From: Greg Kroah-Hartman Date: Mon, 18 Oct 2021 11:51:38 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.14.252~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e1cb19ac9ea60e01abdb0261701bcaefa1cb3066;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: acpi-arm64-fix-next_platform_timer-section-mismatch-error.patch ata-ahci_platform-fix-null-ptr-deref-in-ahci_platform_enable_regulators.patch drm-msm-dsi-fix-an-error-code-in-msm_dsi_modeset_init.patch drm-msm-dsi-fix-off-by-one-in-dsi_bus_clk_enable-error-handling.patch drm-msm-fix-null-pointer-dereference-on-pointer-edp.patch drm-msm-mdp5-fix-cursor-related-warnings.patch drm-panel-olimex-lcd-olinuxino-select-crc32.patch ionic-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch mlxsw-thermal-fix-out-of-bounds-memory-accesses.patch mqprio-correct-stats-in-mqprio_dump_class_stats.patch nfc-digital-fix-possible-memory-leak-in-digital_in_send_sdd_req.patch nfc-digital-fix-possible-memory-leak-in-digital_tg_listen_mdaa.patch nfc-fix-error-handling-of-nfc_proto_register.patch pata_legacy-fix-a-couple-uninitialized-variable-bugs.patch platform-mellanox-mlxreg-io-fix-argument-base-in-kstrtou32-call.patch qed-fix-missing-error-code-in-qed_slowpath_start.patch r8152-select-crc32-and-crypto-crypto_hash-crypto_sha256.patch --- diff --git a/queue-5.4/acpi-arm64-fix-next_platform_timer-section-mismatch-error.patch b/queue-5.4/acpi-arm64-fix-next_platform_timer-section-mismatch-error.patch new file mode 100644 index 00000000000..b16fea82839 --- /dev/null +++ b/queue-5.4/acpi-arm64-fix-next_platform_timer-section-mismatch-error.patch @@ -0,0 +1,52 @@ +From 596143e3aec35c93508d6b7a05ddc999ee209b61 Mon Sep 17 00:00:00 2001 +From: Jackie Liu +Date: Mon, 23 Aug 2021 17:25:26 +0800 +Subject: acpi/arm64: fix next_platform_timer() section mismatch error + +From: Jackie Liu + +commit 596143e3aec35c93508d6b7a05ddc999ee209b61 upstream. + +Fix modpost Section mismatch error in next_platform_timer(). + + [...] + WARNING: modpost: vmlinux.o(.text.unlikely+0x26e60): Section mismatch in reference from the function next_platform_timer() to the variable .init.data:acpi_gtdt_desc + The function next_platform_timer() references + the variable __initdata acpi_gtdt_desc. + This is often because next_platform_timer lacks a __initdata + annotation or the annotation of acpi_gtdt_desc is wrong. + + WARNING: modpost: vmlinux.o(.text.unlikely+0x26e64): Section mismatch in reference from the function next_platform_timer() to the variable .init.data:acpi_gtdt_desc + The function next_platform_timer() references + the variable __initdata acpi_gtdt_desc. + This is often because next_platform_timer lacks a __initdata + annotation or the annotation of acpi_gtdt_desc is wrong. + + ERROR: modpost: Section mismatches detected. + Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them. + make[1]: *** [scripts/Makefile.modpost:59: vmlinux.symvers] Error 1 + make[1]: *** Deleting file 'vmlinux.symvers' + make: *** [Makefile:1176: vmlinux] Error 2 + [...] + +Fixes: a712c3ed9b8a ("acpi/arm64: Add memory-mapped timer support in GTDT driver") +Signed-off-by: Jackie Liu +Acked-by: Hanjun Guo +Link: https://lore.kernel.org/r/20210823092526.2407526-1-liu.yun@linux.dev +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/arm64/gtdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/arm64/gtdt.c ++++ b/drivers/acpi/arm64/gtdt.c +@@ -36,7 +36,7 @@ struct acpi_gtdt_descriptor { + + static struct acpi_gtdt_descriptor acpi_gtdt_desc __initdata; + +-static inline void *next_platform_timer(void *platform_timer) ++static inline __init void *next_platform_timer(void *platform_timer) + { + struct acpi_gtdt_header *gh = platform_timer; + diff --git a/queue-5.4/ata-ahci_platform-fix-null-ptr-deref-in-ahci_platform_enable_regulators.patch b/queue-5.4/ata-ahci_platform-fix-null-ptr-deref-in-ahci_platform_enable_regulators.patch new file mode 100644 index 00000000000..2ce8bad1bbc --- /dev/null +++ b/queue-5.4/ata-ahci_platform-fix-null-ptr-deref-in-ahci_platform_enable_regulators.patch @@ -0,0 +1,63 @@ +From 776c75010803849c1cc4f11031a2b3960ab05202 Mon Sep 17 00:00:00 2001 +From: Wang Hai +Date: Wed, 13 Oct 2021 14:16:31 +0800 +Subject: ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators() + +From: Wang Hai + +commit 776c75010803849c1cc4f11031a2b3960ab05202 upstream. + +I got a null-ptr-deref report: + +KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] +... +RIP: 0010:regulator_enable+0x84/0x260 +... +Call Trace: + ahci_platform_enable_regulators+0xae/0x320 + ahci_platform_enable_resources+0x1a/0x120 + ahci_probe+0x4f/0x1b9 + platform_probe+0x10b/0x280 +... + entry_SYSCALL_64_after_hwframe+0x44/0xae + +If devm_regulator_get() in ahci_platform_get_resources() fails, +hpriv->phy_regulator will point to NULL, when enabling or disabling it, +null-ptr-deref will occur. + +ahci_probe() + ahci_platform_get_resources() + devm_regulator_get(, "phy") // failed, let phy_regulator = NULL + ahci_platform_enable_resources() + ahci_platform_enable_regulators() + regulator_enable(hpriv->phy_regulator) // null-ptr-deref + +commit 962399bb7fbf ("ata: libahci_platform: Fix regulator_get_optional() +misuse") replaces devm_regulator_get_optional() with devm_regulator_get(), +but PHY regulator omits to delete "hpriv->phy_regulator = NULL;" like AHCI. +Delete it like AHCI regulator to fix this bug. + +Fixes: commit 962399bb7fbf ("ata: libahci_platform: Fix regulator_get_optional() misuse") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Reviewed-by: Hans de Goede +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libahci_platform.