From: Sasha Levin Date: Mon, 27 Jul 2020 01:19:22 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v4.14.190~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ffdd6a0328a409b7b2e49c4a11ba9df97962ffe6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch b/queue-4.19/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch new file mode 100644 index 00000000000..1f26dc3114a --- /dev/null +++ b/queue-4.19/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch @@ -0,0 +1,43 @@ +From 829c408370cd875727b312994ac193dc50412fe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2020 12:12:26 +0000 +Subject: arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP + +From: Will Deacon + +[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ] + +Rather than open-code test_tsk_thread_flag() at each callsite, simply +replace the couple of offenders with calls to test_tsk_thread_flag() +directly. + +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/debug-monitors.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index 93ee34dee9f22..501e835c65007 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -392,14 +392,14 @@ void user_rewind_single_step(struct task_struct *task) + * If single step is active for this thread, then set SPSR.SS + * to 1 to avoid returning to the active-pending state. + */ +- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) + set_regs_spsr_ss(task_pt_regs(task)); + } + NOKPROBE_SYMBOL(user_rewind_single_step); + + void user_fastforward_single_step(struct task_struct *task) + { +- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) + clear_regs_spsr_ss(task_pt_regs(task)); + } + +-- +2.25.1 + diff --git a/queue-4.19/ax88172a-fix-ax88172a_unbind-failures.patch b/queue-4.19/ax88172a-fix-ax88172a_unbind-failures.patch new file mode 100644 index 00000000000..0c427d60497 --- /dev/null +++ b/queue-4.19/ax88172a-fix-ax88172a_unbind-failures.patch @@ -0,0 +1,36 @@ +From f856e75dc83f6ab6fe11f2fba98b911144f68687 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 09:59:31 -0400 +Subject: ax88172a: fix ax88172a_unbind() failures + +From: George Kennedy + +[ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ] + +If ax88172a_unbind() fails, make sure that the return code is +less than zero so that cleanup is done properly and avoid UAF. + +Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers") +Signed-off-by: George Kennedy +Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ax88172a.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c +index 914cac55a7ae7..909755ef71ac3 100644 +--- a/drivers/net/usb/ax88172a.c ++++ b/drivers/net/usb/ax88172a.c +@@ -210,6 +210,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) + ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0); + if (ret < ETH_ALEN) { + netdev_err(dev->net, "Failed to read MAC address: %d\n", ret); ++ ret = -EIO; + goto free; + } + memcpy(dev->net->dev_addr, buf, ETH_ALEN); +-- +2.25.1 + diff --git a/queue-4.19/bnxt_en-fix-race-when-modifying-pause-settings.patch b/queue-4.19/bnxt_en-fix-race-when-modifying-pause-settings.patch new file mode 100644 index 00000000000..e13402d7d4f --- /dev/null +++ b/queue-4.19/bnxt_en-fix-race-when-modifying-pause-settings.patch @@ -0,0 +1,44 @@ +From 264658aa2b023dc7cad8b85790142ecf4edb7375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jul 2020 20:48:23 -0400 +Subject: bnxt_en: Fix race when modifying pause settings. + +From: Vasundhara Volam + +[ Upstream commit 163e9ef63641a02de4c95cd921577265c52e1ce2 ] + +The driver was modified to not rely on rtnl lock to protect link +settings about 2 years ago. The pause setting was missed when +making that change. Fix it by acquiring link_lock mutex before +calling bnxt_hwrm_set_pause(). + +Fixes: e2dc9b6e38fa ("bnxt_en: Don't use rtnl lock to protect link change logic in workqueue.") +Signed-off-by: Vasundhara Volam +Reviewed-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 047024717d654..63730e449e088 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1392,8 +1392,11 @@ static int bnxt_set_pauseparam(struct net_device *dev, + if (epause->tx_pause) + link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX; + +- if (netif_running(dev)) ++ if (netif_running(dev)) { ++ mutex_lock(&bp->link_lock); + rc = bnxt_hwrm_set_pause(bp); ++ mutex_unlock(&bp->link_lock); ++ } + return rc; + } + +-- +2.25.1 + diff --git a/queue-4.19/bonding-check-error-value-of-register_netdevice-imme.patch b/queue-4.19/bonding-check-error-value-of-register_netdevice-imme.patch new file mode 100644 index 00000000000..d2748ca3820 --- /dev/null +++ b/queue-4.19/bonding-check-error-value-of-register_netdevice-imme.patch @@ -0,0 +1,90 @@ +From 26ed5f9d5b00d787cd17bfa2c98c07a3a221e018 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 12:11:24 +0000 +Subject: bonding: check error value of register_netdevice() immediately + +From: Taehee Yoo + +[ Upstream commit 544f287b84959203367cd29e16e772717612fab4 ] + +If register_netdevice() is failed, net_device should not be used +because variables are uninitialized or freed. +So, the routine should be stopped immediately. +But, bond_create() doesn't check return value of register_netdevice() +immediately. That will result in a panic because of using uninitialized +or freed memory. + +Test commands: + modprobe netdev-notifier-error-inject + echo -22 > /sys/kernel/debug/notifier-error-inject/netdev/\ +actions/NETDEV_REGISTER/error + modprobe bonding max_bonds=3 + +Splat looks like: +[ 375.028492][ T193] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC PTI +[ 375.033207][ T193] CPU: 2 PID: 193 Comm: kworker/2:2 Not tainted 5.8.0-rc4+ #645 +[ 375.036068][ T193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +[ 375.039673][ T193] Workqueue: events linkwatch_event +[ 375.041557][ T193] RIP: 0010:dev_activate+0x4a/0x340 +[ 375.043381][ T193] Code: 40 a8 04 0f 85 db 00 00 00 8b 83 08 04 00 00 85 c0 0f 84 0d 01 00 00 31 d2 89 d0 48 8d 04 40 48 c1 e0 07 48 03 83 00 04 00 00 <48> 8b 48 10 f6 41 10 01 75 08 f0 80 a1 a0 01 00 00 fd 48 89 48 08 +[ 375.050267][ T193] RSP: 0018:ffff9f8facfcfdd8 EFLAGS: 00010202 +[ 375.052410][ T193] RAX: 6b6b6b6b6b6b6b6b RBX: ffff9f8fae6ea000 RCX: 0000000000000006 +[ 375.055178][ T193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f8fae6ea000 +[ 375.057762][ T193] RBP: ffff9f8fae6ea000 R08: 0000000000000000 R09: 0000000000000000 +[ 375.059810][ T193] R10: 0000000000000001 R11: 0000000000000000 R12: ffff9f8facfcfe08 +[ 375.061892][ T193] R13: ffffffff883587e0 R14: 0000000000000000 R15: ffff9f8fae6ea580 +[ 375.063931][ T193] FS: 0000000000000000(0000) GS:ffff9f8fbae00000(0000) knlGS:0000000000000000 +[ 375.066239][ T193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 375.067841][ T193] CR2: 00007f2f542167a0 CR3: 000000012cee6002 CR4: 00000000003606e0 +[ 375.069657][ T193] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 375.071471][ T193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 375.073269][ T193] Call Trace: +[ 375.074005][ T193] linkwatch_do_dev+0x4d/0x50 +[ 375.075052][ T193] __linkwatch_run_queue+0x10b/0x200 +[ 375.076244][ T193] linkwatch_event+0x21/0x30 +[ 375.077274][ T193] process_one_work+0x252/0x600 +[ 375.078379][ T193] ? process_one_work+0x600/0x600 +[ 375.079518][ T193] worker_thread+0x3c/0x380 +[ 375.080534][ T193] ? process_one_work+0x600/0x600 +[ 375.081668][ T193] kthread+0x139/0x150 +[ 375.082567][ T193] ? kthread_park+0x90/0x90 +[ 375.083567][ T193] ret_from_fork+0x22/0x30 + +Fixes: e826eafa65c6 ("bonding: Call netif_carrier_off after register_netdevice") +Signed-off-by: Taehee Yoo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index f57b86f1373d4..11429df743067 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4817,15 +4817,19 @@ int bond_create(struct net *net, const char *name) + bond_dev->rtnl_link_ops = &bond_link_ops; + + res = register_netdevice(bond_dev); ++ if (res < 0) { ++ free_netdev(bond_dev); ++ rtnl_unlock(); ++ ++ return res; ++ } + + netif_carrier_off(bond_dev); + + bond_work_init_all(bond); + + rtnl_unlock(); +- if (res < 0) +- free_netdev(bond_dev); +- return res; ++ return 0; + } + + static int __net_init bond_net_init(struct net *net) +-- +2.25.1 + diff --git a/queue-4.19/bonding-check-return-value-of-register_netdevice-in-.patch b/queue-4.19/bonding-check-return-value-of-register_netdevice-in-.patch new file mode 100644 index 00000000000..8c9ff17b63c --- /dev/null +++ b/queue-4.19/bonding-check-return-value-of-register_netdevice-in-.patch @@ -0,0 +1,46 @@ +From e5a588b4fcfde99b723ec7dbea2fe530d524f940 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 16:31:54 -0700 +Subject: bonding: check return value of register_netdevice() in bond_newlink() + +From: Cong Wang + +[ Upstream commit c75d1d5248c0c97996051809ad0e9f154ba5d76e ] + +Very similar to commit 544f287b8495 +("bonding: check error value of register_netdevice() immediately"), +we should immediately check the return value of register_netdevice() +before doing anything else. + +Fixes: 005db31d5f5f ("bonding: set carrier off for devices created through netlink") +Reported-and-tested-by: syzbot+bbc3a11c4da63c1b74d6@syzkaller.appspotmail.com +Cc: Beniamino Galvani +Cc: Taehee Yoo +Cc: Jay Vosburgh +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_netlink.