From: Sasha Levin Date: Sun, 30 May 2021 20:40:32 +0000 (-0400) Subject: Fixes for 4.4 X-Git-Tag: v4.4.271~49 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e0bb91ac138fc9650e666165385a637176f20b29;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch b/queue-4.4/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch new file mode 100644 index 00000000000..7fa59038ba7 --- /dev/null +++ b/queue-4.4/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch @@ -0,0 +1,45 @@ +From efa61248647fc1b8a9236102c16e94984cd2d593 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:02 +0200 +Subject: ALSA: sb8: Add a comment note regarding an unused pointer + +From: Atul Gopinathan + +[ Upstream commit a28591f61b60fac820c6de59826ffa710e5e314e ] + +The field "fm_res" of "struct snd_sb8" is never used/dereferenced +throughout the sb8.c code. Therefore there is no need for any null value +check after the "request_region()". + +Add a comment note to make developers know about this and prevent any +"NULL check" patches on this part of code. + +Cc: Takashi Iwai +Signed-off-by: Atul Gopinathan +Link: https://lore.kernel.org/r/20210503115736.2104747-36-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/isa/sb/sb8.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index b8e2391c33ff..4fa3b0f2a270 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -109,7 +109,11 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + acard = card->private_data; + card->private_free = snd_sb8_free; + +- /* block the 0x388 port to avoid PnP conflicts */ ++ /* ++ * Block the 0x388 port to avoid PnP conflicts. ++ * No need to check this value after request_region, ++ * as we never do anything with it. ++ */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); + + if (port[dev] != SNDRV_AUTO_PORT) { +-- +2.30.2 + diff --git a/queue-4.4/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch b/queue-4.4/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch new file mode 100644 index 00000000000..2441b95f0d9 --- /dev/null +++ b/queue-4.4/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch @@ -0,0 +1,61 @@ +From 07a01d788f4652fd15bbe7d1b14aebda9935b38a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:10 +0200 +Subject: ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() + +From: Anirudh Rayabharam + +[ Upstream commit fc6a6521556c8250e356ddc6a3f2391aa62dc976 ] + +ath6kl_wmi_cmd_send could fail, so let's return its error code upstream. + +Signed-off-by: Kangjie Lu +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/debug.c | 5 ++++- + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c +index e2b7809d7886..f3a786af7ece 100644 +--- a/drivers/net/wireless/ath/ath6kl/debug.c ++++ b/drivers/net/wireless/ath/ath6kl/debug.c +@@ -1027,14 +1027,17 @@ static ssize_t ath6kl_lrssi_roam_write(struct file *file, + { + struct ath6kl *ar = file->private_data; + unsigned long lrssi_roam_threshold; ++ int ret; + + if (kstrtoul_from_user(user_buf, count, 0, &lrssi_roam_threshold)) + return -EINVAL; + + ar->lrssi_roam_threshold = lrssi_roam_threshold; + +- ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold); ++ ret = ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold); + ++ if (ret) ++ return ret; + return count; + } + +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c +index 7e1010475cfb..4aead53acf38 100644 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c +@@ -776,10 +776,8 @@ int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi) + cmd->info.params.roam_rssi_floor = DEF_LRSSI_ROAM_FLOOR; + cmd->roam_ctrl = WMI_SET_LRSSI_SCAN_PARAMS; + +- ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, ++ return ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, + NO_SYNC_WMIFLAG); +- +- return 0; + } + + int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid) +-- +2.30.2 + diff --git a/queue-4.4/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch b/queue-4.4/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch new file mode 100644 index 00000000000..cbaf0d5ca6f --- /dev/null +++ b/queue-4.4/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch @@ -0,0 +1,76 @@ +From 