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -440,10 +440,7 @@ struct ahci_host_priv *ahci_platform_get + hpriv->phy_regulator = devm_regulator_get(dev, "phy"); + if (IS_ERR(hpriv->phy_regulator)) { + rc = PTR_ERR(hpriv->phy_regulator); +- if (rc == -EPROBE_DEFER) +- goto err_out; +- rc = 0; +- hpriv->phy_regulator = NULL; ++ goto err_out; + } + + if (flags & AHCI_PLATFORM_GET_RESETS) { diff --git a/queue-5.4/drm-msm-dsi-fix-an-error-code-in-msm_dsi_modeset_init.patch b/queue-5.4/drm-msm-dsi-fix-an-error-code-in-msm_dsi_modeset_init.patch new file mode 100644 index 00000000000..99ed0d11759 --- /dev/null +++ b/queue-5.4/drm-msm-dsi-fix-an-error-code-in-msm_dsi_modeset_init.patch @@ -0,0 +1,37 @@ +From 739b4e7756d3301dd673ca517afca46a5f635562 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 1 Oct 2021 15:33:08 +0300 +Subject: drm/msm/dsi: Fix an error code in msm_dsi_modeset_init() + +From: Dan Carpenter + +commit 739b4e7756d3301dd673ca517afca46a5f635562 upstream. + +Return an error code if msm_dsi_manager_validate_current_config(). +Don't return success. + +Fixes: 8b03ad30e314 ("drm/msm/dsi: Use one connector for dual DSI mode") +Signed-off-by: Dan Carpenter +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20211001123308.GF2283@kili +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/dsi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -206,8 +206,10 @@ int msm_dsi_modeset_init(struct msm_dsi + goto fail; + } + +- if (!msm_dsi_manager_validate_current_config(msm_dsi->id)) ++ if (!msm_dsi_manager_validate_current_config(msm_dsi->id)) { ++ ret = -EINVAL; + goto fail; ++ } + + msm_dsi->encoder = encoder; + diff --git a/queue-5.4/drm-msm-dsi-fix-off-by-one-in-dsi_bus_clk_enable-error-handling.patch b/queue-5.4/drm-msm-dsi-fix-off-by-one-in-dsi_bus_clk_enable-error-handling.patch new file mode 100644 index 00000000000..ac5f92f3d97 --- /dev/null +++ b/queue-5.4/drm-msm-dsi-fix-off-by-one-in-dsi_bus_clk_enable-error-handling.patch @@ -0,0 +1,34 @@ +From c8f01ffc83923a91e8087aaa077de13354a7aa59 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 1 Oct 2021 15:34:09 +0300 +Subject: drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling + +From: Dan Carpenter + +commit c8f01ffc83923a91e8087aaa077de13354a7aa59 upstream. + +This disables a lock which wasn't enabled and it does not disable +the first lock in the array. + +Fixes: 6e0eb52eba9e ("drm/msm/dsi: Parse bus clocks from a list") +Signed-off-by: Dan Carpenter +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20211001123409.GG2283@kili +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -460,7 +460,7 @@ static int dsi_bus_clk_enable(struct msm + + return 0; + err: +- for (; i > 0; i--) ++ while (--i >= 0) + clk_disable_unprepare(msm_host->bus_clks[i]); + + return ret; diff --git a/queue-5.4/drm-msm-fix-null-pointer-dereference-on-pointer-edp.patch b/queue-5.4/drm-msm-fix-null-pointer-dereference-on-pointer-edp.patch new file mode 100644 index 00000000000..6f4fa869364 --- /dev/null +++ b/queue-5.4/drm-msm-fix-null-pointer-dereference-on-pointer-edp.patch @@ -0,0 +1,44 @@ +From 2133c4fc8e1348dcb752f267a143fe2254613b34 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 29 Sep 2021 13:18:57 +0100 +Subject: drm/msm: Fix null pointer dereference on pointer edp + +From: Colin Ian King + +commit 2133c4fc8e1348dcb752f267a143fe2254613b34 upstream. + +The initialization of pointer dev dereferences pointer edp before +edp is null checked, so there is a potential null pointer deference +issue. Fix this by only dereferencing edp after edp has been null +checked. + +Addresses-Coverity: ("Dereference before null check") +Fixes: ab5b0107ccf3 ("drm/msm: Initial add eDP support in msm drm driver (v5)") +Signed-off-by: Colin Ian King +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20210929121857.213922-1-colin.king@canonical.com +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/edp/edp_ctrl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/edp/edp_ctrl.c ++++ b/drivers/gpu/drm/msm/edp/edp_ctrl.c +@@ -1082,7 +1082,7 @@ void msm_edp_ctrl_power(struct edp_ctrl + int msm_edp_ctrl_init(struct msm_edp *edp) + { + struct edp_ctrl *ctrl = NULL; +- struct device *dev = &edp->pdev->dev; ++ struct device *dev; + int ret; + + if (!edp) { +@@ -1090,6 +1090,7 @@ int msm_edp_ctrl_init(struct msm_edp *ed + return -EINVAL; + } + ++ dev = &edp->pdev->dev; + ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL); + if (!ctrl) + return -ENOMEM; diff --git a/queue-5.4/drm-msm-mdp5-fix-cursor-related-warnings.patch b/queue-5.4/drm-msm-mdp5-fix-cursor-related-warnings.patch new file mode 100644 index 00000000000..c9b28bb7525 --- /dev/null +++ b/queue-5.4/drm-msm-mdp5-fix-cursor-related-warnings.patch @@ -0,0 +1,144 @@ +From c491a0c7bbf3a64732cb8414021429d15ec08eec Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Sat, 25 Sep 2021 22:28:24 +0300 +Subject: drm/msm/mdp5: fix cursor-related warnings + +From: Dmitry Baryshkov + +commit c491a0c7bbf3a64732cb8414021429d15ec08eec upstream. + +Since f35a2a99100f ("drm/encoder: make encoder control functions +optional") drm_mode_config_validate would print warnings if both cursor +plane and cursor functions are provided. Restore separate set of +drm_crtc_funcs to be used if separate cursor plane is provided. + +[ 6.556046] ------------[ cut here ]------------ +[ 6.556071] [CRTC:93:crtc-0] must not have both a cursor plane and a cursor_set func +[ 6.556091] WARNING: CPU: 1 