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c +index 6b9ad86732188..fbcd8a752ee70 100644 +--- a/drivers/net/bonding/bond_netlink.c ++++ b/drivers/net/bonding/bond_netlink.c +@@ -451,11 +451,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev, + return err; + + err = register_netdevice(bond_dev); +- +- netif_carrier_off(bond_dev); + if (!err) { + struct bonding *bond = netdev_priv(bond_dev); + ++ netif_carrier_off(bond_dev); + bond_work_init_all(bond); + } + +-- +2.25.1 + diff --git a/queue-4.19/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch b/queue-4.19/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch new file mode 100644 index 00000000000..10bb4952547 --- /dev/null +++ b/queue-4.19/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch @@ -0,0 +1,62 @@ +From 3666cdc74bd8d1de6d78cb81103f12a519cca126 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 21:48:12 +0300 +Subject: dmaengine: ioat setting ioat timeout as module parameter + +From: Leonid Ravich + +[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ] + +DMA transaction time to completion is a function of PCI bandwidth, +transaction size and a queue depth. So hard coded value for timeouts +might be wrong for some scenarios. + +Signed-off-by: Leonid Ravich +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20200701184816.29138-1-leonid.ravich@dell.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/dma.c | 12 ++++++++++++ + drivers/dma/ioat/dma.h | 2 -- + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c +index b94cece58b984..890cadf3ec5d8 100644 +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -38,6 +38,18 @@ + + #include "../dmaengine.h" + ++int completion_timeout = 200; ++module_param(completion_timeout, int, 0644); ++MODULE_PARM_DESC(completion_timeout, ++ "set ioat completion timeout [msec] (default 200 [msec])"); ++int idle_timeout = 2000; ++module_param(idle_timeout, int, 0644); ++MODULE_PARM_DESC(idle_timeout, ++ "set ioat idel timeout [msec] (default 2000 [msec])"); ++ ++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout) ++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout) ++ + static char *chanerr_str[] = { + "DMA Transfer Source Address Error", + "DMA Transfer Destination Address Error", +diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h +index 1ab42ec2b7ff1..b061db2013324 100644 +--- a/drivers/dma/ioat/dma.h ++++ b/drivers/dma/ioat/dma.h +@@ -111,8 +111,6 @@ struct ioatdma_chan { + #define IOAT_RUN 5 + #define IOAT_CHAN_ACTIVE 6 + struct timer_list timer; +- #define COMPLETION_TIMEOUT msecs_to_jiffies(100) +- #define IDLE_TIMEOUT msecs_to_jiffies(2000) + #define RESET_DELAY msecs_to_jiffies(100) + struct ioatdma_device *ioat_dma; + dma_addr_t completion_dma; +-- +2.25.1 + diff --git a/queue-4.19/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch b/queue-4.19/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch new file mode 100644 index 00000000000..af8847fe5bf --- /dev/null +++ b/queue-4.19/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch @@ -0,0 +1,49 @@ +From 0a4a44105358a98f1c44c1aec3e43a870fa3e84b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 14:46:26 +0800 +Subject: dmaengine: tegra210-adma: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit 5b78fac4b1ba731cf4177fdbc1e3a4661521bcd0 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. + +Signed-off-by: Dinghao Liu +Reviewed-by: Jon Hunter +Link: https://lore.kernel.org/r/20200624064626.19855-1-dinghao.liu@zju.edu.cn +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/tegra210-adma.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c +index 045351f3549c1..86b45198fb962 100644 +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -583,6 +583,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc) + + ret = pm_runtime_get_sync(tdc2dev(tdc)); + if (ret < 0) { ++ pm_runtime_put_noidle(tdc2dev(tdc)); + free_irq(tdc->irq, tdc); + return ret; + } +@@ -764,8 +765,10 @@ static int tegra_adma_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + + ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(&pdev->dev); + goto rpm_disable; ++ } + + ret = tegra_adma_init(tdma); + if (ret) +-- +2.25.1 + diff --git a/queue-4.19/drm-sun4i-hdmi-fix-inverted-hpd-result.patch b/queue-4.19/drm-sun4i-hdmi-fix-inverted-hpd-result.patch new file mode 100644 index 00000000000..ff842667576 --- /dev/null +++ b/queue-4.19/drm-sun4i-hdmi-fix-inverted-hpd-result.patch @@ -0,0 +1,40 @@ +From acec08097acbff006169137fd01b25345eec1208 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jul 2020 09:10:30 +0800 +Subject: drm: sun4i: hdmi: Fix inverted HPD result + +From: Chen-Yu Tsai + +[ Upstream commit baa1841eb797eadce6c907bdaed7cd6f01815404 ] + +When the extra HPD polling in sun4i_hdmi was removed, the result of +HPD was accidentally inverted. + +Fix this by inverting the check. + +Fixes: bda8eaa6dee7 ("drm: sun4i: hdmi: Remove extra HPD polling") +Signed-off-by: Chen-Yu Tsai +Tested-by: Mans Rullgard +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20200711011030.21997-1-wens@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +index 7e7fa8cef2ade..8ba19a8ca40f1 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +@@ -243,7 +243,7 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force) + unsigned long reg; + + reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG); +- if (reg & SUN4I_HDMI_HPD_HIGH) { ++ if (!(reg & SUN4I_HDMI_HPD_HIGH)) { + cec_phys_addr_invalidate(hdmi->cec_adap); + return connector_status_disconnected; + } +-- +2.25.1 + diff --git a/queue-4.19/fpga-dfl-fix-bug-in-port-reset-handshake.patch b/queue-4.19/fpga-dfl-fix-bug-in-port-reset-handshake.patch new file mode 100644 index 00000000000..14035cc836d --- /dev/null +++ b/queue-4.19/fpga-dfl-fix-bug-in-port-reset-handshake.patch @@ -0,0 +1,40 @@ +From eed4760405baa76d0e7b5d84417ce06948b039f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2020 14:10:03 +0800 +Subject: fpga: dfl: fix bug in port reset handshake + +From: Matthew Gerlach + +[ Upstream commit 8614afd689df59d9ce019439389be20bd788a897 ] + +When putting the port in reset, driver must wait for the soft reset +acknowledgment bit instead of the soft reset bit. + +Fixes: 47c1b19c160f (fpga: dfl: afu: add port ops support) +Signed-off-by: Matthew Gerlach +Signed-off-by: Xu Yilun +Acked-by: Wu Hao +Reviewed-by: Tom Rix +Signed-off-by: Moritz Fischer +Signed-off-by: Sasha Levin +--- + drivers/fpga/dfl-afu-main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c +index 02baa6a227c0c..fc048f9a99b19 100644 +--- a/drivers/fpga/dfl-afu-main.c ++++ b/drivers/fpga/dfl-afu-main.c +@@ -79,7 +79,8 @@ static int port_disable(struct platform_device *pdev) + * on this port and minimum soft reset pulse width has elapsed. + * Driver polls port_soft_reset_ack to determine if reset done by HW. + */ +- if (readq_poll_timeout(base + PORT_HDR_CTRL, v, v & PORT_CTRL_SFTRST, ++ if (readq_poll_timeout(base + PORT_HDR_CTRL, v, ++ v & PORT_CTRL_SFTRST_ACK, + RST_POLL_INVL, RST_POLL_TIMEOUT)) { + dev_err(&pdev->dev, "timeout, fail to reset device\n"); + return -ETIMEDOUT; +-- +2.25.1 + diff --git a/queue-4.19/hid-alps-support-devices-with-report-id-2.patch b/queue-4.19/hid-alps-support-devices-with-report-id-2.patch new file mode 100644 index 00000000000..0b89759cf5f --- /dev/null +++ b/queue-4.19/hid-alps-support-devices-with-report-id-2.patch @@ -0,0 +1,41 @@ +From e24f0a040c546c46894fe3e9fdada010e424363c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 May 2020 05:06:10 -0400 +Subject: HID: alps: support devices with report id 2 + +From: Caiyuan Xie + +[ Upstream commit aa3c439c144f0a465ed1f28f11c772886fb02b35 ] + +Add support for devices which that have reports with id == 2 + +Signed-off-by: Caiyuan Xie +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-alps.