From: Greg Kroah-Hartman Date: Fri, 15 Jan 2021 10:35:26 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.252~13 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f0d2f4234570d287205672a131888df68405a67a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: arm-omap2-omap_device-fix-idling-of-devices-during-probe.patch block-rsxx-select-config_crc32.patch bpftool-fix-compilation-failure-for-net.o-with-older-glibc.patch can-kvaser_pciefd-select-config_crc32.patch can-m_can-m_can_class_unregister-remove-erroneous-m_can_clk_stop.patch can-tcan4x5x-fix-bittiming-const-use-common-bittiming-from-m_can-driver.patch cpufreq-powernow-k8-pass-policy-rather-than-use-cpufreq_cpu_get.patch dmaengine-dw-edma-fix-use-after-free-in-dw_edma_alloc_chunk.patch dmaengine-mediatek-mtk-hsdma-fix-a-resource-leak-in-the-error-handling-path-of-the-probe-function.patch dmaengine-xilinx_dma-check-dma_async_device_register-return-value.patch dmaengine-xilinx_dma-fix-incompatible-param-warning-in-_child_probe.patch dmaengine-xilinx_dma-fix-mixed_enum_type-coverity-warning.patch i2c-i801-fix-the-i2c-mux-gpiod_lookup_table-not-being-properly-terminated.patch i2c-sprd-use-a-specific-timeout-to-avoid-system-hang-up-issue.patch iommu-intel-fix-memleak-in-intel_irq_remapping_alloc.patch kvm-arm64-don-t-access-pmcr_el0-when-no-pmu-is-available.patch lightnvm-select-config_crc32.patch net-mlx5e-fix-memleak-in-mlx5e_create_l2_table_groups.patch net-mlx5e-fix-two-double-free-cases.patch net-mvpp2-disable-force-link-up-during-port-init-procedure.patch qed-select-config_crc32.patch regmap-debugfs-fix-a-memory-leak-when-calling-regmap_attach_dev.patch regulator-qcom-rpmh-regulator-correct-hfsmps515-definition.patch spi-spi-geni-qcom-fix-geni_spi_isr-null-dereference-in-timeout-case.patch spi-stm32-fifo-threshold-level-fix-align-packet-size.patch wan-ds26522-select-config_bitreverse.patch wil6210-select-config_crc32.patch --- diff --git a/queue-5.4/arm-omap2-omap_device-fix-idling-of-devices-during-probe.patch b/queue-5.4/arm-omap2-omap_device-fix-idling-of-devices-during-probe.patch new file mode 100644 index 00000000000..97172fa2630 --- /dev/null +++ b/queue-5.4/arm-omap2-omap_device-fix-idling-of-devices-during-probe.patch @@ -0,0 +1,64 @@ +From ec76c2eea903947202098090bbe07a739b5246e9 Mon Sep 17 00:00:00 2001 +From: Andreas Kemnade +Date: Fri, 4 Dec 2020 10:55:39 +0100 +Subject: ARM: OMAP2+: omap_device: fix idling of devices during probe + +From: Andreas Kemnade + +commit ec76c2eea903947202098090bbe07a739b5246e9 upstream. + +On the GTA04A5 od->_driver_status was not set to BUS_NOTIFY_BIND_DRIVER +during probe of the second mmc used for wifi. Therefore +omap_device_late_idle idled the device during probing causing oopses when +accessing the registers. + +It was not set because od->_state was set to OMAP_DEVICE_STATE_IDLE +in the notifier callback. Therefore set od->_driver_status also in that +case. + +This came apparent after commit 21b2cec61c04 ("mmc: Set +PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4") causing this +oops: + +omap_hsmmc 480b4000.mmc: omap_device_late_idle: enabled but no driver. Idling +8<--- cut here --- +Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa0b402c +... +(omap_hsmmc_set_bus_width) from [] (omap_hsmmc_set_ios+0x11c/0x258) +(omap_hsmmc_set_ios) from [] (mmc_power_up.part.8+0x3c/0xd0) +(mmc_power_up.part.8) from [] (mmc_start_host+0x88/0x9c) +(mmc_start_host) from [] (mmc_add_host+0x58/0x84) +(mmc_add_host) from [] (omap_hsmmc_probe+0x5fc/0x8c0) +(omap_hsmmc_probe) from [] (platform_drv_probe+0x48/0x98) +(platform_drv_probe) from [] (really_probe+0x1dc/0x3b4) + +Fixes: 04abaf07f6d5 ("ARM: OMAP2+: omap_device: Sync omap_device and pm_runtime after probe defer") +Fixes: 21b2cec61c04 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.4") +Acked-by: Ulf Hansson +Signed-off-by: Andreas Kemnade +[tony@atomide.com: left out extra parens, trimmed description stack trace] +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-omap2/omap_device.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/arch/arm/mach-omap2/omap_device.c ++++ b/arch/arm/mach-omap2/omap_device.c +@@ -234,10 +234,12 @@ static int _omap_device_notifier_call(st + break; + case BUS_NOTIFY_BIND_DRIVER: + od = to_omap_device(pdev); +- if (od && (od->_state == OMAP_DEVICE_STATE_ENABLED) && +- pm_runtime_status_suspended(dev)) { ++ if (od) { + od->_driver_status = BUS_NOTIFY_BIND_DRIVER; +- pm_runtime_set_active(dev); ++ if (od->_state == OMAP_DEVICE_STATE_ENABLED && ++ pm_runtime_status_suspended(dev)) { ++ pm_runtime_set_active(dev); ++ } + } + break; + case BUS_NOTIFY_ADD_DEVICE: diff --git a/queue-5.4/block-rsxx-select-config_crc32.patch b/queue-5.4/block-rsxx-select-config_crc32.patch new file mode 100644 index 00000000000..10ada478429 --- /dev/null +++ b/queue-5.4/block-rsxx-select-config_crc32.patch @@ -0,0 +1,33 @@ +From 36a106a4c1c100d55ba3d32a21ef748cfcd4fa99 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Sun, 3 Jan 2021 22:42:39 +0100 +Subject: block: rsxx: select CONFIG_CRC32 + +From: Arnd Bergmann + +commit 36a106a4c1c100d55ba3d32a21ef748cfcd4fa99 upstream. + +Without crc32, the driver fails to link: + +arm-linux-gnueabi-ld: drivers/block/rsxx/config.o: in function `rsxx_load_config': +config.c:(.text+0x124): undefined reference to `crc32_le' + +Fixes: 8722ff8cdbfa ("block: IBM RamSan 70/80 device driver") +Signed-off-by: Arnd Bergmann +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/block/Kconfig ++++ b/drivers/block/Kconfig +@@ -461,6 +461,7 @@ config BLK_DEV_RBD + config BLK_DEV_RSXX + tristate "IBM Flash Adapter 900GB Full Height PCIe Device Driver" + depends on PCI ++ select CRC32 + help + Device driver for IBM's high speed PCIe SSD + storage device: Flash Adapter 900GB Full Height. diff --git a/queue-5.4/bpftool-fix-compilation-failure-for-net.o-with-older-glibc.patch b/queue-5.4/bpftool-fix-compilation-failure-for-net.o-with-older-glibc.patch new file mode 100644 index 00000000000..c2a6472cdc5 --- /dev/null +++ b/queue-5.4/bpftool-fix-compilation-failure-for-net.o-with-older-glibc.patch @@ -0,0 +1,52 @@ +From 6f02b540d7597f357bc6ee711346761045d4e108 Mon Sep 17 00:00:00 2001 +From: Alan Maguire +Date: Wed, 6 Jan 2021 15:59:06 +0000 +Subject: bpftool: Fix compilation failure for net.o with older glibc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alan Maguire + +commit 6f02b540d7597f357bc6ee711346761045d4e108 upstream. + +For older glibc ~2.17, #include'ing both linux/if.h and net/if.h +fails due to complaints about redefinition of interface flags: + + CC net.o +In file included from net.c:13:0: +/usr/include/linux/if.h:71:2: error: redeclaration of enumerator ‘IFF_UP’ + IFF_UP = 1<<0, /* sysfs */ + ^ +/usr/include/net/if.h:44:5: note: previous definition of ‘IFF_UP’ was here + IFF_UP = 0x1, /* Interface is up. */ + +The issue was fixed in kernel headers in [1], but since compilation +of net.c picks up system headers the problem can recur. + +Dropping #include resolves the issue and it is +not needed for compilation anyhow. + +[1] https://lore.kernel.org/netdev/1461512707-23058-1-git-send-email-mikko.rapeli__34748.27880641$1462831734$gmane$org@iki.fi/ + +Fixes: f6f3bac08ff9 ("tools/bpf: bpftool: add net support") +Signed-off-by: Alan Maguire +Signed-off-by: Andrii Nakryiko +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/1609948746-15369-1-git-send-email-alan.maguire@oracle.com +Signed-off-by: Greg Kroah-Hartman + +--- + tools/bpf/bpftool/net.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/tools/bpf/bpftool/net.c ++++ b/tools/bpf/bpftool/net.c +@@ -9,7 +9,6 @@ + #include + #include + #include +-#include + #include + #include + #include diff --git a/queue-5.4/can-kvaser_pciefd-select-config_crc32.patch b/queue-5.4/can-kvaser_pciefd-select-config_crc32.patch new file mode 100644 index 00000000000..d029c137351 --- /dev/null +++ b/queue-5.4/can-kvaser_pciefd-select-config_crc32.patch @@ -0,0 +1,34 @@ +From 1d48595c786b1b9dc6be301e8d7f6fc74e9882aa Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Sun, 3 Jan 2021 22:36:19 +0100 +Subject: can: kvaser_pciefd: select CONFIG_CRC32 + +From: Arnd Bergmann + +commit 1d48595c786b1b9dc6be301e8d7f6fc74e9882aa upstream. + +Without crc32, this driver fails to link: + +arm-linux-gnueabi-ld: drivers/net/can/kvaser_pciefd.o: in function `kvaser_pciefd_probe': +kvaser_pciefd.c:(.text+0x2b0): undefined reference to `crc32_be' + +Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") +Signed-off-by: Arnd Bergmann +Acked-by: Marc Kleine-Budde +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/can/Kconfig ++++ b/drivers/net/can/Kconfig +@@ -123,6 +123,7 @@ config CAN_JANZ_ICAN3 + config CAN_KVASER_PCIEFD + depends on PCI + tristate "Kvaser PCIe FD cards" ++ select CRC32 + help + This is a driver for the Kvaser PCI Express CAN FD family. + diff --git a/queue-5.4/can-m_can-m_can_class_unregister-remove-erroneous-m_can_clk_stop.patch b/queue-5.4/can-m_can-m_can_class_unregister-remove-erroneous-m_can_clk_stop.patch new file mode 100644 index 00000000000..38261f26b66 --- /dev/null +++ b/queue-5.4/can-m_can-m_can_class_unregister-remove-erroneous-m_can_clk_stop.patch @@ -0,0 +1,37 @@ +From c4aec381ab98c9189d47b935832541d520f1f67f Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Tue, 15 Dec 2020 11:32:37 +0100 +Subject: can: m_can: m_can_class_unregister(): remove erroneous m_can_clk_stop() + +From: Marc Kleine-Budde + +commit c4aec381ab98c9189d47b935832541d520f1f67f upstream. + +In m_can_class_register() the clock is started, but stopped on exit. When +calling m_can_class_unregister(), the clock is stopped a second time. + +This patch removes the erroneous m_can_clk_stop() in m_can_class_unregister(). + +Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework") +Cc: Dan Murphy +Cc: Sriram Dash +Reviewed-by: Sean Nyekjaer +Link: https://lore.kernel.org/r/20201215103238.524029-2-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/m_can/m_can.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1868,8 +1868,6 @@ void m_can_class_unregister(struct m_can + { + unregister_candev(m_can_dev->net); + +- m_can_clk_stop(m_can_dev); +- + free_candev(m_can_dev->net); + } + EXPORT_SYMBOL_GPL(m_can_class_unregister); diff --git a/queue-5.4/can-tcan4x5x-fix-bittiming-const-use-common-bittiming-from-m_can-driver.patch b/queue-5.4/can-tcan4x5x-fix-bittiming-const-use-common-bittiming-from-m_can-driver.patch new file mode 100644 index 00000000000..8f04dcc172b --- /dev/null +++ b/queue-5.4/can-tcan4x5x-fix-bittiming-const-use-common-bittiming-from-m_can-driver.patch @@ -0,0 +1,69 @@ +From aee2b3ccc8a63d1cd7da6a8a153d1f3712d40826 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Tue, 15 Dec 2020 11:32:38 +0100 +Subject: can: tcan4x5x: fix bittiming const, use common bittiming from m_can driver + +From: Marc Kleine-Budde + +commit aee2b3ccc8a63d1cd7da6a8a153d1f3712d40826 upstream. + +According to the TCAN4550 datasheet "SLLSF91 - DECEMBER 2018" the tcan4x5x has +the same bittiming constants as a m_can revision 3.2.x/3.3.0. + +The tcan4x5x chip I'm using identifies itself as m_can revision 3.2.1, so +remove the tcan4x5x specific bittiming values and rely on the values in the +m_can driver, which are selected according to core revision. + +Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel") +Cc: Dan Murphy +Reviewed-by: Sean Nyekjaer +Link: https://lore.kernel.org/r/20201215103238.524029-3-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/m_can/tcan4x5x.c | 26 -------------------------- + 1 file changed, 26 deletions(-) + +--- a/drivers/net/can/m_can/tcan4x5x.c ++++ b/drivers/net/can/m_can/tcan4x5x.c +@@ -126,30 +126,6 @@ struct tcan4x5x_priv { + int reg_offset; + }; + +-static struct can_bittiming_const tcan4x5x_bittiming_const = { +- .name = DEVICE_NAME, +- .tseg1_min = 2, +- .tseg1_max = 31, +- .tseg2_min = 2, +- .tseg2_max = 16, +- .sjw_max = 16, +- .brp_min = 1, +- .brp_max = 32, +- .brp_inc = 1, +-}; +- +-static struct can_bittiming_const tcan4x5x_data_bittiming_const = { +- .name = DEVICE_NAME, +- .tseg1_min = 1, +- .tseg1_max = 32, +- .tseg2_min = 1, +- .tseg2_max = 16, +- .sjw_max = 16, +- .brp_min = 1, +- .brp_max = 32, +- .brp_inc = 1, +-}; +- + static void tcan4x5x_check_wake(struct tcan4x5x_priv *priv) + { + int wake_state = 0; +@@ -449,8 +425,6 @@ static int tcan4x5x_can_probe(struct spi + mcan_class->dev = &spi->dev; + mcan_class->ops = &tcan4x5x_ops; + mcan_class->is_peripheral = true; +- mcan_class->bit_timing = &tcan4x5x_bittiming_const; +- mcan_class->data_timing = &tcan4x5x_data_bittiming_const; + mcan_class->net->irq = spi->irq; + + spi_set_drvdata(spi, priv); diff --git a/queue-5.4/cpufreq-powernow-k8-pass-policy-rather-than-use-cpufreq_cpu_get.patch