PID: 76 at drivers/gpu/drm/drm_mode_config.c:648 drm_mode_config_validate+0x238/0x4d0 +[ 6.567453] Modules linked in: +[ 6.577604] CPU: 1 PID: 76 Comm: kworker/u8:2 Not tainted 5.15.0-rc1-dirty #43 +[ 6.580557] Hardware name: Qualcomm Technologies, Inc. DB820c (DT) +[ 6.587763] Workqueue: events_unbound deferred_probe_work_func +[ 6.593926] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 6.599740] pc : drm_mode_config_validate+0x238/0x4d0 +[ 6.606596] lr : drm_mode_config_validate+0x238/0x4d0 +[ 6.611804] sp : ffff8000121b3980 +[ 6.616838] x29: ffff8000121b3990 x28: 0000000000000000 x27: 0000000000000001 +[ 6.620140] x26: ffff8000114cde50 x25: ffff8000114cdd40 x24: ffff0000987282d8 +[ 6.627258] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000001 +[ 6.634376] x20: ffff000098728000 x19: ffff000080a39000 x18: ffffffffffffffff +[ 6.641494] x17: 3136564e3631564e x16: 0000000000000324 x15: ffff800011c78709 +[ 6.648613] x14: 0000000000000000 x13: ffff800011a22850 x12: 00000000000009ab +[ 6.655730] x11: 0000000000000339 x10: ffff800011a22850 x9 : ffff800011a22850 +[ 6.662848] x8 : 00000000ffffefff x7 : ffff800011a7a850 x6 : ffff800011a7a850 +[ 6.669966] x5 : 000000000000bff4 x4 : 40000000fffff339 x3 : 0000000000000000 +[ 6.677084] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008093b800 +[ 6.684205] Call trace: +[ 6.691319] drm_mode_config_validate+0x238/0x4d0 +[ 6.693577] drm_dev_register+0x17c/0x210 +[ 6.698435] msm_drm_bind+0x4b4/0x694 +[ 6.702429] try_to_bring_up_master+0x164/0x1d0 +[ 6.706075] __component_add+0xa0/0x170 +[ 6.710415] component_add+0x14/0x20 +[ 6.714234] msm_hdmi_dev_probe+0x1c/0x2c +[ 6.718053] platform_probe+0x68/0xe0 +[ 6.721959] really_probe.part.0+0x9c/0x30c +[ 6.725606] __driver_probe_device+0x98/0x144 +[ 6.729600] driver_probe_device+0xc8/0x15c +[ 6.734114] __device_attach_driver+0xb4/0x120 +[ 6.738106] bus_for_each_drv+0x78/0xd0 +[ 6.742619] __device_attach+0xdc/0x184 +[ 6.746351] device_initial_probe+0x14/0x20 +[ 6.750172] bus_probe_device+0x9c/0xa4 +[ 6.754337] deferred_probe_work_func+0x88/0xc0 +[ 6.758158] process_one_work+0x1d0/0x370 +[ 6.762671] worker_thread+0x2c8/0x470 +[ 6.766839] kthread+0x15c/0x170 +[ 6.770483] ret_from_fork+0x10/0x20 +[ 6.773870] ---[ end trace 5884eb76cd26d274 ]--- +[ 6.777500] ------------[ cut here ]------------ +[ 6.782043] [CRTC:93:crtc-0] must not have both a cursor plane and a cursor_move func +[ 6.782063] WARNING: CPU: 1 PID: 76 at drivers/gpu/drm/drm_mode_config.c:654 drm_mode_config_validate+0x290/0x4d0 +[ 6.794362] Modules linked in: +[ 6.804600] CPU: 1 PID: 76 Comm: kworker/u8:2 Tainted: G W 5.15.0-rc1-dirty #43 +[ 6.807555] Hardware name: Qualcomm Technologies, Inc. DB820c (DT) +[ 6.816148] Workqueue: events_unbound deferred_probe_work_func +[ 6.822311] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 6.828126] pc : drm_mode_config_validate+0x290/0x4d0 +[ 6.834981] lr : drm_mode_config_validate+0x290/0x4d0 +[ 6.840189] sp : ffff8000121b3980 +[ 6.845223] x29: ffff8000121b3990 x28: 0000000000000000 x27: 0000000000000001 +[ 6.848525] x26: ffff8000114cde50 x25: ffff8000114cdd40 x24: ffff0000987282d8 +[ 6.855643] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000001 +[ 6.862763] x20: ffff000098728000 x19: ffff000080a39000 x18: ffffffffffffffff +[ 6.869879] x17: 3136564e3631564e x16: 0000000000000324 x15: ffff800011c790c2 +[ 6.876998] x14: 0000000000000000 x13: ffff800011a22850 x12: 0000000000000a2f +[ 6.884116] x11: 0000000000000365 x10: ffff800011a22850 x9 : ffff800011a22850 +[ 6.891234] x8 : 00000000ffffefff x7 : ffff800011a7a850 x6 : ffff800011a7a850 +[ 6.898351] x5 : 000000000000bff4 x4 : 40000000fffff365 x3 : 0000000000000000 +[ 6.905470] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008093b800 +[ 6.912590] Call trace: +[ 6.919702] drm_mode_config_validate+0x290/0x4d0 +[ 6.921960] drm_dev_register+0x17c/0x210 +[ 6.926821] msm_drm_bind+0x4b4/0x694 +[ 6.930813] try_to_bring_up_master+0x164/0x1d0 +[ 6.934459] __component_add+0xa0/0x170 +[ 6.938799] component_add+0x14/0x20 +[ 6.942619] msm_hdmi_dev_probe+0x1c/0x2c +[ 6.946438] platform_probe+0x68/0xe0 +[ 6.950345] really_probe.part.0+0x9c/0x30c +[ 6.953991] __driver_probe_device+0x98/0x144 +[ 6.957984] driver_probe_device+0xc8/0x15c +[ 6.962498] __device_attach_driver+0xb4/0x120 +[ 6.966492] bus_for_each_drv+0x78/0xd0 +[ 6.971004] __device_attach+0xdc/0x184 +[ 6.974737] device_initial_probe+0x14/0x20 +[ 6.978556] bus_probe_device+0x9c/0xa4 +[ 6.982722] deferred_probe_work_func+0x88/0xc0 +[ 6.986543] process_one_work+0x1d0/0x370 +[ 6.991057] worker_thread+0x2c8/0x470 +[ 6.995223] kthread+0x15c/0x170 +[ 6.998869] ret_from_fork+0x10/0x20 +[ 7.002255] ---[ end trace 5884eb76cd26d275 ]--- + +Fixes: aa649e875daf ("drm/msm/mdp5: mdp5_crtc: Restore cursor state only if LM cursors are enabled") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20210925192824.3416259-1-dmitry.baryshkov@linaro.org +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +@@ -1047,6 +1047,20 @@ static void mdp5_crtc_reset(struct drm_c + drm_crtc_vblank_reset(crtc); + } + ++static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = { ++ .set_config = drm_atomic_helper_set_config, ++ .destroy = mdp5_crtc_destroy, ++ .page_flip = drm_atomic_helper_page_flip, ++ .reset = mdp5_crtc_reset, ++ .atomic_duplicate_state = mdp5_crtc_duplicate_state, ++ .atomic_destroy_state = mdp5_crtc_destroy_state, ++ .atomic_print_state = mdp5_crtc_atomic_print_state, ++ .get_vblank_counter = mdp5_crtc_get_vblank_counter, ++ .enable_vblank = msm_crtc_enable_vblank, ++ .disable_vblank = msm_crtc_disable_vblank, ++ .get_vblank_timestamp = drm_crtc_vblank_helper_get_vblank_timestamp, ++}; ++ + static const struct drm_crtc_funcs mdp5_crtc_funcs = { + .set_config = drm_atomic_helper_set_config, + .destroy = mdp5_crtc_destroy, +@@ -1230,6 +1244,8 @@ struct drm_crtc *mdp5_crtc_init(struct d + mdp5_crtc->lm_cursor_enabled = cursor_plane ? false : true; + + drm_crtc_init_with_planes(dev, crtc, plane, cursor_plane, ++ cursor_plane ? ++ &mdp5_crtc_no_lm_cursor_funcs : + &mdp5_crtc_funcs, NULL); + + drm_flip_work_init(&mdp5_crtc->unref_cursor_work, diff --git a/queue-5.4/drm-panel-olimex-lcd-olinuxino-select-crc32.patch b/queue-5.4/drm-panel-olimex-lcd-olinuxino-select-crc32.patch new file mode 100644 index 00000000000..8bc18a5a434 --- /dev/null +++ b/queue-5.4/drm-panel-olimex-lcd-olinuxino-select-crc32.patch @@ -0,0 +1,36 @@ +From a14bc107edd0c108bda2245e50daa22f91c95d20 Mon Sep 17 00:00:00 2001 +From: Vegard Nossum +Date: Tue, 12 Oct 2021 13:52:42 +0200 +Subject: drm/panel: olimex-lcd-olinuxino: select CRC32 + +From: Vegard Nossum + +commit a14bc107edd0c108bda2245e50daa22f91c95d20 upstream. + +Fix the following build/link error by adding a dependency on the CRC32 +routines: + + ld: drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.o: in function `lcd_olinuxino_probe': + panel-olimex-lcd-olinuxino.c:(.text+0x303): undefined reference to `crc32_le' + +Fixes: 17fd7a9d324fd ("drm/panel: Add support for Olimex LCD-OLinuXino panel") +Cc: Arnd Bergmann +Signed-off-by: Vegard Nossum +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20211012115242.10325-1-vegard.nossum@oracle.com +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panel/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/panel/Kconfig ++++ b/drivers/gpu/drm/panel/Kconfig +@@ -141,6 +141,7 @@ config DRM_PANEL_OLIMEX_LCD_OLINUXINO + depends on OF + depends on I2C + depends on BACKLIGHT_CLASS_DEVICE ++ select CRC32 + help + The panel is used with different sizes LCDs, from 480x272 to + 1280x800, and 24 bit per pixel. diff --git a/queue-5.4/ionic-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch b/queue-5.4/ionic-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch new file mode 100644 index 00000000000..3d4547009f9 --- /dev/null +++ b/queue-5.4/ionic-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch @@ -0,0 +1,46 @@ +From 5c976a56570f29aaf4a2f9a1bf99789c252183c9 Mon Sep 17 00:00:00 2001 +From: Shannon Nelson +Date: Fri, 8 Oct 2021 12:38:01 -0700 +Subject: ionic: don't remove netdev->dev_addr when syncing uc list + +From: Shannon Nelson + +commit 5c976a56570f29aaf4a2f9a1bf99789c252183c9 upstream. + +Bridging, and possibly other upper stack gizmos, adds the +lower device's netdev->dev_addr to its own uc list, and +then requests it be deleted when the upper bridge device is +removed. This delete request also happens with the bridging +vlan_filtering is enabled and then disabled. + +Bonding has a similar behavior with the uc list, but since it +also uses set_mac to manage netdev->dev_addr, it doesn't have +the same the failure case. + +Because we store our netdev->dev_addr in our uc list, we need +to ignore the delete request from dev_uc_sync so as to not +lose the address and all hope of communicating. Note that +ndo_set_mac_address is expressly changing netdev->dev_addr, +so no limitation is set there. + +Fixes: 2a654540be10 ("ionic: Add Rx filter and rx_mode ndo support") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -912,6 +912,10 @@ static int ionic_addr_add(struct net_dev + + static int ionic_addr_del(struct net_device *netdev, const u8 *addr) + { ++ /* Don't delete our own address from the uc list */ ++ if (ether_addr_equal(addr, netdev->dev_addr)) ++ return 0; ++ + return ionic_lif_addr(netdev_priv(netdev), addr, false); + } + diff --git a/queue-5.4/mlxsw-thermal-fix-out-of-bounds-memory-accesses.patch b/queue-5.4/mlxsw-thermal-fix-out-of-bounds-memory-accesses.patch new file mode 100644 index 00000000000..17f1d47b562 --- /dev/null +++ b/queue-5.4/mlxsw-thermal-fix-out-of-bounds-memory-accesses.patch @@ -0,0 +1,201 @@ +From 332fdf951df8b870e3da86b122ae304e2aabe88c Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Tue, 12 Oct 2021 20:49:55 +0300 +Subject: mlxsw: thermal: Fix out-of-bounds memory accesses + +From: Ido Schimmel + +commit 332fdf951df8b870e3da86b122ae304e2aabe88c upstream. + +Currently, mlxsw allows cooling states to be set above the maximum +cooling state supported by the driver: + + # cat /sys/class/thermal/thermal_zone2/cdev0/type + mlxsw_fan + # cat /sys/class/thermal/thermal_zone2/cdev0/max_state + 10 + # echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state + # echo $? + 0 + +This results in out-of-bounds memory accesses when thermal state +transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the +transition table is accessed with a too large index (state) [1]. + +According to the thermal maintainer, it is the responsibility of the +driver to reject such operations [2]. + +Therefore, return an error when the state to be set exceeds the maximum +cooling state supported by the driver. + +To avoid dead code, as suggested by the thermal maintainer [3], +partially revert commit a421ce088ac8 ("mlxsw: core: Extend cooling +device with cooling levels") that tried to interpret these invalid +cooling states (above the maximum) in a special way. The cooling levels +array is not removed in order to prevent the fans going below 20% PWM, +which would cause them to get stuck at 