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index 3489f0af7409c..f4cf541d13e08 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -29,6 +29,7 @@ + + #define U1_MOUSE_REPORT_ID 0x01 /* Mouse data ReportID */ + #define U1_ABSOLUTE_REPORT_ID 0x03 /* Absolute data ReportID */ ++#define U1_ABSOLUTE_REPORT_ID_SECD 0x02 /* FW-PTP Absolute data ReportID */ + #define U1_FEATURE_REPORT_ID 0x05 /* Feature ReportID */ + #define U1_SP_ABSOLUTE_REPORT_ID 0x06 /* Feature ReportID */ + +@@ -372,6 +373,7 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size) + case U1_FEATURE_REPORT_ID: + break; + case U1_ABSOLUTE_REPORT_ID: ++ case U1_ABSOLUTE_REPORT_ID_SECD: + for (i = 0; i < hdata->max_fingers; i++) { + u8 *contact = &data[i * 5]; + +-- +2.25.1 + diff --git a/queue-4.19/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch b/queue-4.19/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch new file mode 100644 index 00000000000..daf47aa32bc --- /dev/null +++ b/queue-4.19/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch @@ -0,0 +1,100 @@ +From f3a0d8a9d70d15ecbc13c4cac783e1822f5fd727 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jun 2020 14:32:29 +0200 +Subject: HID: apple: Disable Fn-key key-re-mapping on clone keyboards + +From: Hans de Goede + +[ Upstream commit a5d81646fa294eed57786a9310b06ca48902adf8 ] + +The Maxxter KB-BT-001 Bluetooth keyboard, which looks somewhat like the +Apple Wireless Keyboard, is using the vendor and product IDs (05AC:0239) +of the Apple Wireless Keyboard (2009 ANSI version) . + +But its F1 - F10 keys are marked as sending F1 - F10, not the special +functions hid-apple.c maps them too; and since its descriptors do not +contain the HID_UP_CUSTOM | 0x0003 usage apple-hid looks for for the +Fn-key, apple_setup_input() never gets called, so F1 - F6 are mapped +to key-codes which have not been set in the keybit array causing them +to not send any events at all. + +The lack of a usage code matching the Fn key in the clone is actually +useful as this allows solving this problem in a generic way. + +This commits adds a fn_found flag and it adds a input_configured +callback which checks if this flag is set once all usages have been +mapped. If it is not set, then assume this is a clone and clear the +quirks bitmap so that the hid-apple code does not add any special +handling to this keyboard. + +This fixes F1 - F6 not sending anything at all and F7 - F12 sending +the wrong codes on the Maxxter KB-BT-001 Bluetooth keyboard and on +similar clones. + +Cc: Joao Moreno +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 8ab8f2350bbcd..b58ab769aa7b3 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -57,6 +57,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") + struct apple_sc { + unsigned long quirks; + unsigned int fn_on; ++ unsigned int fn_found; + DECLARE_BITMAP(pressed_numlock, KEY_CNT); + }; + +@@ -342,12 +343,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) + { ++ struct apple_sc *asc = hid_get_drvdata(hdev); ++ + if (usage->hid == (HID_UP_CUSTOM | 0x0003) || + usage->hid == (HID_UP_MSVENDOR | 0x0003) || + usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) { + /* The fn key on Apple USB keyboards */ + set_bit(EV_REP, hi->input->evbit); + hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN); ++ asc->fn_found = true; + apple_setup_input(hi->input); + return 1; + } +@@ -374,6 +378,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi, + return 0; + } + ++static int apple_input_configured(struct hid_device *hdev, ++ struct hid_input *hidinput) ++{ ++ struct apple_sc *asc = hid_get_drvdata(hdev); ++ ++ if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { ++ hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n"); ++ asc->quirks = 0; ++ } ++ ++ return 0; ++} ++ + static int apple_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { +@@ -588,6 +605,7 @@ static struct hid_driver apple_driver = { + .event = apple_event, + .input_mapping = apple_input_mapping, + .input_mapped = apple_input_mapped, ++ .input_configured = apple_input_configured, + }; + module_hid_driver(apple_driver); + +-- +2.25.1 + diff --git a/queue-4.19/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch b/queue-4.19/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch new file mode 100644 index 00000000000..15fcf482026 --- /dev/null +++ b/queue-4.19/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch @@ -0,0 +1,41 @@ +From 08e76f09c10c0a47829847182d11d7b0153f1296 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jun 2020 22:49:11 +0200 +Subject: HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override + +From: Federico Ricchiuto + +[ Upstream commit 43e666acb79f3d355dd89bf20f4d25d3b15da13e ] + +The Mediacom FlexBook edge13 uses the SIPODEV SP1064 touchpad, which does not +supply descriptors, so it has to be added to the override list. + +Signed-off-by: Federico Ricchiuto +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 681ac9bc68b3d..f98c1e1b1dbdc 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Mediacom FlexBook edge 13", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { + .ident = "Odys Winbook 13", + .matches = { +-- +2.25.1 + diff --git a/queue-4.19/hid-steam-fixes-race-in-handling-device-list.patch b/queue-4.19/hid-steam-fixes-race-in-handling-device-list.patch new file mode 100644 index 00000000000..6b2464d4d49 --- /dev/null +++ b/queue-4.19/hid-steam-fixes-race-in-handling-device-list.patch @@ -0,0 +1,59 @@ +From 426c6d63663e95625786d86b9106eeab6c53636d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 18:44:18 +0200 +Subject: HID: steam: fixes race in handling device list. + +From: Rodrigo Rivas Costa + +[ Upstream commit 2d3f53a80e4eed078669853a178ed96d88f74143 ] + +Using uhid and KASAN this driver crashed because it was getting +several connection events where it only expected one. Then the +device was added several times to the static device list and it got +corrupted. + +This patch checks if the device is already in the list before adding +it. + +Signed-off-by: Rodrigo Rivas Costa +Tested-by: Siarhei Vishniakou +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-steam.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c +index 6286204d4c560..a3b151b29bd71 100644 +--- a/drivers/hid/hid-steam.c ++++ b/drivers/hid/hid-steam.c +@@ -526,7 +526,8 @@ static int steam_register(struct steam_device *steam) + steam_battery_register(steam); + + mutex_lock(&steam_devices_lock); +- list_add(&steam->list, &steam_devices); ++ if (list_empty(&steam->list)) ++ list_add(&steam->list, &steam_devices); + mutex_unlock(&steam_devices_lock); + } + +@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam) + hid_info(steam->hdev, "Steam Controller '%s' disconnected", + steam->serial_no); + mutex_lock(&steam_devices_lock); +- list_del(&steam->list); ++ list_del_init(&steam->list); + mutex_unlock(&steam_devices_lock); + steam->serial_no[0] = 0; + } +@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev, + mutex_init(&steam->mutex); + steam->quirks = id->driver_data; + INIT_WORK(&steam->work_connect, steam_work_connect_cb); ++ INIT_LIST_HEAD(&steam->list); + + steam->client_hdev = steam_create_client_hid(hdev); + if (IS_ERR(steam->client_hdev)) { +-- +2.25.1 + diff --git a/queue-4.19/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch b/queue-4.19/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch new file mode 100644 index 00000000000..bfe87f90e79 --- /dev/null +++ b/queue-4.19/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch @@ -0,0 +1,39 @@ +From 0dd6a2920e116948f4c2f485f6e91b61d723064e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 13:00:27 +0200 +Subject: hippi: Fix a size used in a 'pci_free_consistent()' in an error + handling path + +From: Christophe JAILLET + +[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ] + +The size used when calling 'pci_alloc_consistent()' and +'pci_free_consistent()' should match. + +Fix it and have it consistent with the corresponding call in 'rr_close()'. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hippi/rrunner.