11cc51bf58da1455202ed7ec11fa77d49f5193bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 10:56:16 -0400 +Subject: btrfs: do not BUG_ON in link_to_fixup_dir + +From: Josef Bacik + +[ Upstream commit 91df99a6eb50d5a1bc70fff4a09a0b7ae6aab96d ] + +While doing error injection testing I got the following panic + + kernel BUG at fs/btrfs/tree-log.c:1862! + invalid opcode: 0000 [#1] SMP NOPTI + CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 + RIP: 0010:link_to_fixup_dir+0xd5/0xe0 + RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216 + RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0 + RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000 + RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001 + R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800 + R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065 + FS: 00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0 + Call Trace: + replay_one_buffer+0x409/0x470 + ? btree_read_extent_buffer_pages+0xd0/0x110 + walk_up_log_tree+0x157/0x1e0 + walk_log_tree+0xa6/0x1d0 + btrfs_recover_log_trees+0x1da/0x360 + ? replay_one_extent+0x7b0/0x7b0 + open_ctree+0x1486/0x1720 + btrfs_mount_root.cold+0x12/0xea + ? __kmalloc_track_caller+0x12f/0x240 + legacy_get_tree+0x24/0x40 + vfs_get_tree+0x22/0xb0 + vfs_kern_mount.part.0+0x71/0xb0 + btrfs_mount+0x10d/0x380 + ? vfs_parse_fs_string+0x4d/0x90 + legacy_get_tree+0x24/0x40 + vfs_get_tree+0x22/0xb0 + path_mount+0x433/0xa10 + __x64_sys_mount+0xe3/0x120 + do_syscall_64+0x3d/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +We can get -EIO or any number of legitimate errors from +btrfs_search_slot(), panicing here is not the appropriate response. The +error path for this code handles errors properly, simply return the +error. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/tree-log.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index ee26ccd12da8..4cab553c347a 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1582,8 +1582,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans, + ret = btrfs_update_inode(trans, root, inode); + } else if (ret == -EEXIST) { + ret = 0; +- } else { +- BUG(); /* Logic Error */ + } + iput(inode); + +-- +2.30.2 + diff --git a/queue-4.4/char-hpet-add-checks-after-calling-ioremap.patch b/queue-4.4/char-hpet-add-checks-after-calling-ioremap.patch new file mode 100644 index 00000000000..51ede874399 --- /dev/null +++ b/queue-4.4/char-hpet-add-checks-after-calling-ioremap.patch @@ -0,0 +1,46 @@ +From c88d0d030021b1d2eaaccea9f4d489c597c709ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:56 +0200 +Subject: char: hpet: add checks after calling ioremap + +From: Tom Seewald + +[ Upstream commit b11701c933112d49b808dee01cb7ff854ba6a77a ] + +The function hpet_resources() calls ioremap() two times, but in both +cases it does not check if ioremap() returned a null pointer. Fix this +by adding null pointer checks and returning an appropriate error. + +Signed-off-by: Tom Seewald +Link: https://lore.kernel.org/r/20210503115736.2104747-30-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/hpet.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c +index 5b38d7a8202a..eb205f9173f4 100644 +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -976,6 +976,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + if (ACPI_SUCCESS(status)) { + hdp->hd_phys_address = addr.address.minimum; + hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length); ++ if (!hdp->hd_address) ++ return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +@@ -989,6 +991,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + hdp->hd_phys_address = fixmem32->address; + hdp->hd_address = ioremap(fixmem32->address, + HPET_RANGE_SIZE); ++ if (!hdp->hd_address) ++ return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +-- +2.30.2 + diff --git a/queue-4.4/drm-amdgpu-fix-a-use-after-free.patch b/queue-4.4/drm-amdgpu-fix-a-use-after-free.patch new file mode 100644 index 00000000000..000f2c74066 --- /dev/null +++ b/queue-4.4/drm-amdgpu-fix-a-use-after-free.patch @@ -0,0 +1,52 @@ +From b4ef130580e1c2713e0630523d0f1c6920fdaccf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 10:56:07 +0800 +Subject: drm/amdgpu: Fix a