b/queue-5.4/cpufreq-powernow-k8-pass-policy-rather-than-use-cpufreq_cpu_get.patch new file mode 100644 index 00000000000..9e616e7fd22 --- /dev/null +++ b/queue-5.4/cpufreq-powernow-k8-pass-policy-rather-than-use-cpufreq_cpu_get.patch @@ -0,0 +1,63 @@ +From 943bdd0cecad06da8392a33093230e30e501eccc Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 5 Jan 2021 10:19:57 +0000 +Subject: cpufreq: powernow-k8: pass policy rather than use cpufreq_cpu_get() + +From: Colin Ian King + +commit 943bdd0cecad06da8392a33093230e30e501eccc upstream. + +Currently there is an unlikely case where cpufreq_cpu_get() returns a +NULL policy and this will cause a NULL pointer dereference later on. + +Fix this by passing the policy to transition_frequency_fidvid() from +the caller and hence eliminating the need for the cpufreq_cpu_get() +and cpufreq_cpu_put(). + +Thanks to Viresh Kumar for suggesting the fix. + +Addresses-Coverity: ("Dereference null return") +Fixes: b43a7ffbf33b ("cpufreq: Notify all policy->cpus in cpufreq_notify_transition()") +Suggested-by: Viresh Kumar +Signed-off-by: Colin Ian King +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/powernow-k8.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -878,9 +878,9 @@ static int get_transition_latency(struct + + /* Take a frequency, and issue the fid/vid transition command */ + static int transition_frequency_fidvid(struct powernow_k8_data *data, +- unsigned int index) ++ unsigned int index, ++ struct cpufreq_policy *policy) + { +- struct cpufreq_policy *policy; + u32 fid = 0; + u32 vid = 0; + int res; +@@ -912,9 +912,6 @@ static int transition_frequency_fidvid(s + freqs.old = find_khz_freq_from_fid(data->currfid); + freqs.new = find_khz_freq_from_fid(fid); + +- policy = cpufreq_cpu_get(smp_processor_id()); +- cpufreq_cpu_put(policy); +- + cpufreq_freq_transition_begin(policy, &freqs); + res = transition_fid_vid(data, fid, vid); + cpufreq_freq_transition_end(policy, &freqs, res); +@@ -969,7 +966,7 @@ static long powernowk8_target_fn(void *a + + powernow_k8_acpi_pst_values(data, newstate); + +- ret = transition_frequency_fidvid(data, newstate); ++ ret = transition_frequency_fidvid(data, newstate, pol); + + if (ret) { + pr_err("transition frequency failed\n"); diff --git a/queue-5.4/dmaengine-dw-edma-fix-use-after-free-in-dw_edma_alloc_chunk.patch b/queue-5.4/dmaengine-dw-edma-fix-use-after-free-in-dw_edma_alloc_chunk.patch new file mode 100644 index 00000000000..dc97ae02028 --- /dev/null +++ b/queue-5.4/dmaengine-dw-edma-fix-use-after-free-in-dw_edma_alloc_chunk.patch @@ -0,0 +1,46 @@ +From 595a334148449bd1d27cf5d6fcb3b0d718cb1b9f Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 14 Dec 2020 14:56:52 +0300 +Subject: dmaengine: dw-edma: Fix use after free in dw_edma_alloc_chunk() + +From: Dan Carpenter + +commit 595a334148449bd1d27cf5d6fcb3b0d718cb1b9f upstream. + +If the dw_edma_alloc_burst() function fails then we free "chunk" but +it's still on the "desc->chunk->list" list so it will lead to a use +after free. Also the "->chunks_alloc" count is incremented when it +shouldn't be. + +In current kernels small allocations are guaranteed to succeed and +dw_edma_alloc_burst() can't fail so this will not actually affect +runtime. + +Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") +Signed-off-by: Dan Carpenter +Acked-by: Gustavo Pimentel +Link: https://lore.kernel.org/r/X9dTBFrUPEvvW7qc@mwanda +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/dw-edma/dw-edma-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -85,12 +85,12 @@ static struct dw_edma_chunk *dw_edma_all + + if (desc->chunk) { + /* Create and add new element into the linked list */ +- desc->chunks_alloc++; +- list_add_tail(&chunk->list, &desc->chunk->list); + if (!dw_edma_alloc_burst(chunk)) { + kfree(chunk); + return NULL; + } ++ desc->chunks_alloc++; ++ list_add_tail(&chunk->list, &desc->chunk->list); + } else { + /* List head */ + chunk->burst = NULL; diff --git a/queue-5.4/dmaengine-mediatek-mtk-hsdma-fix-a-resource-leak-in-the-error-handling-path-of-the-probe-function.patch b/queue-5.4/dmaengine-mediatek-mtk-hsdma-fix-a-resource-leak-in-the-error-handling-path-of-the-probe-function.patch new file mode 100644 index 00000000000..7a7212eaad5 --- /dev/null +++ b/queue-5.4/dmaengine-mediatek-mtk-hsdma-fix-a-resource-leak-in-the-error-handling-path-of-the-probe-function.patch @@ -0,0 +1,33 @@ +From 33cbd54dc515cc04b5a603603414222b4bb1448d Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 19 Dec 2020 13:47:18 +0100 +Subject: dmaengine: mediatek: mtk-hsdma: Fix a resource leak in the error handling path of the probe function + +From: Christophe JAILLET + +commit 33cbd54dc515cc04b5a603603414222b4bb1448d upstream. + +'mtk_hsdma_hw_deinit()' should be called in the error handling path of the +probe function to undo a previous 'mtk_hsdma_hw_init()' call, as already +done in the remove function. + +Fixes: 548c4597e984 ("dmaengine: mediatek: Add MediaTek High-Speed DMA controller for MT7622 and MT7623 SoC") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201219124718.182664-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/mediatek/mtk-hsdma.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/dma/mediatek/mtk-hsdma.c ++++ b/drivers/dma/mediatek/mtk-hsdma.c +@@ -1007,6 +1007,7 @@ static int mtk_hsdma_probe(struct platfo + return 0; + + err_free: ++ mtk_hsdma_hw_deinit(hsdma); + of_dma_controller_free(pdev->dev.of_node); + err_unregister: + dma_async_device_unregister(dd); diff --git a/queue-5.4/dmaengine-xilinx_dma-check-dma_async_device_register-return-value.patch b/queue-5.4/dmaengine-xilinx_dma-check-dma_async_device_register-return-value.patch new file mode 100644 index 00000000000..8453bdc0483 --- /dev/null +++ b/queue-5.4/dmaengine-xilinx_dma-check-dma_async_device_register-return-value.patch @@ -0,0 +1,40 @@ +From 99974aedbd73523969afb09f33c6e3047cd0ddae Mon Sep 17 00:00:00 2001 +From: Shravya Kumbham +Date: Wed, 23 Dec 2020 16:51:00 +0530 +Subject: dmaengine: xilinx_dma: check dma_async_device_register return value + +From: Shravya Kumbham + +commit 99974aedbd73523969afb09f33c6e3047cd0ddae upstream. + +dma_async_device_register() can return non-zero error code. Add +condition to check the return value of dma_async_device_register +function and handle the error path. + +Addresses-Coverity: Event check_return. +Fixes: 9cd4360de609 ("dma: Add Xilinx