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c +index 029206e4da3b3..2a8c33abb363a 100644 +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1248,7 +1248,7 @@ static int rr_open(struct net_device *dev) + rrpriv->info = NULL; + } + if (rrpriv->rx_ctrl) { +- pci_free_consistent(pdev, sizeof(struct ring_ctrl), ++ pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl), + rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma); + rrpriv->rx_ctrl = NULL; + } +-- +2.25.1 + diff --git a/queue-4.19/hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch b/queue-4.19/hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch new file mode 100644 index 00000000000..23b1619c7d5 --- /dev/null +++ b/queue-4.19/hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch @@ -0,0 +1,71 @@ +From e9a4bdc66f57413b8788cbd96ac275c3fe8c00a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 04:06:12 +0000 +Subject: hwmon: (adm1275) Make sure we are reading enough data for different + chips + +From: Chu Lin + +[ Upstream commit 6d1d41c075a1a54ba03370e268171fec20e06563 ] + +Issue: +When PEC is enabled, binding adm1272 to the adm1275 would +fail due to PEC error. See below: +adm1275: probe of xxxx failed with error -74 + +Diagnosis: +Per the datasheet of adm1272, adm1278, adm1293 and amd1294, +PMON_CONFIG (0xd4) is 16bits wide. On the other hand, +PMON_CONFIG (0xd4) for adm1275 is 8bits wide. The driver should not +assume everything is 8bits wide and read only 8bits from it. + +Solution: +If it is adm1272, adm1278, adm1293 and adm1294, use i2c_read_word. +Else, use i2c_read_byte + +Testing: +Binding adm1272 to the driver. +The change is only tested on adm1272. + +Signed-off-by: Chu Lin +Link: https://lore.kernel.org/r/20200709040612.3977094-1-linchuyuan@google.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/adm1275.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c +index 13600fa79e7f3..a19cf9052fc6d 100644 +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -364,6 +364,7 @@ MODULE_DEVICE_TABLE(i2c, adm1275_id); + static int adm1275_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { ++ s32 (*config_read_fn)(const struct i2c_client *client, u8 reg); + u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1]; + int config, device_config; + int ret; +@@ -408,11 +409,16 @@ static int adm1275_probe(struct i2c_client *client, + "Device mismatch: Configured %s, detected %s\n", + id->name, mid->name); + +- config = i2c_smbus_read_byte_data(client, ADM1275_PMON_CONFIG); ++ if (mid->driver_data == adm1272 || mid->driver_data == adm1278 || ++ mid->driver_data == adm1293 || mid->driver_data == adm1294) ++ config_read_fn = i2c_smbus_read_word_data; ++ else ++ config_read_fn = i2c_smbus_read_byte_data; ++ config = config_read_fn(client, ADM1275_PMON_CONFIG); + if (config < 0) + return config; + +- device_config = i2c_smbus_read_byte_data(client, ADM1275_DEVICE_CONFIG); ++ device_config = config_read_fn(client, ADM1275_DEVICE_CONFIG); + if (device_config < 0) + return device_config; + +-- +2.25.1 + diff --git a/queue-4.19/hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch b/queue-4.19/hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch new file mode 100644 index 00000000000..492445c9cf7 --- /dev/null +++ b/queue-4.19/hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch @@ -0,0 +1,41 @@ +From 18a8a50b7db15e5a2342b1b9d368e4308be20852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2020 14:15:18 +0300 +Subject: hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow + +From: Evgeny Novikov + +[ Upstream commit bc4071aafcf4d0535ee423b69167696d6c03207d ] + +aspeed_create_fan() reads a pwm_port value using of_property_read_u32(). +If pwm_port will be more than ARRAY_SIZE(pwm_port_params), there will be +a buffer overflow in +aspeed_create_pwm_port()->aspeed_set_pwm_port_enable(). The patch fixes +the potential buffer overflow. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Evgeny Novikov +Link: https://lore.kernel.org/r/20200703111518.9644-1-novikov@ispras.ru +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/aspeed-pwm-tacho.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c +index 5e449eac788a1..a43fa730a513b 100644 +--- a/drivers/hwmon/aspeed-pwm-tacho.c ++++ b/drivers/hwmon/aspeed-pwm-tacho.c +@@ -880,6 +880,8 @@ static int aspeed_create_fan(struct device *dev, + ret = of_property_read_u32(child, "reg", &pwm_port); + if (ret) + return ret; ++ if (pwm_port >= ARRAY_SIZE(pwm_port_params)) ++ return -EINVAL; + aspeed_create_pwm_port(priv, (u8)pwm_port); + + ret = of_property_count_u8_elems(child, "cooling-levels"); +-- +2.25.1 + diff --git a/queue-4.19/hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch b/queue-4.19/hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch new file mode 100644 index 00000000000..fa4fe11f1aa --- /dev/null +++ b/queue-4.19/hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch @@ -0,0 +1,43 @@ +From 811eb286996dcc367136a5e0757c928ffa5a2bd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 13:13:38 +0100 +Subject: hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() + +From: Cristian Marussi + +[ Upstream commit 3ce17cd2b94907f6d91b81b32848044b84c97606 ] + +SMATCH detected a potential buffer overflow in the manipulation of +hwmon_attributes array inside the scmi_hwmon_probe function: + +drivers/hwmon/scmi-hwmon.c:226 + scmi_hwmon_probe() error: buffer overflow 'hwmon_attributes' 6 <= 9 + +Fix it by statically declaring the size of the array as the maximum +possible as defined by hwmon_max define. + +Signed-off-by: Cristian Marussi +Reviewed-by: Sudeep Holla +Link: https://lore.kernel.org/r/20200715121338.GA18761@e119603-lin.cambridge.arm.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/scmi-hwmon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c +index 91976b6ca3000..91bfecdb3f5ba 100644 +--- a/drivers/hwmon/scmi-hwmon.c ++++ b/drivers/hwmon/scmi-hwmon.c +@@ -99,7 +99,7 @@ static enum hwmon_sensor_types scmi_types[] = { + [ENERGY] = hwmon_energy, + }; + +-static u32 hwmon_attributes[] = { ++static u32 hwmon_attributes[hwmon_max] = { + [hwmon_chip] = HWMON_C_REGISTER_TZ, + [hwmon_temp] = HWMON_T_INPUT | HWMON_T_LABEL, + [hwmon_in] = HWMON_I_INPUT | HWMON_I_LABEL, +-- +2.25.1 + diff --git a/queue-4.19/i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch b/queue-4.19/i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch new file mode 100644 index 00000000000..f5f51c8de4f --- /dev/null +++ b/queue-4.19/i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch @@ -0,0 +1,48 @@ +From 711d6dc25d088b5b76cd8c968ce8ca6c40183d34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jul 2020 15:38:29 +0200 +Subject: i2c: rcar: always clear ICSAR to avoid side effects + +From: Wolfram Sang + +[ Upstream commit eb01597158ffb1853a7a7fc2c57d4c844640f75e ] + +On R-Car Gen2, we get a timeout when reading from the address set in +ICSAR, even though the slave interface is disabled. Clearing it fixes +this situation. Note that Gen3 is not affected. + +To reproduce: bind and undbind an I2C slave on some bus, run +'i2cdetect' on that bus. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 2c29f901d3090..6e49e438ef5a5 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -863,6 +863,7 @@ static int rcar_unreg_slave(struct i2c_client *slave) + /* disable irqs and ensure none is running before clearing ptr */ + rcar_i2c_write(priv, ICSIER, 0); + rcar_i2c_write(priv, ICSCR, 0); ++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ + + synchronize_irq(priv->irq); + priv->slave = NULL; +@@ -966,6 +967,8 @@ static int rcar_i2c_probe(struct platform_device *pdev) + if (ret < 0) + goto out_pm_put; + ++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ ++ + if (priv->devtype == I2C_RCAR_GEN3) { + priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); + if (!IS_ERR(priv->rstc)) { +-- +2.25.1 + diff --git a/queue-4.19/ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch b/queue-4.19/ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch new file mode 100644 index 00000000000..8afef707765 --- /dev/null +++ b/queue-4.19/ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch @@ -0,0 +1,46 @@ +From 427a874147c18e5b74cad74dd6c20a9bd0e41797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 17:01:21 +0800 +Subject: ieee802154: fix one possible memleak in adf7242_probe + +From: Liu Jian + +[ Upstream commit 66673f96f0f968b991dc38be06102246919c663c ] + +When probe fail, we should destroy the workqueue. + +Fixes: 2795e8c25161 ("net: ieee802154: fix a potential NULL pointer dereference") +Signed-off-by: Liu Jian +Acked-by: Michael Hennerich +Link: https://lore.kernel.org/r/20200717090121.2143-1-liujian56@huawei.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/adf7242.