,0 +1,42 @@ +From 7c454ff6d25f2878609a100248567a29a0392af9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 15:46:45 +0300 +Subject: usb: host: xhci: use snprintf() in xhci_decode_trb() + +From: Sergey Shtylyov + +[ Upstream commit 1ce69c35b86038dd11d3a6115a04501c5b89a940 ] + +Commit cbf286e8ef83 ("xhci: fix unsafe memory usage in xhci tracing") +apparently missed one sprintf() call in xhci_decode_trb() -- replace +it with the snprintf() call as well... + +Found by Linux Verification Center (linuxtesting.org) with the SVACE static +analysis tool. + +Fixes: cbf286e8ef83 ("xhci: fix unsafe memory usage in xhci tracing") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220630124645.1805902-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index a9031f494984..5a6ad776858e 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2376,7 +2376,7 @@ static inline const char *xhci_decode_trb(char *str, size_t size, + field3 & TRB_CYCLE ? 'C' : 'c'); + break; + case TRB_STOP_RING: +- sprintf(str, ++ snprintf(str, size, + "%s: slot %d sp %d ep %d flags %c", + xhci_trb_type_string(type), + TRB_TO_SLOT_ID(field3), +-- +2.35.1 + diff --git a/queue-5.4/usb-ohci-nxp-fix-refcount-leak-in-ohci_hcd_nxp_probe.patch b/queue-5.4/usb-ohci-nxp-fix-refcount-leak-in-ohci_hcd_nxp_probe.patch new file mode 100644 index 00000000000..64f364b2502 --- /dev/null +++ b/queue-5.4/usb-ohci-nxp-fix-refcount-leak-in-ohci_hcd_nxp_probe.patch @@ -0,0 +1,38 @@ +From e39115f785432ef0461cd1405e98f601dd726411 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 18:12:30 +0400 +Subject: usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe + +From: Miaoqian Lin + +[ Upstream commit 302970b4cad3ebfda2c05ce06c322ccdc447d17e ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 73108aa90cbf ("USB: ohci-nxp: Use isp1301 driver") +Acked-by: Alan Stern +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220603141231.979-1-linmq006@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-nxp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/ohci-nxp.c b/drivers/usb/host/ohci-nxp.c +index c561881d0e79..07cee8c7c25e 100644 +--- a/drivers/usb/host/ohci-nxp.c ++++ b/drivers/usb/host/ohci-nxp.c +@@ -164,6 +164,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) + } + + isp1301_i2c_client = isp1301_get_client(isp1301_node); ++ of_node_put(isp1301_node); + if (!isp1301_i2c_client) + return -EPROBE_DEFER; + +-- +2.35.1 + diff --git a/queue-5.4/usb-serial-fix-tty-port-initialized-comments.patch b/queue-5.4/usb-serial-fix-tty-port-initialized-comments.patch new file mode 100644 index 00000000000..3e649eedef5 --- /dev/null +++ b/queue-5.4/usb-serial-fix-tty-port-initialized-comments.patch @@ -0,0 +1,66 @@ +From 3552dedc8f4583dbea041cba2a107d0078800596 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 10:44:57 +0200 +Subject: USB: serial: fix tty-port initialized comments + +From: Johan Hovold + +[ Upstream commit 688ee1d1785c1359f9040f615dd8e6054962bce2 ] + +Fix up the tty-port initialized comments which got truncated and +obfuscated when replacing the old ASYNCB_INITIALIZED flag. + +Fixes: d41861ca19c9 ("tty: Replace ASYNC_INITIALIZED bit and update atomically") +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/sierra.c | 3 ++- + drivers/usb/serial/usb-serial.c | 2 +- + drivers/usb/serial/usb_wwan.c | 3 ++- + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index a43263a0edd8..891e52bc5002 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -757,7 +757,8 @@ static void sierra_close(struct usb_serial_port *port) + + /* + * Need to take susp_lock to make sure port is not already being +- * resumed, but no need to hold it due to initialized ++ * resumed, but no need to hold it due to the tty-port initialized ++ * flag. + */ + spin_lock_irq(&intfdata->susp_lock); + if (--intfdata->open_ports == 0) +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c +index dc7a65b9ec98..2a2469b76cc5 100644 +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -254,7 +254,7 @@ static int serial_open(struct tty_struct *tty, struct file *filp) + * + * Shut down a USB serial port. Serialized against activate by the + * tport mutex and kept to matching open/close pairs +- * of calls by the initialized flag. ++ * of calls by the tty-port initialized flag. + * + * Not called if tty is console. + */ +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index b2285d5a869d..628a75d1232a 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -435,7 +435,8 @@ void usb_wwan_close(struct usb_serial_port *port) + + /* + * Need to take susp_lock to make sure port is not already being +- * resumed, but no need to hold it due to initialized ++ * resumed, but no need to hold it due to the tty-port initialized ++ * flag. + */ + spin_lock_irq(&intfdata->susp_lock); + if (--intfdata->open_ports == 0) +-- +2.35.1 + diff --git a/queue-5.4/usb-xhci-tegra-fix-error-check.patch b/queue-5.4/usb-xhci-tegra-fix-error-check.patch new file mode 100644 index 00000000000..cb23fb2b90b --- /dev/null +++ b/queue-5.4/usb-xhci-tegra-fix-error-check.patch @@ -0,0 +1,49 @@ +From 59597f30dcd80e52fdd8d5bdb09cf2ee80cb7e18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 20:14:04 +0800 +Subject: usb: xhci: tegra: Fix error check + +From: Tang Bin + +[ Upstream commit 18fc7c435be3f17ea26a21b2e2312fcb9088e01f ] + +In the function tegra_xusb_powerdomain_init(), +dev_pm_domain_attach_by_name() may return NULL in some cases, +so IS_ERR() doesn't meet the requirements. Thus fix it. + +Fixes: 6494a9ad86de ("usb: xhci: tegra: Add genpd support") +Signed-off-by: Tang Bin +Link: https://lore.kernel.org/r/20220524121404.18376-1-tangbin@cmss.chinamobile.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-tegra.