AXI Video Direct Memory Access Engine driver support") +Signed-off-by: Shravya Kumbham +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1608722462-29519-2-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/xilinx/xilinx_dma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -2742,7 +2742,11 @@ static int xilinx_dma_probe(struct platf + } + + /* Register the DMA engine with the core */ +- dma_async_device_register(&xdev->common); ++ err = dma_async_device_register(&xdev->common); ++ if (err) { ++ dev_err(xdev->dev, "failed to register the dma device\n"); ++ goto error; ++ } + + err = of_dma_controller_register(node, of_dma_xilinx_xlate, + xdev); diff --git a/queue-5.4/dmaengine-xilinx_dma-fix-incompatible-param-warning-in-_child_probe.patch b/queue-5.4/dmaengine-xilinx_dma-fix-incompatible-param-warning-in-_child_probe.patch new file mode 100644 index 00000000000..0f3f5c17ed8 --- /dev/null +++ b/queue-5.4/dmaengine-xilinx_dma-fix-incompatible-param-warning-in-_child_probe.patch @@ -0,0 +1,38 @@ +From faeb0731be0a31e2246b21a85fa7dabbd750101d Mon Sep 17 00:00:00 2001 +From: Shravya Kumbham +Date: Wed, 23 Dec 2020 16:51:01 +0530 +Subject: dmaengine: xilinx_dma: fix incompatible param warning in _child_probe() + +From: Shravya Kumbham + +commit faeb0731be0a31e2246b21a85fa7dabbd750101d upstream. + +In xilinx_dma_child_probe function, the nr_channels variable is +passed to of_property_read_u32() which expects an u32 return value +pointer. Modify the nr_channels variable type from int to u32 to +fix the incompatible parameter coverity warning. + +Addresses-Coverity: Event incompatible_param. +Fixes: 1a9e7a03c761 ("dmaengine: vdma: Add support for mulit-channel dma mode") +Signed-off-by: Shravya Kumbham +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1608722462-29519-3-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/xilinx/xilinx_dma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -2543,7 +2543,8 @@ static int xilinx_dma_chan_probe(struct + static int xilinx_dma_child_probe(struct xilinx_dma_device *xdev, + struct device_node *node) + { +- int ret, i, nr_channels = 1; ++ int ret, i; ++ u32 nr_channels = 1; + + ret = of_property_read_u32(node, "dma-channels", &nr_channels); + if ((ret < 0) && xdev->mcdma) diff --git a/queue-5.4/dmaengine-xilinx_dma-fix-mixed_enum_type-coverity-warning.patch b/queue-5.4/dmaengine-xilinx_dma-fix-mixed_enum_type-coverity-warning.patch new file mode 100644 index 00000000000..5cf38a6cb6c --- /dev/null +++ b/queue-5.4/dmaengine-xilinx_dma-fix-mixed_enum_type-coverity-warning.patch @@ -0,0 +1,35 @@ +From 2d5efea64472469117dc1a9a39530069e95b21e9 Mon Sep 17 00:00:00 2001 +From: Shravya Kumbham +Date: Wed, 23 Dec 2020 16:51:02 +0530 +Subject: dmaengine: xilinx_dma: fix mixed_enum_type coverity warning + +From: Shravya Kumbham + +commit 2d5efea64472469117dc1a9a39530069e95b21e9 upstream. + +Typecast the fls(width -1) with (enum dmaengine_alignment) in +xilinx_dma_chan_probe function to fix the coverity warning. + +Addresses-Coverity: Event mixed_enum_type. +Fixes: 9cd4360de609 ("dma: Add Xilinx AXI Video Direct Memory Access Engine driver support") +Signed-off-by: Shravya Kumbham +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1608722462-29519-4-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/xilinx/xilinx_dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -2431,7 +2431,7 @@ static int xilinx_dma_chan_probe(struct + has_dre = false; + + if (!has_dre) +- xdev->common.copy_align = fls(width - 1); ++ xdev->common.copy_align = (enum dmaengine_alignment)fls(width - 1); + + if (of_device_is_compatible(node, "xlnx,axi-vdma-mm2s-channel") || + of_device_is_compatible(node, "xlnx,axi-dma-mm2s-channel") || diff --git a/queue-5.4/i2c-i801-fix-the-i2c-mux-gpiod_lookup_table-not-being-properly-terminated.patch b/queue-5.4/i2c-i801-fix-the-i2c-mux-gpiod_lookup_table-not-being-properly-terminated.patch new file mode 100644 index 00000000000..0ee2e3b8e8d --- /dev/null +++ b/queue-5.4/i2c-i801-fix-the-i2c-mux-gpiod_lookup_table-not-being-properly-terminated.patch @@ -0,0 +1,37 @@ +From 0b3ea2a06de1f52ea30865e227e109a5fd3b6214 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 21 Dec 2020 14:42:25 +0100 +Subject: i2c: i801: Fix the i2c-mux gpiod_lookup_table not being properly terminated + +From: Hans de Goede + +commit 0b3ea2a06de1f52ea30865e227e109a5fd3b6214 upstream. + +gpiod_add_lookup_table() expects the gpiod_lookup_table->table passed to +it to be terminated with a zero-ed out entry. + +So we need to allocate one more entry then we will use. + +Fixes: d308dfbf62ef ("i2c: mux/i801: Switch to use descriptor passing") +Signed-off-by: Hans de Goede +Reviewed-by: Mika Westerberg +Acked-by: Jean Delvare +Reviewed-by: Linus Walleij +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-i801.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -1424,7 +1424,7 @@ static int i801_add_mux(struct i801_priv + + /* Register GPIO descriptor lookup table */ + lookup = devm_kzalloc(dev, +- struct_size(lookup, table, mux_config->n_gpios), ++ struct_size(lookup, table, mux_config->n_gpios + 1), + GFP_KERNEL); + if (!lookup) + return -ENOMEM; diff --git a/queue-5.4/i2c-sprd-use-a-specific-timeout-to-avoid-system-hang-up-issue.patch b/queue-5.4/i2c-sprd-use-a-specific-timeout-to-avoid-system-hang-up-issue.patch new file mode 100644 index 00000000000..39e852ee8df --- /dev/null +++ b/queue-5.4/i2c-sprd-use-a-specific-timeout-to-avoid-system-hang-up-issue.patch @@ -0,0 +1,57 @@ +From 0b884fe71f9ee6a5df35e677154256ea2099ebb8 Mon Sep 17 00:00:00 2001 +From: Chunyan Zhang +Date: Mon, 14 Dec 2020 12:58:50 +0800 +Subject: i2c: sprd: use a specific timeout to avoid system hang up issue + +From: Chunyan Zhang + +commit 0b884fe71f9ee6a5df35e677154256ea2099ebb8 upstream. + +If the i2c device SCL bus being pulled up due to some exception before +message transfer done, the system cannot receive the completing interrupt +signal any more, it would not exit waiting loop until MAX_SCHEDULE_TIMEOUT +jiffies eclipse, that would make the system seemed hang up. To avoid that +happen, this patch adds a specific timeout for message transfer. + +Fixes: 8b9ec0719834 ("i2c: Add Spreadtrum I2C controller driver") +Signed-off-by: Linhua Xu +Signed-off-by: Chunyan Zhang +[wsa: changed errno to ETIMEDOUT] +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-sprd.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-sprd.c ++++ b/drivers/i2c/busses/i2c-sprd.c +@@ -72,6 +72,8 @@ + + /* timeout (ms) for pm runtime autosuspend */ + #define SPRD_I2C_PM_TIMEOUT 1000 ++/* timeout (ms) for transfer message */ ++#define I2C_XFER_TIMEOUT 1000 + + /* SPRD i2c data structure */ + struct sprd_i2c { +@@ -244,6 +246,7 @@ static int sprd_i2c_handle_msg(struct i2 + struct i2c_msg *msg, bool is_last_msg) + { + struct sprd_i2c *i2c_dev = i2c_adap->algo_data; ++ unsigned long time_left; + + i2c_dev->msg = msg; + i2c_dev->buf = msg->buf; +@@ -273,7 +276,10 @@ static int sprd_i2c_handle_msg(struct i2 + + sprd_i2c_opt_start(i2c_dev); + +- wait_for_completion(&i2c_dev->complete); ++ time_left = wait_for_completion_timeout(&i2c_dev->complete, ++ msecs_to_jiffies(I2C_XFER_TIMEOUT)); ++ if (!time_left) ++ return -ETIMEDOUT; + + return i2c_dev->err; + } diff --git a/queue-5.4/iommu-intel-fix-memleak-in-intel_irq_remapping_alloc.patch b/queue-5.4/iommu-intel-fix-memleak-in-intel_irq_remapping_alloc.patch new file mode 100644 index 00000000000..3281445210a --- /dev/null +++ b/queue-5.4/iommu-intel-fix-memleak-in-intel_irq_remapping_alloc.patch @@ -0,0 +1,35 @@ +From ff2b46d7cff80d27d82f7f3252711f4ca1666129 Mon Sep 17 00:00:00 2001 +From: Dinghao Liu +Date: Tue, 5 Jan 2021 13:18:37 +0800 +Subject: iommu/intel: Fix memleak in intel_irq_remapping_alloc + +From: Dinghao Liu + +commit ff2b46d7cff80d27d82f7f3252711f4ca1666129 upstream. + +When irq_domain_get_irq_data() or irqd_cfg() fails +at i == 0, data allocated by kzalloc() has not been +freed before returning, which leads to memleak. + +Fixes: b106ee63abcc ("irq_remapping/vt-d: Enhance Intel IR driver to support hierarchical irqdomains") +Signed-off-by: Dinghao Liu +Acked-by: Lu Baolu +Link: https://lore.kernel.org/r/20210105051837.32118-1-dinghao.liu@zju.edu.cn +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel_irq_remapping.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -1400,6 +1400,8 @@ static int intel_irq_remapping_alloc(str + irq_data = irq_domain_get_irq_data(domain, virq + i); + irq_cfg = irqd_cfg(irq_data); + if (!irq_data || !irq_cfg) { ++ if (!i) ++ kfree(data); + ret = -EINVAL; + goto out_free_data; + } diff --git a/queue-5.4/kvm-arm64-don-t-access-pmcr_el0-when-no-pmu-is-available.patch b/queue-5.4/kvm-arm64-don-t-access-pmcr_el0-when-no-pmu-is-available.patch new file mode 100644 index 00000000000..24ba46d5ab1 --- /dev/null +++ b/queue-5.4/kvm-arm64-don-t-access-pmcr_el0-when-no-pmu-is-available.patch @@ -0,0 +1,46 @@ +From 2a5f1b67ec577fb1544b563086e0377f095f88e2 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Thu, 10 Dec 2020 08:30:59 +0000 +Subject: KVM: arm64: Don't access PMCR_EL0 when no PMU is available + +From: Marc Zyngier + +commit 2a5f1b67ec577fb1544b563086e0377f095f88e2 upstream. + +We reset the guest's view of PMCR_EL0 unconditionally, based on +the host's view of this register. It is however legal for an +implementation not to provide any PMU, resulting in an UNDEF. + +The obvious fix is to skip the reset of this shadow register +when no PMU is available, sidestepping the issue entirely. +If no PMU is available, the guest is not able to request +a virtual PMU anyway, so not doing nothing is the right thing +to do! + +It is unlikely that this bug can hit any HW implementation +though, as they all provide a PMU. It has been found using nested +virt with the host KVM not implementing the PMU itself. + +Fixes: ab9468340d2bc ("arm64: KVM: Add access handler for PMCR register") +Reviewed-by: Alexandru Elisei +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20201210083059.1277162-1-maz@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kvm/sys_regs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -625,6 +625,10 @@ static void reset_pmcr(struct kvm_vcpu * + { + u64 pmcr, val; + ++ /* No PMU available, PMCR_EL0 may UNDEF... */ ++ if (!kvm_arm_support_pmu_v3()) ++ return; ++ + pmcr = read_sysreg(pmcr_el0); + /* + * Writable bits of PMCR_EL0 (ARMV8_PMU_PMCR_MASK) are reset to UNKNOWN diff --git a/queue-5.4/lightnvm-select-config_crc32.patch b/queue-5.4/lightnvm-select-config_crc32.patch new file mode 100644 index 00000000000..1ff43badbdd --- /dev/null +++ b/queue-5.4/lightnvm-select-config_crc32.patch @@ -0,0 +1,35 @@ +From 19cd3403cb0d522dd5e10188eef85817de29e26e Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Sun, 3 Jan 2021 22:43:09 +0100 +Subject: lightnvm: select CONFIG_CRC32 + +From: Arnd Bergmann + +commit 19cd3403cb0d522dd5e10188eef85817de29e26e upstream. + +Without CRC32 support, this fails to link: + +arm-linux-gnueabi-ld: drivers/lightnvm/pblk-init.o: in function `pblk_init': +pblk-init.c:(.text+0x2654): undefined reference to `crc32_le' +arm-linux-gnueabi-ld: drivers/lightnvm/pblk-init.o: in function `pblk_exit': +pblk-init.c:(.text+0x2a7c): undefined reference to `crc32_le' + +Fixes: a4bd217b4326 ("lightnvm: physical block device (pblk) target") +Signed-off-by: Arnd Bergmann +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/lightnvm/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/lightnvm/Kconfig ++++ b/drivers/lightnvm/Kconfig +@@ -19,6 +19,7 @@ if NVM + + config NVM_PBLK + tristate "Physical Block Device Open-Channel SSD target" ++ select CRC32 + help + Allows an open-channel SSD to be exposed as a block device to the + host. The target assumes the device exposes raw flash and must be diff --git a/queue-5.4/net-mlx5e-fix-memleak-in-mlx5e_create_l2_table_groups.patch b/queue-5.4/net-mlx5e-fix-memleak-in-mlx5e_create_l2_table_groups.patch new file mode 100644 index 00000000000..80240825fe4 --- /dev/null +++ b/queue-5.4/net-mlx5e-fix-memleak-in-mlx5e_create_l2_table_groups.patch @@ -0,0 +1,34 @@ +From 5b0bb12c58ac7d22e05b5bfdaa30a116c8c32e32 Mon Sep 17 00:00:00 2001 +From: Dinghao Liu +Date: Mon, 21 Dec 2020 19:27:31 +0800 +Subject: net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups + +From: Dinghao Liu + +commit 5b0bb12c58ac7d22e05b5bfdaa30a116c8c32e32 upstream. + +When mlx5_create_flow_group() fails, ft->g should be +freed just like when kvzalloc() fails. The caller of +mlx5e_create_l2_table_groups() does not catch this +issue on failure, which leads to memleak. + +Fixes: 33cfaaa8f36f ("net/mlx5e: Split the main flow steering table") +Signed-off-by: Dinghao Liu +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -1346,6 +1346,7 @@ err_destroy_groups: + ft->g[ft->num_groups] = NULL; + mlx5e_destroy_groups(ft); + kvfree(in); ++ kfree(ft->g); + + return err; + } diff --git a/queue-5.4/net-mlx5e-fix-two-double-free-cases.patch b/queue-5.4/net-mlx5e-fix-two-double-free-cases.patch new file mode 100644 index 00000000000..55c50b57504 --- /dev/null +++ b/queue-5.4/net-mlx5e-fix-two-double-free-cases.patch @@ -0,0 +1,45 @@ +From 7a6eb072a9548492ead086f3e820e9aac71c7138 Mon Sep 17 00:00:00 2001 +From: Dinghao Liu +Date: Mon, 28 Dec 2020 16:48:40 +0800 +Subject: net/mlx5e: Fix two double free cases + +From: Dinghao Liu + +commit 7a6eb072a9548492ead086f3e820e9aac71c7138 upstream. + +mlx5e_create_ttc_table_groups() frees ft->g on failure of +kvzalloc(), but such failure will be caught by its caller +in mlx5e_create_ttc_table() and ft->g will be freed again +in mlx5e_destroy_flow_table(). The same issue also occurs +in mlx5e_create_ttc_table_groups(). Set ft->g to NULL after +kfree() to avoid double free. + +Fixes: 7b3722fa9ef6 ("net/mlx5e: Support RSS for GRE tunneled packets") +Fixes: 33cfaaa8f36f ("net/mlx5e: Split the main flow steering table") +Signed-off-by: Dinghao Liu +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +@@ -927,6 +927,7 @@ static int mlx5e_create_ttc_table_groups + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) { + kfree(ft->g); ++ ft->g = NULL; + return -ENOMEM; + } + +@@ -1067,6 +1068,7 @@ static int mlx5e_create_inner_ttc_table_ + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) { + kfree(ft->g); ++ ft->g = NULL; + return -ENOMEM; + } + diff --git a/queue-5.4/net-mvpp2-disable-force-link-up-during-port-init-procedure.patch b/queue-5.4/net-mvpp2-disable-force-link-up-during-port-init-procedure.patch new file mode 100644 index 00000000000..74f46a5ee73 --- /dev/null +++ b/queue-5.4/net-mvpp2-disable-force-link-up-during-port-init-procedure.patch @@ -0,0 +1,54 @@ +From 87508224485323ce2d4e7fb929ec80f51adcc238 Mon Sep 17 00:00:00 2001 +From: Stefan Chulski +Date: Thu, 17 Dec 2020 16:52:15 +0200 +Subject: net: mvpp2: disable force link UP during port init procedure + +From: Stefan Chulski + +commit 87508224485323ce2d4e7fb929ec80f51adcc238 upstream. + +Force link UP can be enabled by bootloader during tftpboot +and breaks NFS support. +Force link UP disabled during port init procedure. + +Fixes: f84bf386f395 ("net: mvpp2: initialize the GoP") +Signed-off-by: Stefan Chulski +Acked-by: Marcin Wojtas +Link: https://lore.kernel.org/r/1608216735-14501-1-git-send-email-stefanc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -4545,7 +4545,7 @@ static int mvpp2_port_init(struct mvpp2_ + struct mvpp2 *priv = port->priv; + struct mvpp2_txq_pcpu *txq_pcpu; + unsigned int thread; +- int queue, err; ++ int queue, err, val; + + /* Checks for hardware constraints */ + if (port->first_rxq + port->nrxqs > +@@ -4559,6 +4559,18 @@ static int mvpp2_port_init(struct mvpp2_ + mvpp2_egress_disable(port); + mvpp2_port_disable(port); + ++ if (mvpp2_is_xlg(port->phy_interface)) { ++ val = readl(port->base + MVPP22_XLG_CTRL0_REG); ++ val &= ~MVPP22_XLG_CTRL0_FORCE_LINK_PASS; ++ val |= MVPP22_XLG_CTRL0_FORCE_LINK_DOWN; ++ writel(val, port->base + MVPP22_XLG_CTRL0_REG); ++ } else { ++ val = readl(port->base + MVPP2_GMAC_AUTONEG_CONFIG); ++ val &= ~MVPP2_GMAC_FORCE_LINK_PASS; ++ val |= MVPP2_GMAC_FORCE_LINK_DOWN; ++ writel(val, port->base + MVPP2_GMAC_AUTONEG_CONFIG); ++ } ++ + port->tx_time_coal = MVPP2_TXDONE_COAL_USEC; + + port->txqs = devm_kcalloc(dev, port->ntxqs, sizeof(*port->txqs), diff --git a/queue-5.4/qed-select-config_crc32.patch b/queue-5.4/qed-select-config_crc32.patch new file mode 100644 index 00000000000..287c2a84724 --- /dev/null +++ b/queue-5.4/qed-select-config_crc32.patch @@ -0,0 +1,41 @@ +From 2860d45a589818dd8ffd90cdc4bcf77f36a5a6be Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Sun, 3 Jan 2021 22:36:17 +0100 +Subject: qed: select CONFIG_CRC32 + +From: Arnd Bergmann + +commit 2860d45a589818dd8ffd90cdc4bcf77f36a5a6be upstream. + +Without this, the driver fails to link: + +lpc_eth.c:(.text+0x1934): undefined reference to `crc32_le' +arm-linux-gnueabi-ld: drivers/net/ethernet/qlogic/qed/qed_debug.o: in function `qed_grc_dump': +qed_debug.c:(.text+0x4068): undefined reference to `crc32_le' +arm-linux-gnueabi-ld: drivers/net/ethernet/qlogic/qed/qed_debug.o: in function `qed_idle_chk_dump': +qed_debug.c:(.text+0x51fc): undefined reference to `crc32_le' +arm-linux-gnueabi-ld: drivers/net/ethernet/qlogic/qed/qed_debug.o: in function `qed_mcp_trace_dump': +qed_debug.c:(.text+0x6000): undefined reference to `crc32_le' +arm-linux-gnueabi-ld: drivers/net/ethernet/qlogic/qed/qed_debug.o: in function `qed_dbg_reg_fifo_dump': +qed_debug.c:(.text+0x66cc): undefined reference to `crc32_le' +arm-linux-gnueabi-ld: drivers/net/ethernet/qlogic/qed/qed_debug.o:qed_debug.c:(.text+0x6aa4): more undefined references to `crc32_le' follow + +Fixes: 7a4b21b7d1f0 ("qed: Add nvram selftest") +Signed-off-by: Arnd Bergmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/qlogic/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/qlogic/Kconfig ++++ b/drivers/net/ethernet/qlogic/Kconfig +@@ -78,6 +78,7 @@ config QED + depends on PCI + select ZLIB_INFLATE + select CRC8 ++ select CRC32 + select NET_DEVLINK + ---help--- + This enables the support for ... diff --git a/queue-5.4/regmap-debugfs-fix-a-memory-leak-when-calling-regmap_attach_dev.patch b/queue-5.4/regmap-debugfs-fix-a-memory-leak-when-calling-regmap_attach_dev.patch new file mode 100644 index 00000000000..a00f6589815 --- /dev/null +++ b/queue-5.4/regmap-debugfs-fix-a-memory-leak-when-calling-regmap_attach_dev.patch @@ -0,0 +1,75 @@ +From cffa4b2122f5f3e53cf3d529bbc74651f95856d5 Mon Sep 17 00:00:00 2001 +From: Xiaolei Wang +Date: Tue, 29 Dec 2020 18:50:46 +0800 +Subject: regmap: debugfs: Fix a memory leak when calling regmap_attach_dev + +From: Xiaolei Wang + +commit cffa4b2122f5f3e53cf3d529bbc74651f95856d5 upstream. + +After initializing the regmap through +syscon_regmap_lookup_by_compatible, then regmap_attach_dev to the +device, because the debugfs_name has been allocated, there is no +need to redistribute it again + +unreferenced object 0xd8399b80 (size 64): + comm "swapper/0", pid 1, jiffies 4294937641 (age 278.590s) + hex dump (first 32 bytes): + 64 75 6d 6d 79 2d 69 6f 6d 75 78 63 2d 67 70 72 +dummy-iomuxc-gpr + 40 32 30 65 34 30 30 30 00 7f 52 5b d8 7e 42 69 +@20e4000..R[.