0% PWM. + +[1] +BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290 +Read of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5 + +CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122 +Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2FO"/"SA000874", BIOS 4.6.5 03/08/2016 +Workqueue: events_freezable_power_ thermal_zone_device_check +Call Trace: + dump_stack_lvl+0x8b/0xb3 + print_address_description.constprop.0+0x1f/0x140 + kasan_report.cold+0x7f/0x11b + thermal_cooling_device_stats_update+0x271/0x290 + __thermal_cdev_update+0x15e/0x4e0 + thermal_cdev_update+0x9f/0xe0 + step_wise_throttle+0x770/0xee0 + thermal_zone_device_update+0x3f6/0xdf0 + process_one_work+0xa42/0x1770 + worker_thread+0x62f/0x13e0 + kthread+0x3ee/0x4e0 + ret_from_fork+0x1f/0x30 + +Allocated by task 1: + kasan_save_stack+0x1b/0x40 + __kasan_kmalloc+0x7c/0x90 + thermal_cooling_device_setup_sysfs+0x153/0x2c0 + __thermal_cooling_device_register.part.0+0x25b/0x9c0 + thermal_cooling_device_register+0xb3/0x100 + mlxsw_thermal_init+0x5c5/0x7e0 + __mlxsw_core_bus_device_register+0xcb3/0x19c0 + mlxsw_core_bus_device_register+0x56/0xb0 + mlxsw_pci_probe+0x54f/0x710 + local_pci_probe+0xc6/0x170 + pci_device_probe+0x2b2/0x4d0 + really_probe+0x293/0xd10 + __driver_probe_device+0x2af/0x440 + driver_probe_device+0x51/0x1e0 + __driver_attach+0x21b/0x530 + bus_for_each_dev+0x14c/0x1d0 + bus_add_driver+0x3ac/0x650 + driver_register+0x241/0x3d0 + mlxsw_sp_module_init+0xa2/0x174 + do_one_initcall+0xee/0x5f0 + kernel_init_freeable+0x45a/0x4de + kernel_init+0x1f/0x210 + ret_from_fork+0x1f/0x30 + +The buggy address belongs to the object at ffff8881052f7800 + which belongs to the cache kmalloc-1k of size 1024 +The buggy address is located 1016 bytes inside of + 1024-byte region [ffff8881052f7800, ffff8881052f7c00) +The buggy address belongs to the page: +page:0000000052355272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1052f0 +head:0000000052355272 order:3 compound_mapcount:0 compound_pincount:0 +flags: 0x200000000010200(slab|head|node=0|zone=2) +raw: 0200000000010200 ffffea0005034800 0000000300000003 ffff888100041dc0 +raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff8881052f7a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc + ffff8881052f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +>ffff8881052f7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ^ + ffff8881052f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff8881052f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + +[2] https://lore.kernel.org/linux-pm/9aca37cb-1629-5c67-1895-1fdc45c0244e@linaro.org/ +[3] https://lore.kernel.org/linux-pm/af9857f2-578e-de3a-e62b-6baff7e69fd4@linaro.org/ + +CC: Daniel Lezcano +Fixes: a50c1e35650b ("mlxsw: core: Implement thermal zone") +Fixes: a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels") +Signed-off-by: Ido Schimmel +Tested-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20211012174955.472928-1-idosch@idosch.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 52 ++------------------- + 1 file changed, 5 insertions(+), 47 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c +@@ -25,16 +25,8 @@ + #define MLXSW_THERMAL_ZONE_MAX_NAME 16 + #define MLXSW_THERMAL_TEMP_SCORE_MAX GENMASK(31, 0) + #define MLXSW_THERMAL_MAX_STATE 10 ++#define MLXSW_THERMAL_MIN_STATE 2 + #define MLXSW_THERMAL_MAX_DUTY 255 +-/* Minimum and maximum fan allowed speed in percent: from 20% to 100%. Values +- * MLXSW_THERMAL_MAX_STATE + x, where x is between 2 and 10 are used for +- * setting fan speed dynamic minimum. For example, if value is set to 14 (40%) +- * cooling levels vector will be set to 4, 4, 4, 4, 4, 5, 6, 7, 8, 9, 10 to +- * introduce PWM speed in percent: 40, 40, 40, 40, 40, 50, 60. 70, 80, 90, 100. +- */ +-#define MLXSW_THERMAL_SPEED_MIN (MLXSW_THERMAL_MAX_STATE + 2) +-#define MLXSW_THERMAL_SPEED_MAX (MLXSW_THERMAL_MAX_STATE * 2) +-#define MLXSW_THERMAL_SPEED_MIN_LEVEL 2 /* 20% */ + + /* External cooling devices, allowed for binding to mlxsw thermal zones. */ + static char * const mlxsw_thermal_external_allowed_cdev[] = { +@@ -703,49 +695,16 @@ static int mlxsw_thermal_set_cur_state(s + struct mlxsw_thermal *thermal = cdev->devdata; + struct device *dev = thermal->bus_info->dev; + char mfsc_pl[MLXSW_REG_MFSC_LEN]; +- unsigned long cur_state, i; + int idx; +- u8 duty; + int err; + ++ if (state > MLXSW_THERMAL_MAX_STATE) ++ return -EINVAL; ++ + idx = mlxsw_get_cooling_device_idx(thermal, cdev); + if (idx < 0) + return idx; + +- /* Verify if this request is for changing allowed fan dynamical +- * minimum. If it is - update cooling levels accordingly and update +- * state, if current state is below the newly requested minimum state. +- * For example, if current state is 5, and minimal state is to be +- * changed from 4 to 6, thermal->cooling_levels[0 to 5] will be changed +- * all from 4 to 6. And state 5 (thermal->cooling_levels[4]) should be +- * overwritten. +- */ +- if (state >= MLXSW_THERMAL_SPEED_MIN && +- state <= MLXSW_THERMAL_SPEED_MAX) { +- state -= MLXSW_THERMAL_MAX_STATE; +- for (i = 0; i <= MLXSW_THERMAL_MAX_STATE; i++) +- thermal->cooling_levels[i] = max(state, i); +- +- mlxsw_reg_mfsc_pack(mfsc_pl, idx, 0); +- err = mlxsw_reg_query(thermal->core, MLXSW_REG(mfsc), mfsc_pl); +- if (err) +- return err; +- +- duty = mlxsw_reg_mfsc_pwm_duty_cycle_get(mfsc_pl); +- cur_state = mlxsw_duty_to_state(duty); +- +- /* If current fan state is lower than requested dynamical +- * minimum, increase fan speed up to dynamical minimum. +- */ +- if (state < cur_state) +- return 