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c +index cd6b95e673a58..71be8524cca87 100644 +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -1270,7 +1270,7 @@ static int adf7242_probe(struct spi_device *spi) + WQ_MEM_RECLAIM); + if (unlikely(!lp->wqueue)) { + ret = -ENOMEM; +- goto err_hw_init; ++ goto err_alloc_wq; + } + + ret = adf7242_hw_init(lp); +@@ -1302,6 +1302,8 @@ static int adf7242_probe(struct spi_device *spi) + return ret; + + err_hw_init: ++ destroy_workqueue(lp->wqueue); ++err_alloc_wq: + mutex_destroy(&lp->bmux); + ieee802154_free_hw(lp->hw); + +-- +2.25.1 + diff --git a/queue-4.19/input-add-sw_machine_cover.patch b/queue-4.19/input-add-sw_machine_cover.patch new file mode 100644 index 00000000000..9433362fd97 --- /dev/null +++ b/queue-4.19/input-add-sw_machine_cover.patch @@ -0,0 +1,54 @@ +From 5122bb7fb55c4d1f08ef2adfbfa5148e99d5f805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jun 2020 11:47:04 -0700 +Subject: Input: add `SW_MACHINE_COVER` + +From: Merlijn Wajer + +[ Upstream commit c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df ] + +This event code represents the state of a removable cover of a device. +Value 0 means that the cover is open or removed, value 1 means that the +cover is closed. + +Reviewed-by: Sebastian Reichel +Acked-by: Tony Lindgren +Signed-off-by: Merlijn Wajer +Link: https://lore.kernel.org/r/20200612125402.18393-2-merlijn@wizzup.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + include/linux/mod_devicetable.h | 2 +- + include/uapi/linux/input-event-codes.h | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index 84e4e20352d9f..610cdf8082f2e 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -299,7 +299,7 @@ struct pcmcia_device_id { + #define INPUT_DEVICE_ID_LED_MAX 0x0f + #define INPUT_DEVICE_ID_SND_MAX 0x07 + #define INPUT_DEVICE_ID_FF_MAX 0x7f +-#define INPUT_DEVICE_ID_SW_MAX 0x0f ++#define INPUT_DEVICE_ID_SW_MAX 0x10 + #define INPUT_DEVICE_ID_PROP_MAX 0x1f + + #define INPUT_DEVICE_ID_MATCH_BUS 1 +diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h +index 61a5799b440b9..c3e84f7c8261a 100644 +--- a/include/uapi/linux/input-event-codes.h ++++ b/include/uapi/linux/input-event-codes.h +@@ -795,7 +795,8 @@ + #define SW_LINEIN_INSERT 0x0d /* set = inserted */ + #define SW_MUTE_DEVICE 0x0e /* set = device disabled */ + #define SW_PEN_INSERTED 0x0f /* set = pen inserted */ +-#define SW_MAX 0x0f ++#define SW_MACHINE_COVER 0x10 /* set = cover closed */ ++#define SW_MAX 0x10 + #define SW_CNT (SW_MAX+1) + + /* +-- +2.25.1 + diff --git a/queue-4.19/input-elan_i2c-only-increment-wakeup-count-on-touch.patch b/queue-4.19/input-elan_i2c-only-increment-wakeup-count-on-touch.patch new file mode 100644 index 00000000000..a2df61d89bf --- /dev/null +++ b/queue-4.19/input-elan_i2c-only-increment-wakeup-count-on-touch.patch @@ -0,0 +1,64 @@ +From e1b041c198f632208f5cca5b56fff2c72facfd55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 17:39:41 -0700 +Subject: Input: elan_i2c - only increment wakeup count on touch + +From: Derek Basehore + +[ Upstream commit 966334dfc472bdfa67bed864842943b19755d192 ] + +This moves the wakeup increment for elan devices to the touch report. +This prevents the drivers from incorrectly reporting a wakeup when the +resume callback resets then device, which causes an interrupt to +occur. + +Signed-off-by: Derek Basehore +Link: https://lore.kernel.org/r/20200706235046.1984283-1-dbasehore@chromium.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elan_i2c_core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index ae012639ae1d5..82afaca2e1a67 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -917,6 +917,8 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet) + u8 hover_info = packet[ETP_HOVER_INFO_OFFSET]; + bool contact_valid, hover_event; + ++ pm_wakeup_event(&data->client->dev, 0); ++ + hover_event = hover_info & 0x40; + for (i = 0; i < ETP_MAX_FINGERS; i++) { + contact_valid = tp_info & (1U << (3 + i)); +@@ -939,6 +941,8 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report) + u8 *packet = &report[ETP_REPORT_ID_OFFSET + 1]; + int x, y; + ++ pm_wakeup_event(&data->client->dev, 0); ++ + if (!data->tp_input) { + dev_warn_once(&data->client->dev, + "received a trackpoint report while no trackpoint device has been created. Please report upstream.\n"); +@@ -963,7 +967,6 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report) + static irqreturn_t elan_isr(int irq, void *dev_id) + { + struct elan_tp_data *data = dev_id; +- struct device *dev = &data->client->dev; + int error; + u8 report[ETP_MAX_REPORT_LEN]; + +@@ -989,7 +992,7 @@ static irqreturn_t elan_isr(int irq, void *dev_id) + elan_report_trackpoint(data, report); + break; + default: +- dev_err(dev, "invalid report id data (%x)\n", ++ dev_err(&data->client->dev, "invalid report id data (%x)\n", + report[ETP_REPORT_ID_OFFSET]); + } + +-- +2.25.1 + diff --git a/queue-4.19/input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch b/queue-4.19/input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch new file mode 100644 index 00000000000..a8ff99fe63c --- /dev/null +++ b/queue-4.19/input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch @@ -0,0 +1,36 @@ +From f20ce1d05094b2bad3f759b61ffbe6a5d0d6d84b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 15:27:43 -0700 +Subject: Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen + +From: Ilya Katsnelson + +[ Upstream commit dcb00fc799dc03fd320e123e4c81b3278c763ea5 ] + +Tested on my own laptop, touchpad feels slightly more responsive with +this on, though it might just be placebo. + +Signed-off-by: Ilya Katsnelson +Reviewed-by: Lyude Paul +Link: https://lore.kernel.org/r/20200703143457.132373-1-me@0upti.me +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index 671e018eb363a..c6d393114502d 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -182,6 +182,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN0093", /* T480 */ + "LEN0096", /* X280 */ + "LEN0097", /* X280 -> ALPS trackpoint */ ++ "LEN0099", /* X1 Extreme 1st */ + "LEN009b", /* T580 */ + "LEN200f", /* T450s */ + "LEN2044", /* L470 */ +-- +2.25.1 + diff --git a/queue-4.19/ipvs-fix-the-connection-sync-failed-in-some-cases.patch b/queue-4.19/ipvs-fix-the-connection-sync-failed-in-some-cases.patch new file mode 100644 index 00000000000..6f12d44bcff --- /dev/null +++ b/queue-4.19/ipvs-fix-the-connection-sync-failed-in-some-cases.patch @@ -0,0 +1,64 @@ +From a1ac417d77a107d78e22021f64bb7fbc36484814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 16:12:08 +0800 +Subject: ipvs: fix the connection sync failed in some cases + +From: guodeqing + +[ Upstream commit 8210e344ccb798c672ab237b1a4f241bda08909b ] + +The sync_thread_backup only checks sk_receive_queue is empty or not, +there is a situation which cannot sync the connection entries when +sk_receive_queue is empty and sk_rmem_alloc is larger than sk_rcvbuf, +the sync packets are dropped in __udp_enqueue_schedule_skb, this is +because the packets in reader_queue is not read, so the rmem is +not reclaimed. + +Here I add the check of whether the reader_queue of the udp sock is +empty or not to solve this problem. + +Fixes: 2276f58ac589 ("udp: use a separate rx queue for packet reception") +Reported-by: zhouxudong +Signed-off-by: guodeqing +Acked-by: Julian Anastasov +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_sync.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c +index 5acd99f83166b..f6af13c16cf57 100644 +--- a/net/netfilter/ipvs/ip_vs_sync.c ++++ b/net/netfilter/ipvs/ip_vs_sync.c +@@ -1717,6 +1717,8 @@ static int sync_thread_backup(void *data) + { + struct ip_vs_sync_thread_data *tinfo = data; + struct netns_ipvs *ipvs = tinfo->ipvs; ++ struct sock *sk = tinfo->sock->sk; ++ struct udp_sock *up = udp_sk(sk); + int len; + + pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, " +@@ -1724,12 +1726,14 @@ static int sync_thread_backup(void *data) + ipvs->bcfg.mcast_ifn, ipvs->bcfg.syncid, tinfo->id); + + while (!kthread_should_stop()) { +- wait_event_interruptible(*sk_sleep(tinfo->sock->sk), +- !skb_queue_empty(&tinfo->sock->sk->sk_receive_queue) +- || kthread_should_stop()); ++ wait_event_interruptible(*sk_sleep(sk), ++ !skb_queue_empty_lockless(&sk->sk_receive_queue) || ++ !skb_queue_empty_lockless(&up->reader_queue) || ++ kthread_should_stop()); + + /* do we have data now? */ +- while (!skb_queue_empty(&(tinfo->sock->sk->sk_receive_queue))) { ++ while (!skb_queue_empty_lockless(&sk->sk_receive_queue) || ++ !skb_queue_empty_lockless(&up->reader_queue)) { + len = ip_vs_receive(tinfo->sock, tinfo->buf, + ipvs->bcfg.sync_maxlen); + if (len <= 0) { +-- +2.25.1 + diff --git a/queue-4.19/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch b/queue-4.19/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch new file mode 100644 index 00000000000..6c6bfef21ea --- /dev/null +++ b/queue-4.19/mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch @@ -0,0 +1,45 @@ +From e2d64c559daf929b971faa712d532e8c7958b07e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 22:31:49 +0800 +Subject: mlxsw: destroy workqueue when trap_register in mlxsw_emad_init + +From: Liu Jian + +[ Upstream commit 5dbaeb87f2b309936be0aeae00cbc9e7f20ab296 ] + +When mlxsw_core_trap_register fails in mlxsw_emad_init, +destroy_workqueue() shouled be called to destroy mlxsw_core->emad_wq. + +Fixes: d965465b60ba ("mlxsw: core: Fix possible deadlock") +Signed-off-by: Liu Jian +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c +index 2e6df5804b356..e180ec4f1a248 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c +@@ -587,7 +587,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) + err = mlxsw_core_trap_register(mlxsw_core, &mlxsw_emad_rx_listener, + mlxsw_core); + if (err) +- return err; ++ goto err_trap_register; + + err = mlxsw_core->driver->basic_trap_groups_set(mlxsw_core); + if (err) +@@ -599,6 +599,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) + err_emad_trap_set: + mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener, + mlxsw_core); ++err_trap_register: + destroy_workqueue(mlxsw_core->emad_wq); + return err; + } +-- +2.25.1 + diff --git a/queue-4.19/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch b/queue-4.19/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch new file mode 100644 index 00000000000..9630502b941 --- /dev/null +++ b/queue-4.19/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch @@ -0,0 +1,66 @@ +From d9c1c08e7370bf213416acd036f7fcb5a190650c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 19:10:00 +0300 +Subject: net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual + configuration + +From: Sergey Organov + +[ Upstream commit 473309fb8372365ad211f425bca760af800e10a7 ] + +From Documentation/networking/timestamping.txt: + + A driver which supports hardware time stamping shall update the + struct with the actual, possibly more permissive configuration. + +Do update the struct passed when we upscale the requested time +stamping mode. + +Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.") +Signed-off-by: Sergey Organov +Acked-by: Richard Cochran +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83640.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c +index 4fed778331573..dd0a658c843d6 100644 +--- a/drivers/net/phy/dp83640.c ++++ b/drivers/net/phy/dp83640.c +@@ -1343,6 +1343,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4; + dp83640->version = PTP_CLASS_V1; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_L4_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L4_SYNC: +@@ -1350,6 +1351,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_L2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L2_SYNC: +@@ -1357,6 +1359,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L2; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_SYNC: +@@ -1364,6 +1367,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; + break; + default: + return -ERANGE; +-- +2.25.1 + diff --git a/queue-4.19/net-ethernet-ave-fix-error-returns-in-ave_init.patch b/queue-4.19/net-ethernet-ave-fix-error-returns-in-ave_init.patch new file mode 100644 index 00000000000..6e8f0b12b2c --- /dev/null +++ b/queue-4.19/net-ethernet-ave-fix-error-returns-in-ave_init.patch @@ -0,0 +1,39 @@ +From 39767a1ac6668a507fa37a17bf4311c063e06a4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 10:50:49 +0800 +Subject: net: ethernet: ave: Fix error returns in ave_init + +From: Wang Hai + +[ Upstream commit 1264d7fa3a64d8bea7aebb77253f917947ffda25 ] + +When regmap_update_bits failed in ave_init(), calls of the functions +reset_control_assert() and clk_disable_unprepare() were missed. +Add goto out_reset_assert to do this. + +Fixes: 57878f2f4697 ("net: ethernet: ave: add support for phy-mode setting of system controller") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Reviewed-by: Kunihiko Hayashi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/socionext/sni_ave.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c +index c309accc6797e..01cde5f27eade 100644 +--- a/drivers/net/ethernet/socionext/sni_ave.c ++++ b/drivers/net/ethernet/socionext/sni_ave.c +@@ -1196,7 +1196,7 @@ static int ave_init(struct net_device *ndev) + ret = regmap_update_bits(priv->regmap, SG_ETPINMODE, + priv->pinmode_mask, priv->pinmode_val); + if (ret) +- return ret; ++ goto out_reset_assert; + + ave_global_reset(ndev); + +-- +2.25.1 + diff --git a/queue-4.19/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch b/queue-4.19/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch new file mode 100644 index 00000000000..b97b4a89839 --- /dev/null +++ b/queue-4.19/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch @@ -0,0 +1,47 @@ +From f5fb1b2a4f68e20cda9ba1a82ac48cd7c337fe87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 11:50:38 +0800 +Subject: net: smc91x: Fix possible memory leak in smc_drv_probe() + +From: Wang Hai + +[ Upstream commit bca9749b1aa23d964d3ab930938af66dbf887f15 ] + +If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev) +should be called to free the ndev created earlier. Otherwise, a memleak +will occur. + +Fixes: 7d2911c43815 ("net: smc91x: Fix gpios for device tree based booting") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/smsc/smc91x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index 8d6cff8bd1622..0f870ed5a9c8c 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -2287,7 +2287,7 @@ static int smc_drv_probe(struct platform_device *pdev) + ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio, + "power", 0, 0, 100); + if (ret) +- return ret; ++ goto out_free_netdev; + + /* + * Optional reset GPIO configured? Minimum 100 ns reset needed +@@ -2296,7 +2296,7 @@ static int smc_drv_probe(struct platform_device *pdev) + ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio, + "reset", 0, 0, 100); + if (ret) +- return ret; ++ goto out_free_netdev; + + /* + * Need to wait for optional EEPROM to load, max 750 us according +-- +2.25.1 + diff --git a/queue-4.19/qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch b/queue-4.19/qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch new file mode 100644 index 00000000000..185b859ed65 --- /dev/null +++ b/queue-4.19/qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch @@ -0,0 +1,61 @@ +From ed9d0d343085063a3db6ac2f95ceec1ba6dbb551 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 17:41:42 +0300 +Subject: qed: suppress "don't support RoCE & iWARP" flooding on HW init + +From: Alexander Lobakin + +[ Upstream commit 1ea999039fe7c7953da2fbb7ca7c3ef00064d328 ] + +Change the verbosity of the "don't support RoCE & iWARP simultaneously" +warning to debug level to stop flooding on driver/hardware initialization: + +[ 4.783230] qede 01:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth0] +[ 4.810020] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only +[ 4.861186] qede 01:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth1] +[ 4.893311] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only +[ 5.181713] qede a1:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth2] +[ 5.224740] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only +[ 5.276449] qede a1:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth3] +[ 5.318671] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only +[ 5.369548] qede a1:00.02: Storm FW 8.37.7.0, Management FW 8.52.9.0 +[MBI 15.10.6] [eth4] +[ 5.411645] [qed_rdma_set_pf_params:2076()]Current day drivers don't +support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only + +Fixes: e0a8f9de16fc ("qed: Add iWARP enablement support") +Signed-off-by: Alexander Lobakin +Signed-off-by: Igor Russkikh +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +index f3d7c38f539a8..734462f8d881c 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +@@ -2074,8 +2074,8 @@ static void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn, + num_srqs = min_t(u32, QED_RDMA_MAX_SRQS, p_params->num_srqs); + + if (p_hwfn->mcp_info->func_info.protocol == QED_PCI_ETH_RDMA) { +- DP_NOTICE(p_hwfn, +- "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n"); ++ DP_VERBOSE(p_hwfn, QED_MSG_SP, ++ "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n"); + p_hwfn->hw_info.personality = QED_PCI_ETH_ROCE; + } + +-- +2.25.1 + diff --git a/queue-4.19/regmap-dev_get_regmap_match-fix-string-comparison.patch b/queue-4.19/regmap-dev_get_regmap_match-fix-string-comparison.patch new file mode 100644 index 00000000000..276b9303dbf --- /dev/null +++ b/queue-4.19/regmap-dev_get_regmap_match-fix-string-comparison.patch @@ -0,0 +1,43 @@ +From 378c4c9568d36356c4601f9e5636a3880c0ddec6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2020 12:33:15 +0200 +Subject: regmap: dev_get_regmap_match(): fix string comparison + +From: Marc Kleine-Budde + +[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ] + +This function is used by dev_get_regmap() to retrieve a regmap for the +specified device. If the device has more than one regmap, the name parameter +can be used to specify one. + +The code here uses a pointer comparison to check for equal strings. This +however will probably always fail, as the regmap->name is allocated via +kstrdup_const() from the regmap's config->name. + +Fix this by using strcmp() instead. + +Signed-off-by: Marc Kleine-Budde +Link: https://lore.kernel.org/r/20200703103315.267996-1-mkl@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index c7d946b745efe..d26b485ccc7d0 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1343,7 +1343,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data) + + /* If the user didn't specify a name match any */ + if (data) +- return (*r)->name == data; ++ return !strcmp((*r)->name, data); + else + return 1; + } +-- +2.25.1 + diff --git a/queue-4.19/risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch b/queue-4.19/risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch new file mode 100644 index 00000000000..7ab603188b3 --- /dev/null +++ b/queue-4.19/risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch @@ -0,0 +1,45 @@ +From 2362a29ef070c1dd56ed8c2651300d17abdb6f4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 11:57:26 -0700 +Subject: RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw + +From: Palmer Dabbelt + +[ Upstream commit 38b7c2a3ffb1fce8358ddc6006cfe5c038ff9963 ] + +While digging through the recent mmiowb preemption issue it came up that +we aren't actually preventing IO from crossing a scheduling boundary. +While it's a bit ugly to overload smp_mb__after_spinlock() with this +behavior, it's what PowerPC is doing so there's some precedent. + +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/barrier.h | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/include/asm/barrier.h b/arch/riscv/include/asm/barrier.h +index d4628e4b3a5ea..f4c92c91aa047 100644 +--- a/arch/riscv/include/asm/barrier.h ++++ b/arch/riscv/include/asm/barrier.h +@@ -69,8 +69,16 @@ do { \ + * The AQ/RL pair provides a RCpc critical section, but there's not really any + * way we can take advantage of that here because the ordering is only enforced + * on that one lock. Thus, we're just doing a full fence. ++ * ++ * Since we allow writeX to be called from preemptive regions we need at least ++ * an "o" in the predecessor set to ensure device writes are visible before the ++ * task is marked as available for scheduling on a new hart. While I don't see ++ * any concrete reason we need a full IO fence, it seems safer to just upgrade ++ * this in order to avoid any IO crossing a scheduling boundary. In both ++ * instances the scheduler pairs this with an mb(), so nothing is necessary on ++ * the new hart. + */ +-#define smp_mb__after_spinlock() RISCV_FENCE(rw,rw) ++#define smp_mb__after_spinlock() RISCV_FENCE(iorw,iorw) + + #include + +-- +2.25.1 + diff --git a/queue-4.19/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch b/queue-4.19/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch new file mode 100644 index 00000000000..ca99882ac60 --- /dev/null +++ b/queue-4.19/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch @@ -0,0 +1,49 @@ +From 78238f9499d4bb0d54490c7ca835c54a98d50d00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 21:15:43 -0700 +Subject: scripts/decode_stacktrace: strip basepath from all paths + +From: Pi-Hsun Shih + +[ Upstream commit d178770d8d21489abf5bafefcbb6d5243b482e9a ] + +Currently the basepath is removed only from the beginning of the string. +When the symbol is inlined and there's multiple line outputs of +addr2line, only the first line would have basepath removed. + +Change to remove the basepath prefix from all lines. + +Fixes: 31013836a71e ("scripts/decode_stacktrace: match basepath using shell prefix operator, not regex") +Co-developed-by: Shik Chen +Signed-off-by: Pi-Hsun Shih +Signed-off-by: Shik Chen +Signed-off-by: Andrew Morton +Reviewed-by: Stephen Boyd +Cc: Sasha Levin +Cc: Nicolas Boichat +Cc: Jiri Slaby +Link: http://lkml.kernel.org/r/20200720082709.252805-1-pihsun@chromium.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/decode_stacktrace.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index 5aa75a0a1cede..946735bd5a252 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -77,8 +77,8 @@ parse_symbol() { + return + fi + +- # Strip out the base of the path +- code=${code#$basepath/} ++ # Strip out the base of the path on each line ++ code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code") + + # In the case of inlines, move everything to same line + code=${code//$'\n'/' '} +-- +2.25.1 + diff --git a/queue-4.19/scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch b/queue-4.19/scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch new file mode 100644 index 00000000000..dbf364a8906 --- /dev/null +++ b/queue-4.19/scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch @@ -0,0 +1,51 @@ +From 688716588d1c2994933e90388f9777321924cbb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 21:15:52 -0700 +Subject: scripts/gdb: fix lx-symbols 'gdb.error' while loading modules + +From: Stefano Garzarella + +[ Upstream commit 7359608a271ce81803de148befefd309baf88c76 ] + +Commit ed66f991bb19 ("module: Refactor section attr into bin attribute") +removed the 'name' field from 'struct module_sect_attr' triggering the +following error when invoking lx-symbols: + + (gdb) lx-symbols + loading vmlinux + scanning for modules in linux/build + loading @0xffffffffc014f000: linux/build/drivers/net/tun.ko + Python Exception There is no member named name.: + Error occurred in Python: There is no member named name. + +This patch fixes the issue taking the module name from the 'struct +attribute'. + +Fixes: ed66f991bb19 ("module: Refactor section attr into bin attribute") +Signed-off-by: Stefano Garzarella +Signed-off-by: Andrew Morton +Reviewed-by: Jan Kiszka +Reviewed-by: Kieran Bingham +Link: http://lkml.kernel.org/r/20200722102239.313231-1-sgarzare@redhat.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/symbols.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py +index 4644f1a83b578..aa4f87e3ddb12 100644 +--- a/scripts/gdb/linux/symbols.py ++++ b/scripts/gdb/linux/symbols.py +@@ -96,7 +96,7 @@ lx-symbols command.""" + return "" + attrs = sect_attrs['attrs'] + section_name_to_address = { +- attrs[n]['name'].string(): attrs[n]['address'] ++ attrs[n]['battr']['attr']['name'].string(): attrs[n]['address'] + for n in range(int(sect_attrs['nsections']))} + args = [] + for section_name in [".data", ".data..read_mostly", ".rodata", ".bss", +-- +2.25.1 + diff --git a/queue-4.19/serial-exar-fix-gpio-configuration-for-sealevel-card.patch b/queue-4.19/serial-exar-fix-gpio-configuration-for-sealevel-card.patch new file mode 100644 index 00000000000..5bdfc57ade8 --- /dev/null +++ b/queue-4.19/serial-exar-fix-gpio-configuration-for-sealevel-card.patch @@ -0,0 +1,58 @@ +From 189ca097f5e940d1eebf20a96276ba71506b6468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 16:11:24 -0400 +Subject: serial: exar: Fix GPIO configuration for Sealevel cards based on + XR17V35X + +From: Matthew Howell + +[ Upstream commit 5fdbe136ae19ab751daaa4d08d9a42f3e30d17f9 ] + +Sealevel XR17V35X based devices are inoperable on kernel versions +4.11 and above due to a change in the GPIO preconfiguration introduced in +commit +7dea8165f1d. This patch fixes this by preconfiguring the GPIO on Sealevel +cards to the value (0x00) used prior to commit 7dea8165f1d + +With GPIOs preconfigured as per commit 7dea8165f1d all ports on +Sealevel XR17V35X based devices become stuck in high impedance +mode, regardless of dip-switch or software configuration. This +causes the device to become effectively unusable. This patch (in +various forms) has been distributed to our customers and no issues +related to it have been reported. + +Fixes: 7dea8165f1d6 ("serial: exar: Preconfigure xr17v35x MPIOs as output") +Signed-off-by: Matthew Howell +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2007221605270.13247@tstest-VirtualBox +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_exar.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index 8707357764375..d39162e71f59d 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -227,7 +227,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p) + * devices will export them as GPIOs, so we pre-configure them safely + * as inputs. + */ +- u8 dir = pcidev->vendor == PCI_VENDOR_ID_EXAR ? 0xff : 0x00; ++ ++ u8 dir = 0x00; ++ ++ if ((pcidev->vendor == PCI_VENDOR_ID_EXAR) && ++ (pcidev->subsystem_vendor != PCI_VENDOR_ID_SEALEVEL)) { ++ // Configure GPIO as inputs for Commtech adapters ++ dir = 0xff; ++ } else { ++ // Configure GPIO as outputs for SeaLevel adapters ++ dir = 0x00; ++ } + + writeb(0x00, p + UART_EXAR_MPIOINT_7_0); + writeb(0x00, p + UART_EXAR_MPIOLVL_7_0); +-- +2.25.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 74bce920ef9..e7a99781279 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -22,3 +22,39 @@ asoc-rt5670-correct-rt5670_ldo_sel_mask.patch btrfs-fix-double-free-on-ulist-after-backref-resolution-failure.patch btrfs-fix-mount-failure-caused-by-race-with-umount.patch btrfs-fix-page-leaks-after-failure-to-lock-page-for-delalloc.patch +bnxt_en-fix-race-when-modifying-pause-settings.patch +fpga-dfl-fix-bug-in-port-reset-handshake.patch +hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch +ax88172a-fix-ax88172a_unbind-failures.patch +net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch +ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch +drm-sun4i-hdmi-fix-inverted-hpd-result.patch +net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch +bonding-check-error-value-of-register_netdevice-imme.patch +mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch +qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch +ipvs-fix-the-connection-sync-failed-in-some-cases.patch +net-ethernet-ave-fix-error-returns-in-ave_init.patch +i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch +bonding-check-return-value-of-register_netdevice-in-.patch +serial-exar-fix-gpio-configuration-for-sealevel-card.patch +scripts-decode_stacktrace-strip-basepath-from-all-pa.patch +scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch +hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch +hid-alps-support-devices-with-report-id-2.patch +hid-steam-fixes-race-in-handling-device-list.patch +hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch +dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch +input-add-sw_machine_cover.patch +spi-mediatek-use-correct-spi_cfg2_reg-macro.patch +regmap-dev_get_regmap_match-fix-string-comparison.patch +hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch +dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch +input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch +input-elan_i2c-only-increment-wakeup-count-on-touch.patch +usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch +hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch +hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch +arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch +x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch +risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch diff --git a/queue-4.19/spi-mediatek-use-correct-spi_cfg2_reg-macro.patch b/queue-4.19/spi-mediatek-use-correct-spi_cfg2_reg-macro.patch new file mode 100644 index 00000000000..42d6e8c54a7 --- /dev/null +++ b/queue-4.19/spi-mediatek-use-correct-spi_cfg2_reg-macro.patch @@ -0,0 +1,76 @@ +From e63bb82aff51ae607c16628b337c2d04f3282511 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 17:00:20 +0800 +Subject: spi: mediatek: use correct SPI_CFG2_REG MACRO + +From: leilk.liu + +[ Upstream commit 44b37eb79e16a56cb30ba55b2da452396b941e7a ] + +this patch use correct SPI_CFG2_REG offset. + +Signed-off-by: leilk.liu +Link: https://lore.kernel.org/r/20200701090020.7935-1-leilk.liu@mediatek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mt65xx.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c +index 0c2867deb36fc..da28c52c9da19 100644 +--- a/drivers/spi/spi-mt65xx.c ++++ b/drivers/spi/spi-mt65xx.c +@@ -41,7 +41,6 @@ + #define SPI_CFG0_SCK_LOW_OFFSET 8 + #define SPI_CFG0_CS_HOLD_OFFSET 16 + #define SPI_CFG0_CS_SETUP_OFFSET 24 +-#define SPI_ADJUST_CFG0_SCK_LOW_OFFSET 16 + #define SPI_ADJUST_CFG0_CS_HOLD_OFFSET 0 + #define SPI_ADJUST_CFG0_CS_SETUP_OFFSET 16 + +@@ -53,6 +52,8 @@ + #define SPI_CFG1_CS_IDLE_MASK 0xff + #define SPI_CFG1_PACKET_LOOP_MASK 0xff00 + #define SPI_CFG1_PACKET_LENGTH_MASK 0x3ff0000 ++#define SPI_CFG2_SCK_HIGH_OFFSET 0 ++#define SPI_CFG2_SCK_LOW_OFFSET 16 + + #define SPI_CMD_ACT BIT(0) + #define SPI_CMD_RESUME BIT(1) +@@ -259,7 +260,7 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable) + static void mtk_spi_prepare_transfer(struct spi_master *master, + struct spi_transfer *xfer) + { +- u32 spi_clk_hz, div, sck_time, cs_time, reg_val = 0; ++ u32 spi_clk_hz, div, sck_time, cs_time, reg_val; + struct mtk_spi *mdata = spi_master_get_devdata(master); + + spi_clk_hz = clk_get_rate(mdata->spi_clk); +@@ -272,18 +273,18 @@ static void mtk_spi_prepare_transfer(struct spi_master *master, + cs_time = sck_time * 2; + + if (mdata->dev_comp->enhance_timing) { ++ reg_val = (((sck_time - 1) & 0xffff) ++ << SPI_CFG2_SCK_HIGH_OFFSET); + reg_val |= (((sck_time - 1) & 0xffff) +- << SPI_CFG0_SCK_HIGH_OFFSET); +- reg_val |= (((sck_time - 1) & 0xffff) +- << SPI_ADJUST_CFG0_SCK_LOW_OFFSET); ++ << SPI_CFG2_SCK_LOW_OFFSET); + writel(reg_val, mdata->base + SPI_CFG2_REG); +- reg_val |= (((cs_time - 1) & 0xffff) ++ reg_val = (((cs_time - 1) & 0xffff) + << SPI_ADJUST_CFG0_CS_HOLD_OFFSET); + reg_val |= (((cs_time - 1) & 0xffff) + << SPI_ADJUST_CFG0_CS_SETUP_OFFSET); + writel(reg_val, mdata->base + SPI_CFG0_REG); + } else { +- reg_val |= (((sck_time - 1) & 0xff) ++ reg_val = (((sck_time - 1) & 0xff) + << SPI_CFG0_SCK_HIGH_OFFSET); + reg_val |= (((sck_time - 1) & 0xff) << SPI_CFG0_SCK_LOW_OFFSET); + reg_val |= (((cs_time - 1) & 0xff) << SPI_CFG0_CS_HOLD_OFFSET); +-- +2.25.1 + diff --git a/queue-4.19/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch b/queue-4.19/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch new file mode 100644 index 00000000000..b3735e5ed99 --- /dev/null +++ b/queue-4.19/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch @@ -0,0 +1,45 @@ +From 4db697d018add0b38287f07f90cf8c61f145895d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jun 2020 16:17:47 +0300 +Subject: usb: gadget: udc: gr_udc: fix memleak on error handling path in + gr_ep_init() + +From: Evgeny Novikov + +[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ] + +gr_ep_init() does not assign the allocated request anywhere if allocation +of memory for the buffer fails. This is a memory leak fixed by the given +patch. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Evgeny Novikov +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/gr_udc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c +index e50108f9a374e..e0b2fb33ed0d8 100644 +--- a/drivers/usb/gadget/udc/gr_udc.c ++++ b/drivers/usb/gadget/udc/gr_udc.c +@@ -1980,9 +1980,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit) + + if (num == 0) { + _req = gr_alloc_request(&ep->ep, GFP_ATOMIC); ++ if (!_req) ++ return -ENOMEM; ++ + buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC); +- if (!_req || !buf) { +- /* possible _req freed by gr_probe via gr_remove */ ++ if (!buf) { ++ gr_free_request(&ep->ep, _req); + return -ENOMEM; + } + +-- +2.25.1 + diff --git a/queue-4.19/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch b/queue-4.19/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch new file mode 100644 index 00000000000..edfa14675ec --- /dev/null +++ b/queue-4.19/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch @@ -0,0 +1,43 @@ +From bf7d889ea416581f5ae2ce93afbd53a01bb57d3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 15:53:46 +0200 +Subject: x86: math-emu: Fix up 'cmp' insn for clang ias + +From: Arnd Bergmann + +[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ] + +The clang integrated assembler requires the 'cmp' instruction to +have a length prefix here: + +arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an explicit suffix (could be 'cmpb', 'cmpw', or 'cmpl') + cmp $0xffffffff,-24(%ebp) + ^ + +Make this a 32-bit comparison, which it was clearly meant to be. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Thomas Gleixner +Reviewed-by: Nick Desaulniers +Link: https://lkml.kernel.org/r/20200527135352.1198078-1-arnd@arndb.de +Signed-off-by: Sasha Levin +--- + arch/x86/math-emu/wm_sqrt.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S +index f031c0e193565..515cdee90df72 100644 +--- a/arch/x86/math-emu/wm_sqrt.S ++++ b/arch/x86/math-emu/wm_sqrt.S +@@ -209,7 +209,7 @@ sqrt_stage_2_finish: + + #ifdef PARANOID + /* It should be possible to get here only if the arg is ffff....ffff */ +- cmp $0xffffffff,FPU_fsqrt_arg_1 ++ cmpl $0xffffffff,FPU_fsqrt_arg_1 + jnz sqrt_stage_2_error + #endif /* PARANOID */ + +-- +2.25.1 +