~Bi + backtrace: + [] kasprintf+0x2c/0x54 + [<6ad3bbc2>] regmap_debugfs_init+0xdc/0x2fc + [] __regmap_init+0xc38/0xd88 + [<1f7e0609>] of_syscon_register+0x168/0x294 + [<735e8766>] device_node_get_regmap+0x6c/0x98 + [] imx6ul_init_machine+0x20/0x88 + [<0456565b>] customize_machine+0x1c/0x30 + [] do_one_initcall+0x80/0x3ac + [<7e584867>] kernel_init_freeable+0x170/0x1f0 + [<80074741>] kernel_init+0x8/0x120 + [<285d6f28>] ret_from_fork+0x14/0x20 + [<00000000>] 0x0 + +Fixes: 9b947a13e7f6 ("regmap: use debugfs even when no device") +Signed-off-by: Xiaolei Wang +Link: https://lore.kernel.org/r/20201229105046.41984-1-xiaolei.wang@windriver.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/regmap/regmap-debugfs.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/base/regmap/regmap-debugfs.c ++++ b/drivers/base/regmap/regmap-debugfs.c +@@ -583,18 +583,25 @@ void regmap_debugfs_init(struct regmap * + devname = dev_name(map->dev); + + if (name) { +- map->debugfs_name = kasprintf(GFP_KERNEL, "%s-%s", ++ if (!map->debugfs_name) { ++ map->debugfs_name = kasprintf(GFP_KERNEL, "%s-%s", + devname, name); ++ if (!map->debugfs_name) ++ return; ++ } + name = map->debugfs_name; + } else { + name = devname; + } + + if (!strcmp(name, "dummy")) { +- kfree(map->debugfs_name); ++ if (!map->debugfs_name) ++ kfree(map->debugfs_name); + + map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", + dummy_index); ++ if (!map->debugfs_name) ++ return; + name = map->debugfs_name; + dummy_index++; + } diff --git a/queue-5.4/regulator-qcom-rpmh-regulator-correct-hfsmps515-definition.patch b/queue-5.4/regulator-qcom-rpmh-regulator-correct-hfsmps515-definition.patch new file mode 100644 index 00000000000..f5a1d143efc --- /dev/null +++ b/queue-5.4/regulator-qcom-rpmh-regulator-correct-hfsmps515-definition.patch @@ -0,0 +1,34 @@ +From df6b92fa40050e59ea89784294bf6d04c0c47705 Mon Sep 17 00:00:00 2001 +From: Dmitry Baryshkov +Date: Thu, 31 Dec 2020 15:23:46 +0300 +Subject: regulator: qcom-rpmh-regulator: correct hfsmps515 definition + +From: Dmitry Baryshkov + +commit df6b92fa40050e59ea89784294bf6d04c0c47705 upstream. + +According to the datasheet pm8009's HFS515 regulators have 16mV +resolution rather than declared 1.6 mV. Correct the resolution. + +Signed-off-by: Dmitry Baryshkov +Fixes: 06369bcc15a1 ("regulator: qcom-rpmh: Add support for SM8150") +Reviewed-by: Vinod Koul +Link: https://lore.kernel.org/r/20201231122348.637917-3-dmitry.baryshkov@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/qcom-rpmh-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/regulator/qcom-rpmh-regulator.c ++++ b/drivers/regulator/qcom-rpmh-regulator.c +@@ -726,7 +726,7 @@ static const struct rpmh_vreg_hw_data pm + static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = { + .regulator_type = VRM, + .ops = &rpmh_regulator_vrm_ops, +- .voltage_range = REGULATOR_LINEAR_RANGE(2800000, 0, 4, 1600), ++ .voltage_range = REGULATOR_LINEAR_RANGE(2800000, 0, 4, 16000), + .n_voltages = 5, + .pmic_mode_map = pmic_mode_map_pmic5_smps, + .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode, diff --git a/queue-5.4/series b/queue-5.4/series index e65ab46c973..39299a8bacf 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -30,3 +30,30 @@ exfat-month-timestamp-metadata-accidentally-incremented.patch vmlinux.lds.h-add-pgo-and-autofdo-input-sections.patch iio-imu-st_lsm6dsx-fix-edge-trigger-interrupts.patch hid-wacom-fix-memory-leakage-caused-by-kfifo_alloc.patch +arm-omap2-omap_device-fix-idling-of-devices-during-probe.patch +i2c-sprd-use-a-specific-timeout-to-avoid-system-hang-up-issue.patch +dmaengine-dw-edma-fix-use-after-free-in-dw_edma_alloc_chunk.patch +can-tcan4x5x-fix-bittiming-const-use-common-bittiming-from-m_can-driver.patch +can-m_can-m_can_class_unregister-remove-erroneous-m_can_clk_stop.patch +can-kvaser_pciefd-select-config_crc32.patch +cpufreq-powernow-k8-pass-policy-rather-than-use-cpufreq_cpu_get.patch +spi-spi-geni-qcom-fix-geni_spi_isr-null-dereference-in-timeout-case.patch +spi-stm32-fifo-threshold-level-fix-align-packet-size.patch +i2c-i801-fix-the-i2c-mux-gpiod_lookup_table-not-being-properly-terminated.patch +dmaengine-mediatek-mtk-hsdma-fix-a-resource-leak-in-the-error-handling-path-of-the-probe-function.patch +dmaengine-xilinx_dma-check-dma_async_device_register-return-value.patch +dmaengine-xilinx_dma-fix-incompatible-param-warning-in-_child_probe.patch +dmaengine-xilinx_dma-fix-mixed_enum_type-coverity-warning.patch +qed-select-config_crc32.patch +wil6210-select-config_crc32.patch +block-rsxx-select-config_crc32.patch +lightnvm-select-config_crc32.patch +iommu-intel-fix-memleak-in-intel_irq_remapping_alloc.patch +bpftool-fix-compilation-failure-for-net.o-with-older-glibc.patch +net-mlx5e-fix-memleak-in-mlx5e_create_l2_table_groups.patch +net-mlx5e-fix-two-double-free-cases.patch +regmap-debugfs-fix-a-memory-leak-when-calling-regmap_attach_dev.patch +wan-ds26522-select-config_bitreverse.patch +regulator-qcom-rpmh-regulator-correct-hfsmps515-definition.patch +net-mvpp2-disable-force-link-up-during-port-init-procedure.patch +kvm-arm64-don-t-access-pmcr_el0-when-no-pmu-is-available.patch diff --git a/queue-5.4/spi-spi-geni-qcom-fix-geni_spi_isr-null-dereference-in-timeout-case.patch b/queue-5.4/spi-spi-geni-qcom-fix-geni_spi_isr-null-dereference-in-timeout-case.patch new file mode 100644 index 00000000000..21c1e248635 --- /dev/null +++ b/queue-5.4/spi-spi-geni-qcom-fix-geni_spi_isr-null-dereference-in-timeout-case.patch @@ -0,0 +1,90 @@ +From 4aa1464acbe3697710279a4bd65cb4801ed30425 Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Thu, 17 Dec 2020 14:29:11 -0800 +Subject: spi: spi-geni-qcom: Fix geni_spi_isr() NULL dereference in timeout case + +From: Douglas Anderson + +commit 4aa1464acbe3697710279a4bd65cb4801ed30425 upstream. + +In commit 7ba9bdcb91f6 ("spi: spi-geni-qcom: Don't keep a local state +variable") we changed handle_fifo_timeout() so that we set +"mas->cur_xfer" to NULL to make absolutely sure that we don't mess +with the buffers from the previous transfer in the timeout case. + +Unfortunately, this caused the IRQ handler to dereference NULL in some +cases. One case: + + CPU0 CPU1 + ---- ---- + setup_fifo_xfer() + geni_se_setup_m_cmd() + + + + ... + handle_fifo_timeout() + spin_lock_irq(mas->lock) + mas->cur_xfer = NULL + geni_se_cancel_m_cmd() + spin_unlock_irq(mas->lock) + + geni_spi_isr() + spin_lock(mas->lock) + if (m_irq & M_RX_FIFO_WATERMARK_EN) + geni_spi_handle_rx() + mas->cur_xfer NULL dereference! + +tl;dr: Seriously delayed interrupts for RX/TX can lead to timeout +handling setting mas->cur_xfer to NULL. + +Let's check for the NULL transfer in the TX and RX cases and reset the +watermark or clear out the fifo respectively to put the hardware back +into a sane state. + +NOTE: things still could get confused if we get timeouts all the way +through handle_fifo_timeout() and then start a new transfer because +interrupts from the old transfer / cancel / abort could still be +pending. A future patch will help this corner case. + +Fixes: 561de45f72bd ("spi: spi-geni-qcom: Add SPI driver support for GENI based QUP") +Signed-off-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20201217142842.v3.1.I99ee04f0cb823415df59bd4f550d6ff5756e43d6@changeid +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-geni-qcom.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -415,6 +415,12 @@ static void geni_spi_handle_tx(struct sp + unsigned int bytes_per_fifo_word = geni_byte_per_fifo_word(mas); + unsigned int i = 0; + ++ /* Stop the watermark IRQ if nothing to send */ ++ if (!mas->cur_xfer) { ++ writel(0, se->base + SE_GENI_TX_WATERMARK_REG); ++ return false; ++ } ++ + max_bytes = (mas->tx_fifo_depth - mas->tx_wm) * bytes_per_fifo_word; + if (mas->tx_rem_bytes < max_bytes) + max_bytes = mas->tx_rem_bytes; +@@ -454,6 +460,14 @@ static void geni_spi_handle_rx(struct sp + if (rx_last_byte_valid && rx_last_byte_valid < 4) + rx_bytes -= bytes_per_fifo_word - rx_last_byte_valid; + } ++ ++ /* Clear out the FIFO and bail if nowhere to put it */ ++ if (!mas->cur_xfer) { ++ for (i = 0; i < DIV_ROUND_UP(rx_bytes, bytes_per_fifo_word); i++) ++ readl(se->base + SE_GENI_RX_FIFOn); ++ return; ++ } ++ + if (mas->rx_rem_bytes < rx_bytes) + rx_bytes = mas->rx_rem_bytes; + diff --git a/queue-5.4/spi-stm32-fifo-threshold-level-fix-align-packet-size.patch b/queue-5.4/spi-stm32-fifo-threshold-level-fix-align-packet-size.patch new file mode 100644 index 00000000000..ef8275cebdb --- /dev/null +++ b/queue-5.4/spi-stm32-fifo-threshold-level-fix-align-packet-size.patch @@ -0,0 +1,44 @@ +From a590370d918fc66c62df6620445791fbe840344a Mon Sep 17 00:00:00 2001 +From: Roman Guskov +Date: Mon, 21 Dec 2020 13:35:32 +0100 +Subject: spi: stm32: FIFO threshold level - fix align packet size + +From: Roman Guskov + +commit a590370d918fc66c62df6620445791fbe840344a upstream. + +if cur_bpw <= 8 and xfer_len < 4 then the value of fthlv will be 1 and +SPI registers content may have been lost. + +* If SPI data register is accessed as a 16-bit register and DSIZE <= 8bit, + better to select FTHLV = 2, 4, 6 etc + +* If SPI data register is accessed as a 32-bit register and DSIZE > 8bit, + better to select FTHLV = 2, 4, 6 etc, while if DSIZE <= 8bit, + better to select FTHLV = 4, 8, 12 etc + +Signed-off-by: Roman Guskov +Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller") +Reviewed-by: Marek Vasut +Link: https://lore.kernel.org/r/20201221123532.27272-1-rguskov@dh-electronics.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-stm32.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -494,9 +494,9 @@ static u32 stm32h7_spi_prepare_fthlv(str + + /* align packet size with data registers access */ + if (spi->cur_bpw > 8) +- fthlv -= (fthlv % 2); /* multiple of 2 */ ++ fthlv += (fthlv % 2) ? 1 : 0; + else +- fthlv -= (fthlv % 4); /* multiple of 4 */ ++ fthlv += (fthlv % 4) ? (4 - (fthlv % 4)) : 0; + + if (!fthlv) + fthlv = 1; diff --git a/queue-5.4/wan-ds26522-select-config_bitreverse.patch b/queue-5.4/wan-ds26522-select-config_bitreverse.patch new file mode 100644 index 00000000000..55facd71bd4 --- /dev/null +++ b/queue-5.4/wan-ds26522-select-config_bitreverse.patch @@ -0,0 +1,36 @@ +From 69931e11288520c250152180ecf9b6ac5e6e40ed Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Sun, 3 Jan 2021 22:36:23 +0100 +Subject: wan: ds26522: select CONFIG_BITREVERSE + +From: Arnd Bergmann + +commit 69931e11288520c250152180ecf9b6ac5e6e40ed upstream. + +Without this, the driver runs into a link failure + +arm-linux-gnueabi-ld: drivers/net/wan/slic_ds26522.o: in function `slic_ds26522_probe': +slic_ds26522.c:(.text+0x100c): undefined reference to `byte_rev_table' +arm-linux-gnueabi-ld: slic_ds26522.c:(.text+0x1cdc): undefined reference to `byte_rev_table' +arm-linux-gnueabi-ld: drivers/net/wan/slic_ds26522.o: in function `slic_write': +slic_ds26522.c:(.text+0x1e4c): undefined reference to `byte_rev_table' + +Fixes: c37d4a0085c5 ("Maxim/driver: Add driver for maxim ds26522") +Signed-off-by: Arnd Bergmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wan/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wan/Kconfig ++++ b/drivers/net/wan/Kconfig +@@ -282,6 +282,7 @@ config SLIC_DS26522 + tristate "Slic Maxim ds26522 card support" + depends on SPI + depends on FSL_SOC || ARCH_MXC || ARCH_LAYERSCAPE || COMPILE_TEST ++ select BITREVERSE + help + This module initializes and configures the slic maxim card + in T1 or E1 mode. diff --git a/queue-5.4/wil6210-select-config_crc32.patch b/queue-5.4/wil6210-select-config_crc32.patch new file mode 100644 index 00000000000..33ab7cab0fe --- /dev/null +++ b/queue-5.4/wil6210-select-config_crc32.patch @@ -0,0 +1,34 @@ +From e186620d7bf11b274b985b839c38266d7918cc05 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Sun, 3 Jan 2021 22:36:20 +0100 +Subject: wil6210: select CONFIG_CRC32 + +From: Arnd Bergmann + +commit e186620d7bf11b274b985b839c38266d7918cc05 upstream. + +Without crc32, the driver fails to link: + +arm-linux-gnueabi-ld: drivers/net/wireless/ath/wil6210/fw.o: in function `wil_fw_verify': +fw.c:(.text+0x74c): undefined reference to `crc32_le' +arm-linux-gnueabi-ld: drivers/net/wireless/ath/wil6210/fw.o:fw.c:(.text+0x758): more undefined references to `crc32_le' follow + +Fixes: 151a9706503f ("wil6210: firmware download") +Signed-off-by: Arnd Bergmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/wil6210/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/ath/wil6210/Kconfig ++++ b/drivers/net/wireless/ath/wil6210/Kconfig +@@ -2,6 +2,7 @@ + config WIL6210 + tristate "Wilocity 60g WiFi card wil6210 support" + select WANT_DEV_COREDUMP ++ select CRC32 + depends on CFG80211 + depends on PCI + default n