0; +- +- state = cur_state; +- } +- +- if (state > MLXSW_THERMAL_MAX_STATE) +- return -EINVAL; +- + /* Normalize the state to the valid speed range. */ + state = thermal->cooling_levels[state]; + mlxsw_reg_mfsc_pack(mfsc_pl, idx, mlxsw_state_to_duty(state)); +@@ -1040,8 +999,7 @@ int mlxsw_thermal_init(struct mlxsw_core + + /* Initialize cooling levels per PWM state. */ + for (i = 0; i < MLXSW_THERMAL_MAX_STATE; i++) +- thermal->cooling_levels[i] = max(MLXSW_THERMAL_SPEED_MIN_LEVEL, +- i); ++ thermal->cooling_levels[i] = max(MLXSW_THERMAL_MIN_STATE, i); + + thermal->polling_delay = bus_info->low_frequency ? + MLXSW_THERMAL_SLOW_POLL_INT : diff --git a/queue-5.4/mqprio-correct-stats-in-mqprio_dump_class_stats.patch b/queue-5.4/mqprio-correct-stats-in-mqprio_dump_class_stats.patch new file mode 100644 index 00000000000..4451d5ea6f0 --- /dev/null +++ b/queue-5.4/mqprio-correct-stats-in-mqprio_dump_class_stats.patch @@ -0,0 +1,80 @@ +From 14132690860e4d06aa3e1c4d7d8e9866ba7756dd Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Thu, 7 Oct 2021 19:49:57 +0200 +Subject: mqprio: Correct stats in mqprio_dump_class_stats(). + +From: Sebastian Andrzej Siewior + +commit 14132690860e4d06aa3e1c4d7d8e9866ba7756dd upstream. + +Introduction of lockless subqueues broke the class statistics. +Before the change stats were accumulated in `bstats' and `qstats' +on the stack which was then copied to struct gnet_dump. + +After the change the `bstats' and `qstats' are initialized to 0 +and never updated, yet still fed to gnet_dump. The code updates +the global qdisc->cpu_bstats and qdisc->cpu_qstats instead, +clobbering them. Most likely a copy-paste error from the code in +mqprio_dump(). + +__gnet_stats_copy_basic() and __gnet_stats_copy_queue() accumulate +the values for per-CPU case but for global stats they overwrite +the value, so only stats from the last loop iteration / tc end up +in sch->[bq]stats. + +Use the on-stack [bq]stats variables again and add the stats manually +in the global case. + +Fixes: ce679e8df7ed2 ("net: sched: add support for TCQ_F_NOLOCK subqueues to sch_mqprio") +Cc: John Fastabend +Signed-off-by: Sebastian Andrzej Siewior +https://lore.kernel.org/all/20211007175000.2334713-2-bigeasy@linutronix.de/ +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_mqprio.c | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +--- a/net/sched/sch_mqprio.c ++++ b/net/sched/sch_mqprio.c +@@ -529,22 +529,28 @@ static int mqprio_dump_class_stats(struc + for (i = tc.offset; i < tc.offset + tc.count; i++) { + struct netdev_queue *q = netdev_get_tx_queue(dev, i); + struct Qdisc *qdisc = rtnl_dereference(q->qdisc); +- struct gnet_stats_basic_cpu __percpu *cpu_bstats = NULL; +- struct gnet_stats_queue __percpu *cpu_qstats = NULL; + + spin_lock_bh(qdisc_lock(qdisc)); ++ + if (qdisc_is_percpu_stats(qdisc)) { +- cpu_bstats = qdisc->cpu_bstats; +- cpu_qstats = qdisc->cpu_qstats; +- } ++ qlen = qdisc_qlen_sum(qdisc); + +- qlen = qdisc_qlen_sum(qdisc); +- __gnet_stats_copy_basic(NULL, &sch->bstats, +- cpu_bstats, &qdisc->bstats); +- __gnet_stats_copy_queue(&sch->qstats, +- cpu_qstats, +- &qdisc->qstats, +- qlen); ++ __gnet_stats_copy_basic(NULL, &bstats, ++ qdisc->cpu_bstats, ++ &qdisc->bstats); ++ __gnet_stats_copy_queue(&qstats, ++ qdisc->cpu_qstats, ++ &qdisc->qstats, ++ qlen); ++ } else { ++ qlen += qdisc->q.qlen; ++ bstats.bytes += qdisc->bstats.bytes; ++ bstats.packets += qdisc->bstats.packets; ++ qstats.backlog += qdisc->qstats.backlog; ++ qstats.drops += qdisc->qstats.drops; ++ qstats.requeues += qdisc->qstats.requeues; ++ qstats.overlimits += qdisc->qstats.overlimits; ++ } + spin_unlock_bh(qdisc_lock(qdisc)); + } + diff --git a/queue-5.4/nfc-digital-fix-possible-memory-leak-in-digital_in_send_sdd_req.patch b/queue-5.4/nfc-digital-fix-possible-memory-leak-in-digital_in_send_sdd_req.patch new file mode 100644 index 00000000000..257f8de371e --- /dev/null +++ b/queue-5.4/nfc-digital-fix-possible-memory-leak-in-digital_in_send_sdd_req.patch @@ -0,0 +1,39 @@ +From 291c932fc3692e4d211a445ba8aa35663831bac7 Mon Sep 17 00:00:00 2001 +From: Ziyang Xuan +Date: Wed, 13 Oct 2021 15:50:32 +0800 +Subject: NFC: digital: fix possible memory leak in digital_in_send_sdd_req() + +From: Ziyang Xuan + +commit 291c932fc3692e4d211a445ba8aa35663831bac7 upstream. + +'skb' is allocated in digital_in_send_sdd_req(), but not free when +digital_in_send_cmd() failed, which will cause memory leak. Fix it +by freeing 'skb' if digital_in_send_cmd() return failed. + +Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support") +Signed-off-by: Ziyang Xuan +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/nfc/digital_technology.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/net/nfc/digital_technology.c ++++ b/net/nfc/digital_technology.c +@@ -465,8 +465,12 @@ static int digital_in_send_sdd_req(struc + skb_put_u8(skb, sel_cmd); + skb_put_u8(skb, DIGITAL_SDD_REQ_SEL_PAR); + +- return digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res, +- target); ++ rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res, ++ target); ++ if (rc) ++ kfree_skb(skb); ++ ++ return rc; + } + + static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg, diff --git a/queue-5.4/nfc-digital-fix-possible-memory-leak-in-digital_tg_listen_mdaa.patch b/queue-5.4/nfc-digital-fix-possible-memory-leak-in-digital_tg_listen_mdaa.patch new file mode 100644 index 00000000000..d10289e5155 --- /dev/null +++ b/queue-5.4/nfc-digital-fix-possible-memory-leak-in-digital_tg_listen_mdaa.patch @@ -0,0 +1,47 @@ +From 58e7dcc9ca29c14e44267a4d0ea61e3229124907 Mon Sep 17 00:00:00 2001 +From: Ziyang Xuan +Date: Wed, 13 Oct 2021 15:50:12 +0800 +Subject: NFC: digital: fix possible memory leak in digital_tg_listen_mdaa() + +From: Ziyang Xuan + +commit 58e7dcc9ca29c14e44267a4d0ea61e3229124907 upstream. + +'params' is allocated in digital_tg_listen_mdaa(), but not free when +digital_send_cmd() failed, which will cause memory leak. Fix it by +freeing 'params' if digital_send_cmd() return failed. + +Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support") +Signed-off-by: Ziyang Xuan +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/nfc/digital_core.