use-after-free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: xinhui pan + +[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ] + +looks like we forget to set ttm->sg to NULL. +Hit panic below + +[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 1235.989074] Call Trace: +[ 1235.991751] sg_free_table+0x17/0x20 +[ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu] +[ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu] +[ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm] +[ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm] +[ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm] +[ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm] +[ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu] +[ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu] +[ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu] +[ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu] + +Signed-off-by: xinhui pan +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 6beb3e76e1c9..014b87143837 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -737,6 +737,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm) + + if (gtt && gtt->userptr) { + kfree(ttm->sg); ++ ttm->sg = NULL; + ttm->page_flags &= ~TTM_PAGE_FLAG_SG; + return; + } +-- +2.30.2 + diff --git a/queue-4.4/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch b/queue-4.4/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch new file mode 100644 index 00000000000..33afe61e366 --- /dev/null +++ b/queue-4.4/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch @@ -0,0 +1,99 @@ +From 013c9d232e871ad33f07c5452932af6330e06e4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:08 +0200 +Subject: isdn: mISDNinfineon: check/cleanup ioremap failure correctly in + setup_io + +From: Phillip Potter + +[ Upstream commit c446f0d4702d316e1c6bf621f70e79678d28830a ] + +Move hw->cfg.mode and hw->addr.mode assignments from hw->ci->cfg_mode +and hw->ci->addr_mode respectively, to be before the subsequent checks +for memory IO mode (and possible ioremap calls in this case). + +Also introduce ioremap error checks at both locations. This allows +resources to be properly freed on ioremap failure, as when the caller +of setup_io then subsequently calls release_io via its error path, +release_io can now correctly determine the mode as it has been set +before the ioremap call. + +Finally, refactor release_io function so that it will call +release_mem_region in the memory IO case, regardless of whether or not +hw->cfg.p/hw->addr.p are NULL. This means resources are then properly +released on failure. + +This properly implements the original reverted commit (d721fe99f6ad) +from the University of Minnesota, whilst also implementing the ioremap +check for the hw->ci->cfg_mode if block as well. + +Cc: David S. Miller +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-42-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++++++++++++++------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +index d5bdbaf93a1a..d0b6377b9834 100644 +--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c ++++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +@@ -645,17 +645,19 @@ static void + release_io(struct inf_hw *hw) + { + if (hw->cfg.mode) { +- if (hw->cfg.p) { ++ if (hw->cfg.mode == AM_MEMIO) { + release_mem_region(hw->cfg.start, hw->cfg.size); +- iounmap(hw->cfg.p); ++ if (hw->cfg.p) ++ iounmap(hw->cfg.p); + } else + release_region(hw->cfg.start, hw->cfg.size); + hw->cfg.mode = AM_NONE; + } + if (hw->addr.mode) { +- if (hw->addr.p) { ++ if (hw->addr.mode == AM_MEMIO) { + release_mem_region(hw->addr.start, hw->addr.size); +- iounmap(hw->addr.p); ++ if (hw->addr.p) ++ iounmap(hw->addr.p); + } else + release_region(hw->addr.start, hw->addr.size); + hw->addr.mode = AM_NONE; +@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw) + (ulong)hw->cfg.start, (ulong)hw->cfg.size); + return err; + } +- if (hw->ci->cfg_mode == AM_MEMIO) +- hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); + hw->cfg.mode = hw->ci->cfg_mode; ++ if (hw->ci->cfg_mode == AM_MEMIO) { ++ hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); ++ if (!hw->cfg.p) ++ return -ENOMEM; ++ } + if (debug & DEBUG_HW) + pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n", + hw->name, (ulong)hw->cfg.start, +@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw) + (ulong)hw->addr.start, (ulong)hw->addr.size); + return err; + } +- if (hw->ci->addr_mode == AM_MEMIO) +- hw->addr.p = ioremap(hw->addr.start, hw->addr.size); + hw->addr.mode = hw->ci->addr_mode; ++ if (hw->ci->addr_mode == AM_MEMIO) { ++ hw->addr.p = ioremap(hw->addr.start, hw->addr.size); ++ if (!hw->addr.p) ++ return -ENOMEM; ++ } + if (debug & DEBUG_HW) + pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n", + hw->name, (ulong)hw->addr.start, +-- +2.30.2 + diff --git a/queue-4.4/libertas-register-sysfs-groups-properly.patch b/queue-4.4/libertas-register-sysfs-groups-properly.patch new file mode 100644 index 00000000000..c64dab65bc5 --- /dev/null +++ b/queue-4.4/libertas-register-sysfs-groups-properly.patch @@ -0,0 +1,94 @@ +From 256ac52b02bca2687c06eb52d14809d26f41f46d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:20 +0200 +Subject: libertas: register sysfs groups properly + +From: Greg Kroah-Hartman + +[ Upstream commit 7e79b38fe9a403b065ac5915465f620a8fb3de84 ] + +The libertas driver was trying to register sysfs groups "by hand" which +causes them to be created _after_ the device is initialized and +announced to userspace, which causes races and can prevent userspace +tools from seeing the sysfs files correctly. + +Fix this up by using the built-in sysfs_groups pointers in struct +net_device which were created for this very reason, fixing the race +condition, and properly allowing for any error that might have occured +to be handled properly. + +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-54-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/libertas/mesh.c | 28 ++++------------------------ + 1 file changed, 4 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/wireless/libertas/mesh.c b/drivers/net/wireless/libertas/mesh.c +index d0c881dd5846..f1e9cbcfdc16 100644 +--- a/drivers/net/wireless/libertas/mesh.c ++++ b/drivers/net/wireless/libertas/mesh.c +@@ -797,19 +797,6 @@ static const struct attribute_group mesh_ie_group = { + .attrs = mesh_ie_attrs, + }; + +-static void lbs_persist_config_init(struct net_device *dev) +-{ +- int ret; +- ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group); +- ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group); +-} +- +-static void lbs_persist_config_remove(struct net_device *dev) +-{ +- sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group); +- sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group); +-} +- + + /*************************************************************************** + * Initializing and starting, stopping mesh +@@ -1021,6 +1008,10 @@ static int lbs_add_mesh(struct lbs_private *priv) + SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent); + + mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST; ++ mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group; ++ mesh_dev->sysfs_groups[1] = &boot_opts_group; ++ mesh_dev->sysfs_groups[2] = &mesh_ie_group; ++ + /* Register virtual mesh interface */ + ret = register_netdev(mesh_dev); + if (ret) { +@@ -1028,19 +1019,10 @@ static int lbs_add_mesh(struct lbs_private *priv) + goto err_free_netdev; + } + +- ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); +- if (ret) +- goto err_unregister; +- +- lbs_persist_config_init(mesh_dev); +- + /* Everything successful */ + ret = 0; + goto done; + +-err_unregister: +- unregister_netdev(mesh_dev); +- + err_free_netdev: + free_netdev(mesh_dev); + +@@ -1063,8 +1045,6 @@ void lbs_remove_mesh(struct lbs_private *priv) + lbs_deb_enter(LBS_DEB_MESH); + netif_stop_queue(mesh_dev); + netif_carrier_off(mesh_dev); +- sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); +- lbs_persist_config_remove(mesh_dev); + unregister_netdev(mesh_dev); + priv->mesh_dev = NULL; + kfree(mesh_dev->ieee80211_ptr); +-- +2.30.2 + diff --git a/queue-4.4/media-dvb-add-check-on-sp8870_readreg-return.patch b/queue-4.4/media-dvb-add-check-on-sp8870_readreg-return.patch new file mode 100644 index 00000000000..decf3280beb --- /dev/null +++ b/queue-4.4/media-dvb-add-check-on-sp8870_readreg-return.patch @@ -0,0 +1,40 @@ +From d9736f80e8243e9c4cbe48d87af5bd4749ca251c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:26 +0200 +Subject: media: dvb: Add check on sp8870_readreg return + +From: Alaa Emad + +[ Upstream commit c6d822c56e7fd29e6fa1b1bb91b98f6a1e942b3c ] + +The function sp8870_readreg returns a negative value when i2c_transfer +fails so properly check for this and return the error if it happens. + +Cc: Sean Young +Cc: Mauro Carvalho Chehab +Signed-off-by: Alaa Emad +Link: https://lore.kernel.org/r/20210503115736.2104747-60-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/sp8870.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c +index e87ac30d7fb8..b43135c5a960 100644 +--- a/drivers/media/dvb-frontends/sp8870.c ++++ b/drivers/media/dvb-frontends/sp8870.c +@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe) + sp8870_writereg(state, 0xc05, reg0xc05); + + // read status reg in order to clear pending irqs +- sp8870_readreg(state, 0x200); ++ err = sp8870_readreg(state, 0x200); ++ if (err < 0) ++ return err; + + // system controller start + sp8870_microcontroller_start(state); +-- +2.30.2 + diff --git a/queue-4.4/media-gspca-mt9m111-check-write_bridge-for-timeout.patch b/queue-4.4/media-gspca-mt9m111-check-write_bridge-for-timeout.patch new file mode 100644 index 00000000000..20a6a617315 --- /dev/null +++ b/queue-4.4/media-gspca-mt9m111-check-write_bridge-for-timeout.patch @@ -0,0 +1,58 @@ +From 2e88e9fb46605400a624ba9e4a65982d5b0e861d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:28 +0200 +Subject: media: gspca: mt9m111: Check write_bridge for timeout + +From: Alaa Emad + +[ Upstream commit 656025850074f5c1ba2e05be37bda57ba2b8d491 ] + +In mt9m111_probe, m5602_write_bridge can timeout and return a negative +error value. The fix checks for this error and passes it upstream. + +Signed-off-by: Aditya Pakki +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_mt9m111.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +index 27fcef11aef4..67bb207f4eb2 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c ++++ b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +@@ -55,7 +55,7 @@ static const struct v4l2_ctrl_config mt9m111_greenbal_cfg = { + int mt9m111_probe(struct sd *sd) + { + u8 data[2] = {0x00, 0x00}; +- int i; ++ int i, err; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -73,15 +73,17 @@ int mt9m111_probe(struct sd *sd) + /* Do the preinit */ + for (i = 0; i < ARRAY_SIZE(preinit_mt9m111); i++) { + if (preinit_mt9m111[i][0] == BRIDGE) { +- m5602_write_bridge(sd, +- preinit_mt9m111[i][1], +- preinit_mt9m111[i][2]); ++ err = m5602_write_bridge(sd, ++ preinit_mt9m111[i][1], ++ preinit_mt9m111[i][2]); + } else { + data[0] = preinit_mt9m111[i][2]; + data[1] = preinit_mt9m111[i][3]; +- m5602_write_sensor(sd, +- preinit_mt9m111[i][1], data, 2); ++ err = m5602_write_sensor(sd, ++ preinit_mt9m111[i][1], data, 2); + } ++ if (err < 0) ++ return err; + } + + if (m5602_read_sensor(sd, MT9M111_SC_CHIPVER, data, 2)) +-- +2.30.2 + diff --git a/queue-4.4/media-gspca-properly-check-for-errors-in-po1030_prob.patch b/queue-4.4/media-gspca-properly-check-for-errors-in-po1030_prob.patch new file mode 100644 index 00000000000..dd0f285fef5 --- /dev/null +++ b/queue-4.4/media-gspca-properly-check-for-errors-in-po1030_prob.patch @@ -0,0 +1,52 @@ +From a94b1eb577160ed06e55c79f28790ecccf37e332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:30 +0200 +Subject: media: gspca: properly check for errors in po1030_probe() + +From: Greg Kroah-Hartman + +[ Upstream commit dacb408ca6f0e34df22b40d8dd5fae7f8e777d84 ] + +If m5602_write_sensor() or m5602_write_bridge() fail, do not continue to +initialize the device but return the error to the calling funtion. + +Cc: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210503115736.2104747-64-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c +index 4bf5c43424b7..971253dafb57 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c ++++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c +@@ -55,6 +55,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = { + int po1030_probe(struct sd *sd) + { + u8 dev_id_h = 0, i; ++ int err; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -73,10 +74,13 @@ int po1030_probe(struct sd *sd) + for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) { + u8 data = preinit_po1030[i][2]; + if (preinit_po1030[i][0] == SENSOR) +- m5602_write_sensor(sd, +- preinit_po1030[i][1], &data, 1); ++ err = m5602_write_sensor(sd, preinit_po1030[i][1], ++ &data, 1); + else +- m5602_write_bridge(sd, preinit_po1030[i][1], data); ++ err = m5602_write_bridge(sd, preinit_po1030[i][1], ++ data); ++ if (err < 0) ++ return err; + } + + if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1)) +-- +2.30.2 + diff --git a/queue-4.4/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch b/queue-4.4/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch new file mode 100644 index 00000000000..d7f686cde95 --- /dev/null +++ b/queue-4.4/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch @@ -0,0 +1,80 @@ +From 2352a462af038ae96527c0b62a82bc6ec0910901 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:46 +0200 +Subject: net: caif: remove BUG_ON(dev == NULL) in caif_xmit + +From: Du Cheng + +[ Upstream commit 65a67792e3416f7c5d7daa47d99334cbb19a7449 ] + +The condition of dev == NULL is impossible in caif_xmit(), hence it is +for the removal. + +Explanation: +The static caif_xmit() is only called upon via a function pointer +`ndo_start_xmit` defined in include/linux/netdevice.h: +``` +struct net_device_ops { + ... + netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev); + ... +} +``` + +The exhausive list of call points are: +``` +drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c + dev->netdev_ops->ndo_start_xmit(skb, dev); + ^ ^ + +drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c + struct opa_vnic_adapter *adapter = opa_vnic_priv(netdev); + ^ ^ + return adapter->rn_ops->ndo_start_xmit(skb, netdev); // adapter would crash first + ^ ^ + +drivers/usb/gadget/function/f_ncm.c + ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev); + ^ ^ + +include/linux/netdevice.h +static inline netdev_tx_t __netdev_start_xmit(... +{ + return ops->ndo_start_xmit(skb, dev); + ^ +} + + const struct net_device_ops *ops = dev->netdev_ops; + ^ + rc = __netdev_start_xmit(ops, skb, dev, more); + ^ +``` + +In each of the enumerated scenarios, it is impossible for the NULL-valued dev to +reach the caif_xmit() without crashing the kernel earlier, therefore `BUG_ON(dev == +NULL)` is rather useless, hence the removal. + +Cc: David S. Miller +Signed-off-by: Du Cheng +Link: https://lore.kernel.org/r/20210503115736.2104747-20-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/caif/caif_serial.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c +index c2dea4916e5d..32834dad0b83 100644 +--- a/drivers/net/caif/caif_serial.c ++++ b/drivers/net/caif/caif_serial.c +@@ -281,7 +281,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct ser_device *ser; + +- BUG_ON(dev == NULL); + ser = netdev_priv(dev); + + /* Send flow off once, on high water mark */ +-- +2.30.2 + diff --git a/queue-4.4/net-fujitsu-fix-potential-null-ptr-deref.patch b/queue-4.4/net-fujitsu-fix-potential-null-ptr-deref.patch new file mode 100644 index 00000000000..d65790488a2 --- /dev/null +++ b/queue-4.4/net-fujitsu-fix-potential-null-ptr-deref.patch @@ -0,0 +1,42 @@ +From aafeab6c3ae8ed6818e6089c17b90fa2448ebf27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:42 +0200 +Subject: net: fujitsu: fix potential null-ptr-deref + +From: Anirudh Rayabharam + +[ Upstream commit 52202be1cd996cde6e8969a128dc27ee45a7cb5e ] + +In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer +deref. To fix this, check the return value of ioremap and return -1 +to the caller in case of failure. + +Cc: "David S. Miller" +Acked-by: Dominik Brodowski +Signed-off-by: Anirudh Rayabharam +Link: https://lore.kernel.org/r/20210503115736.2104747-16-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +index a7139f588ad2..fb1a9bd24660 100644 +--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c ++++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +@@ -548,6 +548,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id) + return -1; + + base = ioremap(link->resource[2]->start, resource_size(link->resource[2])); ++ if (!base) { ++ pcmcia_release_window(link, link->resource[2]); ++ return -1; ++ } ++ + pcmcia_map_mem_page(link, link->resource[2], 0); + + /* +-- +2.30.2 + diff --git a/queue-4.4/openrisc-define-memory-barrier-mb.patch b/queue-4.4/openrisc-define-memory-barrier-mb.patch new file mode 100644 index 00000000000..6d4f8b25c7d --- /dev/null +++ b/queue-4.4/openrisc-define-memory-barrier-mb.patch @@ -0,0 +1,48 @@ +From af538ed1a950966c0c48eb4d04a8a17be93189d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 14:45:43 +0200 +Subject: openrisc: Define memory barrier mb + +From: Peter Zijlstra + +[ Upstream commit 8b549c18ae81dbc36fb11e4aa08b8378c599ca95 ] + +This came up in the discussion of the requirements of qspinlock on an +architecture. OpenRISC uses qspinlock, but it was noticed that the +memmory barrier was not defined. + +Peter defined it in the mail thread writing: + + As near as I can tell this should do. The arch spec only lists + this one instruction and the text makes it sound like a completion + barrier. + +This is correct so applying this patch. + +Signed-off-by: Peter Zijlstra +[shorne@gmail.com:Turned the mail into a patch] +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + create mode 100644 arch/openrisc/include/asm/barrier.h + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +new file mode 100644 +index 000000000000..7538294721be +--- /dev/null ++++ b/arch/openrisc/include/asm/barrier.h +@@ -0,0 +1,9 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef __ASM_BARRIER_H ++#define __ASM_BARRIER_H ++ ++#define mb() asm volatile ("l.msync" ::: "memory") ++ ++#include ++ ++#endif /* __ASM_BARRIER_H */ +-- +2.30.2 + diff --git a/queue-4.4/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch b/queue-4.4/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch new file mode 100644 index 00000000000..6aff166260a --- /dev/null +++ b/queue-4.4/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch @@ -0,0 +1,95 @@ +From cc014e2a223f9476e12d2c41a6d2f58b13e4840b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Apr 2021 14:07:35 +0800 +Subject: platform/x86: hp_accel: Avoid invoking _INI to speed up resume +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai-Heng Feng + +[ Upstream commit 79d341e26ebcdbc622348aaaab6f8f89b6fdb25f ] + +hp_accel can take almost two seconds to resume on some HP laptops. + +The bottleneck is on evaluating _INI, which is only needed to run once. + +Resolve the issue by only invoking _INI when it's necessary. Namely, on +probe and on hibernation restore. + +Signed-off-by: Kai-Heng Feng +Acked-by: Éric Piel +Link: https://lore.kernel.org/r/20210430060736.590321-1-kai.heng.feng@canonical.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/misc/lis3lv02d/lis3lv02d.h | 1 + + drivers/platform/x86/hp_accel.c | 22 +++++++++++++++++++++- + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h +index c439c827eea8..0ef759671b54 100644 +--- a/drivers/misc/lis3lv02d/lis3lv02d.h ++++ b/drivers/misc/lis3lv02d/lis3lv02d.h +@@ -284,6 +284,7 @@ struct lis3lv02d { + int regs_size; + u8 *reg_cache; + bool regs_stored; ++ bool init_required; + u8 odr_mask; /* ODR bit mask */ + u8 whoami; /* indicates measurement precision */ + s16 (*read_data) (struct lis3lv02d *lis3, int reg); +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 10ce6cba4455..a06262e91a93 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids); + static int lis3lv02d_acpi_init(struct lis3lv02d *lis3) + { + struct acpi_device *dev = lis3->bus_priv; ++ if (!lis3->init_required) ++ return 0; ++ + if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI, + NULL, NULL) != AE_OK) + return -EINVAL; +@@ -361,6 +364,7 @@ static int lis3lv02d_add(struct acpi_device *device) + } + + /* call the core layer do its init */ ++ lis3_dev.init_required = true; + ret = lis3lv02d_init_device(&lis3_dev); + if (ret) + return ret; +@@ -408,11 +412,27 @@ static int lis3lv02d_suspend(struct device *dev) + + static int lis3lv02d_resume(struct device *dev) + { ++ lis3_dev.init_required = false; ++ lis3lv02d_poweron(&lis3_dev); ++ return 0; ++} ++ ++static int lis3lv02d_restore(struct device *dev) ++{ ++ lis3_dev.init_required = true; + lis3lv02d_poweron(&lis3_dev); + return 0; + } + +-static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume); ++static const struct dev_pm_ops hp_accel_pm = { ++ .suspend = lis3lv02d_suspend, ++ .resume = lis3lv02d_resume, ++ .freeze = lis3lv02d_suspend, ++ .thaw = lis3lv02d_resume, ++ .poweroff = lis3lv02d_suspend, ++ .restore = lis3lv02d_restore, ++}; ++ + #define HP_ACCEL_PM (&hp_accel_pm) + #else + #define HP_ACCEL_PM NULL +-- +2.30.2 + diff --git a/queue-4.4/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch b/queue-4.4/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch new file mode 100644 index 00000000000..52bd2942d0a --- /dev/null +++ b/queue-4.4/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch @@ -0,0 +1,65 @@ +From 49fbb3ad74d4c2b3264a04900d3c68df4549ee6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 03:04:37 +0000 +Subject: scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic + +From: Matt Wang + +[ Upstream commit 56f396146af278135c0ff958c79b5ee1bd22453d ] + +Commit 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit") +introduced a serious issue for 64-bit systems. With this commit, +64-bit kernel will enumerate 8*15 non-existing disks. This is caused +by the broken CCB structure. The change from u32 data to void *data +increased CCB length on 64-bit system, which introduced an extra 4 +byte offset of the CDB. This leads to incorrect response to INQUIRY +commands during enumeration. + +Fix disk enumeration failure by reverting the portion of the commit +above which switched the data pointer from u32 to void. + +Link: https://lore.kernel.org/r/C325637F-1166-4340-8F0F-3BCCD59D4D54@vmware.com +Acked-by: Khalid Aziz +Signed-off-by: Matt Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 +++--- + drivers/scsi/BusLogic.h | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index c7be7bb37209..b9b4491d732a 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command, + ccb->opcode = BLOGIC_INITIATOR_CCB_SG; + ccb->datalen = count * sizeof(struct blogic_sg_seg); + if (blogic_multimaster_type(adapter)) +- ccb->data = (void *)((unsigned int) ccb->dma_handle + ++ ccb->data = (unsigned int) ccb->dma_handle + + ((unsigned long) &ccb->sglist - +- (unsigned long) ccb)); ++ (unsigned long) ccb); + else +- ccb->data = ccb->sglist; ++ ccb->data = virt_to_32bit_virt(ccb->sglist); + + scsi_for_each_sg(command, sg, count, i) { + ccb->sglist[i].segbytes = sg_dma_len(sg); +diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h +index b53ec2f1e8cd..5c950a7a1b1c 100644 +--- a/drivers/scsi/BusLogic.h ++++ b/drivers/scsi/BusLogic.h +@@ -821,7 +821,7 @@ struct blogic_ccb { + unsigned char cdblen; /* Byte 2 */ + unsigned char sense_datalen; /* Byte 3 */ + u32 datalen; /* Bytes 4-7 */ +- void *data; /* Bytes 8-11 */ ++ u32 data; /* Bytes 8-11 */ + unsigned char:8; /* Byte 12 */ + unsigned char:8; /* Byte 13 */ + enum blogic_adapter_status adapter_status; /* Byte 14 */ +-- +2.30.2 + diff --git a/queue-4.4/series b/queue-4.4/series index 9891a49c255..be46c14f374 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -28,3 +28,18 @@ revert-net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch tipc-skb_linearize-the-head-skb-when-reassembling-msgs.patch i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch +platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch +net-fujitsu-fix-potential-null-ptr-deref.patch +net-caif-remove-bug_on-dev-null-in-caif_xmit.patch +char-hpet-add-checks-after-calling-ioremap.patch +alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch +isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch +ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch +libertas-register-sysfs-groups-properly.patch +media-dvb-add-check-on-sp8870_readreg-return.patch +media-gspca-mt9m111-check-write_bridge-for-timeout.patch +media-gspca-properly-check-for-errors-in-po1030_prob.patch +scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch +openrisc-define-memory-barrier-mb.patch +btrfs-do-not-bug_on-in-link_to_fixup_dir.patch +drm-amdgpu-fix-a-use-after-free.patch