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index 6087b1fa530f..d53bdb7d297f 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -933,15 +933,15 @@ static int tegra_xusb_powerdomain_init(struct device *dev, + int err; + + tegra->genpd_dev_host = dev_pm_domain_attach_by_name(dev, "xusb_host"); +- if (IS_ERR(tegra->genpd_dev_host)) { +- err = PTR_ERR(tegra->genpd_dev_host); ++ if (IS_ERR_OR_NULL(tegra->genpd_dev_host)) { ++ err = PTR_ERR(tegra->genpd_dev_host) ? : -ENODATA; + dev_err(dev, "failed to get host pm-domain: %d\n", err); + return err; + } + + tegra->genpd_dev_ss = dev_pm_domain_attach_by_name(dev, "xusb_ss"); +- if (IS_ERR(tegra->genpd_dev_ss)) { +- err = PTR_ERR(tegra->genpd_dev_ss); ++ if (IS_ERR_OR_NULL(tegra->genpd_dev_ss)) { ++ err = PTR_ERR(tegra->genpd_dev_ss) ? : -ENODATA; + dev_err(dev, "failed to get superspeed pm-domain: %d\n", err); + return err; + } +-- +2.35.1 + diff --git a/queue-5.4/vfio-ccw-do-not-change-fsm-state-in-subchannel-event.patch b/queue-5.4/vfio-ccw-do-not-change-fsm-state-in-subchannel-event.patch new file mode 100644 index 00000000000..22ce3fe5efa --- /dev/null +++ b/queue-5.4/vfio-ccw-do-not-change-fsm-state-in-subchannel-event.patch @@ -0,0 +1,61 @@ +From 6d4d2d089985449c4dc26efb89953ba0cb18f3bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 15:57:29 +0200 +Subject: vfio/ccw: Do not change FSM state in subchannel event + +From: Eric Farman + +[ Upstream commit cffcc109fd682075dee79bade3d60a07152a8fd1 ] + +The routine vfio_ccw_sch_event() is tasked with handling subchannel events, +specifically machine checks, on behalf of vfio-ccw. It correctly calls +cio_update_schib(), and if that fails (meaning the subchannel is gone) +it makes an FSM event call to mark the subchannel Not Operational. + +If that worked, however, then it decides that if the FSM state was already +Not Operational (implying the subchannel just came back), then it should +simply change the FSM to partially- or fully-open. + +Remove this trickery, since a subchannel returning will require more +probing than simply "oh all is well again" to ensure it works correctly. + +Fixes: bbe37e4cb8970 ("vfio: ccw: introduce a finite state machine") +Signed-off-by: Eric Farman +Reviewed-by: Matthew Rosato +Link: https://lore.kernel.org/r/20220707135737.720765-4-farman@linux.ibm.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/vfio_ccw_drv.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index fd590d1cffc1..d42e5a307437 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -247,19 +247,11 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process) + if (work_pending(&sch->todo_work)) + goto out_unlock; + +- if (cio_update_schib(sch)) { +- vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); +- rc = 0; +- goto out_unlock; +- } +- +- private = dev_get_drvdata(&sch->dev); +- if (private->state == VFIO_CCW_STATE_NOT_OPER) { +- private->state = private->mdev ? VFIO_CCW_STATE_IDLE : +- VFIO_CCW_STATE_STANDBY; +- } + rc = 0; + ++ if (cio_update_schib(sch)) ++ vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); ++ + out_unlock: + spin_unlock_irqrestore(sch->lock, flags); + +-- +2.35.1 + diff --git a/queue-5.4/video-fbdev-amba-clcd-fix-refcount-leak-bugs.patch b/queue-5.4/video-fbdev-amba-clcd-fix-refcount-leak-bugs.patch new file mode 100644 index 00000000000..a04ae2871ec --- /dev/null +++ b/queue-5.4/video-fbdev-amba-clcd-fix-refcount-leak-bugs.patch @@ -0,0 +1,78 @@ +From cfd911cfdca5e9bc313d1f29af9fd25cec701c5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 16:25:46 +0800 +Subject: video: fbdev: amba-clcd: Fix refcount leak bugs + +From: Liang He + +[ Upstream commit 26c2b7d9fac42eb8317f3ceefa4c1a9a9170ca69 ] + +In clcdfb_of_init_display(), we should call of_node_put() for the +references returned by of_graph_get_next_endpoint() and +of_graph_get_remote_port_parent() which have increased the refcount. + +Besides, we should call of_node_put() both in fail path or when +the references are not used anymore. + +Fixes: d10715be03bd ("video: ARM CLCD: Add DT support") +Signed-off-by: Liang He +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/amba-clcd.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c +index 3b7a7c74bf0a..09774ada36fb 100644 +--- a/drivers/video/fbdev/amba-clcd.c ++++ b/drivers/video/fbdev/amba-clcd.c +@@ -714,16 +714,18 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) + return -ENODEV; + + panel = of_graph_get_remote_port_parent(endpoint); +- if (!panel) +- return -ENODEV; ++ if (!panel) { ++ err = -ENODEV; ++ goto out_endpoint_put; ++ } + + err = clcdfb_of_get_backlight(panel, fb->panel); + if (err) +- return err; ++ goto out_panel_put; + + err = clcdfb_of_get_mode(&fb->dev->dev, panel, fb->panel); + if (err) +- return err; ++ goto out_panel_put; + + err = of_property_read_u32(fb->dev->dev.of_node, "max-memory-bandwidth", + &max_bandwidth); +@@ -752,11 +754,21 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) + + if (of_property_read_u32_array(endpoint, + "arm,pl11x,tft-r0g0b0-pads", +- tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) != 0) +- return -ENOENT; ++ tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) != 0) { ++ err = -ENOENT; ++ goto out_panel_put; ++ } ++ ++ of_node_put(panel); ++ of_node_put(endpoint); + + return clcdfb_of_init_tft_panel(fb, tft_r0b0g0[0], + tft_r0b0g0[1], tft_r0b0g0[2]); ++out_panel_put: ++ of_node_put(panel); ++out_endpoint_put: ++ of_node_put(endpoint); ++ return err; + } + + static int clcdfb_of_vram_setup(struct clcd_fb *fb) +-- +2.35.1 + diff --git a/queue-5.4/video-fbdev-arkfb-check-the-size-of-screen-before-me.patch b/queue-5.4/video-fbdev-arkfb-check-the-size-of-screen-before-me.patch new file mode 100644 index 00000000000..ea2c06ca01f --- /dev/null +++ b/queue-5.4/video-fbdev-arkfb-check-the-size-of-screen-before-me.patch @@ -0,0 +1,50 @@ +From f0b7f0ffcd07b69d69c210825bf763e2e030c4fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Aug 2022 20:41:24 +0800 +Subject: video: fbdev: arkfb: Check the size of screen before memset_io() + +From: Zheyu Ma + +[ Upstream commit 96b550971c65d54d64728d8ba973487878a06454 ] + +In the function arkfb_set_par(), the value of 'screen_size' is +calculated by the user input. If the user provides the improper value, +the value of 'screen_size' may larger than 'info->screen_size', which +may cause the following bug: + +[ 659.399066] BUG: unable to handle page fault for address: ffffc90003000000 +[ 659.399077] #PF: supervisor write access in kernel mode +[ 659.399079] #PF: error_code(0x0002) - not-present page +[ 659.399094] RIP: 0010:memset_orig+0x33/0xb0 +[ 659.399116] Call Trace: +[ 659.399122] arkfb_set_par+0x143f/0x24c0 +[ 659.399130] fb_set_var+0x604/0xeb0 +[ 659.399161] do_fb_ioctl+0x234/0x670 +[ 659.399189] fb_ioctl+0xdd/0x130 + +Fix the this by checking the value of 'screen_size' before memset_io(). + +Fixes: 681e14730c73 ("arkfb: new framebuffer driver for ARK Logic cards") +Signed-off-by: Zheyu Ma +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/arkfb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/arkfb.c b/drivers/video/fbdev/arkfb.c +index 311f7ea57625..6b1ad19b8db4 100644 +--- a/drivers/video/fbdev/arkfb.c ++++ b/drivers/video/fbdev/arkfb.c +@@ -794,6 +794,8 @@ static int arkfb_set_par(struct fb_info *info) + value = ((value * hmul / hdiv) / 8) - 5; + vga_wcrt(par->state.vgabase, 0x42, (value + 1) / 2); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + /* Device and screen back on */ + svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80); +-- +2.35.1 + diff --git a/queue-5.4/video-fbdev-arkfb-fix-a-divide-by-zero-bug-in-ark_se.patch b/queue-5.4/video-fbdev-arkfb-fix-a-divide-by-zero-bug-in-ark_se.patch new file mode 100644 index 00000000000..cfd9433721b --- /dev/null +++ b/queue-5.4/video-fbdev-arkfb-fix-a-divide-by-zero-bug-in-ark_se.patch @@ -0,0 +1,59 @@ +From adf33bd82473d484542fcf3899b969dde670459e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Aug 2022 17:23:12 +0800 +Subject: video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() + +From: Zheyu Ma + +[ Upstream commit 2f1c4523f7a3aaabe7e53d3ebd378292947e95c8 ] + +Since the user can control the arguments of the ioctl() from the user +space, under special arguments that may result in a divide-by-zero bug +in: + drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul); +with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0. +and then in: + drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock); +we'll get a division-by-zero. + +The following log can reveal it: + +divide error: 0000 [#1] PREEMPT SMP KASAN PTI +RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline] +RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784 +Call Trace: + fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 + do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 + fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 + +Fix this by checking the argument of ark_set_pixclock() first. + +Fixes: 681e14730c73 ("arkfb: new framebuffer driver for ARK Logic cards") +Signed-off-by: Zheyu Ma +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/arkfb.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/arkfb.c b/drivers/video/fbdev/arkfb.c +index f940e8b66b85..311f7ea57625 100644 +--- a/drivers/video/fbdev/arkfb.c ++++ b/drivers/video/fbdev/arkfb.c +@@ -778,7 +778,12 @@ static int arkfb_set_par(struct fb_info *info) + return -EINVAL; + } + +- ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul); ++ value = (hdiv * info->var.pixclock) / hmul; ++ if (!value) { ++ fb_dbg(info, "invalid pixclock\n"); ++ value = 1; ++ } ++ ark_set_pixclock(info, value); + svga_set_timings(par->state.vgabase, &ark_timing_regs, &(info->var), hmul, hdiv, + (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, + (info->var.vmode & FB_VMODE_INTERLACED) ? 2 : 1, +-- +2.35.1 + diff --git a/queue-5.4/video-fbdev-s3fb-check-the-size-of-screen-before-mem.patch b/queue-5.4/video-fbdev-s3fb-check-the-size-of-screen-before-mem.patch new file mode 100644 index 00000000000..b9546e2e969 --- /dev/null +++ b/queue-5.4/video-fbdev-s3fb-check-the-size-of-screen-before-mem.patch @@ -0,0 +1,49 @@ +From 24028cecf176eb1171f88c7a331c9ef25e292a53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Aug 2022 20:41:25 +0800 +Subject: video: fbdev: s3fb: Check the size of screen before memset_io() + +From: Zheyu Ma + +[ Upstream commit 6ba592fa014f21f35a8ee8da4ca7b95a018f13e8 ] + +In the function s3fb_set_par(), the value of 'screen_size' is +calculated by the user input. If the user provides the improper value, +the value of 'screen_size' may larger than 'info->screen_size', which +may cause the following bug: + +[ 54.083733] BUG: unable to handle page fault for address: ffffc90003000000 +[ 54.083742] #PF: supervisor write access in kernel mode +[ 54.083744] #PF: error_code(0x0002) - not-present page +[ 54.083760] RIP: 0010:memset_orig+0x33/0xb0 +[ 54.083782] Call Trace: +[ 54.083788] s3fb_set_par+0x1ec6/0x4040 +[ 54.083806] fb_set_var+0x604/0xeb0 +[ 54.083836] do_fb_ioctl+0x234/0x670 + +Fix the this by checking the value of 'screen_size' before memset_io(). + +Fixes: a268422de8bf ("fbdev driver for S3 Trio/Virge") +Signed-off-by: Zheyu Ma +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/s3fb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/s3fb.c b/drivers/video/fbdev/s3fb.c +index be16c349c10f..228e5ee7a547 100644 +--- a/drivers/video/fbdev/s3fb.c ++++ b/drivers/video/fbdev/s3fb.c +@@ -902,6 +902,8 @@ static int s3fb_set_par(struct fb_info *info) + value = clamp((htotal + hsstart + 1) / 2 + 2, hsstart + 4, htotal + 1); + svga_wcrt_multi(par->state.vgabase, s3_dtpc_regs, value); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + /* Device and screen back on */ + svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80); +-- +2.35.1 + diff --git a/queue-5.4/video-fbdev-sis-fix-typos-in-sis_getmodeid.patch b/queue-5.4/video-fbdev-sis-fix-typos-in-sis_getmodeid.patch new file mode 100644 index 00000000000..0b83af83a32 --- /dev/null +++ b/queue-5.4/video-fbdev-sis-fix-typos-in-sis_getmodeid.patch @@ -0,0 +1,47 @@ +From fa7d5f0f45b5593b6d8648965290d65c2b3fc3b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 15:43:43 +0300 +Subject: video: fbdev: sis: fix typos in SiS_GetModeID() + +From: Rustam Subkhankulov + +[ Upstream commit 3eb8fccc244bfb41a7961969e4db280d44911226 ] + +The second operand of a '&&' operator has no impact on expression +result for cases 400 and 512 in SiS_GetModeID(). + +Judging by the logic and the names of the variables, in both cases a +typo was made. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Rustam Subkhankulov +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sis/init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c +index fde27feae5d0..d6b2ce95a859 100644 +--- a/drivers/video/fbdev/sis/init.c ++++ b/drivers/video/fbdev/sis/init.c +@@ -355,12 +355,12 @@ SiS_GetModeID(int VGAEngine, unsigned int VBFlags, int HDisplay, int VDisplay, + } + break; + case 400: +- if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 800) && (LCDwidth >= 600))) { ++ if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 800) && (LCDheight >= 600))) { + if(VDisplay == 300) ModeIndex = ModeIndex_400x300[Depth]; + } + break; + case 512: +- if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 1024) && (LCDwidth >= 768))) { ++ if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >= 1024) && (LCDheight >= 768))) { + if(VDisplay == 384) ModeIndex = ModeIndex_512x384[Depth]; + } + break; +-- +2.35.1 + diff --git a/queue-5.4/video-fbdev-vt8623fb-check-the-size-of-screen-before.patch b/queue-5.4/video-fbdev-vt8623fb-check-the-size-of-screen-before.patch new file mode 100644 index 00000000000..c44be0925fb --- /dev/null +++ b/queue-5.4/video-fbdev-vt8623fb-check-the-size-of-screen-before.patch @@ -0,0 +1,50 @@ +From d7a9eaeef89ca2cd362066a18219ba6b575cc658 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Aug 2022 20:41:23 +0800 +Subject: video: fbdev: vt8623fb: Check the size of screen before memset_io() + +From: Zheyu Ma + +[ Upstream commit ec0754c60217248fa77cc9005d66b2b55200ac06 ] + +In the function vt8623fb_set_par(), the value of 'screen_size' is +calculated by the user input. If the user provides the improper value, +the value of 'screen_size' may larger than 'info->screen_size', which +may cause the following bug: + +[ 583.339036] BUG: unable to handle page fault for address: ffffc90005000000 +[ 583.339049] #PF: supervisor write access in kernel mode +[ 583.339052] #PF: error_code(0x0002) - not-present page +[ 583.339074] RIP: 0010:memset_orig+0x33/0xb0 +[ 583.339110] Call Trace: +[ 583.339118] vt8623fb_set_par+0x11cd/0x21e0 +[ 583.339146] fb_set_var+0x604/0xeb0 +[ 583.339181] do_fb_ioctl+0x234/0x670 +[ 583.339209] fb_ioctl+0xdd/0x130 + +Fix the this by checking the value of 'screen_size' before memset_io(). + +Fixes: 558b7bd86c32 ("vt8623fb: new framebuffer driver for VIA VT8623") +Signed-off-by: Zheyu Ma +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/vt8623fb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/vt8623fb.c b/drivers/video/fbdev/vt8623fb.c +index c339a8fbad81..61e2028924a6 100644 +--- a/drivers/video/fbdev/vt8623fb.c ++++ b/drivers/video/fbdev/vt8623fb.c +@@ -504,6 +504,8 @@ static int vt8623fb_set_par(struct fb_info *info) + (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, 1, + 1, info->node); + ++ if (screen_size > info->screen_size) ++ screen_size = info->screen_size; + memset_io(info->screen_base, 0x00, screen_size); + + /* Device and screen back on */ +-- +2.35.1 + diff --git a/queue-5.4/wait-fix-__wait_event_hrtimeout-for-rt-dl-tasks.patch b/queue-5.4/wait-fix-__wait_event_hrtimeout-for-rt-dl-tasks.patch new file mode 100644 index 00000000000..c8c6abe3211 --- /dev/null +++ b/queue-5.4/wait-fix-__wait_event_hrtimeout-for-rt-dl-tasks.patch @@ -0,0 +1,62 @@ +From 45480fc27ad1603a4bc6da87a5e681cd6afe5a7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jun 2022 11:50:51 +0200 +Subject: wait: Fix __wait_event_hrtimeout for RT/DL tasks + +From: Juri Lelli + +[ Upstream commit cceeeb6a6d02e7b9a74ddd27a3225013b34174aa ] + +Changes to hrtimer mode (potentially made by __hrtimer_init_sleeper on +PREEMPT_RT) are not visible to hrtimer_start_range_ns, thus not +accounted for by hrtimer_start_expires call paths. In particular, +__wait_event_hrtimeout suffers from this problem as we have, for +example: + +fs/aio.c::read_events + wait_event_interruptible_hrtimeout + __wait_event_hrtimeout + hrtimer_init_sleeper_on_stack <- this might "mode |= HRTIMER_MODE_HARD" + on RT if task runs at RT/DL priority + hrtimer_start_range_ns + WARN_ON_ONCE(!(mode & HRTIMER_MODE_HARD) ^ !timer->is_hard) + fires since the latter doesn't see the change of mode done by + init_sleeper + +Fix it by making __wait_event_hrtimeout call hrtimer_sleeper_start_expires, +which is aware of the special RT/DL case, instead of hrtimer_start_range_ns. + +Reported-by: Bruno Goncalves +Signed-off-by: Juri Lelli +Signed-off-by: Thomas Gleixner +Reviewed-by: Daniel Bristot de Oliveira +Reviewed-by: Valentin Schneider +Link: https://lore.kernel.org/r/20220627095051.42470-1-juri.lelli@redhat.com +Signed-off-by: Sasha Levin +--- + include/linux/wait.h | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/linux/wait.h b/include/linux/wait.h +index 5903b1d17c92..7d04c1b588c7 100644 +--- a/include/linux/wait.h ++++ b/include/linux/wait.h +@@ -529,10 +529,11 @@ do { \ + \ + hrtimer_init_sleeper_on_stack(&__t, CLOCK_MONOTONIC, \ + HRTIMER_MODE_REL); \ +- if ((timeout) != KTIME_MAX) \ +- hrtimer_start_range_ns(&__t.timer, timeout, \ +- current->timer_slack_ns, \ +- HRTIMER_MODE_REL); \ ++ if ((timeout) != KTIME_MAX) { \ ++ hrtimer_set_expires_range_ns(&__t.timer, timeout, \ ++ current->timer_slack_ns); \ ++ hrtimer_sleeper_start_expires(&__t, HRTIMER_MODE_REL); \ ++ } \ + \ + __ret = ___wait_event(wq_head, condition, state, 0, 0, \ + if (!__t.task) { \ +-- +2.35.1 + diff --git a/queue-5.4/watchdog-armada_37xx_wdt-check-the-return-value-of-d.patch b/queue-5.4/watchdog-armada_37xx_wdt-check-the-return-value-of-d.patch new file mode 100644 index 00000000000..209f2567ee4 --- /dev/null +++ b/queue-5.4/watchdog-armada_37xx_wdt-check-the-return-value-of-d.patch @@ -0,0 +1,42 @@ +From 94d613720981d402ec889961dd3d303806c0e9d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Jul 2022 11:09:38 +0800 +Subject: watchdog: armada_37xx_wdt: check the return value of devm_ioremap() + in armada_37xx_wdt_probe() + +From: William Dean + +[ Upstream commit 2d27e52841092e5831dd41f313028c668d816eb0 ] + +The function devm_ioremap() in armada_37xx_wdt_probe() can fail, so +its return value should be checked. + +Fixes: 54e3d9b518c8a ("watchdog: Add support for Armada 37xx CPU watchdog") +Reported-by: Hacash Robot +Signed-off-by: William Dean +Reviewed-by: Marek Beh=C3=BAn +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20220722030938.2925156-1-williamsukatube@163.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/armada_37xx_wdt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/watchdog/armada_37xx_wdt.c b/drivers/watchdog/armada_37xx_wdt.c +index e5dcb26d85f0..dcb3ffda3fad 100644 +--- a/drivers/watchdog/armada_37xx_wdt.c ++++ b/drivers/watchdog/armada_37xx_wdt.c +@@ -274,6 +274,8 @@ static int armada_37xx_wdt_probe(struct platform_device *pdev) + if (!res) + return -ENODEV; + dev->reg = devm_ioremap(&pdev->dev, res->start, resource_size(res)); ++ if (!dev->reg) ++ return -ENOMEM; + + /* init clock */ + dev->clk = devm_clk_get(&pdev->dev, NULL); +-- +2.35.1 + diff --git a/queue-5.4/wifi-iwlegacy-4965-fix-potential-off-by-one-overflow.patch b/queue-5.4/wifi-iwlegacy-4965-fix-potential-off-by-one-overflow.patch new file mode 100644 index 00000000000..e3ac1c4d9c9 --- /dev/null +++ b/queue-5.4/wifi-iwlegacy-4965-fix-potential-off-by-one-overflow.patch @@ -0,0 +1,64 @@ +From 37181a2da963c14f769aa3d98e99f0f3c1ad95a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 20:16:14 +0300 +Subject: wifi: iwlegacy: 4965: fix potential off-by-one overflow in + il4965_rs_fill_link_cmd() + +From: Alexey Kodanev + +[ Upstream commit a8eb8e6f7159c7c20c0ddac428bde3d110890aa7 ] + +As a result of the execution of the inner while loop, the value +of 'idx' can be equal to LINK_QUAL_MAX_RETRY_NUM. However, this +is not checked after the loop and 'idx' is used to write the +LINK_QUAL_MAX_RETRY_NUM size array 'lq_cmd->rs_table[idx]' below +in the outer loop. + +The fix is to check the new value of 'idx' inside the nested loop, +and break both loops if index equals the size. Checking it at the +start is now pointless, so let's remove it. + +Detected using the static analysis tool - Svace. + +Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965") +Signed-off-by: Alexey Kodanev +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220608171614.28891-1-aleksei.kodanev@bell-sw.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-rs.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-rs.c b/drivers/net/wireless/intel/iwlegacy/4965-rs.c +index 0a02d8aca320..ce891ac32388 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c +@@ -2403,7 +2403,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + /* Repeat initial/next rate. + * For legacy IL_NUMBER_TRY == 1, this loop will not execute. + * For HT IL_HT_NUMBER_TRY == 3, this executes twice. */ +- while (repeat_rate > 0 && idx < LINK_QUAL_MAX_RETRY_NUM) { ++ while (repeat_rate > 0) { + if (is_legacy(tbl_type.lq_type)) { + if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) + ant_toggle_cnt++; +@@ -2422,6 +2422,8 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + cpu_to_le32(new_rate); + repeat_rate--; + idx++; ++ if (idx >= LINK_QUAL_MAX_RETRY_NUM) ++ goto out; + } + + il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, +@@ -2466,6 +2468,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, + repeat_rate--; + } + ++out: + lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF; + lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF; + +-- +2.35.1 + diff --git a/queue-5.4/wifi-iwlwifi-mvm-fix-double-list_add-at-iwl_mvm_mac_.patch b/queue-5.4/wifi-iwlwifi-mvm-fix-double-list_add-at-iwl_mvm_mac_.patch new file mode 100644 index 00000000000..1dd53e0ae05 --- /dev/null +++ b/queue-5.4/wifi-iwlwifi-mvm-fix-double-list_add-at-iwl_mvm_mac_.patch @@ -0,0 +1,70 @@ +From 420334f4fe154069477821db4e84b6914adc6fab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 17:35:42 +0200 +Subject: wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue + +From: Jose Ignacio Tornos Martinez + +[ Upstream commit 14a3aacf517a9de725dd3219dbbcf741e31763c4 ] + +After successfull station association, if station queues are disabled for +some reason, the related lists are not emptied. So if some new element is +added to the list in iwl_mvm_mac_wake_tx_queue, it can match with the old +one and produce a BUG like this: + +[ 46.535263] list_add corruption. prev->next should be next (ffff94c1c318a360), but was 0000000000000000. (prev=ffff94c1d02d3388). +[ 46.535283] ------------[ cut here ]------------ +[ 46.535284] kernel BUG at lib/list_debug.c:26! +[ 46.535290] invalid opcode: 0000 [#1] PREEMPT SMP PTI +[ 46.585304] CPU: 0 PID: 623 Comm: wpa_supplicant Not tainted 5.19.0-rc3+ #1 +[ 46.592380] Hardware name: Dell Inc. Inspiron 660s/0478VN , BIOS A07 08/24/2012 +[ 46.600336] RIP: 0010:__list_add_valid.cold+0x3d/0x3f +[ 46.605475] Code: f2 4c 89 c1 48 89 fe 48 c7 c7 c8 40 67 93 e8 20 cc fd ff 0f 0b 48 89 d1 4c 89 c6 4c 89 ca 48 c7 c7 70 40 67 93 e8 09 cc fd ff <0f> 0b 48 89 fe 48 c7 c7 00 41 67 93 e8 f8 cb fd ff 0f 0b 48 89 d1 +[ 46.624469] RSP: 0018:ffffb20800ab76d8 EFLAGS: 00010286 +[ 46.629854] RAX: 0000000000000075 RBX: ffff94c1c318a0e0 RCX: 0000000000000000 +[ 46.637105] RDX: 0000000000000201 RSI: ffffffff9365e100 RDI: 00000000ffffffff +[ 46.644356] RBP: ffff94c1c5f43370 R08: 0000000000000075 R09: 3064316334396666 +[ 46.651607] R10: 3364323064316334 R11: 39666666663d7665 R12: ffff94c1c5f43388 +[ 46.658857] R13: ffff94c1d02d3388 R14: ffff94c1c318a360 R15: ffff94c1cf2289c0 +[ 46.666108] FS: 00007f65634ff7c0(0000) GS:ffff94c1da200000(0000) knlGS:0000000000000000 +[ 46.674331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 46.680170] CR2: 00007f7dfe984460 CR3: 000000010e894003 CR4: 00000000000606f0 +[ 46.687422] Call Trace: +[ 46.689906] +[ 46.691950] iwl_mvm_mac_wake_tx_queue+0xec/0x15c [iwlmvm] +[ 46.697601] ieee80211_queue_skb+0x4b3/0x720 [mac80211] +[ 46.702973] ? sta_info_get+0x46/0x60 [mac80211] +[ 46.707703] ieee80211_tx+0xad/0x110 [mac80211] +[ 46.712355] __ieee80211_tx_skb_tid_band+0x71/0x90 [mac80211] +... + +In order to avoid this problem, we must also remove the related lists when +station queues are disabled. + +Fixes: cfbc6c4c5b91c ("iwlwifi: mvm: support mac80211 TXQs model") +Reported-by: Takayuki Nagata +Reported-by: Petr Stourac +Tested-by: Petr Stourac +Signed-off-by: Jose Ignacio Tornos Martinez +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220719153542.81466-1-jtornosm@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 5df4bbb6c6de..a3255100e3fe 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1810,6 +1810,7 @@ static void iwl_mvm_disable_sta_queues(struct iwl_mvm *mvm, + iwl_mvm_txq_from_mac80211(sta->txq[i]); + + mvmtxq->txq_id = IWL_MVM_INVALID_QUEUE; ++ list_del_init(&mvmtxq->list); + } + } + +-- +2.35.1 + diff --git a/queue-5.4/wifi-libertas-fix-possible-refcount-leak-in-if_usb_p.patch b/queue-5.4/wifi-libertas-fix-possible-refcount-leak-in-if_usb_p.patch new file mode 100644 index 00000000000..5c644e8d277 --- /dev/null +++ b/queue-5.4/wifi-libertas-fix-possible-refcount-leak-in-if_usb_p.patch @@ -0,0 +1,37 @@ +From e6fc2e4e0b52e0d10d17d530a98e641787e6a0dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 17:23:50 +0800 +Subject: wifi: libertas: Fix possible refcount leak in if_usb_probe() + +From: Hangyu Hua + +[ Upstream commit 6fd57e1d120bf13d4dc6c200a7cf914e6347a316 ] + +usb_get_dev will be called before lbs_get_firmware_async which means that +usb_put_dev need to be called when lbs_get_firmware_async fails. + +Fixes: ce84bb69f50e ("libertas USB: convert to asynchronous firmware loading") +Signed-off-by: Hangyu Hua +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220620092350.39960-1-hbh25y@gmail.com +Link: https://lore.kernel.org/r/20220622113402.16969-1-colin.i.king@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 5d6dc1dd050d..32fdc4150b60 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -287,6 +287,7 @@ static int if_usb_probe(struct usb_interface *intf, + return 0; + + err_get_fw: ++ usb_put_dev(udev); + lbs_remove_card(priv); + err_add_card: + if_usb_reset_device(cardp); +-- +2.35.1 + diff --git a/queue-5.4/wifi-p54-add-missing-parentheses-in-p54_flush.patch b/queue-5.4/wifi-p54-add-missing-parentheses-in-p54_flush.patch new file mode 100644 index 00000000000..2a484b79268 --- /dev/null +++ b/queue-5.4/wifi-p54-add-missing-parentheses-in-p54_flush.patch @@ -0,0 +1,45 @@ +From f006db9e5451d7227c0c01b285c4b8a1a7b8d808 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 16:48:31 +0300 +Subject: wifi: p54: add missing parentheses in p54_flush() + +From: Rustam Subkhankulov + +[ Upstream commit bcfd9d7f6840b06d5988c7141127795cf405805e ] + +The assignment of the value to the variable total in the loop +condition must be enclosed in additional parentheses, since otherwise, +in accordance with the precedence of the operators, the conjunction +will be performed first, and only then the assignment. + +Due to this error, a warning later in the function after the loop may +not occur in the situation when it should. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Rustam Subkhankulov +Fixes: 0d4171e2153b ("p54: implement flush callback") +Acked-by: Christian Lamparter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220714134831.106004-1-subkhankulov@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intersil/p54/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c +index a3ca6620dc0c..8fa3ec71603e 100644 +--- a/drivers/net/wireless/intersil/p54/main.c ++++ b/drivers/net/wireless/intersil/p54/main.c +@@ -682,7 +682,7 @@ static void p54_flush(struct ieee80211_hw *dev, struct ieee80211_vif *vif, + * queues have already been stopped and no new frames can sneak + * up from behind. + */ +- while ((total = p54_flush_count(priv) && i--)) { ++ while ((total = p54_flush_count(priv)) && i--) { + /* waste time */ + msleep(20); + } +-- +2.35.1 + diff --git a/queue-5.4/wifi-p54-fix-an-error-handling-path-in-p54spi_probe.patch b/queue-5.4/wifi-p54-fix-an-error-handling-path-in-p54spi_probe.patch new file mode 100644 index 00000000000..3cad46ebc8b --- /dev/null +++ b/queue-5.4/wifi-p54-fix-an-error-handling-path-in-p54spi_probe.patch @@ -0,0 +1,52 @@ +From 00faa4245cb08b66027b1f8c004b2ee77db61c3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jun 2022 23:12:20 +0200 +Subject: wifi: p54: Fix an error handling path in p54spi_probe() + +From: Christophe JAILLET + +[ Upstream commit 83781f0162d080fec7dcb911afd1bc2f5ad04471 ] + +If an error occurs after a successful call to p54spi_request_firmware(), it +must be undone by a corresponding release_firmware() as already done in +the error handling path of p54spi_request_firmware() and in the .remove() +function. + +Add the missing call in the error handling path and remove it from +p54spi_request_firmware() now that it is the responsibility of the caller +to release the firmware + +Fixes: cd8d3d321285 ("p54spi: p54spi driver") +Signed-off-by: Christophe JAILLET +Acked-by: Christian Lamparter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/297d2547ff2ee627731662abceeab9dbdaf23231.1655068321.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intersil/p54/p54spi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intersil/p54/p54spi.c b/drivers/net/wireless/intersil/p54/p54spi.c +index ab0fe8565851..cdb57819684a 100644 +--- a/drivers/net/wireless/intersil/p54/p54spi.c ++++ b/drivers/net/wireless/intersil/p54/p54spi.c +@@ -164,7 +164,7 @@ static int p54spi_request_firmware(struct ieee80211_hw *dev) + + ret = p54_parse_firmware(dev, priv->firmware); + if (ret) { +- release_firmware(priv->firmware); ++ /* the firmware is released by the caller */ + return ret; + } + +@@ -659,6 +659,7 @@ static int p54spi_probe(struct spi_device *spi) + return 0; + + err_free_common: ++ release_firmware(priv->firmware); + free_irq(gpio_to_irq(p54spi_gpio_irq), spi); + err_free_gpio_irq: + gpio_free(p54spi_gpio_irq); +-- +2.35.1 + diff --git a/queue-5.4/wifi-rtlwifi-fix-error-codes-in-rtl_debugfs_set_writ.patch b/queue-5.4/wifi-rtlwifi-fix-error-codes-in-rtl_debugfs_set_writ.patch new file mode 100644 index 00000000000..ab6c0e439cb --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-fix-error-codes-in-rtl_debugfs_set_writ.patch @@ -0,0 +1,57 @@ +From d4415b51dd538244b20d777052c2a511a755fcb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 14:48:44 +0300 +Subject: wifi: rtlwifi: fix error codes in rtl_debugfs_set_write_h2c() + +From: Dan Carpenter + +[ Upstream commit b88d28146c30a8e14f0f012d56ebf19b68a348f4 ] + +If the copy_from_user() fails or the user gives invalid date then the +correct thing to do is to return a negative error code. (Currently it +returns success). + +I made a copy additional related cleanups: +1) There is no need to check "buffer" for NULL. That's handled by +copy_from_user(). +2) The "h2c_len" variable cannot be negative because it is unsigned +and because sscanf() does not return negative error codes. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YoOLnDkHgVltyXK7@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index 55db71c766fe..ec0da33da4f8 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -349,8 +349,8 @@ static ssize_t rtl_debugfs_set_write_h2c(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -360,8 +360,8 @@ static ssize_t rtl_debugfs_set_write_h2c(struct file *filp, + &h2c_data[4], &h2c_data[5], + &h2c_data[6], &h2c_data[7]); + +- if (h2c_len <= 0) +- return count; ++ if (h2c_len == 0) ++ return -EINVAL; + + for (i = 0; i < h2c_len; i++) + h2c_data_packed[i] = (u8)h2c_data[i]; +-- +2.35.1 + diff --git a/queue-5.4/wifi-wil6210-debugfs-fix-info-leak-in-wil_write_file.patch b/queue-5.4/wifi-wil6210-debugfs-fix-info-leak-in-wil_write_file.patch new file mode 100644 index 00000000000..27f80778a3f --- /dev/null +++ b/queue-5.4/wifi-wil6210-debugfs-fix-info-leak-in-wil_write_file.patch @@ -0,0 +1,52 @@ +From 6335473cc954e0e18b5beb97c7afa169bd5d6f5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 13:35:18 +0300 +Subject: wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() + +From: Dan Carpenter + +[ Upstream commit 7a4836560a6198d245d5732e26f94898b12eb760 ] + +The simple_write_to_buffer() function will succeed if even a single +byte is initialized. However, we need to initialize the whole buffer +to prevent information leaks. Just use memdup_user(). + +Fixes: ff974e408334 ("wil6210: debugfs interface to send raw WMI command") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/Ysg14NdKAZF/hcNG@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/wil6210/debugfs.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c +index 304b4d4e506a..b82af3a49912 100644 +--- a/drivers/net/wireless/ath/wil6210/debugfs.c ++++ b/drivers/net/wireless/ath/wil6210/debugfs.c +@@ -1023,18 +1023,12 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, + u16 cmdid; + int rc, rc1; + +- if (cmdlen < 0) ++ if (cmdlen < 0 || *ppos != 0) + return -EINVAL; + +- wmi = kmalloc(len, GFP_KERNEL); +- if (!wmi) +- return -ENOMEM; +- +- rc = simple_write_to_buffer(wmi, len, ppos, buf, len); +- if (rc < 0) { +- kfree(wmi); +- return rc; +- } ++ wmi = memdup_user(buf, len); ++ if (IS_ERR(wmi)) ++ return PTR_ERR(wmi); + + cmd = (cmdlen > 0) ? &wmi[1] : NULL; + cmdid = le16_to_cpu(wmi->command_id); +-- +2.35.1 + diff --git a/queue-5.4/wifi-wil6210-debugfs-fix-uninitialized-variable-use-.patch b/queue-5.4/wifi-wil6210-debugfs-fix-uninitialized-variable-use-.patch new file mode 100644 index 00000000000..31de1632041 --- /dev/null +++ b/queue-5.4/wifi-wil6210-debugfs-fix-uninitialized-variable-use-.patch @@ -0,0 +1,59 @@ +From ad5341252e5424dfdd05580d7f8938e6f00558a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 20:49:11 +0300 +Subject: wifi: wil6210: debugfs: fix uninitialized variable use in + `wil_write_file_wmi()` + +From: Ammar Faizi + +[ Upstream commit d578e0af3a003736f6c440188b156483d451b329 ] + +Commit 7a4836560a61 changes simple_write_to_buffer() with memdup_user() +but it forgets to change the value to be returned that came from +simple_write_to_buffer() call. It results in the following warning: + + warning: variable 'rc' is uninitialized when used here [-Wuninitialized] + return rc; + ^~ + +Remove rc variable and just return the passed in length if the +memdup_user() succeeds. + +Cc: Dan Carpenter +Reported-by: kernel test robot +Fixes: 7a4836560a6198d245d5732e26f94898b12eb760 ("wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()") +Fixes: ff974e4083341383d3dd4079e52ed30f57f376f0 ("wil6210: debugfs interface to send raw WMI command") +Signed-off-by: Ammar Faizi +Reviewed-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220724202452.61846-1-ammar.faizi@intel.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/wil6210/debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c +index b82af3a49912..1e38fdf92d1d 100644 +--- a/drivers/net/wireless/ath/wil6210/debugfs.c ++++ b/drivers/net/wireless/ath/wil6210/debugfs.c +@@ -1021,7 +1021,7 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, + void *cmd; + int cmdlen = len - sizeof(struct wmi_cmd_hdr); + u16 cmdid; +- int rc, rc1; ++ int rc1; + + if (cmdlen < 0 || *ppos != 0) + return -EINVAL; +@@ -1038,7 +1038,7 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, + + wil_info(wil, "0x%04x[%d] -> %d\n", cmdid, cmdlen, rc1); + +- return rc; ++ return len; + } + + static const struct file_operations fops_wmi = { +-- +2.35.1 + diff --git a/queue-5.4/x86-handle-idle-nomwait-cmdline-properly-for-x86_idl.patch b/queue-5.4/x86-handle-idle-nomwait-cmdline-properly-for-x86_idl.patch new file mode 100644 index 00000000000..5b484b3060b --- /dev/null +++ b/queue-5.4/x86-handle-idle-nomwait-cmdline-properly-for-x86_idl.patch @@ -0,0 +1,97 @@ +From 18a9b9bf4bdd2cb6f296381120197ac3a264eff7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 23:33:34 +0530 +Subject: x86: Handle idle=nomwait cmdline properly for x86_idle + +From: Wyes Karny + +[ Upstream commit 8bcedb4ce04750e1ccc9a6b6433387f6a9166a56 ] + +When kernel is booted with idle=nomwait do not use MWAIT as the +default idle state. + +If the user boots the kernel with idle=nomwait, it is a clear +direction to not use mwait as the default idle state. +However, the current code does not take this into consideration +while selecting the default idle state on x86. + +Fix it by checking for the idle=nomwait boot option in +prefer_mwait_c1_over_halt(). + +Also update the documentation around idle=nomwait appropriately. + +[ dhansen: tweak commit message ] + +Signed-off-by: Wyes Karny +Signed-off-by: Dave Hansen +Tested-by: Zhang Rui +Link: https://lkml.kernel.org/r/fdc2dc2d0a1bc21c2f53d989ea2d2ee3ccbc0dbe.1654538381.git-series.wyes.karny@amd.com +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/pm/cpuidle.rst | 15 +++++++++------ + arch/x86/kernel/process.c | 9 ++++++--- + 2 files changed, 15 insertions(+), 9 deletions(-) + +diff --git a/Documentation/admin-guide/pm/cpuidle.rst b/Documentation/admin-guide/pm/cpuidle.rst +index e70b365dbc60..80cf2ef2a506 100644 +--- a/Documentation/admin-guide/pm/cpuidle.rst ++++ b/Documentation/admin-guide/pm/cpuidle.rst +@@ -676,8 +676,8 @@ the ``menu`` governor to be used on the systems that use the ``ladder`` governor + by default this way, for example. + + The other kernel command line parameters controlling CPU idle time management +-described below are only relevant for the *x86* architecture and some of +-them affect Intel processors only. ++described below are only relevant for the *x86* architecture and references ++to ``intel_idle`` affect Intel processors only. + + The *x86* architecture support code recognizes three kernel command line + options related to CPU idle time management: ``idle=poll``, ``idle=halt``, +@@ -699,10 +699,13 @@ idle, so it very well may hurt single-thread computations performance as well as + energy-efficiency. Thus using it for performance reasons may not be a good idea + at all.] + +-The ``idle=nomwait`` option disables the ``intel_idle`` driver and causes +-``acpi_idle`` to be used (as long as all of the information needed by it is +-there in the system's ACPI tables), but it is not allowed to use the +-``MWAIT`` instruction of the CPUs to ask the hardware to enter idle states. ++The ``idle=nomwait`` option prevents the use of ``MWAIT`` instruction of ++the CPU to enter idle states. When this option is used, the ``acpi_idle`` ++driver will use the ``HLT`` instruction instead of ``MWAIT``. On systems ++running Intel processors, this option disables the ``intel_idle`` driver ++and forces the use of the ``acpi_idle`` driver instead. Note that in either ++case, ``acpi_idle`` driver will function only if all the information needed ++by it is in the system's ACPI tables. + + In addition to the architecture-level kernel command line options affecting CPU + idle time management, there are parameters affecting individual ``CPUIdle`` +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 571e38c9ee1d..068715a52ac1 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -659,6 +659,10 @@ static void amd_e400_idle(void) + */ + static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) + { ++ /* User has disallowed the use of MWAIT. Fallback to HALT */ ++ if (boot_option_idle_override == IDLE_NOMWAIT) ++ return 0; ++ + if (c->x86_vendor != X86_VENDOR_INTEL) + return 0; + +@@ -769,9 +773,8 @@ static int __init idle_setup(char *str) + } else if (!strcmp(str, "nomwait")) { + /* + * If the boot option of "idle=nomwait" is added, +- * it means that mwait will be disabled for CPU C2/C3 +- * states. In such case it won't touch the variable +- * of boot_option_idle_override. ++ * it means that mwait will be disabled for CPU C1/C2/C3 ++ * states. + */ + boot_option_idle_override = IDLE_NOMWAIT; + } else +-- +2.35.1 + diff --git a/queue-5.4/x86-numa-use-cpumask_available-instead-of-hardcoded-.patch b/queue-5.4/x86-numa-use-cpumask_available-instead-of-hardcoded-.patch new file mode 100644 index 00000000000..eaeebb783ee --- /dev/null +++ b/queue-5.4/x86-numa-use-cpumask_available-instead-of-hardcoded-.patch @@ -0,0 +1,76 @@ +From 0a4f97a71e6af1a8c7f7331e6afcceb8f4d1430e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Jul 2022 21:39:13 +0530 +Subject: x86/numa: Use cpumask_available instead of hardcoded NULL check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Siddh Raman Pant + +[ Upstream commit 625395c4a0f4775e0fe00f616888d2e6c1ba49db ] + +GCC-12 started triggering a new warning: + + arch/x86/mm/numa.c: In function ‘cpumask_of_node’: + arch/x86/mm/numa.c:916:39: warning: the comparison will always evaluate as ‘false’ for the address of ‘node_to_cpumask_map’ will never be NULL [-Waddress] + 916 | if (node_to_cpumask_map[node] == NULL) { + | ^~ + +node_to_cpumask_map is of type cpumask_var_t[]. + +When CONFIG_CPUMASK_OFFSTACK is set, cpumask_var_t is typedef'd to a +pointer for dynamic allocation, else to an array of one element. The +"wicked game" can be checked on line 700 of include/linux/cpumask.h. + +The original code in debug_cpumask_set_cpu() and cpumask_of_node() were +probably written by the original authors with CONFIG_CPUMASK_OFFSTACK=y +(i.e. dynamic allocation) in mind, checking if the cpumask was available +via a direct NULL check. + +When CONFIG_CPUMASK_OFFSTACK is not set, GCC gives the above warning +while compiling the kernel. + +Fix that by using cpumask_available(), which does the NULL check when +CONFIG_CPUMASK_OFFSTACK is set, otherwise returns true. Use it wherever +such checks are made. + +Conditional definitions of cpumask_available() can be found along with +the definition of cpumask_var_t. Check the cpumask.h reference mentioned +above. + +Fixes: c032ef60d1aa ("cpumask: convert node_to_cpumask_map[] to cpumask_var_t") +Fixes: de2d9445f162 ("x86: Unify node_to_cpumask_map handling between 32 and 64bit") +Signed-off-by: Siddh Raman Pant +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20220731160913.632092-1-code@siddh.me +Signed-off-by: Sasha Levin +--- + arch/x86/mm/numa.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c +index 4123100e0eaf..67c617c4a7f2 100644 +--- a/arch/x86/mm/numa.c ++++ b/arch/x86/mm/numa.c +@@ -822,7 +822,7 @@ void debug_cpumask_set_cpu(int cpu, int node, bool enable) + return; + } + mask = node_to_cpumask_map[node]; +- if (!mask) { ++ if (!cpumask_available(mask)) { + pr_err("node_to_cpumask_map[%i] NULL\n", node); + dump_stack(); + return; +@@ -868,7 +868,7 @@ const struct cpumask *cpumask_of_node(int node) + dump_stack(); + return cpu_none_mask; + } +- if (node_to_cpumask_map[node] == NULL) { ++ if (!cpumask_available(node_to_cpumask_map[node])) { + printk(KERN_WARNING + "cpumask_of_node(%d): no node_to_cpumask_map!\n", + node); +-- +2.35.1 + diff --git a/queue-5.4/x86-pmem-fix-platform-device-leak-in-error-path.patch b/queue-5.4/x86-pmem-fix-platform-device-leak-in-error-path.patch new file mode 100644 index 00000000000..f53edede4c8 --- /dev/null +++ b/queue-5.4/x86-pmem-fix-platform-device-leak-in-error-path.patch @@ -0,0 +1,41 @@ +From d3e7dc8997aa64c6c60a7677e92ac067e0b1fa78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jun 2022 16:07:23 +0200 +Subject: x86/pmem: Fix platform-device leak in error path + +From: Johan Hovold + +[ Upstream commit 229e73d46994f15314f58b2d39bf952111d89193 ] + +Make sure to free the platform device in the unlikely event that +registration fails. + +Fixes: 7a67832c7e44 ("libnvdimm, e820: make CONFIG_X86_PMEM_LEGACY a tristate option") +Signed-off-by: Johan Hovold +Signed-off-by: Borislav Petkov +Link: https://lore.kernel.org/r/20220620140723.9810-1-johan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/pmem.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/pmem.c b/arch/x86/kernel/pmem.c +index 6b07faaa1579..23154d24b117 100644 +--- a/arch/x86/kernel/pmem.c ++++ b/arch/x86/kernel/pmem.c +@@ -27,6 +27,11 @@ static __init int register_e820_pmem(void) + * simply here to trigger the module to load on demand. + */ + pdev = platform_device_alloc("e820_pmem", -1); +- return platform_device_add(pdev); ++ ++ rc = platform_device_add(pdev); ++ if (rc) ++ platform_device_put(pdev); ++ ++ return rc; + } + device_initcall(register_e820_pmem); +-- +2.35.1 +