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/net/nfc/digital_core.c ++++ b/net/nfc/digital_core.c +@@ -277,6 +277,7 @@ int digital_tg_configure_hw(struct nfc_d + static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech) + { + struct digital_tg_mdaa_params *params; ++ int rc; + + params = kzalloc(sizeof(*params), GFP_KERNEL); + if (!params) +@@ -291,8 +292,12 @@ static int digital_tg_listen_mdaa(struct + get_random_bytes(params->nfcid2 + 2, NFC_NFCID2_MAXSIZE - 2); + params->sc = DIGITAL_SENSF_FELICA_SC; + +- return digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params, +- 500, digital_tg_recv_atr_req, NULL); ++ rc = digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params, ++ 500, digital_tg_recv_atr_req, NULL); ++ if (rc) ++ kfree(params); ++ ++ return rc; + } + + static int digital_tg_listen_md(struct nfc_digital_dev *ddev, u8 rf_tech) diff --git a/queue-5.4/nfc-fix-error-handling-of-nfc_proto_register.patch b/queue-5.4/nfc-fix-error-handling-of-nfc_proto_register.patch new file mode 100644 index 00000000000..5dfa02af58c --- /dev/null +++ b/queue-5.4/nfc-fix-error-handling-of-nfc_proto_register.patch @@ -0,0 +1,35 @@ +From 0911ab31896f0e908540746414a77dd63912748d Mon Sep 17 00:00:00 2001 +From: Ziyang Xuan +Date: Wed, 13 Oct 2021 11:49:32 +0800 +Subject: nfc: fix error handling of nfc_proto_register() + +From: Ziyang Xuan + +commit 0911ab31896f0e908540746414a77dd63912748d upstream. + +When nfc proto id is using, nfc_proto_register() return -EBUSY error +code, but forgot to unregister proto. Fix it by adding proto_unregister() +in the error handling case. + +Fixes: c7fe3b52c128 ("NFC: add NFC socket family") +Signed-off-by: Ziyang Xuan +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20211013034932.2833737-1-william.xuanziyang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/nfc/af_nfc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/nfc/af_nfc.c ++++ b/net/nfc/af_nfc.c +@@ -60,6 +60,9 @@ int nfc_proto_register(const struct nfc_ + proto_tab[nfc_proto->id] = nfc_proto; + write_unlock(&proto_tab_lock); + ++ if (rc) ++ proto_unregister(nfc_proto->proto); ++ + return rc; + } + EXPORT_SYMBOL(nfc_proto_register); diff --git a/queue-5.4/pata_legacy-fix-a-couple-uninitialized-variable-bugs.patch b/queue-5.4/pata_legacy-fix-a-couple-uninitialized-variable-bugs.patch new file mode 100644 index 00000000000..4404fd75339 --- /dev/null +++ b/queue-5.4/pata_legacy-fix-a-couple-uninitialized-variable-bugs.patch @@ -0,0 +1,41 @@ +From 013923477cb311293df9079332cf8b806ed0e6f2 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 6 Oct 2021 10:34:19 +0300 +Subject: pata_legacy: fix a couple uninitialized variable bugs + +From: Dan Carpenter + +commit 013923477cb311293df9079332cf8b806ed0e6f2 upstream. + +The last byte of "pad" is used without being initialized. + +Fixes: 55dba3120fbc ("libata: update ->data_xfer hook for ATAPI") +Signed-off-by: Dan Carpenter +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/pata_legacy.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/ata/pata_legacy.c ++++ b/drivers/ata/pata_legacy.c +@@ -315,7 +315,8 @@ static unsigned int pdc_data_xfer_vlb(st + iowrite32_rep(ap->ioaddr.data_addr, buf, buflen >> 2); + + if (unlikely(slop)) { +- __le32 pad; ++ __le32 pad = 0; ++ + if (rw == READ) { + pad = cpu_to_le32(ioread32(ap->ioaddr.data_addr)); + memcpy(buf + buflen - slop, &pad, slop); +@@ -705,7 +706,8 @@ static unsigned int vlb32_data_xfer(stru + ioread32_rep(ap->ioaddr.data_addr, buf, buflen >> 2); + + if (unlikely(slop)) { +- __le32 pad; ++ __le32 pad = 0; ++ + if (rw == WRITE) { + memcpy(&pad, buf + buflen - slop, slop); + iowrite32(le32_to_cpu(pad), ap->ioaddr.data_addr); diff --git a/queue-5.4/platform-mellanox-mlxreg-io-fix-argument-base-in-kstrtou32-call.patch b/queue-5.4/platform-mellanox-mlxreg-io-fix-argument-base-in-kstrtou32-call.patch new file mode 100644 index 00000000000..82ac56dd1c7 --- /dev/null +++ b/queue-5.4/platform-mellanox-mlxreg-io-fix-argument-base-in-kstrtou32-call.patch @@ -0,0 +1,65 @@ +From 9b024201693e397441668cca0d2df7055fe572eb Mon Sep 17 00:00:00 2001 +From: Vadim Pasternak +Date: Mon, 27 Sep 2021 17:22:13 +0300 +Subject: platform/mellanox: mlxreg-io: Fix argument base in kstrtou32() call + +From: Vadim Pasternak + +commit 9b024201693e397441668cca0d2df7055fe572eb upstream. + +Change kstrtou32() argument 'base' to be zero instead of 'len'. +It works by chance for setting one bit value, but it is not supposed to +work in case value passed to mlxreg_io_attr_store() is greater than 1. + +It works for example, for: +echo 1 > /sys/devices/platform/mlxplat/mlxreg-io/hwmon/.../jtag_enable +But it will fail for: +echo n > /sys/devices/platform/mlxplat/mlxreg-io/hwmon/.../jtag_enable, +where n > 1. + +The flow for input buffer conversion is as below: +_kstrtoull(const char *s, unsigned int base, unsigned long long *res) +calls: +rv = _parse_integer(s, base, &_res); + +For the second case, where n > 1: +- _parse_integer() converts 's' to 'val'. + For n=2, 'len' is set to 2 (string buffer is 0x32 0x0a), for n=3 + 'len' is set to 3 (string buffer 0x33 0x0a), etcetera. +- 'base' is equal or greater then '2' (length of input buffer). + +As a result, _parse_integer() exits with result zero (rv): + rv = 0; + while (1) { + ... + if (val >= base)-> (2 >= 2) + break; + ... + rv++; + ... + } + +And _kstrtoull() in their turn will fail: + if (rv == 0) + return -EINVAL; + +Fixes: 5ec4a8ace06c ("platform/mellanox: Introduce support for Mellanox register access driver") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20210927142214.2613929-2-vadimp@nvidia.com +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/mellanox/mlxreg-io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/mellanox/mlxreg-io.c ++++ b/drivers/platform/mellanox/mlxreg-io.c +@@ -123,7 +123,7 @@ mlxreg_io_attr_store(struct device *dev, + return -EINVAL; + + /* Convert buffer to input value. */ +- ret = kstrtou32(buf, len, &input_val); ++ ret = kstrtou32(buf, 0, &input_val); + if (ret) + return ret; + diff --git a/queue-5.4/qed-fix-missing-error-code-in-qed_slowpath_start.patch b/queue-5.4/qed-fix-missing-error-code-in-qed_slowpath_start.patch new file mode 100644 index 00000000000..d4839151bb0 --- /dev/null +++ b/queue-5.4/qed-fix-missing-error-code-in-qed_slowpath_start.patch @@ -0,0 +1,36 @@ +From a5a14ea7b4e55604acb0dc9d88fdb4cb6945bc77 Mon Sep 17 00:00:00 2001 +From: chongjiapeng +Date: Sat, 9 Oct 2021 16:09:26 +0800 +Subject: qed: Fix missing error code in qed_slowpath_start() + +From: chongjiapeng + +commit a5a14ea7b4e55604acb0dc9d88fdb4cb6945bc77 upstream. + +The error code is missing in this code scenario, add the error code +'-EINVAL' to the return value 'rc'. + +Eliminate the follow smatch warning: + +drivers/net/ethernet/qlogic/qed/qed_main.c:1298 qed_slowpath_start() +warn: missing error code 'rc'. + +Reported-by: Abaci Robot +Fixes: d51e4af5c209 ("qed: aRFS infrastructure support") +Signed-off-by: chongjiapeng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -1238,6 +1238,7 @@ static int qed_slowpath_start(struct qed + } else { + DP_NOTICE(cdev, + "Failed to acquire PTT for aRFS\n"); ++ rc = -EINVAL; + goto err; + } + } diff --git a/queue-5.4/r8152-select-crc32-and-crypto-crypto_hash-crypto_sha256.patch b/queue-5.4/r8152-select-crc32-and-crypto-crypto_hash-crypto_sha256.patch new file mode 100644 index 00000000000..f5fd54a3489 --- /dev/null +++ b/queue-5.4/r8152-select-crc32-and-crypto-crypto_hash-crypto_sha256.patch @@ -0,0 +1,41 @@ +From 9973a43012b6ad1720dbc4d5faf5302c28635b8c Mon Sep 17 00:00:00 2001 +From: Vegard Nossum +Date: Mon, 11 Oct 2021 17:22:49 +0200 +Subject: r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256 + +From: Vegard Nossum + +commit 9973a43012b6ad1720dbc4d5faf5302c28635b8c upstream. + +Fix the following build/link errors by adding a dependency on +CRYPTO, CRYPTO_HASH, CRYPTO_SHA256 and CRC32: + + ld: drivers/net/usb/r8152.o: in function `rtl8152_fw_verify_checksum': + r8152.c:(.text+0x2b2a): undefined reference to `crypto_alloc_shash' + ld: r8152.c:(.text+0x2bed): undefined reference to `crypto_shash_digest' + ld: r8152.c:(.text+0x2c50): undefined reference to `crypto_destroy_tfm' + ld: drivers/net/usb/r8152.o: in function `_rtl8152_set_rx_mode': + r8152.c:(.text+0xdcb0): undefined reference to `crc32_le' + +Fixes: 9370f2d05a2a1 ("r8152: support request_firmware for RTL8153") +Fixes: ac718b69301c7 ("net/usb: new driver for RTL8152") +Signed-off-by: Vegard Nossum +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/Kconfig | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/usb/Kconfig ++++ b/drivers/net/usb/Kconfig +@@ -99,6 +99,10 @@ config USB_RTL8150 + config USB_RTL8152 + tristate "Realtek RTL8152/RTL8153 Based USB Ethernet Adapters" + select MII ++ select CRC32 ++ select CRYPTO ++ select CRYPTO_HASH ++ select CRYPTO_SHA256 + help + This option adds support for Realtek RTL8152 based USB 2.0 + 10/100 Ethernet adapters and RTL8153 based USB 3.0 10/100/1000 diff --git a/queue-5.4/series b/queue-5.4/series index 299e00de3d1..ef4d53690da 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -50,3 +50,20 @@ net-mlx5e-mutually-exclude-rx-fcs-and-rx-port-timestamp.patch net-stmmac-fix-get_hw_feature-on-old-hardware.patch net-encx24j600-check-error-in-devm_regmap_init_encx24j600.patch ethernet-s2io-fix-setting-mac-address-during-resume.patch +nfc-fix-error-handling-of-nfc_proto_register.patch +nfc-digital-fix-possible-memory-leak-in-digital_tg_listen_mdaa.patch +nfc-digital-fix-possible-memory-leak-in-digital_in_send_sdd_req.patch +pata_legacy-fix-a-couple-uninitialized-variable-bugs.patch +ata-ahci_platform-fix-null-ptr-deref-in-ahci_platform_enable_regulators.patch +mlxsw-thermal-fix-out-of-bounds-memory-accesses.patch +platform-mellanox-mlxreg-io-fix-argument-base-in-kstrtou32-call.patch +drm-panel-olimex-lcd-olinuxino-select-crc32.patch +drm-msm-fix-null-pointer-dereference-on-pointer-edp.patch +drm-msm-mdp5-fix-cursor-related-warnings.patch +drm-msm-dsi-fix-an-error-code-in-msm_dsi_modeset_init.patch +drm-msm-dsi-fix-off-by-one-in-dsi_bus_clk_enable-error-handling.patch +acpi-arm64-fix-next_platform_timer-section-mismatch-error.patch +mqprio-correct-stats-in-mqprio_dump_class_stats.patch +qed-fix-missing-error-code-in-qed_slowpath_start.patch +r8152-select-crc32-and-crypto-crypto_hash-crypto_sha256.patch +ionic-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch