From 009b2a6142dec6397223a56a9d2ff854568be30e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 23 Feb 2018 12:09:49 +0100 Subject: [PATCH] 4.14-stable patches added patches: 509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch arm-dts-fix-elm-interrupt-compiler-warning.patch arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch asoc-rockchip-disable-clock-on-error.patch asoc-rsnd-ssi-fix-race-condition-in-rsnd_ssi_pointer_update.patch bnxt_en-need-to-unconditionally-shut-down-roce-in-bnxt_shutdown.patch brcmfmac-avoid-build-error-with-make-w-1.patch btrfs-disable-fua-if-mounted-with-nobarrier.patch btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch btrfs-fix-quota-reservation-leak-on-preallocated-files.patch clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch dmaengine-ioat-fix-error-handling-path.patch dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch drm-armada-fix-leak-of-crtc-structure.patch drm-vc4-release-fence-after-signalling.patch gianfar-disable-eee-autoneg-by-default.patch gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch gpio-74x164-fix-crash-during-.remove.patch gpio-davinci-assign-first-bank-regs-for-unbanked-case.patch hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch i40iw-allocate-a-sdbuf-per-cqp-wqe.patch i40iw-correct-arp-index-mask.patch i40iw-do-not-free-sqbuf-when-event-is-i40iw_timer_type_close.patch ib-core-init-subsys-if-compiled-to-vmlinuz-core.patch ib-hfi1-initialize-bth1-in-16b-rc-ack-builder.patch ib-mlx4-fix-rss-hash-fields-restrictions.patch iio-fix-kernel-doc-build-errors.patch iio-proximity-sx9500-assign-interrupt-from-gpioio.patch ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch kvm-arm-arm64-fix-spinlock-acquisition-in-vgic_set_owner.patch kvm-arm-don-t-treat-unavailable-hyp-mode-as-an-error.patch kvm-vmx-fix-page-leak-in-hardware_setup.patch locking-lockdep-fix-possible-null-deref.patch m68k-add-missing-softirqentry_text-linker-section.patch md-raid1-10-add-missed-blk-plug.patch md-raid5-correct-degraded-calculation-in-raid5_error.patch media-ov13858-select-v4l2_fwnode.patch media-s5k6aa-describe-some-function-parameters.patch meson-gx-socinfo-fix-package-id-parsing.patch mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch net-dsa-mv88e6xxx-fix-interrupt-masking-on-removal.patch net-dsa-mv88e6xxx-unregister-mdio-bus-on-error-path.patch net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch net-mvpp2-allocate-zeroed-tx-descriptors.patch net-qualcomm-rmnet-fix-leak-on-transmit-failure.patch net_sched-red-avoid-devision-by-zero.patch net_sched-red-avoid-illegal-values.patch netfilter-xt_bpf-add-overflow-checks.patch nfp-fix-port-stats-for-mac-representors.patch pci-rcar-fix-use-after-free-in-probe-error-path.patch perf-annotate-do-not-truncate-instruction-names-at-6-chars.patch perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch perf-fix-header.size-for-namespace-events.patch perf-help-fix-a-bug-during-strstart-conversion.patch perf-record-fix-c-f-options-for-cpu-event-aliases.patch perf-test-fix-test-21-for-s390x.patch perf-test-shell-fix-check-open-filename-arg-using-perf-trace-on-s390x.patch perf-top-fix-window-dimensions-change-handling.patch phylink-ensure-we-take-the-link-down-when-phylink_stop-is-called.patch pinctrl-denverton-fix-uart2-rts-pin-mode.patch pinctrl-sunxi-fix-a64-uart-mux-value.patch pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch pm-runtime-fix-handling-of-suppliers-with-disabled-runtime-pm.patch powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch powerpc-perf-imc-fix-nest-imc-cpuhotplug-callback-failure.patch rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch s390-dasd-prevent-prefix-i-o-error.patch s390-virtio-add-bsd-license-to-virtio-ccw.patch scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch scsi-bfa-fix-access-to-bfad_im_port_s.patch scsi-bfa-fix-type-conversion-warning.patch scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch serdev-fix-receive_buf-return-value-when-no-callback.patch sfp-fix-rx_los-signal-handling.patch spi-sun4i-disable-clocks-in-the-remove-function.patch staging-ccree-uninitialized-return-in-ssi_ahash_import.patch trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch usb-build-drivers-usb-common-when-usb_support-is-set.patch usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch virtio_net-fix-return-value-check-in-receive_mergeable.patch vsock-fix-outdated-sk_state-value-in-hvs_release.patch x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch xen-xen_acpi_processor-is-dom0-only.patch xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch --- ...lized-stack-memory-when-oid-is-empty.patch | 56 +++++ ...m33xx_pwrdm_read_prev_pwrst-function.patch | 59 +++++ ...t-the-interrupts_properties-of-mcasp.patch | 50 +++++ ...43-correct-the-dmas-property-of-spi0.patch | 34 +++ ...s-fix-elm-interrupt-compiler-warning.patch | 34 +++ ...-connected-to-usb-by-using-wakeupgen.patch | 61 ++++++ ...fix-gpmc-addresses-for-nand-and-enet.patch | 49 +++++ ...-dts-logicpd-somlv-fix-wl127x-pinmux.patch | 70 ++++++ ...nslation-for-save_secure_ram_context.patch | 201 ++++++++++++++++++ ...asoc-rockchip-disable-clock-on-error.patch | 73 +++++++ ...condition-in-rsnd_ssi_pointer_update.patch | 73 +++++++ ...ally-shut-down-roce-in-bnxt_shutdown.patch | 49 +++++ ...fmac-avoid-build-error-with-make-w-1.patch | 40 ++++ ...isable-fua-if-mounted-with-nobarrier.patch | 55 +++++ ...-by-one-in-btrfs_search_path_in_tree.patch | 56 +++++ ...servation-leak-on-preallocated-files.patch | 47 ++++ ...ror-caused-by-accessing-null-pointer.patch | 43 ++++ ...eference-in-atc_prep_dma_interleaved.patch | 48 +++++ ...aengine-ioat-fix-error-handling-path.patch | 33 +++ ...disable-unprepare-clk-if-probe-fails.patch | 44 ++++ ...rm-armada-fix-leak-of-crtc-structure.patch | 82 +++++++ ...m-vc4-release-fence-after-signalling.patch | 50 +++++ ...anfar-disable-eee-autoneg-by-default.patch | 49 +++++ ...ent-reports-because-of-padding-issue.patch | 81 +++++++ ...gpio-74x164-fix-crash-during-.remove.patch | 57 +++++ ...gn-first-bank-regs-for-unbanked-case.patch | 33 +++ ...ible-sleep-in-atomic-bug-in-rr_close.patch | 39 ++++ .../i40iw-allocate-a-sdbuf-per-cqp-wqe.patch | 146 +++++++++++++ queue-4.14/i40iw-correct-arp-index-mask.patch | 38 ++++ ...when-event-is-i40iw_timer_type_close.patch | 52 +++++ ...t-subsys-if-compiled-to-vmlinuz-core.patch | 40 ++++ ...nitialize-bth1-in-16b-rc-ack-builder.patch | 36 ++++ ...lx4-fix-rss-hash-fields-restrictions.patch | 87 ++++++++ .../iio-fix-kernel-doc-build-errors.patch | 45 ++++ ...-sx9500-assign-interrupt-from-gpioio.patch | 54 +++++ ...rk-as-flow4-s-member-to-lookup-route.patch | 31 +++ ...inlock-acquisition-in-vgic_set_owner.patch | 53 +++++ ...eat-unavailable-hyp-mode-as-an-error.patch | 37 ++++ ...-vmx-fix-page-leak-in-hardware_setup.patch | 33 +++ ...king-lockdep-fix-possible-null-deref.patch | 38 ++++ ...ing-softirqentry_text-linker-section.patch | 72 +++++++ .../md-raid1-10-add-missed-blk-plug.patch | 63 ++++++ ...-degraded-calculation-in-raid5_error.patch | 52 +++++ .../media-ov13858-select-v4l2_fwnode.patch | 32 +++ ...aa-describe-some-function-parameters.patch | 59 +++++ ...on-gx-socinfo-fix-package-id-parsing.patch | 52 +++++ ...-boot-hang-with-earlyprintk-efi-keep.patch | 48 +++++ ...xxx-fix-interrupt-masking-on-removal.patch | 50 +++++ ...xx-unregister-mdio-bus-on-error-path.patch | 79 +++++++ ...rror-handling-in-emac_rockchip_probe.patch | 46 ++++ ...mvpp2-allocate-zeroed-tx-descriptors.patch | 39 ++++ ...m-rmnet-fix-leak-on-transmit-failure.patch | 50 +++++ ...net_sched-red-avoid-devision-by-zero.patch | 32 +++ .../net_sched-red-avoid-illegal-values.patch | 93 ++++++++ ...netfilter-xt_bpf-add-overflow-checks.patch | 81 +++++++ ...-fix-port-stats-for-mac-representors.patch | 51 +++++ ...x-use-after-free-in-probe-error-path.patch | 65 ++++++ ...runcate-instruction-names-at-6-chars.patch | 124 +++++++++++ ...ixup-discontiguous-sparse-numa-nodes.patch | 132 ++++++++++++ ...fix-header.size-for-namespace-events.patch | 52 +++++ ...fix-a-bug-during-strstart-conversion.patch | 54 +++++ ...ix-c-f-options-for-cpu-event-aliases.patch | 127 +++++++++++ .../perf-test-fix-test-21-for-s390x.patch | 45 ++++ ...lename-arg-using-perf-trace-on-s390x.patch | 65 ++++++ ...ix-window-dimensions-change-handling.patch | 82 +++++++ ...ink-down-when-phylink_stop-is-called.patch | 33 +++ ...trl-denverton-fix-uart2-rts-pin-mode.patch | 32 +++ ...pinctrl-sunxi-fix-a64-uart-mux-value.patch | 35 +++ ...trl-sunxi-fix-a80-interrupt-pin-bank.patch | 53 +++++ ...max-lighting-for-dell-latitude-e6410.patch | 71 +++++++ ...f-suppliers-with-disabled-runtime-pm.patch | 40 ++++ ...s-when-grouping-different-pmu-events.patch | 60 ++++++ ...nest-imc-cpuhotplug-callback-failure.patch | 66 ++++++ ...ure-that-psn-is-not-over-max-allowed.patch | 35 +++ .../s390-dasd-prevent-prefix-i-o-error.patch | 62 ++++++ ...virtio-add-bsd-license-to-virtio-ccw.patch | 38 ++++ ...tus-0-if-error-encountered-with-none.patch | 52 +++++ ...csi-bfa-fix-access-to-bfad_im_port_s.patch | 76 +++++++ ...scsi-bfa-fix-type-conversion-warning.patch | 110 ++++++++++ ...c-use-after-free-in-lpfc_rq_buf_free.patch | 39 ++++ ...mitted-queue-when-doing-prsctp_prune.patch | 58 +++++ ...ve_buf-return-value-when-no-callback.patch | 40 ++++ queue-4.14/series | 95 +++++++++ .../sfp-fix-rx_los-signal-handling.patch | 55 +++++ ...isable-clocks-in-the-remove-function.patch | 35 +++ ...itialized-return-in-ssi_ahash_import.patch | 32 +++ ...f_map-declared-inside-parameter-list.patch | 69 ++++++ ...s-usb-common-when-usb_support-is-set.patch | 40 ++++ ...controller-to-end-command-processing.patch | 79 +++++++ ...le-fix-missing-clk_disable_unprepare.patch | 40 ++++ ...urn-value-check-in-receive_mergeable.patch | 32 +++ ...tdated-sk_state-value-in-hvs_release.patch | 43 ++++ ...iotrace-for-page-unaligned-addresses.patch | 116 ++++++++++ .../xen-xen_acpi_processor-is-dom0-only.patch | 32 +++ ...isconfigured-transport-mode-policies.patch | 64 ++++++ ...ify-state-is-valid-when-encap_type-0.patch | 54 +++++ 96 files changed, 5587 insertions(+) create mode 100644 queue-4.14/509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch create mode 100644 queue-4.14/arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch create mode 100644 queue-4.14/arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch create mode 100644 queue-4.14/arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch create mode 100644 queue-4.14/arm-dts-fix-elm-interrupt-compiler-warning.patch create mode 100644 queue-4.14/arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch create mode 100644 queue-4.14/arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch create mode 100644 queue-4.14/arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch create mode 100644 queue-4.14/arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch create mode 100644 queue-4.14/asoc-rockchip-disable-clock-on-error.patch create mode 100644 queue-4.14/asoc-rsnd-ssi-fix-race-condition-in-rsnd_ssi_pointer_update.patch create mode 100644 queue-4.14/bnxt_en-need-to-unconditionally-shut-down-roce-in-bnxt_shutdown.patch create mode 100644 queue-4.14/brcmfmac-avoid-build-error-with-make-w-1.patch create mode 100644 queue-4.14/btrfs-disable-fua-if-mounted-with-nobarrier.patch create mode 100644 queue-4.14/btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch create mode 100644 queue-4.14/btrfs-fix-quota-reservation-leak-on-preallocated-files.patch create mode 100644 queue-4.14/clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch create mode 100644 queue-4.14/dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch create mode 100644 queue-4.14/dmaengine-ioat-fix-error-handling-path.patch create mode 100644 queue-4.14/dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch create mode 100644 queue-4.14/drm-armada-fix-leak-of-crtc-structure.patch create mode 100644 queue-4.14/drm-vc4-release-fence-after-signalling.patch create mode 100644 queue-4.14/gianfar-disable-eee-autoneg-by-default.patch create mode 100644 queue-4.14/gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch create mode 100644 queue-4.14/gpio-74x164-fix-crash-during-.remove.patch create mode 100644 queue-4.14/gpio-davinci-assign-first-bank-regs-for-unbanked-case.patch create mode 100644 queue-4.14/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch create mode 100644 queue-4.14/i40iw-allocate-a-sdbuf-per-cqp-wqe.patch create mode 100644 queue-4.14/i40iw-correct-arp-index-mask.patch create mode 100644 queue-4.14/i40iw-do-not-free-sqbuf-when-event-is-i40iw_timer_type_close.patch create mode 100644 queue-4.14/ib-core-init-subsys-if-compiled-to-vmlinuz-core.patch create mode 100644 queue-4.14/ib-hfi1-initialize-bth1-in-16b-rc-ack-builder.patch create mode 100644 queue-4.14/ib-mlx4-fix-rss-hash-fields-restrictions.patch create mode 100644 queue-4.14/iio-fix-kernel-doc-build-errors.patch create mode 100644 queue-4.14/iio-proximity-sx9500-assign-interrupt-from-gpioio.patch create mode 100644 queue-4.14/ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch create mode 100644 queue-4.14/kvm-arm-arm64-fix-spinlock-acquisition-in-vgic_set_owner.patch create mode 100644 queue-4.14/kvm-arm-don-t-treat-unavailable-hyp-mode-as-an-error.patch create mode 100644 queue-4.14/kvm-vmx-fix-page-leak-in-hardware_setup.patch create mode 100644 queue-4.14/locking-lockdep-fix-possible-null-deref.patch create mode 100644 queue-4.14/m68k-add-missing-softirqentry_text-linker-section.patch create mode 100644 queue-4.14/md-raid1-10-add-missed-blk-plug.patch create mode 100644 queue-4.14/md-raid5-correct-degraded-calculation-in-raid5_error.patch create mode 100644 queue-4.14/media-ov13858-select-v4l2_fwnode.patch create mode 100644 queue-4.14/media-s5k6aa-describe-some-function-parameters.patch create mode 100644 queue-4.14/meson-gx-socinfo-fix-package-id-parsing.patch create mode 100644 queue-4.14/mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch create mode 100644 queue-4.14/net-dsa-mv88e6xxx-fix-interrupt-masking-on-removal.patch create mode 100644 queue-4.14/net-dsa-mv88e6xxx-unregister-mdio-bus-on-error-path.patch create mode 100644 queue-4.14/net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch create mode 100644 queue-4.14/net-mvpp2-allocate-zeroed-tx-descriptors.patch create mode 100644 queue-4.14/net-qualcomm-rmnet-fix-leak-on-transmit-failure.patch create mode 100644 queue-4.14/net_sched-red-avoid-devision-by-zero.patch create mode 100644 queue-4.14/net_sched-red-avoid-illegal-values.patch create mode 100644 queue-4.14/netfilter-xt_bpf-add-overflow-checks.patch create mode 100644 queue-4.14/nfp-fix-port-stats-for-mac-representors.patch create mode 100644 queue-4.14/pci-rcar-fix-use-after-free-in-probe-error-path.patch create mode 100644 queue-4.14/perf-annotate-do-not-truncate-instruction-names-at-6-chars.patch create mode 100644 queue-4.14/perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch create mode 100644 queue-4.14/perf-fix-header.size-for-namespace-events.patch create mode 100644 queue-4.14/perf-help-fix-a-bug-during-strstart-conversion.patch create mode 100644 queue-4.14/perf-record-fix-c-f-options-for-cpu-event-aliases.patch create mode 100644 queue-4.14/perf-test-fix-test-21-for-s390x.patch create mode 100644 queue-4.14/perf-test-shell-fix-check-open-filename-arg-using-perf-trace-on-s390x.patch create mode 100644 queue-4.14/perf-top-fix-window-dimensions-change-handling.patch create mode 100644 queue-4.14/phylink-ensure-we-take-the-link-down-when-phylink_stop-is-called.patch create mode 100644 queue-4.14/pinctrl-denverton-fix-uart2-rts-pin-mode.patch create mode 100644 queue-4.14/pinctrl-sunxi-fix-a64-uart-mux-value.patch create mode 100644 queue-4.14/pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch create mode 100644 queue-4.14/platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch create mode 100644 queue-4.14/pm-runtime-fix-handling-of-suppliers-with-disabled-runtime-pm.patch create mode 100644 queue-4.14/powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch create mode 100644 queue-4.14/powerpc-perf-imc-fix-nest-imc-cpuhotplug-callback-failure.patch create mode 100644 queue-4.14/rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch create mode 100644 queue-4.14/s390-dasd-prevent-prefix-i-o-error.patch create mode 100644 queue-4.14/s390-virtio-add-bsd-license-to-virtio-ccw.patch create mode 100644 queue-4.14/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch create mode 100644 queue-4.14/scsi-bfa-fix-access-to-bfad_im_port_s.patch create mode 100644 queue-4.14/scsi-bfa-fix-type-conversion-warning.patch create mode 100644 queue-4.14/scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch create mode 100644 queue-4.14/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch create mode 100644 queue-4.14/serdev-fix-receive_buf-return-value-when-no-callback.patch create mode 100644 queue-4.14/sfp-fix-rx_los-signal-handling.patch create mode 100644 queue-4.14/spi-sun4i-disable-clocks-in-the-remove-function.patch create mode 100644 queue-4.14/staging-ccree-uninitialized-return-in-ssi_ahash_import.patch create mode 100644 queue-4.14/trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch create mode 100644 queue-4.14/usb-build-drivers-usb-common-when-usb_support-is-set.patch create mode 100644 queue-4.14/usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch create mode 100644 queue-4.14/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch create mode 100644 queue-4.14/virtio_net-fix-return-value-check-in-receive_mergeable.patch create mode 100644 queue-4.14/vsock-fix-outdated-sk_state-value-in-hvs_release.patch create mode 100644 queue-4.14/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch create mode 100644 queue-4.14/xen-xen_acpi_processor-is-dom0-only.patch create mode 100644 queue-4.14/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch create mode 100644 queue-4.14/xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch diff --git a/queue-4.14/509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch b/queue-4.14/509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch new file mode 100644 index 00000000000..8fc0bcff41a --- /dev/null +++ b/queue-4.14/509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch @@ -0,0 +1,56 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Eric Biggers +Date: Fri, 8 Dec 2017 15:13:28 +0000 +Subject: 509: fix printing uninitialized stack memory when OID is empty + +From: Eric Biggers + + +[ Upstream commit 8dfd2f22d3bf3ab7714f7495ad5d897b8845e8c1 ] + +Callers of sprint_oid() do not check its return value before printing +the result. In the case where the OID is zero-length, -EBADMSG was +being returned without anything being written to the buffer, resulting +in uninitialized stack memory being printed. Fix this by writing +"(bad)" to the buffer in the cases where -EBADMSG is returned. + +Fixes: 4f73175d0375 ("X.509: Add utility functions to render OIDs as strings") +Signed-off-by: Eric Biggers +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + lib/oid_registry.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/lib/oid_registry.c ++++ b/lib/oid_registry.c +@@ -116,7 +116,7 @@ int sprint_oid(const void *data, size_t + int count; + + if (v >= end) +- return -EBADMSG; ++ goto bad; + + n = *v++; + ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40); +@@ -134,7 +134,7 @@ int sprint_oid(const void *data, size_t + num = n & 0x7f; + do { + if (v >= end) +- return -EBADMSG; ++ goto bad; + n = *v++; + num <<= 7; + num |= n & 0x7f; +@@ -148,6 +148,10 @@ int sprint_oid(const void *data, size_t + } + + return ret; ++ ++bad: ++ snprintf(buffer, bufsize, "(bad)"); ++ return -EBADMSG; + } + EXPORT_SYMBOL_GPL(sprint_oid); + diff --git a/queue-4.14/arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch b/queue-4.14/arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch new file mode 100644 index 00000000000..4b01d48c902 --- /dev/null +++ b/queue-4.14/arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch @@ -0,0 +1,59 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Keerthy +Date: Fri, 10 Nov 2017 16:56:52 +0530 +Subject: ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function + +From: Keerthy + + +[ Upstream commit b6d6af7226465b6d11eac09d0be2ab78a4a9eb62 ] + +Referring TRM Am335X series: +http://www.ti.com/lit/ug/spruh73p/spruh73p.pdf + +The LastPowerStateEntered bitfield is present only for PM_CEFUSE +domain. This is not present in any of the other power domains. Hence +remove the generic am33xx_pwrdm_read_prev_pwrst hook which wrongly +reads the reserved bit fields for all the other power domains. + +Reading the reserved bits leads to wrongly interpreting the low +power transitions for various power domains that do not have the +LastPowerStateEntered field. The pm debug counters values are wrong +currently as we are incrementing them based on the reserved bits. + +Signed-off-by: Keerthy +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/prm33xx.c | 12 ------------ + 1 file changed, 12 deletions(-) + +--- a/arch/arm/mach-omap2/prm33xx.c ++++ b/arch/arm/mach-omap2/prm33xx.c +@@ -176,17 +176,6 @@ static int am33xx_pwrdm_read_pwrst(struc + return v; + } + +-static int am33xx_pwrdm_read_prev_pwrst(struct powerdomain *pwrdm) +-{ +- u32 v; +- +- v = am33xx_prm_read_reg(pwrdm->prcm_offs, pwrdm->pwrstst_offs); +- v &= AM33XX_LASTPOWERSTATEENTERED_MASK; +- v >>= AM33XX_LASTPOWERSTATEENTERED_SHIFT; +- +- return v; +-} +- + static int am33xx_pwrdm_set_lowpwrstchange(struct powerdomain *pwrdm) + { + am33xx_prm_rmw_reg_bits(AM33XX_LOWPOWERSTATECHANGE_MASK, +@@ -357,7 +346,6 @@ struct pwrdm_ops am33xx_pwrdm_operations + .pwrdm_set_next_pwrst = am33xx_pwrdm_set_next_pwrst, + .pwrdm_read_next_pwrst = am33xx_pwrdm_read_next_pwrst, + .pwrdm_read_pwrst = am33xx_pwrdm_read_pwrst, +- .pwrdm_read_prev_pwrst = am33xx_pwrdm_read_prev_pwrst, + .pwrdm_set_logic_retst = am33xx_pwrdm_set_logic_retst, + .pwrdm_read_logic_pwrst = am33xx_pwrdm_read_logic_pwrst, + .pwrdm_read_logic_retst = am33xx_pwrdm_read_logic_retst, diff --git a/queue-4.14/arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch b/queue-4.14/arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch new file mode 100644 index 00000000000..27cb01e2e62 --- /dev/null +++ b/queue-4.14/arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch @@ -0,0 +1,50 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Peter Ujfalusi +Date: Wed, 1 Nov 2017 11:03:31 +0200 +Subject: ARM: dts: am4372: Correct the interrupts_properties of McASP + +From: Peter Ujfalusi + + +[ Upstream commit 627395a6f8091c0aa18f49dca7df59ba3ec147ef ] + +Fixes the following warnings: + +arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property): +interrupts size is (8), expected multiple of 12 in +/ocp@44000000/mcasp@48038000 + +arch/arm/boot/dts/am437x-cm-t43.dtb: Warning (interrupts_property): +interrupts size is (8), expected multiple of 12 in +/ocp@44000000/mcasp@4803C000 + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am4372.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/am4372.dtsi ++++ b/arch/arm/boot/dts/am4372.dtsi +@@ -927,7 +927,8 @@ + reg = <0x48038000 0x2000>, + <0x46000000 0x400000>; + reg-names = "mpu", "dat"; +- interrupts = <80>, <81>; ++ interrupts = , ++ ; + interrupt-names = "tx", "rx"; + status = "disabled"; + dmas = <&edma 8 2>, +@@ -941,7 +942,8 @@ + reg = <0x4803C000 0x2000>, + <0x46400000 0x400000>; + reg-names = "mpu", "dat"; +- interrupts = <82>, <83>; ++ interrupts = , ++ ; + interrupt-names = "tx", "rx"; + status = "disabled"; + dmas = <&edma 10 2>, diff --git a/queue-4.14/arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch b/queue-4.14/arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch new file mode 100644 index 00000000000..5985e2b0619 --- /dev/null +++ b/queue-4.14/arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch @@ -0,0 +1,34 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Peter Ujfalusi +Date: Wed, 1 Nov 2017 11:03:40 +0200 +Subject: ARM: dts: am437x-cm-t43: Correct the dmas property of spi0 + +From: Peter Ujfalusi + + +[ Upstream commit ca41e244517d6d3f1600c229ff7ca615049c1e9c ] + +The DMA binding for eDMA needs 2 parameters, not 1. +The second, missing parameter is the tptc to be used for the channel. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am437x-cm-t43.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/am437x-cm-t43.dts ++++ b/arch/arm/boot/dts/am437x-cm-t43.dts +@@ -301,8 +301,8 @@ + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&spi0_pins>; +- dmas = <&edma 16 +- &edma 17>; ++ dmas = <&edma 16 0 ++ &edma 17 0>; + dma-names = "tx0", "rx0"; + + flash: w25q64cvzpig@0 { diff --git a/queue-4.14/arm-dts-fix-elm-interrupt-compiler-warning.patch b/queue-4.14/arm-dts-fix-elm-interrupt-compiler-warning.patch new file mode 100644 index 00000000000..19b2b11a8b5 --- /dev/null +++ b/queue-4.14/arm-dts-fix-elm-interrupt-compiler-warning.patch @@ -0,0 +1,34 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Tony Lindgren +Date: Mon, 4 Dec 2017 08:27:17 -0800 +Subject: ARM: dts: Fix elm interrupt compiler warning + +From: Tony Lindgren + + +[ Upstream commit d364b038bc962f494cffb8f6cb6cddbe41bcb5b6 ] + +Looks like the interrupt property is missing the controller and level +information causing: + +Warning (interrupts_property): interrupts size is (4), expected multiple +of 12 in /ocp/elm@48078000 + +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap4.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap4.dtsi ++++ b/arch/arm/boot/dts/omap4.dtsi +@@ -354,7 +354,7 @@ + elm: elm@48078000 { + compatible = "ti,am3352-elm"; + reg = <0x48078000 0x2000>; +- interrupts = <4>; ++ interrupts = ; + ti,hwmods = "elm"; + status = "disabled"; + }; diff --git a/queue-4.14/arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch b/queue-4.14/arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch new file mode 100644 index 00000000000..c378a7cfdc1 --- /dev/null +++ b/queue-4.14/arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch @@ -0,0 +1,61 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Tony Lindgren +Date: Fri, 17 Nov 2017 08:56:58 -0800 +Subject: ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen + +From: Tony Lindgren + + +[ Upstream commit cf87634c8b24e24bf379b8c6807c8b0fb5f23567 ] + +There's been a reproducable USB OHCI/EHCI cpuidle related hang on omap4 +for a while that happens after about 20 - 40 minutes on an idle system +with some data feeding device being connected, like a USB GPS device or +a cellular modem. + +This issue happens in cpuidle states C2 and C3 and does not happen if +cpuidle is limited to C1 state only. The symptoms are that the whole +system hangs and never wakes up from idle, and if a watchdog is +configured the system reboots after a while. + +Turns out that OHCI/EHCI devices on omap4 are trying to use the GIC +interrupt controller directly as a parent instead of the WUGEN. We +need to pass the interrupts through WUGEN to GIC to provide the wakeup +events for the processor. + +Let's fix the issue by removing the gic interrupt-parent and use the +default interrupt-parent wakeupgen instead. Note that omap5.dtsi had +this already fixes earlier by commit 7136d457f365 ("ARM: omap: convert +wakeupgen to stacked domains") but we somehow missed omap4 at that +point. + +Fixes: 7136d457f365 ("ARM: omap: convert wakeupgen to stacked domains") +Cc: Dave Gerlach +Cc: Nishanth Menon +Cc: Marc Zyngier +Cc: Sebastian Reichel +Reviewed-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap4.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/arm/boot/dts/omap4.dtsi ++++ b/arch/arm/boot/dts/omap4.dtsi +@@ -861,14 +861,12 @@ + usbhsohci: ohci@4a064800 { + compatible = "ti,ohci-omap3"; + reg = <0x4a064800 0x400>; +- interrupt-parent = <&gic>; + interrupts = ; + }; + + usbhsehci: ehci@4a064c00 { + compatible = "ti,ehci-omap"; + reg = <0x4a064c00 0x400>; +- interrupt-parent = <&gic>; + interrupts = ; + }; + }; diff --git a/queue-4.14/arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch b/queue-4.14/arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch new file mode 100644 index 00000000000..ac8ce2bd695 --- /dev/null +++ b/queue-4.14/arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch @@ -0,0 +1,49 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Adam Ford +Date: Tue, 31 Oct 2017 13:42:13 -0500 +Subject: ARM: dts: logicpd-som-lv: Fix gpmc addresses for NAND and enet + +From: Adam Ford + + +[ Upstream commit 3c18bbf3d11d2005da08b57ff26f44ff1c2b12d0 ] + +This patch fixes and issue where the NAND and GPMC based ethernet +controller stopped working. This also updates the GPMC settings +to be consistent with the Logic PD Torpedo development from the +commit listed above. + +Fixes: 44e4716499b8 ("ARM: dts: omap3: Fix NAND device nodes") + +Signed-off-by: Adam Ford +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts | 3 ++- + arch/arm/boot/dts/logicpd-som-lv.dtsi | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts ++++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts +@@ -72,7 +72,8 @@ + }; + + &gpmc { +- ranges = <1 0 0x08000000 0x1000000>; /* CS1: 16MB for LAN9221 */ ++ ranges = <0 0 0x30000000 0x1000000 /* CS0: 16MB for NAND */ ++ 1 0 0x2c000000 0x1000000>; /* CS1: 16MB for LAN9221 */ + + ethernet@gpmc { + pinctrl-names = "default"; +--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi ++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi +@@ -37,7 +37,7 @@ + }; + + &gpmc { +- ranges = <0 0 0x00000000 0x1000000>; /* CS0: 16MB for NAND */ ++ ranges = <0 0 0x30000000 0x1000000>; /* CS0: 16MB for NAND */ + + nand@0,0 { + compatible = "ti,omap2-nand"; diff --git a/queue-4.14/arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch b/queue-4.14/arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch new file mode 100644 index 00000000000..bc827e1a8fb --- /dev/null +++ b/queue-4.14/arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch @@ -0,0 +1,70 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Adam Ford +Date: Tue, 31 Oct 2017 13:45:59 -0500 +Subject: ARM: dts: logicpd-somlv: Fix wl127x pinmux + +From: Adam Ford + + +[ Upstream commit cd7594ac3281722cb8f10d6f6c7e4287747c7a9d ] + +The pin assignment for the wl127x interrupt was incorrect. I am +not sure how this every worked. This also eliminates a conflict with +the SMC911x ethernet driver and properly moves pinmuxes for the +related gpio to omap3_pmx_wkup from omap3_pmx_core. + +Fixes: ab8dd3aed011 ("ARM: DTS: Add minimal Support for Logic PD +DM3730 SOM-LV") + +Signed-off-by: Adam Ford +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/logicpd-som-lv.dtsi | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi ++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi +@@ -121,7 +121,7 @@ + + &mmc3 { + interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>; +- pinctrl-0 = <&mmc3_pins>; ++ pinctrl-0 = <&mmc3_pins &wl127x_gpio>; + pinctrl-names = "default"; + vmmc-supply = <&wl12xx_vmmc>; + non-removable; +@@ -132,8 +132,8 @@ + wlcore: wlcore@2 { + compatible = "ti,wl1273"; + reg = <2>; +- interrupt-parent = <&gpio5>; +- interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; /* gpio 152 */ ++ interrupt-parent = <&gpio1>; ++ interrupts = <2 IRQ_TYPE_LEVEL_HIGH>; /* gpio 2 */ + ref-clock-frequency = <26000000>; + }; + }; +@@ -157,8 +157,6 @@ + OMAP3_CORE1_IOPAD(0x2166, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat5.sdmmc3_dat1 */ + OMAP3_CORE1_IOPAD(0x2168, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat2 */ + OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat3 */ +- OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT_PULLUP | MUX_MODE4) /* mcbsp4_clkx.gpio_152 */ +- OMAP3_CORE1_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */ + OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs1.sdmmc3_cmd */ + OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs2.sdmmc_clk */ + >; +@@ -228,6 +226,12 @@ + OMAP3_WKUP_IOPAD(0x2a0e, PIN_OUTPUT | MUX_MODE4) /* sys_boot2.gpio_4 */ + >; + }; ++ wl127x_gpio: pinmux_wl127x_gpio_pin { ++ pinctrl-single,pins = < ++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */ ++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */ ++ >; ++ }; + }; + + &omap3_pmx_core2 { diff --git a/queue-4.14/arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch b/queue-4.14/arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch new file mode 100644 index 00000000000..76beec879d5 --- /dev/null +++ b/queue-4.14/arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch @@ -0,0 +1,201 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Tony Lindgren +Date: Mon, 27 Nov 2017 08:57:26 -0800 +Subject: ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context + +From: Tony Lindgren + + +[ Upstream commit d09220a887f70368afa79e850c95e74890c0a32d ] + +With the CMA changes from Joonsoo Kim , it +was noticed that n900 stopped booting. After investigating it turned +out that n900 save_secure_ram_context does some whacky virtual to +physical address translation for the SRAM data address. + +As we now only have minimal parts of omap3 idle code copied to SRAM, +running save_secure_ram_context() in SRAM is not needed. It only gets +called on PM init. And it seems there's no need to ever call this from +SRAM idle code. + +So let's just keep save_secure_ram_context() in DDR, and pass it the +physical address of the parameters. We can do everything else in +omap-secure.c like we already do for other secure code. + +And since we don't have any documentation, I still have no clue what +the values for 0, 1 and 1 for the parameters might be. If somebody has +figured it out, please do send a patch to add some comments. + +Debugged-by: Joonsoo Kim +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/omap-secure.c | 19 +++++++++++++++++++ + arch/arm/mach-omap2/omap-secure.h | 4 ++++ + arch/arm/mach-omap2/pm.h | 4 ---- + arch/arm/mach-omap2/pm34xx.c | 13 ++++--------- + arch/arm/mach-omap2/sleep34xx.S | 26 ++++---------------------- + 5 files changed, 31 insertions(+), 35 deletions(-) + +--- a/arch/arm/mach-omap2/omap-secure.c ++++ b/arch/arm/mach-omap2/omap-secure.c +@@ -73,6 +73,25 @@ phys_addr_t omap_secure_ram_mempool_base + return omap_secure_memblock_base; + } + ++u32 omap3_save_secure_ram(void __iomem *addr, int size) ++{ ++ u32 ret; ++ u32 param[5]; ++ ++ if (size != OMAP3_SAVE_SECURE_RAM_SZ) ++ return OMAP3_SAVE_SECURE_RAM_SZ; ++ ++ param[0] = 4; /* Number of arguments */ ++ param[1] = __pa(addr); /* Physical address for saving */ ++ param[2] = 0; ++ param[3] = 1; ++ param[4] = 1; ++ ++ ret = save_secure_ram_context(__pa(param)); ++ ++ return ret; ++} ++ + /** + * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls + * @idx: The PPA API index +--- a/arch/arm/mach-omap2/omap-secure.h ++++ b/arch/arm/mach-omap2/omap-secure.h +@@ -31,6 +31,8 @@ + /* Maximum Secure memory storage size */ + #define OMAP_SECURE_RAM_STORAGE (88 * SZ_1K) + ++#define OMAP3_SAVE_SECURE_RAM_SZ 0x803F ++ + /* Secure low power HAL API index */ + #define OMAP4_HAL_SAVESECURERAM_INDEX 0x1a + #define OMAP4_HAL_SAVEHW_INDEX 0x1b +@@ -65,6 +67,8 @@ extern u32 omap_smc2(u32 id, u32 falg, u + extern u32 omap_smc3(u32 id, u32 process, u32 flag, u32 pargs); + extern phys_addr_t omap_secure_ram_mempool_base(void); + extern int omap_secure_ram_reserve_memblock(void); ++extern u32 save_secure_ram_context(u32 args_pa); ++extern u32 omap3_save_secure_ram(void __iomem *save_regs, int size); + + extern u32 rx51_secure_dispatcher(u32 idx, u32 process, u32 flag, u32 nargs, + u32 arg1, u32 arg2, u32 arg3, u32 arg4); +--- a/arch/arm/mach-omap2/pm.h ++++ b/arch/arm/mach-omap2/pm.h +@@ -81,10 +81,6 @@ extern unsigned int omap3_do_wfi_sz; + /* ... and its pointer from SRAM after copy */ + extern void (*omap3_do_wfi_sram)(void); + +-/* save_secure_ram_context function pointer and size, for copy to SRAM */ +-extern int save_secure_ram_context(u32 *addr); +-extern unsigned int save_secure_ram_context_sz; +- + extern void omap3_save_scratchpad_contents(void); + + #define PM_RTA_ERRATUM_i608 (1 << 0) +--- a/arch/arm/mach-omap2/pm34xx.c ++++ b/arch/arm/mach-omap2/pm34xx.c +@@ -48,6 +48,7 @@ + #include "prm3xxx.h" + #include "pm.h" + #include "sdrc.h" ++#include "omap-secure.h" + #include "sram.h" + #include "control.h" + #include "vc.h" +@@ -66,7 +67,6 @@ struct power_state { + + static LIST_HEAD(pwrst_list); + +-static int (*_omap_save_secure_sram)(u32 *addr); + void (*omap3_do_wfi_sram)(void); + + static struct powerdomain *mpu_pwrdm, *neon_pwrdm; +@@ -121,8 +121,8 @@ static void omap3_save_secure_ram_contex + * will hang the system. + */ + pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON); +- ret = _omap_save_secure_sram((u32 *)(unsigned long) +- __pa(omap3_secure_ram_storage)); ++ ret = omap3_save_secure_ram(omap3_secure_ram_storage, ++ OMAP3_SAVE_SECURE_RAM_SZ); + pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state); + /* Following is for error tracking, it should not happen */ + if (ret) { +@@ -434,15 +434,10 @@ static int __init pwrdms_setup(struct po + * + * The minimum set of functions is pushed to SRAM for execution: + * - omap3_do_wfi for erratum i581 WA, +- * - save_secure_ram_context for security extensions. + */ + void omap_push_sram_idle(void) + { + omap3_do_wfi_sram = omap_sram_push(omap3_do_wfi, omap3_do_wfi_sz); +- +- if (omap_type() != OMAP2_DEVICE_TYPE_GP) +- _omap_save_secure_sram = omap_sram_push(save_secure_ram_context, +- save_secure_ram_context_sz); + } + + static void __init pm_errata_configure(void) +@@ -553,7 +548,7 @@ int __init omap3_pm_init(void) + clkdm_add_wkdep(neon_clkdm, mpu_clkdm); + if (omap_type() != OMAP2_DEVICE_TYPE_GP) { + omap3_secure_ram_storage = +- kmalloc(0x803F, GFP_KERNEL); ++ kmalloc(OMAP3_SAVE_SECURE_RAM_SZ, GFP_KERNEL); + if (!omap3_secure_ram_storage) + pr_err("Memory allocation failed when allocating for secure sram context\n"); + +--- a/arch/arm/mach-omap2/sleep34xx.S ++++ b/arch/arm/mach-omap2/sleep34xx.S +@@ -93,20 +93,13 @@ ENTRY(enable_omap3630_toggle_l2_on_resto + ENDPROC(enable_omap3630_toggle_l2_on_restore) + + /* +- * Function to call rom code to save secure ram context. This gets +- * relocated to SRAM, so it can be all in .data section. Otherwise +- * we need to initialize api_params separately. ++ * Function to call rom code to save secure ram context. ++ * ++ * r0 = physical address of the parameters + */ +- .data +- .align 3 + ENTRY(save_secure_ram_context) + stmfd sp!, {r4 - r11, lr} @ save registers on stack +- adr r3, api_params @ r3 points to parameters +- str r0, [r3,#0x4] @ r0 has sdram address +- ldr r12, high_mask +- and r3, r3, r12 +- ldr r12, sram_phy_addr_mask +- orr r3, r3, r12 ++ mov r3, r0 @ physical address of parameters + mov r0, #25 @ set service ID for PPA + mov r12, r0 @ copy secure service ID in r12 + mov r1, #0 @ set task id for ROM code in r1 +@@ -120,18 +113,7 @@ ENTRY(save_secure_ram_context) + nop + nop + ldmfd sp!, {r4 - r11, pc} +- .align +-sram_phy_addr_mask: +- .word SRAM_BASE_P +-high_mask: +- .word 0xffff +-api_params: +- .word 0x4, 0x0, 0x0, 0x1, 0x1 + ENDPROC(save_secure_ram_context) +-ENTRY(save_secure_ram_context_sz) +- .word . - save_secure_ram_context +- +- .text + + /* + * ====================== diff --git a/queue-4.14/asoc-rockchip-disable-clock-on-error.patch b/queue-4.14/asoc-rockchip-disable-clock-on-error.patch new file mode 100644 index 00000000000..0d4bcabf540 --- /dev/null +++ b/queue-4.14/asoc-rockchip-disable-clock-on-error.patch @@ -0,0 +1,73 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Stefan Potyra +Date: Wed, 6 Dec 2017 16:03:24 +0100 +Subject: ASoC: rockchip: disable clock on error + +From: Stefan Potyra + + +[ Upstream commit c7b92172a61b91936be985cb9bc499a4ebc6489b ] + +Disable the clocks in rk_spdif_probe when an error occurs after one +of the clocks has been enabled previously. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: f874b80e1571 ASoC: rockchip: Add rockchip SPDIF transceiver driver +Signed-off-by: Stefan Potyra +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/rockchip/rockchip_spdif.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/sound/soc/rockchip/rockchip_spdif.c ++++ b/sound/soc/rockchip/rockchip_spdif.c +@@ -322,26 +322,30 @@ static int rk_spdif_probe(struct platfor + spdif->mclk = devm_clk_get(&pdev->dev, "mclk"); + if (IS_ERR(spdif->mclk)) { + dev_err(&pdev->dev, "Can't retrieve rk_spdif master clock\n"); +- return PTR_ERR(spdif->mclk); ++ ret = PTR_ERR(spdif->mclk); ++ goto err_disable_hclk; + } + + ret = clk_prepare_enable(spdif->mclk); + if (ret) { + dev_err(spdif->dev, "clock enable failed %d\n", ret); +- return ret; ++ goto err_disable_clocks; + } + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + regs = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(regs)) +- return PTR_ERR(regs); ++ if (IS_ERR(regs)) { ++ ret = PTR_ERR(regs); ++ goto err_disable_clocks; ++ } + + spdif->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "hclk", regs, + &rk_spdif_regmap_config); + if (IS_ERR(spdif->regmap)) { + dev_err(&pdev->dev, + "Failed to initialise managed register map\n"); +- return PTR_ERR(spdif->regmap); ++ ret = PTR_ERR(spdif->regmap); ++ goto err_disable_clocks; + } + + spdif->playback_dma_data.addr = res->start + SPDIF_SMPDR; +@@ -373,6 +377,10 @@ static int rk_spdif_probe(struct platfor + + err_pm_runtime: + pm_runtime_disable(&pdev->dev); ++err_disable_clocks: ++ clk_disable_unprepare(spdif->mclk); ++err_disable_hclk: ++ clk_disable_unprepare(spdif->hclk); + + return ret; + } diff --git a/queue-4.14/asoc-rsnd-ssi-fix-race-condition-in-rsnd_ssi_pointer_update.patch b/queue-4.14/asoc-rsnd-ssi-fix-race-condition-in-rsnd_ssi_pointer_update.patch new file mode 100644 index 00000000000..03cdd300e0a --- /dev/null +++ b/queue-4.14/asoc-rsnd-ssi-fix-race-condition-in-rsnd_ssi_pointer_update.patch @@ -0,0 +1,73 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Jiada Wang +Date: Thu, 7 Dec 2017 22:15:38 -0800 +Subject: ASoC: rsnd: ssi: fix race condition in rsnd_ssi_pointer_update + +From: Jiada Wang + + +[ Upstream commit 33f801366bdf3f8b67dfe325b84f4051a090d01e ] + +Currently there is race condition between set of byte_pos and wrap +it around when new buffer starts. If .pointer is called in-between +it will result in inconsistent pointer position be returned +from .pointer callback. + +This patch increments buffer pointer atomically to avoid this issue. + +Signed-off-by: Jiada Wang +Reviewed-by: Takashi Sakamoto +Acked-by: Kuninori Morimoto +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sh/rcar/ssi.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -449,25 +449,29 @@ static bool rsnd_ssi_pointer_update(stru + int byte) + { + struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod); ++ bool ret = false; ++ int byte_pos; + +- ssi->byte_pos += byte; ++ byte_pos = ssi->byte_pos + byte; + +- if (ssi->byte_pos >= ssi->next_period_byte) { ++ if (byte_pos >= ssi->next_period_byte) { + struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); + + ssi->period_pos++; + ssi->next_period_byte += ssi->byte_per_period; + + if (ssi->period_pos >= runtime->periods) { +- ssi->byte_pos = 0; ++ byte_pos = 0; + ssi->period_pos = 0; + ssi->next_period_byte = ssi->byte_per_period; + } + +- return true; ++ ret = true; + } + +- return false; ++ WRITE_ONCE(ssi->byte_pos, byte_pos); ++ ++ return ret; + } + + /* +@@ -838,7 +842,7 @@ static int rsnd_ssi_pointer(struct rsnd_ + struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod); + struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); + +- *pointer = bytes_to_frames(runtime, ssi->byte_pos); ++ *pointer = bytes_to_frames(runtime, READ_ONCE(ssi->byte_pos)); + + return 0; + } diff --git a/queue-4.14/bnxt_en-need-to-unconditionally-shut-down-roce-in-bnxt_shutdown.patch b/queue-4.14/bnxt_en-need-to-unconditionally-shut-down-roce-in-bnxt_shutdown.patch new file mode 100644 index 00000000000..81e03324343 --- /dev/null +++ b/queue-4.14/bnxt_en-need-to-unconditionally-shut-down-roce-in-bnxt_shutdown.patch @@ -0,0 +1,49 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Ray Jui +Date: Fri, 1 Dec 2017 03:13:02 -0500 +Subject: bnxt_en: Need to unconditionally shut down RoCE in bnxt_shutdown + +From: Ray Jui + + +[ Upstream commit a7f3f939dd7d8398acebecd1ceb2e9e7ffbe91d2 ] + +The current 'bnxt_shutdown' implementation only invokes +'bnxt_ulp_shutdown' to shut down RoCE in the case when the system is in +the path of power off (SYSTEM_POWER_OFF). While this may work in most +cases, it does not work in the smart NIC case, when Linux 'reboot' +command is initiated from the Linux that runs on the ARM cores of the +NIC card. In this particular case, Linux 'reboot' results in a system +'L3' level reset where the entire ARM and associated subsystems are +being reset, but at the same time, Nitro core is being kept in sane state +(to allow external PCIe connected servers to continue to work). Without +properly shutting down RoCE and freeing all associated resources, it +results in the ARM core to hang immediately after the 'reboot' + +By always invoking 'bnxt_ulp_shutdown' in 'bnxt_shutdown', it fixes the +above issue + +Fixes: 0efd2fc65c92 ("bnxt_en: Add a callback to inform RDMA driver during PCI shutdown.") + +Signed-off-by: Ray Jui +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8218,8 +8218,9 @@ static void bnxt_shutdown(struct pci_dev + if (netif_running(dev)) + dev_close(dev); + ++ bnxt_ulp_shutdown(bp); ++ + if (system_state == SYSTEM_POWER_OFF) { +- bnxt_ulp_shutdown(bp); + bnxt_clear_int_mode(bp); + pci_wake_from_d3(pdev, bp->wol); + pci_set_power_state(pdev, PCI_D3hot); diff --git a/queue-4.14/brcmfmac-avoid-build-error-with-make-w-1.patch b/queue-4.14/brcmfmac-avoid-build-error-with-make-w-1.patch new file mode 100644 index 00000000000..2c908e4419e --- /dev/null +++ b/queue-4.14/brcmfmac-avoid-build-error-with-make-w-1.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andy Shevchenko +Date: Thu, 23 Nov 2017 17:57:04 +0200 +Subject: brcmfmac: Avoid build error with make W=1 + +From: Andy Shevchenko + + +[ Upstream commit 51ef7925e10688c57186d438e784532e063492e4 ] + +When I run make W=1 on gcc (Debian 7.2.0-16) 7.2.0 I got an error for +the first run, all next ones are okay. + + CC [M] drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o +drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union! +scripts/Makefile.build:310: recipe for target 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.o' failed + +Seems like something happened with W=1 and wrong kernel doc format. +As a quick fix remove dubious /** in the code. + +Signed-off-by: Andy Shevchenko +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -2064,7 +2064,7 @@ static int brcmf_sdio_txpkt_hdalign(stru + return head_pad; + } + +-/** ++/* + * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for + * bus layer usage. + */ diff --git a/queue-4.14/btrfs-disable-fua-if-mounted-with-nobarrier.patch b/queue-4.14/btrfs-disable-fua-if-mounted-with-nobarrier.patch new file mode 100644 index 00000000000..9e62801a1c6 --- /dev/null +++ b/queue-4.14/btrfs-disable-fua-if-mounted-with-nobarrier.patch @@ -0,0 +1,55 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Omar Sandoval +Date: Tue, 5 Dec 2017 22:54:02 -0800 +Subject: Btrfs: disable FUA if mounted with nobarrier + +From: Omar Sandoval + + +[ Upstream commit 1b9e619c5bc8235cfba3dc4ced2fb0e3554a05d4 ] + +I was seeing disk flushes still happening when I mounted a Btrfs +filesystem with nobarrier for testing. This is because we use FUA to +write out the first super block, and on devices without FUA support, the +block layer translates FUA to a flush. Even on devices supporting true +FUA, using FUA when we asked for no barriers is surprising. + +Fixes: 387125fc722a8ed ("Btrfs: fix barrier flushes") +Signed-off-by: Omar Sandoval +Reviewed-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/disk-io.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -3391,6 +3391,7 @@ static int write_dev_supers(struct btrfs + int errors = 0; + u32 crc; + u64 bytenr; ++ int op_flags; + + if (max_mirrors == 0) + max_mirrors = BTRFS_SUPER_MIRROR_MAX; +@@ -3433,13 +3434,10 @@ static int write_dev_supers(struct btrfs + * we fua the first super. The others we allow + * to go down lazy. + */ +- if (i == 0) { +- ret = btrfsic_submit_bh(REQ_OP_WRITE, +- REQ_SYNC | REQ_FUA | REQ_META | REQ_PRIO, bh); +- } else { +- ret = btrfsic_submit_bh(REQ_OP_WRITE, +- REQ_SYNC | REQ_META | REQ_PRIO, bh); +- } ++ op_flags = REQ_SYNC | REQ_META | REQ_PRIO; ++ if (i == 0 && !btrfs_test_opt(device->fs_info, NOBARRIER)) ++ op_flags |= REQ_FUA; ++ ret = btrfsic_submit_bh(REQ_OP_WRITE, op_flags, bh); + if (ret) + errors++; + } diff --git a/queue-4.14/btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch b/queue-4.14/btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch new file mode 100644 index 00000000000..48ccbcfa166 --- /dev/null +++ b/queue-4.14/btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch @@ -0,0 +1,56 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Nikolay Borisov +Date: Fri, 1 Dec 2017 11:19:42 +0200 +Subject: btrfs: Fix possible off-by-one in btrfs_search_path_in_tree + +From: Nikolay Borisov + + +[ Upstream commit c8bcbfbd239ed60a6562964b58034ac8a25f4c31 ] + +The name char array passed to btrfs_search_path_in_tree is of size +BTRFS_INO_LOOKUP_PATH_MAX (4080). So the actual accessible char indexes +are in the range of [0, 4079]. Currently the code uses the define but this +represents an off-by-one. + +Implications: + +Size of btrfs_ioctl_ino_lookup_args is 4096, so the new byte will be +written to extra space, not some padding that could be provided by the +allocator. + +btrfs-progs store the arguments on stack, but kernel does own copy of +the ioctl buffer and the off-by-one overwrite does not affect userspace, +but the ending 0 might be lost. + +Kernel ioctl buffer is allocated dynamically so we're overwriting +somebody else's memory, and the ioctl is privileged if args.objectid is +not 256. Which is in most cases, but resolving a subvolume stored in +another directory will trigger that path. + +Before this patch the buffer was one byte larger, but then the -1 was +not added. + +Fixes: ac8e9819d71f907 ("Btrfs: add search and inode lookup ioctls") +Signed-off-by: Nikolay Borisov +Reviewed-by: David Sterba +[ added implications ] +Signed-off-by: David Sterba + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/ioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2221,7 +2221,7 @@ static noinline int btrfs_search_path_in + if (!path) + return -ENOMEM; + +- ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX]; ++ ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1]; + + key.objectid = tree_id; + key.type = BTRFS_ROOT_ITEM_KEY; diff --git a/queue-4.14/btrfs-fix-quota-reservation-leak-on-preallocated-files.patch b/queue-4.14/btrfs-fix-quota-reservation-leak-on-preallocated-files.patch new file mode 100644 index 00000000000..3e48769d2d1 --- /dev/null +++ b/queue-4.14/btrfs-fix-quota-reservation-leak-on-preallocated-files.patch @@ -0,0 +1,47 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Justin Maggard +Date: Mon, 30 Oct 2017 15:29:10 -0700 +Subject: btrfs: Fix quota reservation leak on preallocated files + +From: Justin Maggard + + +[ Upstream commit b430b7751286b3acff2d324553c8cec4f1e87764 ] + +Commit c6887cd11149 ("Btrfs: don't do nocow check unless we have to") +changed the behavior of __btrfs_buffered_write() so that it first tries +to get a data space reservation, and then skips the relatively expensive +nocow check if the reservation succeeded. + +If we have quotas enabled, the data space reservation also includes a +quota reservation. But in the rewrite case, the space has already been +accounted for in qgroups. So btrfs_check_data_free_space() increases +the quota reservation, but it never gets decreased when the data +actually gets written and overwrites the pre-existing data. So we're +left with both the qgroup and qgroup reservation accounting for the same +space. + +This commit adds the missing btrfs_qgroup_free_data() call in the case +of BTRFS_ORDERED_PREALLOC extents. + +Fixes: c6887cd11149 ("Btrfs: don't do nocow check unless we have to") +Signed-off-by: Justin Maggard +Reviewed-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -3016,6 +3016,8 @@ static int btrfs_finish_ordered_io(struc + compress_type = ordered_extent->compress_type; + if (test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags)) { + BUG_ON(compress_type); ++ btrfs_qgroup_free_data(inode, NULL, ordered_extent->file_offset, ++ ordered_extent->len); + ret = btrfs_mark_extent_written(trans, BTRFS_I(inode), + ordered_extent->file_offset, + ordered_extent->file_offset + diff --git a/queue-4.14/clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch b/queue-4.14/clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch new file mode 100644 index 00000000000..e15c1397ee4 --- /dev/null +++ b/queue-4.14/clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch @@ -0,0 +1,43 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Cai Li +Date: Tue, 21 Nov 2017 17:24:38 +0800 +Subject: clk: fix a panic error caused by accessing NULL pointer + +From: Cai Li + + +[ Upstream commit 975b820b6836b6b6c42fb84cd2e772e2b41bca67 ] + +In some cases the clock parent would be set NULL when doing re-parent, +it will cause a NULL pointer accessing if clk_set trace event is +enabled. + +This patch sets the parent as "none" if the input parameter is NULL. + +Fixes: dfc202ead312 (clk: Add tracepoints for hardware operations) +Signed-off-by: Cai Li +Signed-off-by: Chunyan Zhang +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/trace/events/clk.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/trace/events/clk.h ++++ b/include/trace/events/clk.h +@@ -134,12 +134,12 @@ DECLARE_EVENT_CLASS(clk_parent, + + TP_STRUCT__entry( + __string( name, core->name ) +- __string( pname, parent->name ) ++ __string( pname, parent ? parent->name : "none" ) + ), + + TP_fast_assign( + __assign_str(name, core->name); +- __assign_str(pname, parent->name); ++ __assign_str(pname, parent ? parent->name : "none"); + ), + + TP_printk("%s %s", __get_str(name), __get_str(pname)) diff --git a/queue-4.14/dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch b/queue-4.14/dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch new file mode 100644 index 00000000000..07f281e6393 --- /dev/null +++ b/queue-4.14/dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch @@ -0,0 +1,48 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: "Gustavo A. R. Silva" +Date: Mon, 20 Nov 2017 08:28:14 -0600 +Subject: dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved + +From: "Gustavo A. R. Silva" + + +[ Upstream commit 62a277d43d47e74972de44d33bd3763e31992414 ] + +_xt_ is being dereferenced before it is null checked, hence there is a +potential null pointer dereference. + +Fix this by moving the pointer dereference after _xt_ has been null +checked. + +This issue was detected with the help of Coccinelle. + +Fixes: 4483320e241c ("dmaengine: Use Pointer xt after NULL check.") +Signed-off-by: Gustavo A. R. Silva +Acked-by: Ludovic Desroches +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/at_hdmac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan + unsigned long flags) + { + struct at_dma_chan *atchan = to_at_dma_chan(chan); +- struct data_chunk *first = xt->sgl; ++ struct data_chunk *first; + struct at_desc *desc = NULL; + size_t xfer_count; + unsigned int dwidth; +@@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan + if (unlikely(!xt || xt->numf != 1 || !xt->frame_size)) + return NULL; + ++ first = xt->sgl; ++ + dev_info(chan2dev(chan), + "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n", + __func__, &xt->src_start, &xt->dst_start, xt->numf, diff --git a/queue-4.14/dmaengine-ioat-fix-error-handling-path.patch b/queue-4.14/dmaengine-ioat-fix-error-handling-path.patch new file mode 100644 index 00000000000..69887fad928 --- /dev/null +++ b/queue-4.14/dmaengine-ioat-fix-error-handling-path.patch @@ -0,0 +1,33 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Christophe JAILLET +Date: Fri, 17 Nov 2017 22:37:53 +0100 +Subject: dmaengine: ioat: Fix error handling path + +From: Christophe JAILLET + + +[ Upstream commit 5c9afbda911ce20b3f2181d1e440a0222e1027dd ] + +If the last test in 'ioat_dma_self_test()' fails, we must release all +the allocated resources and not just part of them. + +Signed-off-by: Christophe JAILLET +Acked-by: Dave Jiang +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ioat/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -390,7 +390,7 @@ static int ioat_dma_self_test(struct ioa + if (memcmp(src, dest, IOAT_TEST_SIZE)) { + dev_err(dev, "Self-test copy failed compare, disabling\n"); + err = -ENODEV; +- goto free_resources; ++ goto unmap_dma; + } + + unmap_dma: diff --git a/queue-4.14/dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch b/queue-4.14/dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch new file mode 100644 index 00000000000..e0c39eaf589 --- /dev/null +++ b/queue-4.14/dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch @@ -0,0 +1,44 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Tobias Jordan +Date: Wed, 6 Dec 2017 14:28:27 +0100 +Subject: dmaengine: jz4740: disable/unprepare clk if probe fails + +From: Tobias Jordan + + +[ Upstream commit eb9436966fdc84cebdf222952a99898ab46d9bb0 ] + +in error path of jz4740_dma_probe(), call clk_disable_unprepare() to clean +up. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 25ce6c35fea0 MIPS: jz4740: Remove custom DMA API +Signed-off-by: Tobias Jordan +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dma-jz4740.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/dma-jz4740.c ++++ b/drivers/dma/dma-jz4740.c +@@ -555,7 +555,7 @@ static int jz4740_dma_probe(struct platf + + ret = dma_async_device_register(dd); + if (ret) +- return ret; ++ goto err_clk; + + irq = platform_get_irq(pdev, 0); + ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev); +@@ -568,6 +568,8 @@ static int jz4740_dma_probe(struct platf + + err_unregister: + dma_async_device_unregister(dd); ++err_clk: ++ clk_disable_unprepare(dmadev->clk); + return ret; + } + diff --git a/queue-4.14/drm-armada-fix-leak-of-crtc-structure.patch b/queue-4.14/drm-armada-fix-leak-of-crtc-structure.patch new file mode 100644 index 00000000000..a48cc7e7f26 --- /dev/null +++ b/queue-4.14/drm-armada-fix-leak-of-crtc-structure.patch @@ -0,0 +1,82 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Russell King +Date: Fri, 8 Dec 2017 12:16:22 +0000 +Subject: drm/armada: fix leak of crtc structure + +From: Russell King + + +[ Upstream commit 33cd3c07a976e11c3c4cc6b0b3db6760ad1590c5 ] + +Fix the leak of the CRTC structure in the failure paths of +armada_drm_crtc_create(). + +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/armada/armada_crtc.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/armada/armada_crtc.c ++++ b/drivers/gpu/drm/armada/armada_crtc.c +@@ -1225,17 +1225,13 @@ static int armada_drm_crtc_create(struct + + ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc", + dcrtc); +- if (ret < 0) { +- kfree(dcrtc); +- return ret; +- } ++ if (ret < 0) ++ goto err_crtc; + + if (dcrtc->variant->init) { + ret = dcrtc->variant->init(dcrtc, dev); +- if (ret) { +- kfree(dcrtc); +- return ret; +- } ++ if (ret) ++ goto err_crtc; + } + + /* Ensure AXI pipeline is enabled */ +@@ -1246,13 +1242,15 @@ static int armada_drm_crtc_create(struct + dcrtc->crtc.port = port; + + primary = kzalloc(sizeof(*primary), GFP_KERNEL); +- if (!primary) +- return -ENOMEM; ++ if (!primary) { ++ ret = -ENOMEM; ++ goto err_crtc; ++ } + + ret = armada_drm_plane_init(primary); + if (ret) { + kfree(primary); +- return ret; ++ goto err_crtc; + } + + ret = drm_universal_plane_init(drm, &primary->base, 0, +@@ -1263,7 +1261,7 @@ static int armada_drm_crtc_create(struct + DRM_PLANE_TYPE_PRIMARY, NULL); + if (ret) { + kfree(primary); +- return ret; ++ goto err_crtc; + } + + ret = drm_crtc_init_with_planes(drm, &dcrtc->crtc, &primary->base, NULL, +@@ -1282,6 +1280,9 @@ static int armada_drm_crtc_create(struct + + err_crtc_init: + primary->base.funcs->destroy(&primary->base); ++err_crtc: ++ kfree(dcrtc); ++ + return ret; + } + diff --git a/queue-4.14/drm-vc4-release-fence-after-signalling.patch b/queue-4.14/drm-vc4-release-fence-after-signalling.patch new file mode 100644 index 00000000000..4ad570a24e7 --- /dev/null +++ b/queue-4.14/drm-vc4-release-fence-after-signalling.patch @@ -0,0 +1,50 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Stefan Schake +Date: Sat, 2 Dec 2017 18:40:39 +0100 +Subject: drm/vc4: Release fence after signalling + +From: Stefan Schake + + +[ Upstream commit babc8110057cb9ca542c3c1666cbda4e8ccf9250 ] + +We were never releasing the initial fence reference that is obtained +through dma_fence_init. + +Link: https://github.com/anholt/linux/issues/122 +Fixes: cdec4d361323 ("drm/vc4: Expose dma-buf fences for V3D rendering.") +Signed-off-by: Stefan Schake +Signed-off-by: Eric Anholt +Reviewed-by: Eric Anholt +Link: https://patchwork.freedesktop.org/patch/msgid/1512236444-301-1-git-send-email-stschake@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vc4/vc4_gem.c | 4 +++- + drivers/gpu/drm/vc4/vc4_irq.c | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_gem.c ++++ b/drivers/gpu/drm/vc4/vc4_gem.c +@@ -829,8 +829,10 @@ vc4_complete_exec(struct drm_device *dev + /* If we got force-completed because of GPU reset rather than + * through our IRQ handler, signal the fence now. + */ +- if (exec->fence) ++ if (exec->fence) { + dma_fence_signal(exec->fence); ++ dma_fence_put(exec->fence); ++ } + + if (exec->bo) { + for (i = 0; i < exec->bo_count; i++) +--- a/drivers/gpu/drm/vc4/vc4_irq.c ++++ b/drivers/gpu/drm/vc4/vc4_irq.c +@@ -139,6 +139,7 @@ vc4_irq_finish_render_job(struct drm_dev + list_move_tail(&exec->head, &vc4->job_done_list); + if (exec->fence) { + dma_fence_signal_locked(exec->fence); ++ dma_fence_put(exec->fence); + exec->fence = NULL; + } + vc4_submit_next_render_job(dev); diff --git a/queue-4.14/gianfar-disable-eee-autoneg-by-default.patch b/queue-4.14/gianfar-disable-eee-autoneg-by-default.patch new file mode 100644 index 00000000000..2b1b4f02690 --- /dev/null +++ b/queue-4.14/gianfar-disable-eee-autoneg-by-default.patch @@ -0,0 +1,49 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Claudiu Manoil +Date: Thu, 7 Dec 2017 18:44:23 +0200 +Subject: gianfar: Disable EEE autoneg by default + +From: Claudiu Manoil + + +[ Upstream commit b6b5e8a691185606dfffff3198c89e3b4fd9d4f6 ] + +This controller does not support EEE, but it may connect to a PHY +which supports EEE and advertises EEE by default, while its link +partner also advertises EEE. If this happens, the PHY enters low +power mode when the traffic rate is low and causes packet loss. +This patch disables EEE advertisement by default for any PHY that +gianfar connects to, to prevent the above unwanted outcome. + +Signed-off-by: Shaohui Xie +Tested-by: Yangbo Lu +Signed-off-by: Claudiu Manoil +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -1792,6 +1792,7 @@ static int init_phy(struct net_device *d + GFAR_SUPPORTED_GBIT : 0; + phy_interface_t interface; + struct phy_device *phydev; ++ struct ethtool_eee edata; + + priv->oldlink = 0; + priv->oldspeed = 0; +@@ -1816,6 +1817,10 @@ static int init_phy(struct net_device *d + /* Add support for flow control, but don't advertise it by default */ + phydev->supported |= (SUPPORTED_Pause | SUPPORTED_Asym_Pause); + ++ /* disable EEE autoneg, EEE not supported by eTSEC */ ++ memset(&edata, 0, sizeof(struct ethtool_eee)); ++ phy_ethtool_set_eee(phydev, &edata); ++ + return 0; + } + diff --git a/queue-4.14/gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch b/queue-4.14/gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch new file mode 100644 index 00000000000..9825c2a3184 --- /dev/null +++ b/queue-4.14/gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch @@ -0,0 +1,81 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Zumeng Chen +Date: Mon, 4 Dec 2017 11:22:02 +0800 +Subject: gianfar: fix a flooded alignment reports because of padding issue. + +From: Zumeng Chen + + +[ Upstream commit 58117672943734715bbe7565ac9f062effa524f0 ] + +According to LS1021A RM, the value of PAL can be set so that the start of the +IP header in the receive data buffer is aligned to a 32-bit boundary. Normally, +setting PAL = 2 provides minimal padding to ensure such alignment of the IP +header. + +However every incoming packet's 8-byte time stamp will be inserted into the +packet data buffer as padding alignment bytes when hardware time stamping is +enabled. + +So we set the padding 8+2 here to avoid the flooded alignment faults: + +root@128:~# cat /proc/cpu/alignment +User: 0 +System: 17539 (inet_gro_receive+0x114/0x2c0) +Skipped: 0 +Half: 0 +Word: 0 +DWord: 0 +Multi: 17539 +User faults: 2 (fixup) + +Also shown when exception report enablement + +CPU: 0 PID: 161 Comm: irq/66-eth1_g0_ Not tainted 4.1.21-rt13-WR8.0.0.0_preempt-rt #16 +Hardware name: Freescale LS1021A +[<8001b420>] (unwind_backtrace) from [<8001476c>] (show_stack+0x20/0x24) +[<8001476c>] (show_stack) from [<807cfb48>] (dump_stack+0x94/0xac) +[<807cfb48>] (dump_stack) from [<80025d70>] (do_alignment+0x720/0x958) +[<80025d70>] (do_alignment) from [<80009224>] (do_DataAbort+0x40/0xbc) +[<80009224>] (do_DataAbort) from [<80015398>] (__dabt_svc+0x38/0x60) +Exception stack(0x86ad1cc0 to 0x86ad1d08) +1cc0: f9b3e080 86b3d072 2d78d287 00000000 866816c0 86b3d05e 86e785d0 00000000 +1ce0: 00000011 0000000e 80840ab0 86ad1d3c 86ad1d08 86ad1d08 806d7fc0 806d806c +1d00: 40070013 ffffffff +[<80015398>] (__dabt_svc) from [<806d806c>] (inet_gro_receive+0x114/0x2c0) +[<806d806c>] (inet_gro_receive) from [<80660eec>] (dev_gro_receive+0x21c/0x3c0) +[<80660eec>] (dev_gro_receive) from [<8066133c>] (napi_gro_receive+0x44/0x17c) +[<8066133c>] (napi_gro_receive) from [<804f0538>] (gfar_clean_rx_ring+0x39c/0x7d4) +[<804f0538>] (gfar_clean_rx_ring) from [<804f0bf4>] (gfar_poll_rx_sq+0x58/0xe0) +[<804f0bf4>] (gfar_poll_rx_sq) from [<80660b10>] (net_rx_action+0x27c/0x43c) +[<80660b10>] (net_rx_action) from [<80033638>] (do_current_softirqs+0x1e0/0x3dc) +[<80033638>] (do_current_softirqs) from [<800338c4>] (__local_bh_enable+0x90/0xa8) +[<800338c4>] (__local_bh_enable) from [<8008025c>] (irq_forced_thread_fn+0x70/0x84) +[<8008025c>] (irq_forced_thread_fn) from [<800805e8>] (irq_thread+0x16c/0x244) +[<800805e8>] (irq_thread) from [<8004e490>] (kthread+0xe8/0x104) +[<8004e490>] (kthread) from [<8000fda8>] (ret_from_fork+0x14/0x2c) + +Signed-off-by: Zumeng Chen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -1378,9 +1378,11 @@ static int gfar_probe(struct platform_de + + gfar_init_addr_hash_table(priv); + +- /* Insert receive time stamps into padding alignment bytes */ ++ /* Insert receive time stamps into padding alignment bytes, and ++ * plus 2 bytes padding to ensure the cpu alignment. ++ */ + if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) +- priv->padding = 8; ++ priv->padding = 8 + DEFAULT_PADDING; + + if (dev->features & NETIF_F_IP_CSUM || + priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) diff --git a/queue-4.14/gpio-74x164-fix-crash-during-.remove.patch b/queue-4.14/gpio-74x164-fix-crash-during-.remove.patch new file mode 100644 index 00000000000..e54748e2596 --- /dev/null +++ b/queue-4.14/gpio-74x164-fix-crash-during-.remove.patch @@ -0,0 +1,57 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Geert Uytterhoeven +Date: Tue, 21 Nov 2017 15:18:10 +0100 +Subject: gpio: 74x164: Fix crash during .remove() + +From: Geert Uytterhoeven + + +[ Upstream commit a158531f3c92467df0e93e000d58185acae78a6e ] + +Commit 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' +property") added a new member gpiod_oe to the end of the struct +gen_74x164_chip, after the zero-length buffer array. + +However, this buffer is a flexible array, allocated together with the +structure during .probe(). As the buffer is no longer the last member, +writing to it corrupts the newly added member after it. +During device removal, the corrupted member will be used as a pointer, +leading to a crash. + +This went unnoticed, as the flexible array was declared as "buffer[0]" +instead of "buffer[]", and thus did not trigger a "flexible array member +not at end of struct" error from gcc. + +Move the gpiod_oe field up to fix this, and drop the zero from the array +size to prevent future similar bugs. + +Fixes: 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Fabio Estevam +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-74x164.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/gpio-74x164.c ++++ b/drivers/gpio/gpio-74x164.c +@@ -23,6 +23,7 @@ + struct gen_74x164_chip { + struct gpio_chip gpio_chip; + struct mutex lock; ++ struct gpio_desc *gpiod_oe; + u32 registers; + /* + * Since the registers are chained, every byte sent will make +@@ -31,8 +32,7 @@ struct gen_74x164_chip { + * register at the end of the transfer. So, to have a logical + * numbering, store the bytes in reverse order. + */ +- u8 buffer[0]; +- struct gpio_desc *gpiod_oe; ++ u8 buffer[]; + }; + + static int __gen_74x164_write_config(struct gen_74x164_chip *chip) diff --git a/queue-4.14/gpio-davinci-assign-first-bank-regs-for-unbanked-case.patch b/queue-4.14/gpio-davinci-assign-first-bank-regs-for-unbanked-case.patch new file mode 100644 index 00000000000..c1689c7d446 --- /dev/null +++ b/queue-4.14/gpio-davinci-assign-first-bank-regs-for-unbanked-case.patch @@ -0,0 +1,33 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Keerthy +Date: Fri, 10 Nov 2017 16:43:17 +0530 +Subject: gpio: davinci: Assign first bank regs for unbanked case + +From: Keerthy + + +[ Upstream commit 7f8e2a85c1b0bd440ffe87be82c79fdc319e8291 ] + +As per the re-design assign the first bank regs for unbanked +irq case. This was missed out in the original patch. + +Signed-off-by: Keerthy +Fixes: b5cf3fd827d2e1 ("gpio: davinci: Redesign driver to accommodate ngpios in one gpio chip") +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-davinci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpio/gpio-davinci.c ++++ b/drivers/gpio/gpio-davinci.c +@@ -383,7 +383,7 @@ static int gpio_irq_type_unbanked(struct + u32 mask; + + d = (struct davinci_gpio_controller *)irq_data_get_irq_handler_data(data); +- g = (struct davinci_gpio_regs __iomem *)d->regs; ++ g = (struct davinci_gpio_regs __iomem *)d->regs[0]; + mask = __gpio_mask(data->irq - d->base_irq); + + if (trigger & ~(IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING)) diff --git a/queue-4.14/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch b/queue-4.14/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch new file mode 100644 index 00000000000..6b870b96b5d --- /dev/null +++ b/queue-4.14/hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Jia-Ju Bai +Date: Tue, 12 Dec 2017 16:49:52 +0800 +Subject: hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close + +From: Jia-Ju Bai + + +[ Upstream commit 6e266610eb6553cfb7e7eb5d11914bd01509c406 ] + +The driver may sleep under a spinlock. +The function call path is: +rr_close (acquire the spinlock) + free_irq --> may sleep + +To fix it, free_irq is moved to the place without holding the spinlock. + +This bug is found by my static analysis tool(DSAC) and checked by my code review. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hippi/rrunner.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1381,8 +1381,8 @@ static int rr_close(struct net_device *d + rrpriv->info_dma); + rrpriv->info = NULL; + +- free_irq(pdev->irq, dev); + spin_unlock_irqrestore(&rrpriv->lock, flags); ++ free_irq(pdev->irq, dev); + + return 0; + } diff --git a/queue-4.14/i40iw-allocate-a-sdbuf-per-cqp-wqe.patch b/queue-4.14/i40iw-allocate-a-sdbuf-per-cqp-wqe.patch new file mode 100644 index 00000000000..7d9eaefe7b0 --- /dev/null +++ b/queue-4.14/i40iw-allocate-a-sdbuf-per-cqp-wqe.patch @@ -0,0 +1,146 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Chien Tin Tung +Date: Tue, 21 Nov 2017 16:18:30 -0600 +Subject: i40iw: Allocate a sdbuf per CQP WQE + +From: Chien Tin Tung + + +[ Upstream commit 100d6de2ced538c539d923dc14a1b5cbae234503 ] + +Currently there is only one sdbuf per Control QP (CQP) for +programming Segment Descriptor (SD). If multiple SD work +requests are posted simultaneously, the sdbuf is reused +by all WQEs and new WQEs can corrupt previous WQEs sdbuf +leading to incorrect SD programming. + +Fix this by allocating one sdbuf per CQP SQ WQE. When an +SD command is posted, it will use the corresponding sdbuf +for the WQE. + +Fixes: 86dbcd0f12e9 ("i40iw: add file to handle cqp calls") +Signed-off-by: Chien Tin Tung +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 43 +++++++++++++++++++++---------- + drivers/infiniband/hw/i40iw/i40iw_d.h | 4 ++ + 2 files changed, 33 insertions(+), 14 deletions(-) + +--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +@@ -506,7 +506,7 @@ static enum i40iw_status_code i40iw_sc_c + + ret_code = i40iw_allocate_dma_mem(cqp->dev->hw, + &cqp->sdbuf, +- 128, ++ I40IW_UPDATE_SD_BUF_SIZE * cqp->sq_size, + I40IW_SD_BUF_ALIGNMENT); + + if (ret_code) +@@ -589,14 +589,15 @@ void i40iw_sc_cqp_post_sq(struct i40iw_s + } + + /** +- * i40iw_sc_cqp_get_next_send_wqe - get next wqe on cqp sq +- * @cqp: struct for cqp hw +- * @wqe_idx: we index of cqp ring ++ * i40iw_sc_cqp_get_next_send_wqe_idx - get next WQE on CQP SQ and pass back the index ++ * @cqp: pointer to CQP structure ++ * @scratch: private data for CQP WQE ++ * @wqe_idx: WQE index for next WQE on CQP SQ + */ +-u64 *i40iw_sc_cqp_get_next_send_wqe(struct i40iw_sc_cqp *cqp, u64 scratch) ++static u64 *i40iw_sc_cqp_get_next_send_wqe_idx(struct i40iw_sc_cqp *cqp, ++ u64 scratch, u32 *wqe_idx) + { + u64 *wqe = NULL; +- u32 wqe_idx; + enum i40iw_status_code ret_code; + + if (I40IW_RING_FULL_ERR(cqp->sq_ring)) { +@@ -609,21 +610,33 @@ u64 *i40iw_sc_cqp_get_next_send_wqe(stru + cqp->sq_ring.size); + return NULL; + } +- I40IW_ATOMIC_RING_MOVE_HEAD(cqp->sq_ring, wqe_idx, ret_code); ++ I40IW_ATOMIC_RING_MOVE_HEAD(cqp->sq_ring, *wqe_idx, ret_code); + cqp->dev->cqp_cmd_stats[OP_REQUESTED_COMMANDS]++; + if (ret_code) + return NULL; +- if (!wqe_idx) ++ if (!*wqe_idx) + cqp->polarity = !cqp->polarity; + +- wqe = cqp->sq_base[wqe_idx].elem; +- cqp->scratch_array[wqe_idx] = scratch; ++ wqe = cqp->sq_base[*wqe_idx].elem; ++ cqp->scratch_array[*wqe_idx] = scratch; + I40IW_CQP_INIT_WQE(wqe); + + return wqe; + } + + /** ++ * i40iw_sc_cqp_get_next_send_wqe - get next wqe on cqp sq ++ * @cqp: struct for cqp hw ++ * @scratch: private data for CQP WQE ++ */ ++u64 *i40iw_sc_cqp_get_next_send_wqe(struct i40iw_sc_cqp *cqp, u64 scratch) ++{ ++ u32 wqe_idx; ++ ++ return i40iw_sc_cqp_get_next_send_wqe_idx(cqp, scratch, &wqe_idx); ++} ++ ++/** + * i40iw_sc_cqp_destroy - destroy cqp during close + * @cqp: struct for cqp hw + */ +@@ -3534,8 +3547,10 @@ static enum i40iw_status_code cqp_sds_wq + u64 *wqe; + int mem_entries, wqe_entries; + struct i40iw_dma_mem *sdbuf = &cqp->sdbuf; ++ u64 offset; ++ u32 wqe_idx; + +- wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch); ++ wqe = i40iw_sc_cqp_get_next_send_wqe_idx(cqp, scratch, &wqe_idx); + if (!wqe) + return I40IW_ERR_RING_FULL; + +@@ -3548,8 +3563,10 @@ static enum i40iw_status_code cqp_sds_wq + LS_64(mem_entries, I40IW_CQPSQ_UPESD_ENTRY_COUNT); + + if (mem_entries) { +- memcpy(sdbuf->va, &info->entry[3], (mem_entries << 4)); +- data = sdbuf->pa; ++ offset = wqe_idx * I40IW_UPDATE_SD_BUF_SIZE; ++ memcpy((char *)sdbuf->va + offset, &info->entry[3], ++ mem_entries << 4); ++ data = (u64)sdbuf->pa + offset; + } else { + data = 0; + } +--- a/drivers/infiniband/hw/i40iw/i40iw_d.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h +@@ -1516,7 +1516,7 @@ enum i40iw_alignment { + I40IW_AEQ_ALIGNMENT = 0x100, + I40IW_CEQ_ALIGNMENT = 0x100, + I40IW_CQ0_ALIGNMENT = 0x100, +- I40IW_SD_BUF_ALIGNMENT = 0x100 ++ I40IW_SD_BUF_ALIGNMENT = 0x80 + }; + + #define I40IW_WQE_SIZE_64 64 +@@ -1524,6 +1524,8 @@ enum i40iw_alignment { + #define I40IW_QP_WQE_MIN_SIZE 32 + #define I40IW_QP_WQE_MAX_SIZE 128 + ++#define I40IW_UPDATE_SD_BUF_SIZE 128 ++ + #define I40IW_CQE_QTYPE_RQ 0 + #define I40IW_CQE_QTYPE_SQ 1 + diff --git a/queue-4.14/i40iw-correct-arp-index-mask.patch b/queue-4.14/i40iw-correct-arp-index-mask.patch new file mode 100644 index 00000000000..46d782de13c --- /dev/null +++ b/queue-4.14/i40iw-correct-arp-index-mask.patch @@ -0,0 +1,38 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Mustafa Ismail +Date: Tue, 21 Nov 2017 16:18:32 -0600 +Subject: i40iw: Correct ARP index mask + +From: Mustafa Ismail + + +[ Upstream commit a283cdc4d3670700182c820b59078387f9a01a30 ] + +The ARP table entry indexes are aliased to 12bits +instead of the intended 16bits when uploaded to +the QP Context. This will present an issue when the +number of connections exceeds 4096 as ARP entries are +reused. Fix this by adjusting the mask to account for +the full 16bits. + +Fixes: 4e9042e647ff ("i40iw: add hw and utils files") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/i40iw/i40iw_d.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/i40iw/i40iw_d.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h +@@ -1109,7 +1109,7 @@ + #define I40IWQPC_VLANTAG_MASK (0xffffULL << I40IWQPC_VLANTAG_SHIFT) + + #define I40IWQPC_ARPIDX_SHIFT 48 +-#define I40IWQPC_ARPIDX_MASK (0xfffULL << I40IWQPC_ARPIDX_SHIFT) ++#define I40IWQPC_ARPIDX_MASK (0xffffULL << I40IWQPC_ARPIDX_SHIFT) + + #define I40IWQPC_FLOWLABEL_SHIFT 0 + #define I40IWQPC_FLOWLABEL_MASK (0xfffffUL << I40IWQPC_FLOWLABEL_SHIFT) diff --git a/queue-4.14/i40iw-do-not-free-sqbuf-when-event-is-i40iw_timer_type_close.patch b/queue-4.14/i40iw-do-not-free-sqbuf-when-event-is-i40iw_timer_type_close.patch new file mode 100644 index 00000000000..2b1473ba90b --- /dev/null +++ b/queue-4.14/i40iw-do-not-free-sqbuf-when-event-is-i40iw_timer_type_close.patch @@ -0,0 +1,52 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Mustafa Ismail +Date: Tue, 21 Nov 2017 16:18:31 -0600 +Subject: i40iw: Do not free sqbuf when event is I40IW_TIMER_TYPE_CLOSE + +From: Mustafa Ismail + + +[ Upstream commit 10499986dbd8778e1acf9f9d2e166800dfee44b4 ] + +When the event type is I40IW_TIMER_TYPE_CLOSE, there is no sqbuf and +it should not be freed as one in i40iw_schedule_cm_timer(). + +Fixes: f27b4746f378 ("i40iw: add connection management code") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/i40iw/i40iw_cm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c +@@ -1043,7 +1043,7 @@ negotiate_done: + * i40iw_schedule_cm_timer + * @@cm_node: connection's node + * @sqbuf: buffer to send +- * @type: if it es send ot close ++ * @type: if it is send or close + * @send_retrans: if rexmits to be done + * @close_when_complete: is cm_node to be removed + * +@@ -1067,7 +1067,8 @@ int i40iw_schedule_cm_timer(struct i40iw + + new_send = kzalloc(sizeof(*new_send), GFP_ATOMIC); + if (!new_send) { +- i40iw_free_sqbuf(vsi, (void *)sqbuf); ++ if (type != I40IW_TIMER_TYPE_CLOSE) ++ i40iw_free_sqbuf(vsi, (void *)sqbuf); + return -ENOMEM; + } + new_send->retrycount = I40IW_DEFAULT_RETRYS; +@@ -1082,7 +1083,6 @@ int i40iw_schedule_cm_timer(struct i40iw + new_send->timetosend += (HZ / 10); + if (cm_node->close_entry) { + kfree(new_send); +- i40iw_free_sqbuf(vsi, (void *)sqbuf); + i40iw_pr_err("already close entry\n"); + return -EINVAL; + } diff --git a/queue-4.14/ib-core-init-subsys-if-compiled-to-vmlinuz-core.patch b/queue-4.14/ib-core-init-subsys-if-compiled-to-vmlinuz-core.patch new file mode 100644 index 00000000000..6dc846f3bf9 --- /dev/null +++ b/queue-4.14/ib-core-init-subsys-if-compiled-to-vmlinuz-core.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Dmitry Monakhov +Date: Mon, 27 Nov 2017 13:39:05 +0000 +Subject: IB/core: Init subsys if compiled to vmlinuz-core + +From: Dmitry Monakhov + + +[ Upstream commit a9cd1a673737dd81332fce1145801bfacfb90d90 ] + +Once infiniband is compiled as a core component its subsystem must be +enabled before device initialization. Otherwise there is a NULL pointer +dereference during mlx4_core init, calltrace: +->device_add + if (dev->class) { + deref dev->class->p =>NULLPTR + +#Config +CONFIG_NET_DEVLINK=y +CONFIG_MAY_USE_DEVLINK=y +CONFIG_MLX4_EN=y + +Signed-off-by: Dmitry Monakhov +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -1261,5 +1261,5 @@ static void __exit ib_core_cleanup(void) + + MODULE_ALIAS_RDMA_NETLINK(RDMA_NL_LS, 4); + +-module_init(ib_core_init); ++subsys_initcall(ib_core_init); + module_exit(ib_core_cleanup); diff --git a/queue-4.14/ib-hfi1-initialize-bth1-in-16b-rc-ack-builder.patch b/queue-4.14/ib-hfi1-initialize-bth1-in-16b-rc-ack-builder.patch new file mode 100644 index 00000000000..e6ba1768973 --- /dev/null +++ b/queue-4.14/ib-hfi1-initialize-bth1-in-16b-rc-ack-builder.patch @@ -0,0 +1,36 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Dennis Dalessandro +Date: Tue, 14 Nov 2017 04:34:23 -0800 +Subject: IB/hfi1: Initialize bth1 in 16B rc ack builder + +From: Dennis Dalessandro + + +[ Upstream commit 8935780b9f7bbad0f2eb5dd43f61ba7b509a1575 ] + +It is possible the bth1 variable could be used uninitialized so going +ahead and giving it a default value. + +Otherwise we leak stack memory to the network. + +Fixes: 5b6cabb0db77 ("IB/hfi1: Add 16B RC/UC support") +Reviewed-by: Don Hiatt +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/hfi1/rc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/hfi1/rc.c ++++ b/drivers/infiniband/hw/hfi1/rc.c +@@ -815,7 +815,7 @@ static inline void hfi1_make_rc_ack_16B( + struct hfi1_pportdata *ppd = ppd_from_ibp(ibp); + struct hfi1_16b_header *hdr = &opa_hdr->opah; + struct ib_other_headers *ohdr; +- u32 bth0, bth1; ++ u32 bth0, bth1 = 0; + u16 len, pkey; + u8 becn = !!is_fecn; + u8 l4 = OPA_16B_L4_IB_LOCAL; diff --git a/queue-4.14/ib-mlx4-fix-rss-hash-fields-restrictions.patch b/queue-4.14/ib-mlx4-fix-rss-hash-fields-restrictions.patch new file mode 100644 index 00000000000..377cdc602f6 --- /dev/null +++ b/queue-4.14/ib-mlx4-fix-rss-hash-fields-restrictions.patch @@ -0,0 +1,87 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Guy Levi +Date: Tue, 5 Dec 2017 22:30:03 +0200 +Subject: IB/mlx4: Fix RSS hash fields restrictions + +From: Guy Levi + + +[ Upstream commit 4d02ebd9bbbdde1d524e62b540b0402cee7bbcdf ] + +Mistakenly the driver didn't allow RSS hash fields combinations which +involve both IPv4 and IPv6 protocols. This bug caused to failures for +user's use cases for RSS. + +Consequently, this patch fixes this bug and allows any combination that +the HW can support. + +Additionally, the patch fixes the driver to return an error in case the +user provides an unsupported mask for RSS hash fields. + +Fixes: 3078f5f1bd8b ("IB/mlx4: Add support for RSS QP") +Signed-off-by: Guy Levi +Reviewed-by: Yishai Hadas +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx4/qp.c | 26 +++++++++++++++++++------- + 1 file changed, 19 insertions(+), 7 deletions(-) + +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -666,6 +666,19 @@ static int set_qp_rss(struct mlx4_ib_dev + return (-EOPNOTSUPP); + } + ++ if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4 | ++ MLX4_IB_RX_HASH_DST_IPV4 | ++ MLX4_IB_RX_HASH_SRC_IPV6 | ++ MLX4_IB_RX_HASH_DST_IPV6 | ++ MLX4_IB_RX_HASH_SRC_PORT_TCP | ++ MLX4_IB_RX_HASH_DST_PORT_TCP | ++ MLX4_IB_RX_HASH_SRC_PORT_UDP | ++ MLX4_IB_RX_HASH_DST_PORT_UDP)) { ++ pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n", ++ ucmd->rx_hash_fields_mask); ++ return (-EOPNOTSUPP); ++ } ++ + if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_IPV4) && + (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_IPV4)) { + rss_ctx->flags = MLX4_RSS_IPV4; +@@ -691,11 +704,11 @@ static int set_qp_rss(struct mlx4_ib_dev + return (-EOPNOTSUPP); + } + +- if (rss_ctx->flags & MLX4_RSS_IPV4) { ++ if (rss_ctx->flags & MLX4_RSS_IPV4) + rss_ctx->flags |= MLX4_RSS_UDP_IPV4; +- } else if (rss_ctx->flags & MLX4_RSS_IPV6) { ++ if (rss_ctx->flags & MLX4_RSS_IPV6) + rss_ctx->flags |= MLX4_RSS_UDP_IPV6; +- } else { ++ if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) { + pr_debug("RX Hash fields_mask is not supported - UDP must be set with IPv4 or IPv6\n"); + return (-EOPNOTSUPP); + } +@@ -707,15 +720,14 @@ static int set_qp_rss(struct mlx4_ib_dev + + if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) && + (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) { +- if (rss_ctx->flags & MLX4_RSS_IPV4) { ++ if (rss_ctx->flags & MLX4_RSS_IPV4) + rss_ctx->flags |= MLX4_RSS_TCP_IPV4; +- } else if (rss_ctx->flags & MLX4_RSS_IPV6) { ++ if (rss_ctx->flags & MLX4_RSS_IPV6) + rss_ctx->flags |= MLX4_RSS_TCP_IPV6; +- } else { ++ if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) { + pr_debug("RX Hash fields_mask is not supported - TCP must be set with IPv4 or IPv6\n"); + return (-EOPNOTSUPP); + } +- + } else if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) || + (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) { + pr_debug("RX Hash fields_mask is not supported - both TCP SRC and DST must be set\n"); diff --git a/queue-4.14/iio-fix-kernel-doc-build-errors.patch b/queue-4.14/iio-fix-kernel-doc-build-errors.patch new file mode 100644 index 00000000000..8568b859104 --- /dev/null +++ b/queue-4.14/iio-fix-kernel-doc-build-errors.patch @@ -0,0 +1,45 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Randy Dunlap +Date: Sun, 29 Oct 2017 17:06:01 -0700 +Subject: iio: fix kernel-doc build errors + +From: Randy Dunlap + + +[ Upstream commit c175cb7cd953782bbf4e8bdf088ad61440d6dde5 ] + +Fix build errors in kernel-doc notation. Symbols that end in '_' +have a special meaning, but adding a '*' makes them OK. + +../drivers/iio/industrialio-core.c:635: ERROR: Unknown target name: "iio_val". +../drivers/iio/industrialio-core.c:642: ERROR: Unknown target name: "iio_val". + +Signed-off-by: Randy Dunlap +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -631,7 +631,7 @@ static ssize_t __iio_format_value(char * + * iio_format_value() - Formats a IIO value into its string representation + * @buf: The buffer to which the formatted value gets written + * which is assumed to be big enough (i.e. PAGE_SIZE). +- * @type: One of the IIO_VAL_... constants. This decides how the val ++ * @type: One of the IIO_VAL_* constants. This decides how the val + * and val2 parameters are formatted. + * @size: Number of IIO value entries contained in vals + * @vals: Pointer to the values, exact meaning depends on the +@@ -639,7 +639,7 @@ static ssize_t __iio_format_value(char * + * + * Return: 0 by default, a negative number on failure or the + * total number of characters written for a type that belongs +- * to the IIO_VAL_... constant. ++ * to the IIO_VAL_* constant. + */ + ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals) + { diff --git a/queue-4.14/iio-proximity-sx9500-assign-interrupt-from-gpioio.patch b/queue-4.14/iio-proximity-sx9500-assign-interrupt-from-gpioio.patch new file mode 100644 index 00000000000..d07d9d01e20 --- /dev/null +++ b/queue-4.14/iio-proximity-sx9500-assign-interrupt-from-gpioio.patch @@ -0,0 +1,54 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andy Shevchenko +Date: Fri, 3 Nov 2017 15:03:36 +0200 +Subject: iio: proximity: sx9500: Assign interrupt from GpioIo() + +From: Andy Shevchenko + + +[ Upstream commit e53111ad5deaef98d8c18a9933ef1f5624c5979d ] + +The commit 0f0796509c07 + +("iio: remove gpio interrupt probing from drivers that use a single interrupt") + +removed custom IRQ assignment for the drivers which are enumerated via +ACPI or OF. Unfortunately, some ACPI tables have IRQ line defined as +GpioIo() resource and thus automatic IRQ allocation will fail. + +Partially revert the commit 0f0796509c07 to restore original behaviour. + +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/proximity/sx9500.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/iio/proximity/sx9500.c ++++ b/drivers/iio/proximity/sx9500.c +@@ -871,6 +871,7 @@ static int sx9500_init_device(struct iio + static void sx9500_gpio_probe(struct i2c_client *client, + struct sx9500_data *data) + { ++ struct gpio_desc *gpiod_int; + struct device *dev; + + if (!client) +@@ -878,6 +879,14 @@ static void sx9500_gpio_probe(struct i2c + + dev = &client->dev; + ++ if (client->irq <= 0) { ++ gpiod_int = devm_gpiod_get(dev, SX9500_GPIO_INT, GPIOD_IN); ++ if (IS_ERR(gpiod_int)) ++ dev_err(dev, "gpio get irq failed\n"); ++ else ++ client->irq = gpiod_to_irq(gpiod_int); ++ } ++ + data->gpiod_rst = devm_gpiod_get(dev, SX9500_GPIO_RESET, GPIOD_OUT_HIGH); + if (IS_ERR(data->gpiod_rst)) { + dev_warn(dev, "gpio get reset pin failed\n"); diff --git a/queue-4.14/ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch b/queue-4.14/ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch new file mode 100644 index 00000000000..1768b95f7c5 --- /dev/null +++ b/queue-4.14/ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch @@ -0,0 +1,31 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Gao Feng +Date: Fri, 1 Dec 2017 09:58:42 +0800 +Subject: ipvlan: Add the skb->mark as flow4's member to lookup route + +From: Gao Feng + + +[ Upstream commit a98a4ebc8c61d20f0150d6be66e0e65223a347af ] + +Current codes don't use skb->mark to assign flowi4_mark, it would +make the policy route rule with fwmark doesn't work as expected. + +Signed-off-by: Gao Feng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ipvlan/ipvlan_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -375,6 +375,7 @@ static int ipvlan_process_v4_outbound(st + .flowi4_oif = dev->ifindex, + .flowi4_tos = RT_TOS(ip4h->tos), + .flowi4_flags = FLOWI_FLAG_ANYSRC, ++ .flowi4_mark = skb->mark, + .daddr = ip4h->daddr, + .saddr = ip4h->saddr, + }; diff --git a/queue-4.14/kvm-arm-arm64-fix-spinlock-acquisition-in-vgic_set_owner.patch b/queue-4.14/kvm-arm-arm64-fix-spinlock-acquisition-in-vgic_set_owner.patch new file mode 100644 index 00000000000..4622eebc3f4 --- /dev/null +++ b/queue-4.14/kvm-arm-arm64-fix-spinlock-acquisition-in-vgic_set_owner.patch @@ -0,0 +1,53 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Marc Zyngier +Date: Thu, 30 Nov 2017 17:00:30 +0000 +Subject: KVM: arm/arm64: Fix spinlock acquisition in vgic_set_owner + +From: Marc Zyngier + + +[ Upstream commit 7465894e90e5a47e0e52aa5f1f708653fc40020f ] + +vgic_set_owner acquires the irq lock without disabling interrupts, +resulting in a lockdep splat (an interrupt could fire and result +in the same lock being taken if the same virtual irq is to be +injected). + +In practice, it is almost impossible to trigger this bug, but +better safe than sorry. Convert the lock acquisition to a +spin_lock_irqsave() and keep lockdep happy. + +Reported-by: James Morse +Signed-off-by: Marc Zyngier +Signed-off-by: Christoffer Dall +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + virt/kvm/arm/vgic/vgic.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/virt/kvm/arm/vgic/vgic.c ++++ b/virt/kvm/arm/vgic/vgic.c +@@ -454,6 +454,7 @@ int kvm_vgic_unmap_phys_irq(struct kvm_v + int kvm_vgic_set_owner(struct kvm_vcpu *vcpu, unsigned int intid, void *owner) + { + struct vgic_irq *irq; ++ unsigned long flags; + int ret = 0; + + if (!vgic_initialized(vcpu->kvm)) +@@ -464,12 +465,12 @@ int kvm_vgic_set_owner(struct kvm_vcpu * + return -EINVAL; + + irq = vgic_get_irq(vcpu->kvm, vcpu, intid); +- spin_lock(&irq->irq_lock); ++ spin_lock_irqsave(&irq->irq_lock, flags); + if (irq->owner && irq->owner != owner) + ret = -EEXIST; + else + irq->owner = owner; +- spin_unlock(&irq->irq_lock); ++ spin_unlock_irqrestore(&irq->irq_lock, flags); + + return ret; + } diff --git a/queue-4.14/kvm-arm-don-t-treat-unavailable-hyp-mode-as-an-error.patch b/queue-4.14/kvm-arm-don-t-treat-unavailable-hyp-mode-as-an-error.patch new file mode 100644 index 00000000000..d48dea87b2f --- /dev/null +++ b/queue-4.14/kvm-arm-don-t-treat-unavailable-hyp-mode-as-an-error.patch @@ -0,0 +1,37 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Ard Biesheuvel +Date: Tue, 28 Nov 2017 15:18:19 +0000 +Subject: kvm: arm: don't treat unavailable HYP mode as an error + +From: Ard Biesheuvel + + +[ Upstream commit 58d0d19a204604ca0da26058828a53558b265da3 ] + +Since it is perfectly legal to run the kernel at EL1, it is not +actually an error if HYP mode is not available when attempting to +initialize KVM, given that KVM support cannot be built as a module. +So demote the kvm_err() to kvm_info(), which prevents the error from +appearing on an otherwise 'quiet' console. + +Acked-by: Marc Zyngier +Acked-by: Christoffer Dall +Signed-off-by: Ard Biesheuvel +Signed-off-by: Christoffer Dall +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + virt/kvm/arm/arm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/virt/kvm/arm/arm.c ++++ b/virt/kvm/arm/arm.c +@@ -1453,7 +1453,7 @@ int kvm_arch_init(void *opaque) + bool in_hyp_mode; + + if (!is_hyp_mode_available()) { +- kvm_err("HYP mode not available\n"); ++ kvm_info("HYP mode not available\n"); + return -ENODEV; + } + diff --git a/queue-4.14/kvm-vmx-fix-page-leak-in-hardware_setup.patch b/queue-4.14/kvm-vmx-fix-page-leak-in-hardware_setup.patch new file mode 100644 index 00000000000..416c581ab12 --- /dev/null +++ b/queue-4.14/kvm-vmx-fix-page-leak-in-hardware_setup.patch @@ -0,0 +1,33 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Jim Mattson +Date: Fri, 1 Dec 2017 09:57:56 -0800 +Subject: KVM: VMX: fix page leak in hardware_setup() + +From: Jim Mattson + + +[ Upstream commit 2895db67b01cb875457c9c3f30a14723b6b5dfd5 ] + +vmx_io_bitmap_b should not be allocated twice. + +Fixes: 23611332938d ("KVM: VMX: refactor setup of global page-sized bitmaps") +Signed-off-by: Jim Mattson +Reviewed-by: Krish Sadhukhan +Reviewed-by: David Hildenbrand +Signed-off-by: Radim Krčmář +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/vmx.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -6950,7 +6950,6 @@ static __init int hardware_setup(void) + goto out; + } + +- vmx_io_bitmap_b = (unsigned long *)__get_free_page(GFP_KERNEL); + memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE); + memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE); + diff --git a/queue-4.14/locking-lockdep-fix-possible-null-deref.patch b/queue-4.14/locking-lockdep-fix-possible-null-deref.patch new file mode 100644 index 00000000000..aae3c89bca0 --- /dev/null +++ b/queue-4.14/locking-lockdep-fix-possible-null-deref.patch @@ -0,0 +1,38 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Peter Zijlstra +Date: Wed, 6 Dec 2017 17:32:47 +0100 +Subject: locking/lockdep: Fix possible NULL deref + +From: Peter Zijlstra + + +[ Upstream commit 5e351ad106997e06b2dc3da9c6b939b95f67fb88 ] + +We can't invalidate xhlocks when we've not yet allocated any. + +Reported-by: Dmitry Vyukov +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-kernel@vger.kernel.org +Fixes: f52be5708076 ("locking/lockdep: Untangle xhlock history save/restore from task independence") +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/lockdep.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -4777,7 +4777,8 @@ void lockdep_invariant_state(bool force) + * Verify the former, enforce the latter. + */ + WARN_ON_ONCE(!force && current->lockdep_depth); +- invalidate_xhlock(&xhlock(current->xhlock_idx)); ++ if (current->xhlocks) ++ invalidate_xhlock(&xhlock(current->xhlock_idx)); + } + + static int cross_lock(struct lockdep_map *lock) diff --git a/queue-4.14/m68k-add-missing-softirqentry_text-linker-section.patch b/queue-4.14/m68k-add-missing-softirqentry_text-linker-section.patch new file mode 100644 index 00000000000..f8950520bab --- /dev/null +++ b/queue-4.14/m68k-add-missing-softirqentry_text-linker-section.patch @@ -0,0 +1,72 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Greg Ungerer +Date: Tue, 14 Nov 2017 11:50:07 +1000 +Subject: m68k: add missing SOFTIRQENTRY_TEXT linker section + +From: Greg Ungerer + + +[ Upstream commit 969de0988b77e5a57aac2f7270191a3c50540c52 ] + +Commit be7635e7287e ("arch, ftrace: for KASAN put hard/soft IRQ entries +into separate sections") added a new linker section, SOFTIRQENTRY_TEXT, +to the linker scripts for most architectures. It didn't add it to any of +the linker scripts for the m68k architecture. This was not really a problem +because it is only defined if either of CONFIG_FUNCTION_GRAPH_TRACER or +CONFIG_KASAN are enabled - which can never be true for m68k. + +However commit 229a71860547 ("irq: Make the irqentry text section +unconditional") means that SOFTIRQENTRY_TEXT is now always defined. So on +m68k we now end up with a separate ELF section for .softirqentry.text +instead of it being part of the .text section. On some m68k targets in some +configurations this can also cause a fatal link error: + + LD vmlinux +/usr/local/bin/../m68k-uclinux/bin/ld.real: section .softirqentry.text loaded at [0000000010de10c0,0000000010de12dd] overlaps section .rodata loaded at [0000000010de10c0,0000000010e0fd67] + +To fix add in the missing SOFTIRQENTRY_TEXT section into the m68k linker +scripts. I noticed that m68k is also missing the IRQENTRY_TEXT section, +so this patch also adds an entry for that too. + +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/m68k/kernel/vmlinux-nommu.lds | 2 ++ + arch/m68k/kernel/vmlinux-std.lds | 2 ++ + arch/m68k/kernel/vmlinux-sun3.lds | 2 ++ + 3 files changed, 6 insertions(+) + +--- a/arch/m68k/kernel/vmlinux-nommu.lds ++++ b/arch/m68k/kernel/vmlinux-nommu.lds +@@ -45,6 +45,8 @@ SECTIONS { + .text : { + HEAD_TEXT + TEXT_TEXT ++ IRQENTRY_TEXT ++ SOFTIRQENTRY_TEXT + SCHED_TEXT + CPUIDLE_TEXT + LOCK_TEXT +--- a/arch/m68k/kernel/vmlinux-std.lds ++++ b/arch/m68k/kernel/vmlinux-std.lds +@@ -16,6 +16,8 @@ SECTIONS + .text : { + HEAD_TEXT + TEXT_TEXT ++ IRQENTRY_TEXT ++ SOFTIRQENTRY_TEXT + SCHED_TEXT + CPUIDLE_TEXT + LOCK_TEXT +--- a/arch/m68k/kernel/vmlinux-sun3.lds ++++ b/arch/m68k/kernel/vmlinux-sun3.lds +@@ -16,6 +16,8 @@ SECTIONS + .text : { + HEAD_TEXT + TEXT_TEXT ++ IRQENTRY_TEXT ++ SOFTIRQENTRY_TEXT + SCHED_TEXT + CPUIDLE_TEXT + LOCK_TEXT diff --git a/queue-4.14/md-raid1-10-add-missed-blk-plug.patch b/queue-4.14/md-raid1-10-add-missed-blk-plug.patch new file mode 100644 index 00000000000..3122151baee --- /dev/null +++ b/queue-4.14/md-raid1-10-add-missed-blk-plug.patch @@ -0,0 +1,63 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Shaohua Li +Date: Fri, 1 Dec 2017 12:12:34 -0800 +Subject: md/raid1/10: add missed blk plug + +From: Shaohua Li + + +[ Upstream commit 18022a1bd3709b74ca31ef0b28fccd52bcd6c504 ] + +flush_pending_writes isn't always called with block plug, so add it, and plug +works in nested way. + +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid1.c | 4 ++++ + drivers/md/raid10.c | 4 ++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -810,11 +810,15 @@ static void flush_pending_writes(struct + spin_lock_irq(&conf->device_lock); + + if (conf->pending_bio_list.head) { ++ struct blk_plug plug; + struct bio *bio; ++ + bio = bio_list_get(&conf->pending_bio_list); + conf->pending_count = 0; + spin_unlock_irq(&conf->device_lock); ++ blk_start_plug(&plug); + flush_bio_list(conf, bio); ++ blk_finish_plug(&plug); + } else + spin_unlock_irq(&conf->device_lock); + } +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -890,10 +890,13 @@ static void flush_pending_writes(struct + spin_lock_irq(&conf->device_lock); + + if (conf->pending_bio_list.head) { ++ struct blk_plug plug; + struct bio *bio; ++ + bio = bio_list_get(&conf->pending_bio_list); + conf->pending_count = 0; + spin_unlock_irq(&conf->device_lock); ++ blk_start_plug(&plug); + /* flush any pending bitmap writes to disk + * before proceeding w/ I/O */ + bitmap_unplug(conf->mddev->bitmap); +@@ -914,6 +917,7 @@ static void flush_pending_writes(struct + generic_make_request(bio); + bio = next; + } ++ blk_finish_plug(&plug); + } else + spin_unlock_irq(&conf->device_lock); + } diff --git a/queue-4.14/md-raid5-correct-degraded-calculation-in-raid5_error.patch b/queue-4.14/md-raid5-correct-degraded-calculation-in-raid5_error.patch new file mode 100644 index 00000000000..0abba88812b --- /dev/null +++ b/queue-4.14/md-raid5-correct-degraded-calculation-in-raid5_error.patch @@ -0,0 +1,52 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: bingjingc +Date: Fri, 17 Nov 2017 10:57:44 +0800 +Subject: md/raid5: correct degraded calculation in raid5_error + +From: bingjingc + + +[ Upstream commit aff69d89bdebc39235cddb4445371eb979b49685 ] + +When disk failure occurs on new disks for reshape, mddev->degraded +is not calculated correctly. Faulty bit of the failure device is not +set before raid5_calc_degraded(conf). + +mdadm --create /dev/md0 --level=5 --raid-devices=3 /dev/loop[012] +mdadm /dev/md0 -a /dev/loop3 +mdadm /dev/md0 --grow -n4 +mdadm /dev/md0 -f /dev/loop3 # simulating disk failure + +cat /sys/block/md0/md/degraded # it outputs 0, but it should be 1. + +However, mdadm -D /dev/md0 will show that it is degraded. It's a bug. +It can be fixed by moving the resources raid5_calc_degraded() depends +on before it. + +Reported-by: Roy Chung +Reviewed-by: Alex Wu +Signed-off-by: BingJing Chang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2678,13 +2678,13 @@ static void raid5_error(struct mddev *md + pr_debug("raid456: error called\n"); + + spin_lock_irqsave(&conf->device_lock, flags); ++ set_bit(Faulty, &rdev->flags); + clear_bit(In_sync, &rdev->flags); + mddev->degraded = raid5_calc_degraded(conf); + spin_unlock_irqrestore(&conf->device_lock, flags); + set_bit(MD_RECOVERY_INTR, &mddev->recovery); + + set_bit(Blocked, &rdev->flags); +- set_bit(Faulty, &rdev->flags); + set_mask_bits(&mddev->sb_flags, 0, + BIT(MD_SB_CHANGE_DEVS) | BIT(MD_SB_CHANGE_PENDING)); + pr_crit("md/raid:%s: Disk failure on %s, disabling device.\n" diff --git a/queue-4.14/media-ov13858-select-v4l2_fwnode.patch b/queue-4.14/media-ov13858-select-v4l2_fwnode.patch new file mode 100644 index 00000000000..92cc080c86e --- /dev/null +++ b/queue-4.14/media-ov13858-select-v4l2_fwnode.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Sakari Ailus +Date: Sun, 5 Nov 2017 17:51:00 -0500 +Subject: media: ov13858: Select V4L2_FWNODE + +From: Sakari Ailus + + +[ Upstream commit fce8ba670b7418319da14a6fc6668db1f1a96267 ] + +The ov13858 driver depends on the V4L2 fwnode, thus add that to Kconfig. + +Fixes: 5fcf092e0c9f ("[media] ov13858: add support for OV13858 sensor") + +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/i2c/Kconfig ++++ b/drivers/media/i2c/Kconfig +@@ -660,6 +660,7 @@ config VIDEO_OV13858 + tristate "OmniVision OV13858 sensor support" + depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API + depends on MEDIA_CAMERA_SUPPORT ++ select V4L2_FWNODE + ---help--- + This is a Video4Linux2 sensor-level driver for the OmniVision + OV13858 camera. diff --git a/queue-4.14/media-s5k6aa-describe-some-function-parameters.patch b/queue-4.14/media-s5k6aa-describe-some-function-parameters.patch new file mode 100644 index 00000000000..9f64bee1029 --- /dev/null +++ b/queue-4.14/media-s5k6aa-describe-some-function-parameters.patch @@ -0,0 +1,59 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Mauro Carvalho Chehab +Date: Wed, 29 Nov 2017 08:44:41 -0500 +Subject: media: s5k6aa: describe some function parameters + +From: Mauro Carvalho Chehab + + +[ Upstream commit 070250a1715cee2297de0d9e7e2cea58be999d37 ] + +as warned: + drivers/media/i2c/s5k6aa.c:429: warning: No description found for parameter 's5k6aa' + drivers/media/i2c/s5k6aa.c:679: warning: No description found for parameter 's5k6aa' + drivers/media/i2c/s5k6aa.c:733: warning: No description found for parameter 's5k6aa' + drivers/media/i2c/s5k6aa.c:733: warning: No description found for parameter 'preset' + drivers/media/i2c/s5k6aa.c:787: warning: No description found for parameter 'sd' + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/s5k6aa.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/media/i2c/s5k6aa.c ++++ b/drivers/media/i2c/s5k6aa.c +@@ -421,6 +421,7 @@ static int s5k6aa_set_ahb_address(struct + + /** + * s5k6aa_configure_pixel_clock - apply ISP main clock/PLL configuration ++ * @s5k6aa: pointer to &struct s5k6aa describing the device + * + * Configure the internal ISP PLL for the required output frequency. + * Locking: called with s5k6aa.lock mutex held. +@@ -669,6 +670,7 @@ static int s5k6aa_set_input_params(struc + + /** + * s5k6aa_configure_video_bus - configure the video output interface ++ * @s5k6aa: pointer to &struct s5k6aa describing the device + * @bus_type: video bus type: parallel or MIPI-CSI + * @nlanes: number of MIPI lanes to be used (MIPI-CSI only) + * +@@ -724,6 +726,8 @@ static int s5k6aa_new_config_sync(struct + + /** + * s5k6aa_set_prev_config - write user preview register set ++ * @s5k6aa: pointer to &struct s5k6aa describing the device ++ * @preset: s5kaa preset to be applied + * + * Configure output resolution and color fromat, pixel clock + * frequency range, device frame rate type and frame period range. +@@ -777,6 +781,7 @@ static int s5k6aa_set_prev_config(struct + + /** + * s5k6aa_initialize_isp - basic ISP MCU initialization ++ * @sd: pointer to V4L2 sub-device descriptor + * + * Configure AHB addresses for registers read/write; configure PLLs for + * required output pixel clock. The ISP power supply needs to be already diff --git a/queue-4.14/meson-gx-socinfo-fix-package-id-parsing.patch b/queue-4.14/meson-gx-socinfo-fix-package-id-parsing.patch new file mode 100644 index 00000000000..b10124a7877 --- /dev/null +++ b/queue-4.14/meson-gx-socinfo-fix-package-id-parsing.patch @@ -0,0 +1,52 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Arnaud Patard +Date: Wed, 29 Nov 2017 16:09:46 +0100 +Subject: meson-gx-socinfo: Fix package id parsing + +From: Arnaud Patard + + +[ Upstream commit 044d71bc6cdee8980d0fdc35ec79a0d5818b2ce3 ] + +I've noticed the following message while booting a S905X based board: + +soc soc0: Amlogic Meson GXL (S905D) Revision 21:82 (b:2) Detected + +The S905D string is obviously wrong. The vendor code does: +... + ver = (readl(assist_hw_rev) >> 8) & 0xff; + meson_cpu_version[MESON_CPU_VERSION_LVL_MINOR] = ver; + ver = (readl(assist_hw_rev) >> 16) & 0xff; + meson_cpu_version[MESON_CPU_VERSION_LVL_PACK] = ver; +... + +while the current code does: +... +... + +This means that the current mainline code has package id and minor +version reversed. + +Fixes: a9daaba2965e8 ("soc: Add Amlogic SoC Information driver") +Signed-off-by: Arnaud Patard +Acked-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/amlogic/meson-gx-socinfo.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/soc/amlogic/meson-gx-socinfo.c ++++ b/drivers/soc/amlogic/meson-gx-socinfo.c +@@ -20,8 +20,8 @@ + #define AO_SEC_SOCINFO_OFFSET AO_SEC_SD_CFG8 + + #define SOCINFO_MAJOR GENMASK(31, 24) +-#define SOCINFO_MINOR GENMASK(23, 16) +-#define SOCINFO_PACK GENMASK(15, 8) ++#define SOCINFO_PACK GENMASK(23, 16) ++#define SOCINFO_MINOR GENMASK(15, 8) + #define SOCINFO_MISC GENMASK(7, 0) + + static const struct meson_gx_soc_id { diff --git a/queue-4.14/mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch b/queue-4.14/mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch new file mode 100644 index 00000000000..ab294e37d18 --- /dev/null +++ b/queue-4.14/mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch @@ -0,0 +1,48 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Dave Young +Date: Sat, 9 Dec 2017 12:16:10 +0800 +Subject: mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep + +From: Dave Young + + +[ Upstream commit 7f6f60a1ba52538c16f26930bfbcfe193d9d746a ] + +earlyprintk=efi,keep does not work any more with a warning +in mm/early_ioremap.c: WARN_ON(system_state != SYSTEM_BOOTING): +Boot just hangs because of the earlyprintk within the earlyprintk +implementation code itself. + +This is caused by a new introduced middle state in: + + 69a78ff226fe ("init: Introduce SYSTEM_SCHEDULING state") + +early_ioremap() is fine in both SYSTEM_BOOTING and SYSTEM_SCHEDULING +states, original condition should be updated accordingly. + +Signed-off-by: Dave Young +Acked-by: Thomas Gleixner +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: bp@suse.de +Cc: linux-efi@vger.kernel.org +Cc: linux-mm@kvack.org +Link: http://lkml.kernel.org/r/20171209041610.GA3249@dhcp-128-65.nay.redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/early_ioremap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/early_ioremap.c ++++ b/mm/early_ioremap.c +@@ -111,7 +111,7 @@ __early_ioremap(resource_size_t phys_add + enum fixed_addresses idx; + int i, slot; + +- WARN_ON(system_state != SYSTEM_BOOTING); ++ WARN_ON(system_state >= SYSTEM_RUNNING); + + slot = -1; + for (i = 0; i < FIX_BTMAPS_SLOTS; i++) { diff --git a/queue-4.14/net-dsa-mv88e6xxx-fix-interrupt-masking-on-removal.patch b/queue-4.14/net-dsa-mv88e6xxx-fix-interrupt-masking-on-removal.patch new file mode 100644 index 00000000000..2da3454da9e --- /dev/null +++ b/queue-4.14/net-dsa-mv88e6xxx-fix-interrupt-masking-on-removal.patch @@ -0,0 +1,50 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andrew Lunn +Date: Thu, 7 Dec 2017 01:05:56 +0100 +Subject: net: dsa: mv88e6xxx: Fix interrupt masking on removal + +From: Andrew Lunn + + +[ Upstream commit 3d5fdba1842bdd2eef29364c660558cb4cbb3fe0 ] + +When removing the interrupt handling code, we should mask the +generation of interrupts. The code however unmasked all +interrupts. This can then cause a new interrupt. We then get into a +deadlock where the interrupt thread is waiting to run, and the code +continues, trying to remove the interrupt handler, which means waiting +for the thread to complete. On a UP machine this deadlocks. + +Fix so we really mask interrupts in the hardware. The same error is +made in the error path when install the interrupt handling code. + +Fixes: 3460a5770ce9 ("net: dsa: mv88e6xxx: Mask g1 interrupts and free interrupt") +Signed-off-by: Andrew Lunn +Reviewed-by: Vivien Didelot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mv88e6xxx/chip.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -339,7 +339,7 @@ static void mv88e6xxx_g1_irq_free(struct + u16 mask; + + mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &mask); +- mask |= GENMASK(chip->g1_irq.nirqs, 0); ++ mask &= ~GENMASK(chip->g1_irq.nirqs, 0); + mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask); + + free_irq(chip->irq, chip); +@@ -395,7 +395,7 @@ static int mv88e6xxx_g1_irq_setup(struct + return 0; + + out_disable: +- mask |= GENMASK(chip->g1_irq.nirqs, 0); ++ mask &= ~GENMASK(chip->g1_irq.nirqs, 0); + mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask); + + out_mapping: diff --git a/queue-4.14/net-dsa-mv88e6xxx-unregister-mdio-bus-on-error-path.patch b/queue-4.14/net-dsa-mv88e6xxx-unregister-mdio-bus-on-error-path.patch new file mode 100644 index 00000000000..b9be89b4ca5 --- /dev/null +++ b/queue-4.14/net-dsa-mv88e6xxx-unregister-mdio-bus-on-error-path.patch @@ -0,0 +1,79 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andrew Lunn +Date: Thu, 7 Dec 2017 01:05:57 +0100 +Subject: net: dsa: mv88e6xxx: Unregister MDIO bus on error path + +From: Andrew Lunn + + +[ Upstream commit 3126aeec5313565bfa19e2dd8fd7e3c3390514cb ] + +The MDIO busses need to be unregistered before they are freed, +otherwise BUG() is called. Add a call to the unregister code if the +registration fails, since we can have multiple busses, of which some +may correctly register before one fails. This requires moving the code +around a little. + +Fixes: a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") +Signed-off-by: Andrew Lunn +Reviewed-by: Vivien Didelot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mv88e6xxx/chip.c | 30 ++++++++++++++++-------------- + 1 file changed, 16 insertions(+), 14 deletions(-) + +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2153,6 +2153,19 @@ static const struct of_device_id mv88e6x + { }, + }; + ++static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip) ++ ++{ ++ struct mv88e6xxx_mdio_bus *mdio_bus; ++ struct mii_bus *bus; ++ ++ list_for_each_entry(mdio_bus, &chip->mdios, list) { ++ bus = mdio_bus->bus; ++ ++ mdiobus_unregister(bus); ++ } ++} ++ + static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip, + struct device_node *np) + { +@@ -2177,27 +2190,16 @@ static int mv88e6xxx_mdios_register(stru + match = of_match_node(mv88e6xxx_mdio_external_match, child); + if (match) { + err = mv88e6xxx_mdio_register(chip, child, true); +- if (err) ++ if (err) { ++ mv88e6xxx_mdios_unregister(chip); + return err; ++ } + } + } + + return 0; + } + +-static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip) +- +-{ +- struct mv88e6xxx_mdio_bus *mdio_bus; +- struct mii_bus *bus; +- +- list_for_each_entry(mdio_bus, &chip->mdios, list) { +- bus = mdio_bus->bus; +- +- mdiobus_unregister(bus); +- } +-} +- + static int mv88e6xxx_get_eeprom_len(struct dsa_switch *ds) + { + struct mv88e6xxx_chip *chip = ds->priv; diff --git a/queue-4.14/net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch b/queue-4.14/net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch new file mode 100644 index 00000000000..9edc638af97 --- /dev/null +++ b/queue-4.14/net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch @@ -0,0 +1,46 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Branislav Radocaj +Date: Thu, 7 Dec 2017 00:07:38 +0100 +Subject: net: ethernet: arc: fix error handling in emac_rockchip_probe + +From: Branislav Radocaj + + +[ Upstream commit e46772a6946a7d1f3fbbc1415871851d6651f1d4 ] + +If clk_set_rate() fails, we should disable clk before return. +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Branislav Radocaj +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/arc/emac_rockchip.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/arc/emac_rockchip.c ++++ b/drivers/net/ethernet/arc/emac_rockchip.c +@@ -220,9 +220,11 @@ static int emac_rockchip_probe(struct pl + + /* RMII TX/RX needs always a rate of 25MHz */ + err = clk_set_rate(priv->macclk, 25000000); +- if (err) ++ if (err) { + dev_err(dev, + "failed to change mac clock rate (%d)\n", err); ++ goto out_clk_disable_macclk; ++ } + } + + err = arc_emac_probe(ndev, interface); +@@ -232,7 +234,8 @@ static int emac_rockchip_probe(struct pl + } + + return 0; +- ++out_clk_disable_macclk: ++ clk_disable_unprepare(priv->macclk); + out_regulator_disable: + if (priv->regulator) + regulator_disable(priv->regulator); diff --git a/queue-4.14/net-mvpp2-allocate-zeroed-tx-descriptors.patch b/queue-4.14/net-mvpp2-allocate-zeroed-tx-descriptors.patch new file mode 100644 index 00000000000..3511fbde3be --- /dev/null +++ b/queue-4.14/net-mvpp2-allocate-zeroed-tx-descriptors.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Yan Markman +Date: Thu, 30 Nov 2017 10:49:46 +0100 +Subject: net: mvpp2: allocate zeroed tx descriptors + +From: Yan Markman + + +[ Upstream commit a154f8e399a063137fc42b961f437248d55ece29 ] + +Reserved and unused fields in the Tx descriptors should be 0. The PPv2 +driver doesn't clear them at run-time (for performance reasons) but +these descriptors aren't zeroed when allocated, which can lead to +unpredictable behaviors. This patch fixes this by using +dma_zalloc_coherent instead of dma_alloc_coherent. + +Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") +Signed-off-by: Yan Markman +[Antoine: commit message] +Signed-off-by: Antoine Tenart +Signed-off-by: David S. Miller + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -5399,7 +5399,7 @@ static int mvpp2_aggr_txq_init(struct pl + u32 txq_dma; + + /* Allocate memory for TX descriptors */ +- aggr_txq->descs = dma_alloc_coherent(&pdev->dev, ++ aggr_txq->descs = dma_zalloc_coherent(&pdev->dev, + MVPP2_AGGR_TXQ_SIZE * MVPP2_DESC_ALIGNED_SIZE, + &aggr_txq->descs_dma, GFP_KERNEL); + if (!aggr_txq->descs) diff --git a/queue-4.14/net-qualcomm-rmnet-fix-leak-on-transmit-failure.patch b/queue-4.14/net-qualcomm-rmnet-fix-leak-on-transmit-failure.patch new file mode 100644 index 00000000000..5713c23c8ff --- /dev/null +++ b/queue-4.14/net-qualcomm-rmnet-fix-leak-on-transmit-failure.patch @@ -0,0 +1,50 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Subash Abhinov Kasiviswanathan +Date: Tue, 5 Dec 2017 13:41:17 -0700 +Subject: net: qualcomm: rmnet: Fix leak on transmit failure + +From: Subash Abhinov Kasiviswanathan + + +[ Upstream commit c20a548792f15f8d8e38cd74356301c6db0d241f ] + +If a skb in transmit path does not have sufficient headroom to add +the map header, the skb is not sent out and is never freed. + +Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") +Signed-off-by: Subash Abhinov Kasiviswanathan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c ++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c +@@ -166,12 +166,12 @@ static int rmnet_map_egress_handler(stru + + if (skb_headroom(skb) < required_headroom) { + if (pskb_expand_head(skb, required_headroom, 0, GFP_KERNEL)) +- return RMNET_MAP_CONSUMED; ++ goto fail; + } + + map_header = rmnet_map_add_map_header(skb, additional_header_len, 0); + if (!map_header) +- return RMNET_MAP_CONSUMED; ++ goto fail; + + if (port->egress_data_format & RMNET_EGRESS_FORMAT_MUXING) { + if (ep->mux_id == 0xff) +@@ -183,6 +183,10 @@ static int rmnet_map_egress_handler(stru + skb->protocol = htons(ETH_P_MAP); + + return RMNET_MAP_SUCCESS; ++ ++fail: ++ kfree_skb(skb); ++ return RMNET_MAP_CONSUMED; + } + + /* Ingress / Egress Entry Points */ diff --git a/queue-4.14/net_sched-red-avoid-devision-by-zero.patch b/queue-4.14/net_sched-red-avoid-devision-by-zero.patch new file mode 100644 index 00000000000..f095e6f88bc --- /dev/null +++ b/queue-4.14/net_sched-red-avoid-devision-by-zero.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Nogah Frankel +Date: Mon, 4 Dec 2017 13:31:10 +0200 +Subject: net_sched: red: Avoid devision by zero + +From: Nogah Frankel + + +[ Upstream commit 5c472203421ab4f928aa1ae9e1dbcfdd80324148 ] + +Do not allow delta value to be zero since it is used as a divisor. + +Fixes: 8af2a218de38 ("sch_red: Adaptative RED AQM") +Signed-off-by: Nogah Frankel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/red.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -179,7 +179,7 @@ static inline void red_set_parms(struct + p->qth_max = qth_max << Wlog; + p->Wlog = Wlog; + p->Plog = Plog; +- if (delta < 0) ++ if (delta <= 0) + delta = 1; + p->qth_delta = delta; + if (!max_P) { diff --git a/queue-4.14/net_sched-red-avoid-illegal-values.patch b/queue-4.14/net_sched-red-avoid-illegal-values.patch new file mode 100644 index 00000000000..1c0b60d25d6 --- /dev/null +++ b/queue-4.14/net_sched-red-avoid-illegal-values.patch @@ -0,0 +1,93 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Nogah Frankel +Date: Mon, 4 Dec 2017 13:31:11 +0200 +Subject: net_sched: red: Avoid illegal values + +From: Nogah Frankel + + +[ Upstream commit 8afa10cbe281b10371fee5a87ab266e48d71a7f9 ] + +Check the qmin & qmax values doesn't overflow for the given Wlog value. +Check that qmin <= qmax. + +Fixes: a783474591f2 ("[PKT_SCHED]: Generic RED layer") +Signed-off-by: Nogah Frankel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/red.h | 11 +++++++++++ + net/sched/sch_choke.c | 3 +++ + net/sched/sch_gred.c | 3 +++ + net/sched/sch_red.c | 2 ++ + net/sched/sch_sfq.c | 3 +++ + 5 files changed, 22 insertions(+) + +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -168,6 +168,17 @@ static inline void red_set_vars(struct r + v->qcount = -1; + } + ++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog) ++{ ++ if (fls(qth_min) + Wlog > 32) ++ return false; ++ if (fls(qth_max) + Wlog > 32) ++ return false; ++ if (qth_max < qth_min) ++ return false; ++ return true; ++} ++ + static inline void red_set_parms(struct red_parms *p, + u32 qth_min, u32 qth_max, u8 Wlog, u8 Plog, + u8 Scell_log, u8 *stab, u32 max_P) +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -369,6 +369,9 @@ static int choke_change(struct Qdisc *sc + + ctl = nla_data(tb[TCA_CHOKE_PARMS]); + ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ return -EINVAL; ++ + if (ctl->limit > CHOKE_MAX_QUEUE) + return -EINVAL; + +--- a/net/sched/sch_gred.c ++++ b/net/sched/sch_gred.c +@@ -356,6 +356,9 @@ static inline int gred_change_vq(struct + struct gred_sched *table = qdisc_priv(sch); + struct gred_sched_data *q = table->tab[dp]; + ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ return -EINVAL; ++ + if (!q) { + table->tab[dp] = q = *prealloc; + *prealloc = NULL; +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -184,6 +184,8 @@ static int red_change(struct Qdisc *sch, + max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0; + + ctl = nla_data(tb[TCA_RED_PARMS]); ++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog)) ++ return -EINVAL; + + if (ctl->limit > 0) { + child = fifo_create_dflt(sch, &bfifo_qdisc_ops, ctl->limit); +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -637,6 +637,9 @@ static int sfq_change(struct Qdisc *sch, + if (ctl->divisor && + (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536)) + return -EINVAL; ++ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max, ++ ctl_v1->Wlog)) ++ return -EINVAL; + if (ctl_v1 && ctl_v1->qth_min) { + p = kmalloc(sizeof(*p), GFP_KERNEL); + if (!p) diff --git a/queue-4.14/netfilter-xt_bpf-add-overflow-checks.patch b/queue-4.14/netfilter-xt_bpf-add-overflow-checks.patch new file mode 100644 index 00000000000..e6bac606380 --- /dev/null +++ b/queue-4.14/netfilter-xt_bpf-add-overflow-checks.patch @@ -0,0 +1,81 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Jann Horn +Date: Fri, 1 Dec 2017 01:46:07 +0100 +Subject: netfilter: xt_bpf: add overflow checks + +From: Jann Horn + + +[ Upstream commit 6ab405114b0b229151ef06f4e31c7834dd09d0c0 ] + +Check whether inputs from userspace are too long (explicit length field too +big or string not null-terminated) to avoid out-of-bounds reads. + +As far as I can tell, this can at worst lead to very limited kernel heap +memory disclosure or oopses. + +This bug can be triggered by an unprivileged user even if the xt_bpf module +is not loaded: iptables is available in network namespaces, and the xt_bpf +module can be autoloaded. + +Triggering the bug with a classic BPF filter with fake length 0x1000 causes +the following KASAN report: + +================================================================== +BUG: KASAN: slab-out-of-bounds in bpf_prog_create+0x84/0xf0 +Read of size 32768 at addr ffff8801eff2c494 by task test/4627 + +CPU: 0 PID: 4627 Comm: test Not tainted 4.15.0-rc1+ #1 +[...] +Call Trace: + dump_stack+0x5c/0x85 + print_address_description+0x6a/0x260 + kasan_report+0x254/0x370 + ? bpf_prog_create+0x84/0xf0 + memcpy+0x1f/0x50 + bpf_prog_create+0x84/0xf0 + bpf_mt_check+0x90/0xd6 [xt_bpf] +[...] +Allocated by task 4627: + kasan_kmalloc+0xa0/0xd0 + __kmalloc_node+0x47/0x60 + xt_alloc_table_info+0x41/0x70 [x_tables] +[...] +The buggy address belongs to the object at ffff8801eff2c3c0 + which belongs to the cache kmalloc-2048 of size 2048 +The buggy address is located 212 bytes inside of + 2048-byte region [ffff8801eff2c3c0, ffff8801eff2cbc0) +[...] +================================================================== + +Fixes: e6f30c731718 ("netfilter: x_tables: add xt_bpf match") +Signed-off-by: Jann Horn +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/xt_bpf.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/netfilter/xt_bpf.c ++++ b/net/netfilter/xt_bpf.c +@@ -27,6 +27,9 @@ static int __bpf_mt_check_bytecode(struc + { + struct sock_fprog_kern program; + ++ if (len > XT_BPF_MAX_NUM_INSTR) ++ return -EINVAL; ++ + program.len = len; + program.filter = insns; + +@@ -55,6 +58,9 @@ static int __bpf_mt_check_path(const cha + mm_segment_t oldfs = get_fs(); + int retval, fd; + ++ if (strnlen(path, XT_BPF_PATH_MAX) == XT_BPF_PATH_MAX) ++ return -EINVAL; ++ + set_fs(KERNEL_DS); + fd = bpf_obj_get_user(path); + set_fs(oldfs); diff --git a/queue-4.14/nfp-fix-port-stats-for-mac-representors.patch b/queue-4.14/nfp-fix-port-stats-for-mac-representors.patch new file mode 100644 index 00000000000..842189cc8d3 --- /dev/null +++ b/queue-4.14/nfp-fix-port-stats-for-mac-representors.patch @@ -0,0 +1,51 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Pieter Jansen van Vuuren +Date: Fri, 1 Dec 2017 21:37:23 -0800 +Subject: nfp: fix port stats for mac representors + +From: Pieter Jansen van Vuuren + + +[ Upstream commit 42d779ffc186f6dd26271fc60a7417cb51aca93e ] + +Previously we swapped the tx_packets, tx_bytes and tx_dropped counters +with rx_packets, rx_bytes and rx_dropped counters, respectively. This +behaviour is correct and expected for VF representors but it should not +be swapped for physical port mac representors. + +Fixes: eadfa4c3be99 ("nfp: add stats and xmit helpers for representors") +Signed-off-by: Pieter Jansen van Vuuren +Reviewed-by: Simon Horman +Reviewed-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/netronome/nfp/nfp_net_repr.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c +@@ -84,16 +84,13 @@ nfp_repr_phy_port_get_stats64(struct nfp + { + u8 __iomem *mem = port->eth_stats; + +- /* TX and RX stats are flipped as we are returning the stats as seen +- * at the switch port corresponding to the phys port. +- */ +- stats->tx_packets = readq(mem + NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK); +- stats->tx_bytes = readq(mem + NFP_MAC_STATS_RX_IN_OCTETS); +- stats->tx_dropped = readq(mem + NFP_MAC_STATS_RX_IN_ERRORS); ++ stats->tx_packets = readq(mem + NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK); ++ stats->tx_bytes = readq(mem + NFP_MAC_STATS_TX_OUT_OCTETS); ++ stats->tx_dropped = readq(mem + NFP_MAC_STATS_TX_OUT_ERRORS); + +- stats->rx_packets = readq(mem + NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK); +- stats->rx_bytes = readq(mem + NFP_MAC_STATS_TX_OUT_OCTETS); +- stats->rx_dropped = readq(mem + NFP_MAC_STATS_TX_OUT_ERRORS); ++ stats->rx_packets = readq(mem + NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK); ++ stats->rx_bytes = readq(mem + NFP_MAC_STATS_RX_IN_OCTETS); ++ stats->rx_dropped = readq(mem + NFP_MAC_STATS_RX_IN_ERRORS); + } + + static void diff --git a/queue-4.14/pci-rcar-fix-use-after-free-in-probe-error-path.patch b/queue-4.14/pci-rcar-fix-use-after-free-in-probe-error-path.patch new file mode 100644 index 00000000000..3554ac8a21c --- /dev/null +++ b/queue-4.14/pci-rcar-fix-use-after-free-in-probe-error-path.patch @@ -0,0 +1,65 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Geert Uytterhoeven +Date: Thu, 7 Dec 2017 11:15:19 +0100 +Subject: PCI: rcar: Fix use-after-free in probe error path + +From: Geert Uytterhoeven + + +[ Upstream commit 0c31f1d7be1b5c4858b1d714dcefa25f41428cab ] + +If CONFIG_DEBUG_SLAB=y, and no PCIe card is inserted, the kernel crashes +during probe on r8a7791/koelsch: + + rcar-pcie fe000000.pcie: PCIe link down + Unable to handle kernel paging request at virtual address 6b6b6b6b + +(seeing this message requires earlycon and keep_bootcon). + +Indeed, pci_free_host_bridge() frees the PCI host bridge, including the +embedded rcar_pcie object, so pci_free_resource_list() must not be called +afterwards. + +To fix this, move the call to pci_free_resource_list() up, and update the +label name accordingly. + +Fixes: ddd535f1ea3eb27e ("PCI: rcar: Fix memory leak when no PCIe card is inserted") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Bjorn Helgaas +Acked-by: Simon Horman +Acked-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pcie-rcar.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/pci/host/pcie-rcar.c ++++ b/drivers/pci/host/pcie-rcar.c +@@ -1146,12 +1146,12 @@ static int rcar_pcie_probe(struct platfo + err = rcar_pcie_get_resources(pcie); + if (err < 0) { + dev_err(dev, "failed to request resources: %d\n", err); +- goto err_free_bridge; ++ goto err_free_resource_list; + } + + err = rcar_pcie_parse_map_dma_ranges(pcie, dev->of_node); + if (err) +- goto err_free_bridge; ++ goto err_free_resource_list; + + pm_runtime_enable(dev); + err = pm_runtime_get_sync(dev); +@@ -1194,9 +1194,9 @@ err_pm_put: + err_pm_disable: + pm_runtime_disable(dev); + +-err_free_bridge: +- pci_free_host_bridge(bridge); ++err_free_resource_list: + pci_free_resource_list(&pcie->resources); ++ pci_free_host_bridge(bridge); + + return err; + } diff --git a/queue-4.14/perf-annotate-do-not-truncate-instruction-names-at-6-chars.patch b/queue-4.14/perf-annotate-do-not-truncate-instruction-names-at-6-chars.patch new file mode 100644 index 00000000000..b24236ae88c --- /dev/null +++ b/queue-4.14/perf-annotate-do-not-truncate-instruction-names-at-6-chars.patch @@ -0,0 +1,124 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Ravi Bangoria +Date: Tue, 14 Nov 2017 08:55:40 +0530 +Subject: perf annotate: Do not truncate instruction names at 6 chars + +From: Ravi Bangoria + + +[ Upstream commit 05d0e62d9fa0f1002cf82009ef31b36174da5472 ] + +There are many instructions, esp on PowerPC, whose mnemonics are longer +than 6 characters. Using precision limit causes truncation of such +mnemonics. + +Fix this by removing precision limit. Note that, 'width' is still 6, so +alignment won't get affected for length <= 6. + +Before: + + li r11,-1 + xscvdp vs1,vs1 + add. r10,r10,r11 + +After: + + li r11,-1 + xscvdpsxds vs1,vs1 + add. r10,r10,r11 + +Reported-by: Donald Stence +Signed-off-by: Ravi Bangoria +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Taeung Song +Link: http://lkml.kernel.org/r/20171114032540.4564-1-ravi.bangoria@linux.vnet.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/annotate.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -166,7 +166,7 @@ static void ins__delete(struct ins_opera + static int ins__raw_scnprintf(struct ins *ins, char *bf, size_t size, + struct ins_operands *ops) + { +- return scnprintf(bf, size, "%-6.6s %s", ins->name, ops->raw); ++ return scnprintf(bf, size, "%-6s %s", ins->name, ops->raw); + } + + int ins__scnprintf(struct ins *ins, char *bf, size_t size, +@@ -231,12 +231,12 @@ static int call__scnprintf(struct ins *i + struct ins_operands *ops) + { + if (ops->target.name) +- return scnprintf(bf, size, "%-6.6s %s", ins->name, ops->target.name); ++ return scnprintf(bf, size, "%-6s %s", ins->name, ops->target.name); + + if (ops->target.addr == 0) + return ins__raw_scnprintf(ins, bf, size, ops); + +- return scnprintf(bf, size, "%-6.6s *%" PRIx64, ins->name, ops->target.addr); ++ return scnprintf(bf, size, "%-6s *%" PRIx64, ins->name, ops->target.addr); + } + + static struct ins_ops call_ops = { +@@ -300,7 +300,7 @@ static int jump__scnprintf(struct ins *i + c++; + } + +- return scnprintf(bf, size, "%-6.6s %.*s%" PRIx64, ++ return scnprintf(bf, size, "%-6s %.*s%" PRIx64, + ins->name, c ? c - ops->raw : 0, ops->raw, + ops->target.offset); + } +@@ -373,7 +373,7 @@ static int lock__scnprintf(struct ins *i + if (ops->locked.ins.ops == NULL) + return ins__raw_scnprintf(ins, bf, size, ops); + +- printed = scnprintf(bf, size, "%-6.6s ", ins->name); ++ printed = scnprintf(bf, size, "%-6s ", ins->name); + return printed + ins__scnprintf(&ops->locked.ins, bf + printed, + size - printed, ops->locked.ops); + } +@@ -449,7 +449,7 @@ out_free_source: + static int mov__scnprintf(struct ins *ins, char *bf, size_t size, + struct ins_operands *ops) + { +- return scnprintf(bf, size, "%-6.6s %s,%s", ins->name, ++ return scnprintf(bf, size, "%-6s %s,%s", ins->name, + ops->source.name ?: ops->source.raw, + ops->target.name ?: ops->target.raw); + } +@@ -489,7 +489,7 @@ static int dec__parse(struct arch *arch + static int dec__scnprintf(struct ins *ins, char *bf, size_t size, + struct ins_operands *ops) + { +- return scnprintf(bf, size, "%-6.6s %s", ins->name, ++ return scnprintf(bf, size, "%-6s %s", ins->name, + ops->target.name ?: ops->target.raw); + } + +@@ -501,7 +501,7 @@ static struct ins_ops dec_ops = { + static int nop__scnprintf(struct ins *ins __maybe_unused, char *bf, size_t size, + struct ins_operands *ops __maybe_unused) + { +- return scnprintf(bf, size, "%-6.6s", "nop"); ++ return scnprintf(bf, size, "%-6s", "nop"); + } + + static struct ins_ops nop_ops = { +@@ -925,7 +925,7 @@ void disasm_line__free(struct disasm_lin + int disasm_line__scnprintf(struct disasm_line *dl, char *bf, size_t size, bool raw) + { + if (raw || !dl->ins.ops) +- return scnprintf(bf, size, "%-6.6s %s", dl->ins.name, dl->ops.raw); ++ return scnprintf(bf, size, "%-6s %s", dl->ins.name, dl->ops.raw); + + return ins__scnprintf(&dl->ins, bf, size, &dl->ops); + } diff --git a/queue-4.14/perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch b/queue-4.14/perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch new file mode 100644 index 00000000000..221a4471db6 --- /dev/null +++ b/queue-4.14/perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch @@ -0,0 +1,132 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Satheesh Rajendran +Date: Wed, 22 Nov 2017 22:13:53 +0530 +Subject: perf bench numa: Fixup discontiguous/sparse numa nodes + +From: Satheesh Rajendran + + +[ Upstream commit 321a7c35c90cc834851ceda18a8ee18f1d032b92 ] + +Certain systems are designed to have sparse/discontiguous nodes. On +such systems, 'perf bench numa' hangs, shows wrong number of nodes and +shows values for non-existent nodes. Handle this by only taking nodes +that are exposed by kernel to userspace. + +Signed-off-by: Satheesh Rajendran +Reviewed-by: Srikar Dronamraju +Acked-by: Naveen N. Rao +Link: http://lkml.kernel.org/r/1edbcd353c009e109e93d78f2f46381930c340fe.1511368645.git.sathnaga@linux.vnet.ibm.com +Signed-off-by: Balamuruhan S +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/bench/numa.c | 56 +++++++++++++++++++++++++++++++++++++++++++----- + 1 file changed, 51 insertions(+), 5 deletions(-) + +--- a/tools/perf/bench/numa.c ++++ b/tools/perf/bench/numa.c +@@ -216,6 +216,47 @@ static const char * const numa_usage[] = + NULL + }; + ++/* ++ * To get number of numa nodes present. ++ */ ++static int nr_numa_nodes(void) ++{ ++ int i, nr_nodes = 0; ++ ++ for (i = 0; i < g->p.nr_nodes; i++) { ++ if (numa_bitmask_isbitset(numa_nodes_ptr, i)) ++ nr_nodes++; ++ } ++ ++ return nr_nodes; ++} ++ ++/* ++ * To check if given numa node is present. ++ */ ++static int is_node_present(int node) ++{ ++ return numa_bitmask_isbitset(numa_nodes_ptr, node); ++} ++ ++/* ++ * To check given numa node has cpus. ++ */ ++static bool node_has_cpus(int node) ++{ ++ struct bitmask *cpu = numa_allocate_cpumask(); ++ unsigned int i; ++ ++ if (cpu && !numa_node_to_cpus(node, cpu)) { ++ for (i = 0; i < cpu->size; i++) { ++ if (numa_bitmask_isbitset(cpu, i)) ++ return true; ++ } ++ } ++ ++ return false; /* lets fall back to nocpus safely */ ++} ++ + static cpu_set_t bind_to_cpu(int target_cpu) + { + cpu_set_t orig_mask, mask; +@@ -244,12 +285,12 @@ static cpu_set_t bind_to_cpu(int target_ + + static cpu_set_t bind_to_node(int target_node) + { +- int cpus_per_node = g->p.nr_cpus/g->p.nr_nodes; ++ int cpus_per_node = g->p.nr_cpus / nr_numa_nodes(); + cpu_set_t orig_mask, mask; + int cpu; + int ret; + +- BUG_ON(cpus_per_node*g->p.nr_nodes != g->p.nr_cpus); ++ BUG_ON(cpus_per_node * nr_numa_nodes() != g->p.nr_cpus); + BUG_ON(!cpus_per_node); + + ret = sched_getaffinity(0, sizeof(orig_mask), &orig_mask); +@@ -649,7 +690,7 @@ static int parse_setup_node_list(void) + int i; + + for (i = 0; i < mul; i++) { +- if (t >= g->p.nr_tasks) { ++ if (t >= g->p.nr_tasks || !node_has_cpus(bind_node)) { + printf("\n# NOTE: ignoring bind NODEs starting at NODE#%d\n", bind_node); + goto out; + } +@@ -964,6 +1005,8 @@ static void calc_convergence(double runt + sum = 0; + + for (node = 0; node < g->p.nr_nodes; node++) { ++ if (!is_node_present(node)) ++ continue; + nr = nodes[node]; + nr_min = min(nr, nr_min); + nr_max = max(nr, nr_max); +@@ -984,8 +1027,11 @@ static void calc_convergence(double runt + process_groups = 0; + + for (node = 0; node < g->p.nr_nodes; node++) { +- int processes = count_node_processes(node); ++ int processes; + ++ if (!is_node_present(node)) ++ continue; ++ processes = count_node_processes(node); + nr = nodes[node]; + tprintf(" %2d/%-2d", nr, processes); + +@@ -1291,7 +1337,7 @@ static void print_summary(void) + + printf("\n ###\n"); + printf(" # %d %s will execute (on %d nodes, %d CPUs):\n", +- g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", g->p.nr_nodes, g->p.nr_cpus); ++ g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", nr_numa_nodes(), g->p.nr_cpus); + printf(" # %5dx %5ldMB global shared mem operations\n", + g->p.nr_loops, g->p.bytes_global/1024/1024); + printf(" # %5dx %5ldMB process shared mem operations\n", diff --git a/queue-4.14/perf-fix-header.size-for-namespace-events.patch b/queue-4.14/perf-fix-header.size-for-namespace-events.patch new file mode 100644 index 00000000000..4ffbb55aaf2 --- /dev/null +++ b/queue-4.14/perf-fix-header.size-for-namespace-events.patch @@ -0,0 +1,52 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Jiri Olsa +Date: Wed, 9 Aug 2017 18:14:06 +0200 +Subject: perf: Fix header.size for namespace events + +From: Jiri Olsa + + +[ Upstream commit 34900ec5c9577cc1b0f22887ac7349f458ba8ac2 ] + +Reset header size for namespace events, otherwise it only gets bigger in +ctx iterations. + +Signed-off-by: Jiri Olsa +Acked-by: Peter Zijlstra (Intel) +Fixes: e422267322cd ("perf: Add PERF_RECORD_NAMESPACES to include namespaces related info") +Link: http://lkml.kernel.org/n/tip-nlo4gonz9d4guyb8153ukzt0@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/events/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6719,6 +6719,7 @@ static void perf_event_namespaces_output + struct perf_namespaces_event *namespaces_event = data; + struct perf_output_handle handle; + struct perf_sample_data sample; ++ u16 header_size = namespaces_event->event_id.header.size; + int ret; + + if (!perf_event_namespaces_match(event)) +@@ -6729,7 +6730,7 @@ static void perf_event_namespaces_output + ret = perf_output_begin(&handle, event, + namespaces_event->event_id.header.size); + if (ret) +- return; ++ goto out; + + namespaces_event->event_id.pid = perf_event_pid(event, + namespaces_event->task); +@@ -6741,6 +6742,8 @@ static void perf_event_namespaces_output + perf_event__output_id_sample(event, &handle, &sample); + + perf_output_end(&handle); ++out: ++ namespaces_event->event_id.header.size = header_size; + } + + static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info, diff --git a/queue-4.14/perf-help-fix-a-bug-during-strstart-conversion.patch b/queue-4.14/perf-help-fix-a-bug-during-strstart-conversion.patch new file mode 100644 index 00000000000..f499cd41295 --- /dev/null +++ b/queue-4.14/perf-help-fix-a-bug-during-strstart-conversion.patch @@ -0,0 +1,54 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Namhyung Kim +Date: Tue, 14 Nov 2017 09:15:42 +0900 +Subject: perf help: Fix a bug during strstart() conversion + +From: Namhyung Kim + + +[ Upstream commit af98f2273fd0af31ce327cd1406b67c7be0b6734 ] + +The commit 8e99b6d4533c changed prefixcmp() to strstart() but missed to +change the return value in some place. It makes perf help print +annoying output even for sane config items like below: + + $ perf help + '.root': unsupported man viewer sub key. + ... + +Reported-by: Arnaldo Carvalho de Melo +Signed-off-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Tested-by: Taeung Song +Cc: Jiri Olsa +Cc: Sihyeon Jang +Cc: kernel-team@lge.com +Link: http://lkml.kernel.org/r/20171114001542.GA16464@sejong +Fixes: 8e99b6d4533c ("tools include: Adopt strstarts() from the kernel") +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-help.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/perf/builtin-help.c ++++ b/tools/perf/builtin-help.c +@@ -284,7 +284,7 @@ static int perf_help_config(const char * + add_man_viewer(value); + return 0; + } +- if (!strstarts(var, "man.")) ++ if (strstarts(var, "man.")) + return add_man_viewer_info(var, value); + + return 0; +@@ -314,7 +314,7 @@ static const char *cmd_to_page(const cha + + if (!perf_cmd) + return "perf"; +- else if (!strstarts(perf_cmd, "perf")) ++ else if (strstarts(perf_cmd, "perf")) + return perf_cmd; + + return asprintf(&s, "perf-%s", perf_cmd) < 0 ? NULL : s; diff --git a/queue-4.14/perf-record-fix-c-f-options-for-cpu-event-aliases.patch b/queue-4.14/perf-record-fix-c-f-options-for-cpu-event-aliases.patch new file mode 100644 index 00000000000..a027b07f2d2 --- /dev/null +++ b/queue-4.14/perf-record-fix-c-f-options-for-cpu-event-aliases.patch @@ -0,0 +1,127 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andi Kleen +Date: Fri, 20 Oct 2017 13:27:55 -0700 +Subject: perf record: Fix -c/-F options for cpu event aliases + +From: Andi Kleen + + +[ Upstream commit 59622fd496a3175c7bf549046e091d81c303ecff ] + +The Intel PMU event aliases have a implicit period= specifier to set the +default period. + +Unfortunately this breaks overriding these periods with -c or -F, +because the alias terms look like they are user specified to the +internal parser, and user specified event qualifiers override the +command line options. + +Track that they are coming from aliases by adding a "weak" state to the +term. Any weak terms don't override command line options. + +I only did it for -c/-F for now, I think that's the only case that's +broken currently. + +Before: + +$ perf record -c 1000 -vv -e uops_issued.any +... + { sample_period, sample_freq } 2000003 + +After: + +$ perf record -c 1000 -vv -e uops_issued.any +... + { sample_period, sample_freq } 1000 + +Signed-off-by: Andi Kleen +Acked-by: Jiri Olsa +Link: http://lkml.kernel.org/r/20171020202755.21410-2-andi@firstfloor.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/evsel.c | 12 ++++++++---- + tools/perf/util/evsel.h | 1 + + tools/perf/util/parse-events.c | 2 ++ + tools/perf/util/parse-events.h | 3 +++ + tools/perf/util/pmu.c | 5 +++++ + 5 files changed, 19 insertions(+), 4 deletions(-) + +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -733,12 +733,16 @@ static void apply_config_terms(struct pe + list_for_each_entry(term, config_terms, list) { + switch (term->type) { + case PERF_EVSEL__CONFIG_TERM_PERIOD: +- attr->sample_period = term->val.period; +- attr->freq = 0; ++ if (!(term->weak && opts->user_interval != ULLONG_MAX)) { ++ attr->sample_period = term->val.period; ++ attr->freq = 0; ++ } + break; + case PERF_EVSEL__CONFIG_TERM_FREQ: +- attr->sample_freq = term->val.freq; +- attr->freq = 1; ++ if (!(term->weak && opts->user_freq != UINT_MAX)) { ++ attr->sample_freq = term->val.freq; ++ attr->freq = 1; ++ } + break; + case PERF_EVSEL__CONFIG_TERM_TIME: + if (term->val.time) +--- a/tools/perf/util/evsel.h ++++ b/tools/perf/util/evsel.h +@@ -67,6 +67,7 @@ struct perf_evsel_config_term { + bool overwrite; + char *branch; + } val; ++ bool weak; + }; + + /** struct perf_evsel - event selector +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -1115,6 +1115,7 @@ do { \ + INIT_LIST_HEAD(&__t->list); \ + __t->type = PERF_EVSEL__CONFIG_TERM_ ## __type; \ + __t->val.__name = __val; \ ++ __t->weak = term->weak; \ + list_add_tail(&__t->list, head_terms); \ + } while (0) + +@@ -2395,6 +2396,7 @@ static int new_term(struct parse_events_ + + *term = *temp; + INIT_LIST_HEAD(&term->list); ++ term->weak = false; + + switch (term->type_val) { + case PARSE_EVENTS__TERM_TYPE_NUM: +--- a/tools/perf/util/parse-events.h ++++ b/tools/perf/util/parse-events.h +@@ -101,6 +101,9 @@ struct parse_events_term { + /* error string indexes for within parsed string */ + int err_term; + int err_val; ++ ++ /* Coming from implicit alias */ ++ bool weak; + }; + + struct parse_events_error { +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -404,6 +404,11 @@ static int pmu_alias_terms(struct perf_p + parse_events_terms__purge(&list); + return ret; + } ++ /* ++ * Weak terms don't override command line options, ++ * which we don't want for implicit terms in aliases. ++ */ ++ cloned->weak = true; + list_add_tail(&cloned->list, &list); + } + list_splice(&list, terms); diff --git a/queue-4.14/perf-test-fix-test-21-for-s390x.patch b/queue-4.14/perf-test-fix-test-21-for-s390x.patch new file mode 100644 index 00000000000..a93b94666a3 --- /dev/null +++ b/queue-4.14/perf-test-fix-test-21-for-s390x.patch @@ -0,0 +1,45 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Thomas Richter +Date: Thu, 23 Nov 2017 12:46:11 +0100 +Subject: perf test: Fix test 21 for s390x + +From: Thomas Richter + + +[ Upstream commit 996548499df61babae5306544c7daf5fd39db31c ] + +Test case 21 (Number of exit events of a simple workload) fails on +s390x. The reason is the invalid sample frequency supplied for this +test. On s390x the minimum sample frequency is much higher (see output +of /proc/service_levels). + +Supply a save sample frequency value for s390x to fix this. The value +will be adjusted by the s390x CPUMF frequency convertion function to a +value well below the sysctl kernel.perf_event_max_sample_rate value. + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Cc: Martin Schwidefsky +LPU-Reference: 20171123114611.93397-1-tmricht@linux.vnet.ibm.com +Link: https://lkml.kernel.org/n/tip-1ynblyhi1n81idpido59nt1y@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/tests/task-exit.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/tools/perf/tests/task-exit.c ++++ b/tools/perf/tests/task-exit.c +@@ -84,7 +84,11 @@ int test__task_exit(struct test *test __ + + evsel = perf_evlist__first(evlist); + evsel->attr.task = 1; ++#ifdef __s390x__ ++ evsel->attr.sample_freq = 1000000; ++#else + evsel->attr.sample_freq = 1; ++#endif + evsel->attr.inherit = 0; + evsel->attr.watermark = 0; + evsel->attr.wakeup_events = 1; diff --git a/queue-4.14/perf-test-shell-fix-check-open-filename-arg-using-perf-trace-on-s390x.patch b/queue-4.14/perf-test-shell-fix-check-open-filename-arg-using-perf-trace-on-s390x.patch new file mode 100644 index 00000000000..ef48072603d --- /dev/null +++ b/queue-4.14/perf-test-shell-fix-check-open-filename-arg-using-perf-trace-on-s390x.patch @@ -0,0 +1,65 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Thomas Richter +Date: Tue, 14 Nov 2017 08:18:46 +0100 +Subject: perf test shell: Fix check open filename arg using 'perf trace' on s390x + +From: Thomas Richter + + +[ Upstream commit ccafc38f1c778847ab6d53dd7933260426731cf3 ] + +This 'perf test' case fails on s390x. The 'touch' command on s390x uses +the 'openat' system call to open the file named on the command line: + +[root@s35lp76 perf]# perf probe -l + probe:vfs_getname (on getname_flags:72@fs/namei.c with pathname) +[root@s35lp76 perf]# perf trace -e open touch /tmp/abc + 0.400 ( 0.015 ms): touch/27542 open(filename: + /usr/lib/locale/locale-archive, flags: CLOEXEC) = 3 +[root@s35lp76 perf]# + +There is no 'open' system call for file '/tmp/abc'. Instead the 'openat' +system call is used: + +[root@s35lp76 perf]# strace touch /tmp/abc + execve("/usr/bin/touch", ["touch", "/tmp/abc"], 0x3ffd547ec98 + /* 30 vars */) = 0 + [...] + openat(AT_FDCWD, "/tmp/abc", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3 + [...] + +On s390x the 'egrep' command does not find a matching pattern and +returns an error. + +Fix this for s390x create a platform dependent command line to enable +the 'perf probe' call to listen to the 'openat' system call and get the +expected output. + +Signed-off-by: Thomas-Mich Richter +Tested-by: Arnaldo Carvalho de Melo +Cc: Hendrik Brueckner +Cc: Thomas-Mich Richter +LPU-Reference: 20171114071847.2381-1-tmricht@linux.vnet.ibm.com +Link: http://lkml.kernel.org/n/tip-3qf38jk0prz54rhmhyu871my@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/tests/shell/trace+probe_vfs_getname.sh | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh ++++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh +@@ -17,8 +17,10 @@ skip_if_no_perf_probe || exit 2 + file=$(mktemp /tmp/temporary_file.XXXXX) + + trace_open_vfs_getname() { +- perf trace -e open touch $file 2>&1 | \ +- egrep " +[0-9]+\.[0-9]+ +\( +[0-9]+\.[0-9]+ ms\): +touch\/[0-9]+ open\(filename: +${file}, +flags: CREAT\|NOCTTY\|NONBLOCK\|WRONLY, +mode: +IRUGO\|IWUGO\) += +[0-9]+$" ++ test "$(uname -m)" = s390x && { svc="openat"; txt="dfd: +CWD, +"; } ++ ++ perf trace -e ${svc:-open} touch $file 2>&1 | \ ++ egrep " +[0-9]+\.[0-9]+ +\( +[0-9]+\.[0-9]+ ms\): +touch\/[0-9]+ ${svc:-open}\(${txt}filename: +${file}, +flags: CREAT\|NOCTTY\|NONBLOCK\|WRONLY, +mode: +IRUGO\|IWUGO\) += +[0-9]+$" + } + + diff --git a/queue-4.14/perf-top-fix-window-dimensions-change-handling.patch b/queue-4.14/perf-top-fix-window-dimensions-change-handling.patch new file mode 100644 index 00000000000..4dbc081763d --- /dev/null +++ b/queue-4.14/perf-top-fix-window-dimensions-change-handling.patch @@ -0,0 +1,82 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Jiri Olsa +Date: Tue, 14 Nov 2017 10:23:39 +0100 +Subject: perf top: Fix window dimensions change handling + +From: Jiri Olsa + + +[ Upstream commit 89d0aeab4252adc2a7ea693637dd21c588bfa2d1 ] + +The stdio perf top crashes when we change the terminal +window size. The reason is that we assumed we get the +perf_top pointer as a signal handler argument which is +not the case. + +Changing the SIGWINCH handler logic to change global +resize variable, which is checked in the main thread +loop. + +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Tested-by: Ravi Bangoria +Cc: Adrian Hunter +Cc: Andi Kleen +Cc: David Ahern +Cc: Namhyung Kim +Cc: Wang Nan +Link: http://lkml.kernel.org/n/tip-ysuzwz77oev1ftgvdscn9bpu@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-top.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -77,6 +77,7 @@ + #include "sane_ctype.h" + + static volatile int done; ++static volatile int resize; + + #define HEADER_LINE_NR 5 + +@@ -86,10 +87,13 @@ static void perf_top__update_print_entri + } + + static void perf_top__sig_winch(int sig __maybe_unused, +- siginfo_t *info __maybe_unused, void *arg) ++ siginfo_t *info __maybe_unused, void *arg __maybe_unused) + { +- struct perf_top *top = arg; ++ resize = 1; ++} + ++static void perf_top__resize(struct perf_top *top) ++{ + get_term_dimensions(&top->winsize); + perf_top__update_print_entries(top); + } +@@ -477,7 +481,7 @@ static bool perf_top__handle_keypress(st + .sa_sigaction = perf_top__sig_winch, + .sa_flags = SA_SIGINFO, + }; +- perf_top__sig_winch(SIGWINCH, NULL, top); ++ perf_top__resize(top); + sigaction(SIGWINCH, &act, NULL); + } else { + signal(SIGWINCH, SIG_DFL); +@@ -1022,6 +1026,11 @@ static int __cmd_top(struct perf_top *to + + if (hits == top->samples) + ret = perf_evlist__poll(top->evlist, 100); ++ ++ if (resize) { ++ perf_top__resize(top); ++ resize = 0; ++ } + } + + ret = 0; diff --git a/queue-4.14/phylink-ensure-we-take-the-link-down-when-phylink_stop-is-called.patch b/queue-4.14/phylink-ensure-we-take-the-link-down-when-phylink_stop-is-called.patch new file mode 100644 index 00000000000..082320f034f --- /dev/null +++ b/queue-4.14/phylink-ensure-we-take-the-link-down-when-phylink_stop-is-called.patch @@ -0,0 +1,33 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Russell King +Date: Thu, 30 Nov 2017 13:59:26 +0000 +Subject: phylink: ensure we take the link down when phylink_stop() is called + +From: Russell King + + +[ Upstream commit 2012b7d6b2868c532f22d9172c8b24611637eb48 ] + +Ensure that we tell the MAC to take the link down when phylink_stop() +is called, and that this completes prior to phylink_stop() returns. + +Reported-by: Florian Fainelli +Tested-by: Florian Fainelli +Signed-off-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/phylink.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -772,6 +772,7 @@ void phylink_stop(struct phylink *pl) + sfp_upstream_stop(pl->sfp_bus); + + set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state); ++ queue_work(system_power_efficient_wq, &pl->resolve); + flush_work(&pl->resolve); + } + EXPORT_SYMBOL_GPL(phylink_stop); diff --git a/queue-4.14/pinctrl-denverton-fix-uart2-rts-pin-mode.patch b/queue-4.14/pinctrl-denverton-fix-uart2-rts-pin-mode.patch new file mode 100644 index 00000000000..ea968b664ce --- /dev/null +++ b/queue-4.14/pinctrl-denverton-fix-uart2-rts-pin-mode.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andy Shevchenko +Date: Fri, 10 Nov 2017 19:55:18 +0200 +Subject: pinctrl: denverton: Fix UART2 RTS pin mode + +From: Andy Shevchenko + + +[ Upstream commit 4bd6683da2e64590bdc27ecf7e61ad8376861768 ] + +UART2 RTS is mode 2 of the pin. + +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/intel/pinctrl-denverton.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/intel/pinctrl-denverton.c ++++ b/drivers/pinctrl/intel/pinctrl-denverton.c +@@ -207,7 +207,7 @@ static const unsigned int dnv_uart0_pins + static const unsigned int dnv_uart0_modes[] = { 2, 3, 1, 1 }; + static const unsigned int dnv_uart1_pins[] = { 94, 95, 96, 97 }; + static const unsigned int dnv_uart2_pins[] = { 60, 61, 62, 63 }; +-static const unsigned int dnv_uart2_modes[] = { 1, 1, 2, 2 }; ++static const unsigned int dnv_uart2_modes[] = { 1, 2, 2, 2 }; + static const unsigned int dnv_emmc_pins[] = { + 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, + }; diff --git a/queue-4.14/pinctrl-sunxi-fix-a64-uart-mux-value.patch b/queue-4.14/pinctrl-sunxi-fix-a64-uart-mux-value.patch new file mode 100644 index 00000000000..371a6089468 --- /dev/null +++ b/queue-4.14/pinctrl-sunxi-fix-a64-uart-mux-value.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andre Przywara +Date: Sat, 25 Nov 2017 12:12:30 +0000 +Subject: pinctrl: sunxi: Fix A64 UART mux value + +From: Andre Przywara + + +[ Upstream commit 7c5c2c2d18d778e51fd8b899965097168306031c ] + +To use pin PF4 as the RX signal of UART0, we have to write 0b011 into +the respective pin controller register. +Fix the wrong value we had in our table so far. + +Fixes: 96851d391d02 ("drivers: pinctrl: add driver for Allwinner A64 SoC") +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c +@@ -428,7 +428,7 @@ static const struct sunxi_desc_pin a64_p + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x2, "mmc0"), /* D3 */ +- SUNXI_FUNCTION(0x4, "uart0")), /* RX */ ++ SUNXI_FUNCTION(0x3, "uart0")), /* RX */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(F, 5), + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), diff --git a/queue-4.14/pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch b/queue-4.14/pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch new file mode 100644 index 00000000000..c20df33c048 --- /dev/null +++ b/queue-4.14/pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch @@ -0,0 +1,53 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andre Przywara +Date: Sat, 25 Nov 2017 12:19:48 +0000 +Subject: pinctrl: sunxi: Fix A80 interrupt pin bank + +From: Andre Przywara + + +[ Upstream commit 6ad4cc8d1ac483e0fd33f605fb2788b0ecf51ed4 ] + +On the A80 the pins on port B can trigger interrupts, and those are +assigned to the second interrupt bank. +Having two pins assigned to the same interrupt bank/pin combination does +not look healthy (instead more like a copy&paste bug from pins PA14-PA16), +so fix the interrupt bank for pins PB14-PB16, which is actually 1. + +I don't have any A80 board, so could not test this. + +Fixes: d5e9fb31baa2 ("pinctrl: sunxi: Add A80 pinctrl muxing options") +Signed-off-by: Andre Przywara +Acked-by: Chen-Yu Tsai +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c +@@ -145,19 +145,19 @@ static const struct sunxi_desc_pin sun9i + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* MCLK */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), /* PB_EINT14 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 14)), /* PB_EINT14 */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 15), + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* SCK */ + SUNXI_FUNCTION(0x4, "i2c4"), /* SCK */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 15)), /* PB_EINT15 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 15)), /* PB_EINT15 */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 16), + SUNXI_FUNCTION(0x0, "gpio_in"), + SUNXI_FUNCTION(0x1, "gpio_out"), + SUNXI_FUNCTION(0x3, "mcsi"), /* SDA */ + SUNXI_FUNCTION(0x4, "i2c4"), /* SDA */ +- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 16)), /* PB_EINT16 */ ++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 16)), /* PB_EINT16 */ + + /* Hole */ + SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 0), diff --git a/queue-4.14/platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch b/queue-4.14/platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch new file mode 100644 index 00000000000..a1631b6e194 --- /dev/null +++ b/queue-4.14/platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch @@ -0,0 +1,71 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: "Pali Rohár" +Date: Thu, 2 Nov 2017 21:25:24 +0100 +Subject: platform/x86: dell-laptop: Fix keyboard max lighting for Dell Latitude E6410 + +From: "Pali Rohár" + + +[ Upstream commit 68a213d325c23d39f109f4c7c824b906a7d209de ] + +This machine reports number of keyboard backlight led levels, instead of +value of the last led level index. Therefore max_brightness properly needs +to be subtracted by 1 to match led max_brightness API. + +Signed-off-by: Pali Rohár +Reported-by: Gabriel M. Elder +Link: https://bugzilla.kernel.org/show_bug.cgi?id=196913 +Signed-off-by: Darren Hart (VMware) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/dell-laptop.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -49,6 +49,7 @@ + + struct quirk_entry { + u8 touchpad_led; ++ u8 kbd_led_levels_off_1; + + int needs_kbd_timeouts; + /* +@@ -79,6 +80,10 @@ static struct quirk_entry quirk_dell_xps + .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 }, + }; + ++static struct quirk_entry quirk_dell_latitude_e6410 = { ++ .kbd_led_levels_off_1 = 1, ++}; ++ + static struct platform_driver platform_driver = { + .driver = { + .name = "dell-laptop", +@@ -280,6 +285,15 @@ static const struct dmi_system_id dell_q + }, + .driver_data = &quirk_dell_xps13_9333, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "Dell Latitude E6410", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"), ++ }, ++ .driver_data = &quirk_dell_latitude_e6410, ++ }, + { } + }; + +@@ -1200,6 +1214,9 @@ static int kbd_get_info(struct kbd_info + units = (buffer->output[2] >> 8) & 0xFF; + info->levels = (buffer->output[2] >> 16) & 0xFF; + ++ if (quirks && quirks->kbd_led_levels_off_1 && info->levels) ++ info->levels--; ++ + if (units & BIT(0)) + info->seconds = (buffer->output[3] >> 0) & 0xFF; + if (units & BIT(1)) diff --git a/queue-4.14/pm-runtime-fix-handling-of-suppliers-with-disabled-runtime-pm.patch b/queue-4.14/pm-runtime-fix-handling-of-suppliers-with-disabled-runtime-pm.patch new file mode 100644 index 00000000000..4b87208197d --- /dev/null +++ b/queue-4.14/pm-runtime-fix-handling-of-suppliers-with-disabled-runtime-pm.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: "Rafael J. Wysocki" +Date: Fri, 1 Dec 2017 14:58:34 +0100 +Subject: PM / runtime: Fix handling of suppliers with disabled runtime PM + +From: "Rafael J. Wysocki" + + +[ Upstream commit 31eb7431805493e10f4731f366cf4d4e3e952035 ] + +Prevent rpm_get_suppliers() from returning an error code if runtime +PM is disabled for one or more of the supplier devices it wants to +runtime-resume, so as to make runtime PM work for devices with links +to suppliers that don't use runtime PM (such links may be created +during device enumeration even before it is known whether or not +runtime PM will be enabled for the devices in question, for example). + +Fixes: 21d5c57b3726 (PM / runtime: Use device links) +Reported-by: Adrian Hunter +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Lukas Wunner +Tested-by: Adrian Hunter +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/power/runtime.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -276,7 +276,8 @@ static int rpm_get_suppliers(struct devi + continue; + + retval = pm_runtime_get_sync(link->supplier); +- if (retval < 0) { ++ /* Ignore suppliers with disabled runtime PM. */ ++ if (retval < 0 && retval != -EACCES) { + pm_runtime_put_noidle(link->supplier); + return retval; + } diff --git a/queue-4.14/powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch b/queue-4.14/powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch new file mode 100644 index 00000000000..74d150e3f20 --- /dev/null +++ b/queue-4.14/powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch @@ -0,0 +1,60 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Ravi Bangoria +Date: Thu, 30 Nov 2017 14:03:22 +0530 +Subject: powerpc/perf: Fix oops when grouping different pmu events + +From: Ravi Bangoria + + +[ Upstream commit 5aa04b3eb6fca63d2e9827be656dcadc26d54e11 ] + +When user tries to group imc (In-Memory Collections) event with +normal event, (sometime) kernel crashes with following log: + + Faulting instruction address: 0x00000000 + [link register ] c00000000010ce88 power_check_constraints+0x128/0x980 + ... + c00000000010e238 power_pmu_event_init+0x268/0x6f0 + c0000000002dc60c perf_try_init_event+0xdc/0x1a0 + c0000000002dce88 perf_event_alloc+0x7b8/0xac0 + c0000000002e92e0 SyS_perf_event_open+0x530/0xda0 + c00000000000b004 system_call+0x38/0xe0 + +'event_base' field of 'struct hw_perf_event' is used as flags for +normal hw events and used as memory address for imc events. While +grouping these two types of events, collect_events() tries to +interpret imc 'event_base' as a flag, which causes a corruption +resulting in a crash. + +Consider only those events which belongs to 'perf_hw_context' in +collect_events(). + +Signed-off-by: Ravi Bangoria +Reviewed-By: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/perf/core-book3s.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -1419,7 +1419,7 @@ static int collect_events(struct perf_ev + int n = 0; + struct perf_event *event; + +- if (!is_software_event(group)) { ++ if (group->pmu->task_ctx_nr == perf_hw_context) { + if (n >= max_count) + return -1; + ctrs[n] = group; +@@ -1427,7 +1427,7 @@ static int collect_events(struct perf_ev + events[n++] = group->hw.config; + } + list_for_each_entry(event, &group->sibling_list, group_entry) { +- if (!is_software_event(event) && ++ if (event->pmu->task_ctx_nr == perf_hw_context && + event->state != PERF_EVENT_STATE_OFF) { + if (n >= max_count) + return -1; diff --git a/queue-4.14/powerpc-perf-imc-fix-nest-imc-cpuhotplug-callback-failure.patch b/queue-4.14/powerpc-perf-imc-fix-nest-imc-cpuhotplug-callback-failure.patch new file mode 100644 index 00000000000..ae51a4b61c2 --- /dev/null +++ b/queue-4.14/powerpc-perf-imc-fix-nest-imc-cpuhotplug-callback-failure.patch @@ -0,0 +1,66 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Anju T Sudhakar +Date: Tue, 5 Dec 2017 11:00:38 +0530 +Subject: powerpc/perf/imc: Fix nest-imc cpuhotplug callback failure + +From: Anju T Sudhakar + + +[ Upstream commit ad2b6e01024ef23bddc3ce0bcb115ecd8c520b7e ] + +Oops is observed during boot: + + Faulting instruction address: 0xc000000000248340 + cpu 0x0: Vector: 380 (Data Access Out of Range) at [c000000ff66fb850] + pc: c000000000248340: event_function_call+0x50/0x1f0 + lr: c00000000024878c: perf_remove_from_context+0x3c/0x100 + sp: c000000ff66fbad0 + msr: 9000000000009033 + dar: 7d20e2a6f92d03c0 + pid = 14, comm = cpuhp/0 + +While registering the cpuhotplug callbacks for nest-imc, if we fail in +the cpuhotplug online path for any random node in a multi node +system (because the opal call to stop nest-imc counters fails for that +node), ppc_nest_imc_cpu_offline() will get invoked for other nodes who +successfully returned from cpuhotplug online path. + +This call trace is generated since in the ppc_nest_imc_cpu_offline() +path we are trying to migrate the event context, when nest-imc +counters are not even initialized. + +Patch to add a check to ensure that nest-imc is registered before +migrating the event context. + +Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") +Signed-off-by: Anju T Sudhakar +Reviewed-by: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/perf/imc-pmu.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/arch/powerpc/perf/imc-pmu.c ++++ b/arch/powerpc/perf/imc-pmu.c +@@ -309,6 +309,19 @@ static int ppc_nest_imc_cpu_offline(unsi + return 0; + + /* ++ * Check whether nest_imc is registered. We could end up here if the ++ * cpuhotplug callback registration fails. i.e, callback invokes the ++ * offline path for all successfully registered nodes. At this stage, ++ * nest_imc pmu will not be registered and we should return here. ++ * ++ * We return with a zero since this is not an offline failure. And ++ * cpuhp_setup_state() returns the actual failure reason to the caller, ++ * which in turn will call the cleanup routine. ++ */ ++ if (!nest_pmus) ++ return 0; ++ ++ /* + * Now that this cpu is one of the designated, + * find a next cpu a) which is online and b) in same chip. + */ diff --git a/queue-4.14/rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch b/queue-4.14/rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch new file mode 100644 index 00000000000..f8d69ef6bd9 --- /dev/null +++ b/queue-4.14/rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Moni Shoua +Date: Sun, 26 Nov 2017 20:23:54 +0200 +Subject: RDMA/cma: Make sure that PSN is not over max allowed + +From: Moni Shoua + + +[ Upstream commit 23a9cd2ad90543e9da3786878d2b2729c095439d ] + +This patch limits the initial value for PSN to 24 bits as +spec requires. + +Signed-off-by: Moni Shoua +Signed-off-by: Mukesh Kacker +Signed-off-by: Daniel Jurgens +Reviewed-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/cma.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -801,6 +801,7 @@ struct rdma_cm_id *rdma_create_id(struct + INIT_LIST_HEAD(&id_priv->mc_list); + get_random_bytes(&id_priv->seq_num, sizeof id_priv->seq_num); + id_priv->id.route.addr.dev_addr.net = get_net(net); ++ id_priv->seq_num &= 0x00ffffff; + + return &id_priv->id; + } diff --git a/queue-4.14/s390-dasd-prevent-prefix-i-o-error.patch b/queue-4.14/s390-dasd-prevent-prefix-i-o-error.patch new file mode 100644 index 00000000000..49bf9db3a33 --- /dev/null +++ b/queue-4.14/s390-dasd-prevent-prefix-i-o-error.patch @@ -0,0 +1,62 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Stefan Haberland +Date: Thu, 26 Oct 2017 14:37:35 +0200 +Subject: s390/dasd: prevent prefix I/O error + +From: Stefan Haberland + + +[ Upstream commit da340f921d3454f1521671c7a5a43ad3331fbe50 ] + +Prevent that a prefix flag is set based on invalid configuration data. +The validity.verify_base flag should only be set for alias devices. +Usually the unit address type is either one of base, PAV alias or +HyperPAV alias. But in cases where the unit address type is not set or +any other value the validity.verify_base flag might be set as well. +This would lead to follow on errors. +Explicitly check for alias devices and set the validity flag only for +them. + +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd_eckd.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -530,10 +530,12 @@ static int prefix_LRE(struct ccw1 *ccw, + pfxdata->validity.define_extent = 1; + + /* private uid is kept up to date, conf_data may be outdated */ +- if (startpriv->uid.type != UA_BASE_DEVICE) { ++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS) + pfxdata->validity.verify_base = 1; +- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) +- pfxdata->validity.hyper_pav = 1; ++ ++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) { ++ pfxdata->validity.verify_base = 1; ++ pfxdata->validity.hyper_pav = 1; + } + + rc = define_extent(NULL, dedata, trk, totrk, cmd, basedev, blksize); +@@ -3414,10 +3416,12 @@ static int prepare_itcw(struct itcw *itc + pfxdata.validity.define_extent = 1; + + /* private uid is kept up to date, conf_data may be outdated */ +- if (startpriv->uid.type != UA_BASE_DEVICE) { ++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS) ++ pfxdata.validity.verify_base = 1; ++ ++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) { + pfxdata.validity.verify_base = 1; +- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) +- pfxdata.validity.hyper_pav = 1; ++ pfxdata.validity.hyper_pav = 1; + } + + switch (cmd) { diff --git a/queue-4.14/s390-virtio-add-bsd-license-to-virtio-ccw.patch b/queue-4.14/s390-virtio-add-bsd-license-to-virtio-ccw.patch new file mode 100644 index 00000000000..994841743bb --- /dev/null +++ b/queue-4.14/s390-virtio-add-bsd-license-to-virtio-ccw.patch @@ -0,0 +1,38 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: "Michael S. Tsirkin" +Date: Tue, 28 Nov 2017 16:11:29 +0200 +Subject: s390/virtio: add BSD license to virtio-ccw + +From: "Michael S. Tsirkin" + + +[ Upstream commit edfb8d8fcb94a75b2e61c63549d4a5f6474ad3d2 ] + +The original intent of the virtio header relicensing +from 2008 was to make sure anyone can implement compatible +devices/drivers. The virtio-ccw was omitted by mistake. + +We have an ack from the only contributor as well as the +maintainer from IBM, so it's not too late to fix that. + +Make it dual-licensed with GPLv2, as the whole kernel is GPL2. + +Acked-by: Christian Borntraeger +Acked-by: Cornelia Huck +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/uapi/asm/virtio-ccw.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/include/uapi/asm/virtio-ccw.h ++++ b/arch/s390/include/uapi/asm/virtio-ccw.h +@@ -1,4 +1,4 @@ +-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ ++/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */ + /* + * Definitions for virtio-ccw devices. + * diff --git a/queue-4.14/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch b/queue-4.14/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch new file mode 100644 index 00000000000..fb75313795a --- /dev/null +++ b/queue-4.14/scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch @@ -0,0 +1,52 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Will Deacon +Date: Wed, 29 Nov 2017 15:20:03 +0000 +Subject: scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none + +From: Will Deacon + + +[ Upstream commit e814bccbafece52a24e152d2395b5d49eef55841 ] + +My bisect scripts starting running into build failures when trying to +compile 4.15-rc1 with the builds failing with things like: + +drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:2078: error: Cannot parse struct or union! + +The line in question is actually just a #define, but after some digging +it turns out that my scripts pass W=1 and since commit 3a025e1d1c2ea +("Add optional check for bad kernel-doc comments") that results in +kernel-doc running on each source file. The file in question has a +badly formatted comment immediately before the #define: + +/** + * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for + * bus layer usage. + */ + +which causes the regex in dump_struct to fail (lack of braces following +struct declaration) and kernel-doc returns 1, which causes the build +to fail. + +Fix the issue by always returning 0 from kernel-doc when invoked with +-none. It successfully generates no documentation, and prints out any +issues. + +Cc: Matthew Wilcox +Cc: Jonathan Corbet +Signed-off-by: Will Deacon +Signed-off-by: Jonathan Corbet +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + scripts/kernel-doc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/kernel-doc ++++ b/scripts/kernel-doc +@@ -3216,4 +3216,4 @@ if ($verbose && $warnings) { + print STDERR "$warnings warnings\n"; + } + +-exit($errors); ++exit($output_mode eq "none" ? 0 : $errors); diff --git a/queue-4.14/scsi-bfa-fix-access-to-bfad_im_port_s.patch b/queue-4.14/scsi-bfa-fix-access-to-bfad_im_port_s.patch new file mode 100644 index 00000000000..5e409c76c23 --- /dev/null +++ b/queue-4.14/scsi-bfa-fix-access-to-bfad_im_port_s.patch @@ -0,0 +1,76 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Johannes Thumshirn +Date: Tue, 28 Nov 2017 16:26:57 +0100 +Subject: scsi: bfa: fix access to bfad_im_port_s + +From: Johannes Thumshirn + + +[ Upstream commit 45349821ab3a8d378b8f37e52c6fe1aa1b870c47 ] + +Commit 'cd21c605b2cf ("scsi: fc: provide fc_bsg_to_shost() helper")' +changed access to bfa's 'struct bfad_im_port_s' by using shost_priv() +instead of shost->hostdata[0]. + +This lead to crashes like in the following back-trace: + +task: ffff880046375300 ti: ffff8800a2ef8000 task.ti: ffff8800a2ef8000 +RIP: e030:[] [] bfa_fcport_get_attr+0x82/0x260 [bfa] +RSP: e02b:ffff8800a2efba10 EFLAGS: 00010046 +RAX: 575f415441536432 RBX: ffff8800a2efba28 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: ffff8800a2efba28 RDI: ffff880004dc31d8 +RBP: ffff880004dc31d8 R08: 0000000000000000 R09: 0000000000000001 +R10: ffff88011fadc468 R11: 0000000000000001 R12: ffff880004dc31f0 +R13: 0000000000000200 R14: ffff880004dc61d0 R15: ffff880004947a10 +FS: 00007feb1e489700(0000) GS:ffff88011fac0000(0000) knlGS:0000000000000000 +CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b +CR2: 00007ffe14e46c10 CR3: 00000000957b8000 CR4: 0000000000000660 +Stack: + ffff88001d4da000 ffff880004dc31c0 ffffffffa048a9df ffffffff81e56380 + 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +[] bfad_iocmd_ioc_get_info+0x4f/0x220 [bfa] +[] bfad_iocmd_handler+0xa00/0xd40 [bfa] +[] bfad_im_bsg_request+0xee/0x1b0 [bfa] +[] fc_bsg_dispatch+0x10b/0x1b0 [scsi_transport_fc] +[] bsg_request_fn+0x11d/0x1c0 +[] __blk_run_queue+0x2f/0x40 +[] blk_execute_rq_nowait+0xa8/0x160 +[] blk_execute_rq+0x77/0x120 +[] bsg_ioctl+0x1b6/0x200 +[] do_vfs_ioctl+0x2cd/0x4a0 +[] SyS_ioctl+0x74/0x80 +[] entry_SYSCALL_64_fastpath+0x12/0x6d + +Fixes: cd21c605b2cf ("scsi: fc: provide fc_bsg_to_shost() helper") +Signed-off-by: Johannes Thumshirn +Cc: Michal Koutný +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/bfa/bfad_bsg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/bfa/bfad_bsg.c ++++ b/drivers/scsi/bfa/bfad_bsg.c +@@ -3135,7 +3135,8 @@ bfad_im_bsg_vendor_request(struct bsg_jo + struct fc_bsg_request *bsg_request = job->request; + struct fc_bsg_reply *bsg_reply = job->reply; + uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0]; +- struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job)); ++ struct Scsi_Host *shost = fc_bsg_to_shost(job); ++ struct bfad_im_port_s *im_port = shost->hostdata[0]; + struct bfad_s *bfad = im_port->bfad; + struct request_queue *request_q = job->req->q; + void *payload_kbuf; +@@ -3357,7 +3358,8 @@ int + bfad_im_bsg_els_ct_request(struct bsg_job *job) + { + struct bfa_bsg_data *bsg_data; +- struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job)); ++ struct Scsi_Host *shost = fc_bsg_to_shost(job); ++ struct bfad_im_port_s *im_port = shost->hostdata[0]; + struct bfad_s *bfad = im_port->bfad; + bfa_bsg_fcpt_t *bsg_fcpt; + struct bfad_fcxp *drv_fcxp; diff --git a/queue-4.14/scsi-bfa-fix-type-conversion-warning.patch b/queue-4.14/scsi-bfa-fix-type-conversion-warning.patch new file mode 100644 index 00000000000..b9c76cdd451 --- /dev/null +++ b/queue-4.14/scsi-bfa-fix-type-conversion-warning.patch @@ -0,0 +1,110 @@ +From 48d83282db077f93b2cf40de120f4d6f29eb293b Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 6 Dec 2017 15:14:18 +0100 +Subject: scsi: bfa: fix type conversion warning + +From: Arnd Bergmann + +commit 48d83282db077f93b2cf40de120f4d6f29eb293b upstream. + +A regression fix introduced a harmless type mismatch warning: + +drivers/scsi/bfa/bfad_bsg.c: In function 'bfad_im_bsg_vendor_request': +drivers/scsi/bfa/bfad_bsg.c:3137:35: error: initialization of 'struct bfad_im_port_s *' from 'long unsigned int' makes pointer from integer without a cast [-Werror=int-conversion] + struct bfad_im_port_s *im_port = shost->hostdata[0]; + ^~~~~ +drivers/scsi/bfa/bfad_bsg.c: In function 'bfad_im_bsg_els_ct_request': +drivers/scsi/bfa/bfad_bsg.c:3353:35: error: initialization of 'struct bfad_im_port_s *' from 'long unsigned int' makes pointer from integer without a cast [-Werror=int-conversion] + struct bfad_im_port_s *im_port = shost->hostdata[0]; + +This changes the code back to shost_priv() once more, but encapsulates +it in an inline function to document the rather unusual way of +using the private data only as a pointer to the previously allocated +structure. + +I did not try to get rid of the extra indirection level entirely, +which would have been rather invasive and required reworking the entire +initialization sequence. + +Fixes: 45349821ab3a ("scsi: bfa: fix access to bfad_im_port_s") +Signed-off-by: Arnd Bergmann +Reviewed-by: Johannes Thumshirn +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Cc: Sasha Levin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/bfa/bfad_bsg.c | 4 ++-- + drivers/scsi/bfa/bfad_im.c | 6 ++++-- + drivers/scsi/bfa/bfad_im.h | 10 ++++++++++ + 3 files changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/bfa/bfad_bsg.c ++++ b/drivers/scsi/bfa/bfad_bsg.c +@@ -3136,7 +3136,7 @@ bfad_im_bsg_vendor_request(struct bsg_jo + struct fc_bsg_reply *bsg_reply = job->reply; + uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0]; + struct Scsi_Host *shost = fc_bsg_to_shost(job); +- struct bfad_im_port_s *im_port = shost->hostdata[0]; ++ struct bfad_im_port_s *im_port = bfad_get_im_port(shost); + struct bfad_s *bfad = im_port->bfad; + struct request_queue *request_q = job->req->q; + void *payload_kbuf; +@@ -3359,7 +3359,7 @@ bfad_im_bsg_els_ct_request(struct bsg_jo + { + struct bfa_bsg_data *bsg_data; + struct Scsi_Host *shost = fc_bsg_to_shost(job); +- struct bfad_im_port_s *im_port = shost->hostdata[0]; ++ struct bfad_im_port_s *im_port = bfad_get_im_port(shost); + struct bfad_s *bfad = im_port->bfad; + bfa_bsg_fcpt_t *bsg_fcpt; + struct bfad_fcxp *drv_fcxp; +--- a/drivers/scsi/bfa/bfad_im.c ++++ b/drivers/scsi/bfa/bfad_im.c +@@ -546,6 +546,7 @@ int + bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port, + struct device *dev) + { ++ struct bfad_im_port_pointer *im_portp; + int error = 1; + + mutex_lock(&bfad_mutex); +@@ -564,7 +565,8 @@ bfad_im_scsi_host_alloc(struct bfad_s *b + goto out_free_idr; + } + +- im_port->shost->hostdata[0] = (unsigned long)im_port; ++ im_portp = shost_priv(im_port->shost); ++ im_portp->p = im_port; + im_port->shost->unique_id = im_port->idr_id; + im_port->shost->this_id = -1; + im_port->shost->max_id = MAX_FCP_TARGET; +@@ -748,7 +750,7 @@ bfad_scsi_host_alloc(struct bfad_im_port + + sht->sg_tablesize = bfad->cfg_data.io_max_sge; + +- return scsi_host_alloc(sht, sizeof(unsigned long)); ++ return scsi_host_alloc(sht, sizeof(struct bfad_im_port_pointer)); + } + + void +--- a/drivers/scsi/bfa/bfad_im.h ++++ b/drivers/scsi/bfa/bfad_im.h +@@ -69,6 +69,16 @@ struct bfad_im_port_s { + struct fc_vport *fc_vport; + }; + ++struct bfad_im_port_pointer { ++ struct bfad_im_port_s *p; ++}; ++ ++static inline struct bfad_im_port_s *bfad_get_im_port(struct Scsi_Host *host) ++{ ++ struct bfad_im_port_pointer *im_portp = shost_priv(host); ++ return im_portp->p; ++} ++ + enum bfad_itnim_state { + ITNIM_STATE_NONE, + ITNIM_STATE_ONLINE, diff --git a/queue-4.14/scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch b/queue-4.14/scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch new file mode 100644 index 00000000000..bd1d677492c --- /dev/null +++ b/queue-4.14/scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Dan Carpenter +Date: Wed, 22 Nov 2017 11:58:03 +0300 +Subject: scsi: lpfc: Use after free in lpfc_rq_buf_free() + +From: Dan Carpenter + + +[ Upstream commit 9816ef6ecbc102b9bcbb1d83e12c7fb19924f38c ] + +The error message dereferences "rqb_entry" so we need to print it first +and then free the buffer. + +Fixes: 6c621a2229b0 ("scsi: lpfc: Separate NVMET RQ buffer posting from IO resources SGL/iocbq/context") +Signed-off-by: Dan Carpenter +Acked-by: Dick Kennedy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/lpfc/lpfc_mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_mem.c ++++ b/drivers/scsi/lpfc/lpfc_mem.c +@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, + drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys); + rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe); + if (rc < 0) { +- (rqbp->rqb_free_buffer)(phba, rqb_entry); + lpfc_printf_log(phba, KERN_ERR, LOG_INIT, + "6409 Cannot post to RQ %d: %x %x\n", + rqb_entry->hrq->queue_id, + rqb_entry->hrq->host_index, + rqb_entry->hrq->hba_index); ++ (rqbp->rqb_free_buffer)(phba, rqb_entry); + } else { + list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list); + rqbp->buffer_count++; diff --git a/queue-4.14/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch b/queue-4.14/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch new file mode 100644 index 00000000000..1b6d6ccf368 --- /dev/null +++ b/queue-4.14/sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch @@ -0,0 +1,58 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Xin Long +Date: Sat, 25 Nov 2017 21:18:34 +0800 +Subject: sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune + +From: Xin Long + + +[ Upstream commit d30fc5126efb0c33b7adf5966d3051db2c3d7721 ] + +Now outstanding_bytes is only increased when appending chunks into one +packet and sending it at 1st time, while decreased when it is about to +move into retransmit queue. It means outstanding_bytes value is already +decreased for all chunks in retransmit queue. + +However sctp_prsctp_prune_sent is a common function to check the chunks +in both transmitted and retransmit queue, it decrease outstanding_bytes +when moving a chunk into abandoned queue from either of them. + +It could cause outstanding_bytes underflow, as it also decreases it's +value for the chunks in retransmit queue. + +This patch fixes it by only updating outstanding_bytes for transmitted +queue when pruning queues for prsctp prio policy, the same fix is also +needed in sctp_check_transmitted. + +Fixes: 8dbdf1f5b09c ("sctp: implement prsctp PRIO policy") +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/outqueue.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/sctp/outqueue.c ++++ b/net/sctp/outqueue.c +@@ -368,7 +368,8 @@ static int sctp_prsctp_prune_sent(struct + asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++; + streamout->abandoned_sent[SCTP_PR_INDEX(PRIO)]++; + +- if (!chk->tsn_gap_acked) { ++ if (queue != &asoc->outqueue.retransmit && ++ !chk->tsn_gap_acked) { + if (chk->transport) + chk->transport->flight_size -= + sctp_data_size(chk); +@@ -1429,7 +1430,8 @@ static void sctp_check_transmitted(struc + /* If this chunk has not been acked, stop + * considering it as 'outstanding'. + */ +- if (!tchunk->tsn_gap_acked) { ++ if (transmitted_queue != &q->retransmit && ++ !tchunk->tsn_gap_acked) { + if (tchunk->transport) + tchunk->transport->flight_size -= + sctp_data_size(tchunk); diff --git a/queue-4.14/serdev-fix-receive_buf-return-value-when-no-callback.patch b/queue-4.14/serdev-fix-receive_buf-return-value-when-no-callback.patch new file mode 100644 index 00000000000..ef073c7e45e --- /dev/null +++ b/queue-4.14/serdev-fix-receive_buf-return-value-when-no-callback.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Johan Hovold +Date: Fri, 3 Nov 2017 15:30:53 +0100 +Subject: serdev: fix receive_buf return value when no callback + +From: Johan Hovold + + +[ Upstream commit fd00cf81a9a84776ba58e56bd042c726dcf75cf3 ] + +The receive_buf callback is supposed to return the number of bytes +processed and should specifically not return a negative errno. + +Due to missing sanity checks in the serdev tty-port controller, a driver +not providing a receive_buf callback could cause the flush_to_ldisc() +worker to spin in a tight loop when the tty buffer pointers are +incremented with -EINVAL (-22). + +The missing sanity checks have now been added to the tty-port +controller, but let's fix up the serdev-controller helper as well. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/serdev.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/serdev.h ++++ b/include/linux/serdev.h +@@ -184,7 +184,7 @@ static inline int serdev_controller_rece + struct serdev_device *serdev = ctrl->serdev; + + if (!serdev || !serdev->ops->receive_buf) +- return -EINVAL; ++ return 0; + + return serdev->ops->receive_buf(serdev, data, count); + } diff --git a/queue-4.14/series b/queue-4.14/series index 4389ce67b9d..2c79c023858 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -56,3 +56,98 @@ staging-fsl-mc-fix-build-testing-on-x86.patch staging-iio-adc-ad7192-fix-external-frequency-setting.patch staging-iio-ad5933-switch-buffer-mode-to-software.patch usbip-keep-usbip_device-sockfd-state-in-sync-with-tcp_socket.patch +usb-build-drivers-usb-common-when-usb_support-is-set.patch +serdev-fix-receive_buf-return-value-when-no-callback.patch +arm-omap2-fix-sram-virt-to-phys-translation-for-save_secure_ram_context.patch +arm-am33xx-prm-remove-am33xx_pwrdm_read_prev_pwrst-function.patch +arm-dts-fix-omap4-hang-with-gps-connected-to-usb-by-using-wakeupgen.patch +arm-dts-logicpd-som-lv-fix-gpmc-addresses-for-nand-and-enet.patch +arm-dts-logicpd-somlv-fix-wl127x-pinmux.patch +arm-dts-am4372-correct-the-interrupts_properties-of-mcasp.patch +arm-dts-am437x-cm-t43-correct-the-dmas-property-of-spi0.patch +perf-record-fix-c-f-options-for-cpu-event-aliases.patch +perf-help-fix-a-bug-during-strstart-conversion.patch +perf-annotate-do-not-truncate-instruction-names-at-6-chars.patch +perf-test-shell-fix-check-open-filename-arg-using-perf-trace-on-s390x.patch +perf-fix-header.size-for-namespace-events.patch +perf-top-fix-window-dimensions-change-handling.patch +perf-bench-numa-fixup-discontiguous-sparse-numa-nodes.patch +perf-test-fix-test-21-for-s390x.patch +pinctrl-denverton-fix-uart2-rts-pin-mode.patch +kvm-arm-don-t-treat-unavailable-hyp-mode-as-an-error.patch +trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch +media-s5k6aa-describe-some-function-parameters.patch +media-ov13858-select-v4l2_fwnode.patch +net-mvpp2-allocate-zeroed-tx-descriptors.patch +gpio-74x164-fix-crash-during-.remove.patch +gpio-davinci-assign-first-bank-regs-for-unbanked-case.patch +pinctrl-sunxi-fix-a80-interrupt-pin-bank.patch +pinctrl-sunxi-fix-a64-uart-mux-value.patch +ib-hfi1-initialize-bth1-in-16b-rc-ack-builder.patch +meson-gx-socinfo-fix-package-id-parsing.patch +kvm-arm-arm64-fix-spinlock-acquisition-in-vgic_set_owner.patch +i40iw-allocate-a-sdbuf-per-cqp-wqe.patch +i40iw-do-not-free-sqbuf-when-event-is-i40iw_timer_type_close.patch +i40iw-correct-arp-index-mask.patch +rdma-cma-make-sure-that-psn-is-not-over-max-allowed.patch +ib-core-init-subsys-if-compiled-to-vmlinuz-core.patch +md-raid5-correct-degraded-calculation-in-raid5_error.patch +sctp-only-update-outstanding_bytes-for-transmitted-queue-when-doing-prsctp_prune.patch +sfp-fix-rx_los-signal-handling.patch +phylink-ensure-we-take-the-link-down-when-phylink_stop-is-called.patch +md-raid1-10-add-missed-blk-plug.patch +iio-proximity-sx9500-assign-interrupt-from-gpioio.patch +iio-fix-kernel-doc-build-errors.patch +scripts-kernel-doc-don-t-fail-with-status-0-if-error-encountered-with-none.patch +bnxt_en-need-to-unconditionally-shut-down-roce-in-bnxt_shutdown.patch +ipvlan-add-the-skb-mark-as-flow4-s-member-to-lookup-route.patch +m68k-add-missing-softirqentry_text-linker-section.patch +powerpc-perf-fix-oops-when-grouping-different-pmu-events.patch +pm-runtime-fix-handling-of-suppliers-with-disabled-runtime-pm.patch +s390-virtio-add-bsd-license-to-virtio-ccw.patch +s390-dasd-prevent-prefix-i-o-error.patch +arm-dts-fix-elm-interrupt-compiler-warning.patch +nfp-fix-port-stats-for-mac-representors.patch +gianfar-fix-a-flooded-alignment-reports-because-of-padding-issue.patch +net_sched-red-avoid-devision-by-zero.patch +net_sched-red-avoid-illegal-values.patch +vsock-fix-outdated-sk_state-value-in-hvs_release.patch +kvm-vmx-fix-page-leak-in-hardware_setup.patch +net-qualcomm-rmnet-fix-leak-on-transmit-failure.patch +locking-lockdep-fix-possible-null-deref.patch +btrfs-fix-quota-reservation-leak-on-preallocated-files.patch +btrfs-disable-fua-if-mounted-with-nobarrier.patch +btrfs-fix-possible-off-by-one-in-btrfs_search_path_in_tree.patch +brcmfmac-avoid-build-error-with-make-w-1.patch +virtio_net-fix-return-value-check-in-receive_mergeable.patch +net-ethernet-arc-fix-error-handling-in-emac_rockchip_probe.patch +net-dsa-mv88e6xxx-fix-interrupt-masking-on-removal.patch +net-dsa-mv88e6xxx-unregister-mdio-bus-on-error-path.patch +509-fix-printing-uninitialized-stack-memory-when-oid-is-empty.patch +gianfar-disable-eee-autoneg-by-default.patch +scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch +scsi-bfa-fix-access-to-bfad_im_port_s.patch +scsi-bfa-fix-type-conversion-warning.patch +dmaengine-ioat-fix-error-handling-path.patch +dmaengine-at_hdmac-fix-potential-null-pointer-dereference-in-atc_prep_dma_interleaved.patch +xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch +netfilter-xt_bpf-add-overflow-checks.patch +clk-fix-a-panic-error-caused-by-accessing-null-pointer.patch +staging-ccree-uninitialized-return-in-ssi_ahash_import.patch +asoc-rockchip-disable-clock-on-error.patch +spi-sun4i-disable-clocks-in-the-remove-function.patch +ib-mlx4-fix-rss-hash-fields-restrictions.patch +xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch +drm-armada-fix-leak-of-crtc-structure.patch +asoc-rsnd-ssi-fix-race-condition-in-rsnd_ssi_pointer_update.patch +drm-vc4-release-fence-after-signalling.patch +dmaengine-jz4740-disable-unprepare-clk-if-probe-fails.patch +usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch +usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch +mm-early_ioremap-fix-boot-hang-with-earlyprintk-efi-keep.patch +x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch +platform-x86-dell-laptop-fix-keyboard-max-lighting-for-dell-latitude-e6410.patch +xen-xen_acpi_processor-is-dom0-only.patch +pci-rcar-fix-use-after-free-in-probe-error-path.patch +powerpc-perf-imc-fix-nest-imc-cpuhotplug-callback-failure.patch +hippi-fix-a-fix-a-possible-sleep-in-atomic-bug-in-rr_close.patch diff --git a/queue-4.14/sfp-fix-rx_los-signal-handling.patch b/queue-4.14/sfp-fix-rx_los-signal-handling.patch new file mode 100644 index 00000000000..328671c162f --- /dev/null +++ b/queue-4.14/sfp-fix-rx_los-signal-handling.patch @@ -0,0 +1,55 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Russell King +Date: Thu, 30 Nov 2017 13:59:11 +0000 +Subject: sfp: fix RX_LOS signal handling + +From: Russell King + + +[ Upstream commit acf1c02f023926b8b04672a9e81b1711ae681619 ] + +The options word is a be16 quantity, so we need to test the flags +having converted the endian-ness. Convert the flag bits to be16, +which can be optimised by the compiler, rather than converting a +variable at runtime. + +Reported-by: Florian Fainelli +Signed-off-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/sfp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -358,7 +358,7 @@ static void sfp_sm_link_check_los(struct + * SFP_OPTIONS_LOS_NORMAL are set? For now, we assume + * the same as SFP_OPTIONS_LOS_NORMAL set. + */ +- if (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED) ++ if (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_INVERTED)) + los ^= SFP_F_LOS; + + if (los) +@@ -583,7 +583,8 @@ static void sfp_sm_event(struct sfp *sfp + if (event == SFP_E_TX_FAULT) + sfp_sm_fault(sfp, true); + else if (event == +- (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ? ++ (sfp->id.ext.options & ++ cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) ? + SFP_E_LOS_HIGH : SFP_E_LOS_LOW)) + sfp_sm_link_up(sfp); + break; +@@ -593,7 +594,8 @@ static void sfp_sm_event(struct sfp *sfp + sfp_sm_link_down(sfp); + sfp_sm_fault(sfp, true); + } else if (event == +- (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ? ++ (sfp->id.ext.options & ++ cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) ? + SFP_E_LOS_LOW : SFP_E_LOS_HIGH)) { + sfp_sm_link_down(sfp); + sfp_sm_next(sfp, SFP_S_WAIT_LOS, 0); diff --git a/queue-4.14/spi-sun4i-disable-clocks-in-the-remove-function.patch b/queue-4.14/spi-sun4i-disable-clocks-in-the-remove-function.patch new file mode 100644 index 00000000000..bad17543822 --- /dev/null +++ b/queue-4.14/spi-sun4i-disable-clocks-in-the-remove-function.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Takuo Koguchi +Date: Thu, 7 Dec 2017 16:20:14 +0900 +Subject: spi: sun4i: disable clocks in the remove function + +From: Takuo Koguchi + + +[ Upstream commit c810daba0ab5226084a56893a789af427a801146 ] + +mclk and hclk need to be disabled. Since pm_runtime_disable does +not disable the clocks, use pm_runtime_force_suspend instead. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Takuo Koguchi +Acked-by: Maxime Ripard +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-sun4i.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-sun4i.c ++++ b/drivers/spi/spi-sun4i.c +@@ -525,7 +525,7 @@ err_free_master: + + static int sun4i_spi_remove(struct platform_device *pdev) + { +- pm_runtime_disable(&pdev->dev); ++ pm_runtime_force_suspend(&pdev->dev); + + return 0; + } diff --git a/queue-4.14/staging-ccree-uninitialized-return-in-ssi_ahash_import.patch b/queue-4.14/staging-ccree-uninitialized-return-in-ssi_ahash_import.patch new file mode 100644 index 00000000000..33e25cdc8d1 --- /dev/null +++ b/queue-4.14/staging-ccree-uninitialized-return-in-ssi_ahash_import.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Dan Carpenter +Date: Tue, 5 Dec 2017 17:37:17 +0300 +Subject: staging: ccree: Uninitialized return in ssi_ahash_import() + +From: Dan Carpenter + + +[ Upstream commit aece09024414b54158e03aa45f4a4436e7cb996c ] + +The return value isn't initialized on some success paths. + +Fixes: c5f39d07860c ("staging: ccree: fix leak of import() after init()") +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/ccree/ssi_hash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/ccree/ssi_hash.c ++++ b/drivers/staging/ccree/ssi_hash.c +@@ -1781,7 +1781,7 @@ static int ssi_ahash_import(struct ahash + struct device *dev = &ctx->drvdata->plat_dev->dev; + struct ahash_req_ctx *state = ahash_request_ctx(req); + u32 tmp; +- int rc; ++ int rc = 0; + + memcpy(&tmp, in, sizeof(u32)); + if (tmp != CC_EXPORT_MAGIC) { diff --git a/queue-4.14/trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch b/queue-4.14/trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch new file mode 100644 index 00000000000..0a2d2fbf0bc --- /dev/null +++ b/queue-4.14/trace-xdp-fix-compile-warning-struct-bpf_map-declared-inside-parameter-list.patch @@ -0,0 +1,69 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Xie XiuQi +Date: Thu, 30 Nov 2017 09:41:29 +0800 +Subject: trace/xdp: fix compile warning: 'struct bpf_map' declared inside parameter list + +From: Xie XiuQi + + +[ Upstream commit 23721a755f98ac846897a013c92cccb281c1bcc8 ] + +We meet this compile warning, which caused by missing bpf.h in xdp.h. + +In file included from ./include/trace/events/xdp.h:10:0, + from ./include/linux/bpf_trace.h:6, + from drivers/net/ethernet/intel/i40e/i40e_txrx.c:29: +./include/trace/events/xdp.h:93:17: warning: ‘struct bpf_map’ declared inside parameter list will not be visible outside of this definition or declaration + const struct bpf_map *map, u32 map_index), + ^ +./include/linux/tracepoint.h:187:34: note: in definition of macro ‘__DECLARE_TRACE’ + static inline void trace_##name(proto) \ + ^~~~~ +./include/linux/tracepoint.h:352:24: note: in expansion of macro ‘PARAMS’ + __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \ + ^~~~~~ +./include/linux/tracepoint.h:477:2: note: in expansion of macro ‘DECLARE_TRACE’ + DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) + ^~~~~~~~~~~~~ +./include/linux/tracepoint.h:477:22: note: in expansion of macro ‘PARAMS’ + DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) + ^~~~~~ +./include/trace/events/xdp.h:89:1: note: in expansion of macro ‘DEFINE_EVENT’ + DEFINE_EVENT(xdp_redirect_template, xdp_redirect, + ^~~~~~~~~~~~ +./include/trace/events/xdp.h:90:2: note: in expansion of macro ‘TP_PROTO’ + TP_PROTO(const struct net_device *dev, + ^~~~~~~~ +./include/trace/events/xdp.h:93:17: warning: ‘struct bpf_map’ declared inside parameter list will not be visible outside of this definition or declaration + const struct bpf_map *map, u32 map_index), + ^ +./include/linux/tracepoint.h:203:38: note: in definition of macro ‘__DECLARE_TRACE’ + register_trace_##name(void (*probe)(data_proto), void *data) \ + ^~~~~~~~~~ +./include/linux/tracepoint.h:354:4: note: in expansion of macro ‘PARAMS’ + PARAMS(void *__data, proto), \ + ^~~~~~ + +Reported-by: Huang Daode +Cc: Hanjun Guo +Fixes: 8d3b778ff544 ("xdp: tracepoint xdp_redirect also need a map argument") +Signed-off-by: Xie XiuQi +Acked-by: Jesper Dangaard Brouer +Acked-by: Steven Rostedt (VMware) +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/trace/events/xdp.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/trace/events/xdp.h ++++ b/include/trace/events/xdp.h +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + + #define __XDP_ACT_MAP(FN) \ + FN(ABORTED) \ diff --git a/queue-4.14/usb-build-drivers-usb-common-when-usb_support-is-set.patch b/queue-4.14/usb-build-drivers-usb-common-when-usb_support-is-set.patch new file mode 100644 index 00000000000..8241cbe5152 --- /dev/null +++ b/queue-4.14/usb-build-drivers-usb-common-when-usb_support-is-set.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Randy Dunlap +Date: Fri, 17 Nov 2017 11:00:45 -0800 +Subject: usb: build drivers/usb/common/ when USB_SUPPORT is set + +From: Randy Dunlap + + +[ Upstream commit c9d24f78268be444e803fb2bb138a2f598de9c23 ] + +PHY drivers can use ULPI interfaces when CONFIG_USB (which is host side +support) is not enabled, so also build drivers/usb/ when CONFIG_USB_SUPPORT +is enabled so that drivers/usb/common/ is built. + +ERROR: "ulpi_unregister_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined! +ERROR: "__ulpi_register_driver" [drivers/phy/ti/phy-tusb1210.ko] undefined! +ERROR: "ulpi_read" [drivers/phy/ti/phy-tusb1210.ko] undefined! +ERROR: "ulpi_write" [drivers/phy/ti/phy-tusb1210.ko] undefined! +ERROR: "ulpi_unregister_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined! +ERROR: "__ulpi_register_driver" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined! +ERROR: "ulpi_write" [drivers/phy/qualcomm/phy-qcom-usb-hs.ko] undefined! + +Signed-off-by: Randy Dunlap +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/Makefile | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/Makefile ++++ b/drivers/Makefile +@@ -105,6 +105,7 @@ obj-$(CONFIG_TC) += tc/ + obj-$(CONFIG_UWB) += uwb/ + obj-$(CONFIG_USB_PHY) += usb/ + obj-$(CONFIG_USB) += usb/ ++obj-$(CONFIG_USB_SUPPORT) += usb/ + obj-$(CONFIG_PCI) += usb/ + obj-$(CONFIG_USB_GADGET) += usb/ + obj-$(CONFIG_OF) += usb/ diff --git a/queue-4.14/usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch b/queue-4.14/usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch new file mode 100644 index 00000000000..c9486ea4eaf --- /dev/null +++ b/queue-4.14/usb-dwc3-gadget-wait-longer-for-controller-to-end-command-processing.patch @@ -0,0 +1,79 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Vincent Pelletier +Date: Thu, 30 Nov 2017 15:31:06 +0000 +Subject: usb: dwc3: gadget: Wait longer for controller to end command processing + +From: Vincent Pelletier + + +[ Upstream commit 8722e095f5a44d0e409e45c5ddc2ee9cf589c777 ] + +DWC3_DEPCMD_ENDTRANSFER has been witnessed to require around 600 iterations +before controller would become idle again after unplugging the USB cable +with AIO reads submitted. +Bump timeout from 500 iterations to 1000 so dwc3_stop_active_transfer does +not receive -ETIMEDOUT and does not WARN: + +[ 81.326273] ------------[ cut here ]------------ +[ 81.335341] WARNING: CPU: 0 PID: 1874 at drivers/usb/dwc3/gadget.c:2627 dwc3_stop_active_transfer.constprop.23+0x69/0xc0 [dwc3] +[ 81.347094] Modules linked in: usb_f_fs libcomposite configfs bnep btsdio bluetooth ecdh_generic brcmfmac brcmutil dwc3 intel_powerclamp coretemp ulpi kvm_intel udc_core kvm irqbypass crc32_pclmul crc32c_intel pcbc dwc3_pci aesni_intel aes_i586 crypto_simd cryptd ehci_pci ehci_hcd basincove_gpadc industrialio gpio_keys usbcore usb_common +[ 81.378142] CPU: 0 PID: 1874 Comm: irq/34-dwc3 Not tainted 4.14.0-edison+ #119 +[ 81.385545] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48 +[ 81.394548] task: f5b1be00 task.stack: f420a000 +[ 81.399219] EIP: dwc3_stop_active_transfer.constprop.23+0x69/0xc0 [dwc3] +[ 81.406086] EFLAGS: 00010086 CPU: 0 +[ 81.409672] EAX: 0000001f EBX: f5729800 ECX: c132a2a2 EDX: 00000000 +[ 81.416096] ESI: f4054014 EDI: f41cf400 EBP: f420be10 ESP: f420bdf4 +[ 81.422521] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 +[ 81.428061] CR0: 80050033 CR2: b7a3f000 CR3: 01d94000 CR4: 001006d0 +[ 81.434483] Call Trace: +[ 81.437063] __dwc3_gadget_ep_disable+0xa3/0x2b0 [dwc3] +[ 81.442438] ? _raw_spin_lock_irqsave+0x32/0x40 +[ 81.447135] dwc3_gadget_ep_disable+0xbf/0xe0 [dwc3] +[ 81.452269] usb_ep_disable+0x1c/0xd0 [udc_core] +[ 81.457048] ffs_func_eps_disable.isra.15+0x3b/0x90 [usb_f_fs] +[ 81.463070] ffs_func_set_alt+0x7d/0x310 [usb_f_fs] +[ 81.468132] ffs_func_disable+0x14/0x20 [usb_f_fs] +[ 81.473075] reset_config+0x5b/0x90 [libcomposite] +[ 81.478023] composite_disconnect+0x2b/0x50 [libcomposite] +[ 81.483685] dwc3_disconnect_gadget+0x39/0x50 [dwc3] +[ 81.488808] dwc3_gadget_disconnect_interrupt+0x21b/0x250 [dwc3] +[ 81.495014] dwc3_thread_interrupt+0x2a8/0xf70 [dwc3] +[ 81.500219] ? __schedule+0x78c/0x7e0 +[ 81.504027] irq_thread_fn+0x18/0x30 +[ 81.507715] ? irq_thread+0xb7/0x180 +[ 81.511400] irq_thread+0x111/0x180 +[ 81.515000] ? irq_finalize_oneshot+0xe0/0xe0 +[ 81.519490] ? wake_threads_waitq+0x30/0x30 +[ 81.523806] kthread+0x107/0x110 +[ 81.527131] ? disable_percpu_irq+0x50/0x50 +[ 81.531439] ? kthread_stop+0x150/0x150 +[ 81.535397] ret_from_fork+0x19/0x24 +[ 81.539136] Code: 89 d8 c7 45 ec 00 00 00 00 c7 45 f0 00 00 00 00 c7 45 f4 00 00 00 00 e8 56 ef ff ff 85 c0 74 12 50 68 b9 1c 14 f8 e8 64 0f f7 c8 <0f> ff 58 5a 8d 76 00 8b 83 98 00 00 00 c6 83 a0 00 00 00 00 83 +[ 81.559295] ---[ end trace f3133eec81a473b8 ]--- + +Number of iterations measured on 4 consecutive unplugs: +[ 1088.799777] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 605 times +[ 1222.024986] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 580 times +[ 1317.590452] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 598 times +[ 1453.218314] dwc3_send_gadget_ep_cmd(cmd=331016, params={0, 0, 0}) iterated 594 times + +Signed-off-by: Vincent Pelletier +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -267,7 +267,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ + { + const struct usb_endpoint_descriptor *desc = dep->endpoint.desc; + struct dwc3 *dwc = dep->dwc; +- u32 timeout = 500; ++ u32 timeout = 1000; + u32 reg; + + int cmd_status = 0; diff --git a/queue-4.14/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch b/queue-4.14/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch new file mode 100644 index 00000000000..964502a6430 --- /dev/null +++ b/queue-4.14/usb-dwc3-of-simple-fix-missing-clk_disable_unprepare.patch @@ -0,0 +1,40 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Andreas Platschek +Date: Thu, 7 Dec 2017 11:32:20 +0100 +Subject: usb: dwc3: of-simple: fix missing clk_disable_unprepare + +From: Andreas Platschek + + +[ Upstream commit ded600ea9fb51a495d2fcd21e90351df876488e8 ] + +If of_clk_get() fails, the clean-up of already initialized clocks should be +the same as when clk_prepare_enable() fails. Thus a clk_disable_unprepare() +for each clock should be called before the clk_put(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 16adc674d0d6 ("usb: dwc3: ep0: fix setup_packet_pending initialization") + +Signed-off-by: Andreas Platschek +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-of-simple.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-of-simple.c ++++ b/drivers/usb/dwc3/dwc3-of-simple.c +@@ -57,8 +57,10 @@ static int dwc3_of_simple_clk_init(struc + + clk = of_clk_get(np, i); + if (IS_ERR(clk)) { +- while (--i >= 0) ++ while (--i >= 0) { ++ clk_disable_unprepare(simple->clks[i]); + clk_put(simple->clks[i]); ++ } + return PTR_ERR(clk); + } + diff --git a/queue-4.14/virtio_net-fix-return-value-check-in-receive_mergeable.patch b/queue-4.14/virtio_net-fix-return-value-check-in-receive_mergeable.patch new file mode 100644 index 00000000000..1b4890b6bcc --- /dev/null +++ b/queue-4.14/virtio_net-fix-return-value-check-in-receive_mergeable.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Yunjian Wang +Date: Mon, 4 Dec 2017 14:02:19 +0800 +Subject: virtio_net: fix return value check in receive_mergeable() + +From: Yunjian Wang + + +[ Upstream commit 03e9f8a05bce7330bcd9c5cc54c8e42d0fcbf993 ] + +The function virtqueue_get_buf_ctx() could return NULL, the return +value 'buf' need to be checked with NULL, not value 'ctx'. + +Signed-off-by: Yunjian Wang +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/virtio_net.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -714,7 +714,7 @@ static struct sk_buff *receive_mergeable + int num_skb_frags; + + buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx); +- if (unlikely(!ctx)) { ++ if (unlikely(!buf)) { + pr_debug("%s: rx error: %d buffers out of %d missing\n", + dev->name, num_buf, + virtio16_to_cpu(vi->vdev, diff --git a/queue-4.14/vsock-fix-outdated-sk_state-value-in-hvs_release.patch b/queue-4.14/vsock-fix-outdated-sk_state-value-in-hvs_release.patch new file mode 100644 index 00000000000..98c3c4d7ce7 --- /dev/null +++ b/queue-4.14/vsock-fix-outdated-sk_state-value-in-hvs_release.patch @@ -0,0 +1,43 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Stefan Hajnoczi +Date: Tue, 5 Dec 2017 11:31:14 +0000 +Subject: VSOCK: fix outdated sk_state value in hvs_release() + +From: Stefan Hajnoczi + + +[ Upstream commit c9d3fe9da094a9a7a3d3cd365b334b822e05f5e8 ] + +Since commit 3b4477d2dcf2709d0be89e2a8dced3d0f4a017f2 ("VSOCK: use TCP +state constants for sk_state") VSOCK has used TCP_* constants for +sk_state. + +Commit b4562ca7925a3bedada87a3dd072dd5bad043288 ("hv_sock: add locking +in the open/close/release code paths") reintroduced the SS_DISCONNECTING +constant. + +This patch replaces the old SS_DISCONNECTING with the new TCP_CLOSING +constant. + +CC: Dexuan Cui +CC: Cathy Avery +Signed-off-by: Stefan Hajnoczi +Reviewed-by: Jorgen Hansen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/vmw_vsock/hyperv_transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/vmw_vsock/hyperv_transport.c ++++ b/net/vmw_vsock/hyperv_transport.c +@@ -488,7 +488,7 @@ static void hvs_release(struct vsock_soc + + lock_sock(sk); + +- sk->sk_state = SS_DISCONNECTING; ++ sk->sk_state = TCP_CLOSING; + vsock_remove_sock(vsk); + + release_sock(sk); diff --git a/queue-4.14/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch b/queue-4.14/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch new file mode 100644 index 00000000000..6fb8f45353d --- /dev/null +++ b/queue-4.14/x86-mm-kmmio-fix-mmiotrace-for-page-unaligned-addresses.patch @@ -0,0 +1,116 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Karol Herbst +Date: Mon, 27 Nov 2017 08:51:39 +0100 +Subject: x86/mm/kmmio: Fix mmiotrace for page unaligned addresses + +From: Karol Herbst + + +[ Upstream commit 6d60ce384d1d5ca32b595244db4077a419acc687 ] + +If something calls ioremap() with an address not aligned to PAGE_SIZE, the +returned address might be not aligned as well. This led to a probe +registered on exactly the returned address, but the entire page was armed +for mmiotracing. + +On calling iounmap() the address passed to unregister_kmmio_probe() was +PAGE_SIZE aligned by the caller leading to a complete freeze of the +machine. + +We should always page align addresses while (un)registerung mappings, +because the mmiotracer works on top of pages, not mappings. We still keep +track of the probes based on their real addresses and lengths though, +because the mmiotrace still needs to know what are mapped memory regions. + +Also move the call to mmiotrace_iounmap() prior page aligning the address, +so that all probes are unregistered properly, otherwise the kernel ends up +failing memory allocations randomly after disabling the mmiotracer. + +Tested-by: Lyude +Signed-off-by: Karol Herbst +Acked-by: Pekka Paalanen +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Steven Rostedt +Cc: Thomas Gleixner +Cc: nouveau@lists.freedesktop.org +Link: http://lkml.kernel.org/r/20171127075139.4928-1-kherbst@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/mm/ioremap.c | 4 ++-- + arch/x86/mm/kmmio.c | 12 +++++++----- + 2 files changed, 9 insertions(+), 7 deletions(-) + +--- a/arch/x86/mm/ioremap.c ++++ b/arch/x86/mm/ioremap.c +@@ -349,11 +349,11 @@ void iounmap(volatile void __iomem *addr + return; + } + ++ mmiotrace_iounmap(addr); ++ + addr = (volatile void __iomem *) + (PAGE_MASK & (unsigned long __force)addr); + +- mmiotrace_iounmap(addr); +- + /* Use the vm area unlocked, assuming the caller + ensures there isn't another iounmap for the same address + in parallel. Reuse of the virtual address is prevented by +--- a/arch/x86/mm/kmmio.c ++++ b/arch/x86/mm/kmmio.c +@@ -435,17 +435,18 @@ int register_kmmio_probe(struct kmmio_pr + unsigned long flags; + int ret = 0; + unsigned long size = 0; ++ unsigned long addr = p->addr & PAGE_MASK; + const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); + unsigned int l; + pte_t *pte; + + spin_lock_irqsave(&kmmio_lock, flags); +- if (get_kmmio_probe(p->addr)) { ++ if (get_kmmio_probe(addr)) { + ret = -EEXIST; + goto out; + } + +- pte = lookup_address(p->addr, &l); ++ pte = lookup_address(addr, &l); + if (!pte) { + ret = -EINVAL; + goto out; +@@ -454,7 +455,7 @@ int register_kmmio_probe(struct kmmio_pr + kmmio_count++; + list_add_rcu(&p->list, &kmmio_probes); + while (size < size_lim) { +- if (add_kmmio_fault_page(p->addr + size)) ++ if (add_kmmio_fault_page(addr + size)) + pr_err("Unable to set page fault.\n"); + size += page_level_size(l); + } +@@ -528,19 +529,20 @@ void unregister_kmmio_probe(struct kmmio + { + unsigned long flags; + unsigned long size = 0; ++ unsigned long addr = p->addr & PAGE_MASK; + const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); + struct kmmio_fault_page *release_list = NULL; + struct kmmio_delayed_release *drelease; + unsigned int l; + pte_t *pte; + +- pte = lookup_address(p->addr, &l); ++ pte = lookup_address(addr, &l); + if (!pte) + return; + + spin_lock_irqsave(&kmmio_lock, flags); + while (size < size_lim) { +- release_kmmio_fault_page(p->addr + size, &release_list); ++ release_kmmio_fault_page(addr + size, &release_list); + size += page_level_size(l); + } + list_del_rcu(&p->list); diff --git a/queue-4.14/xen-xen_acpi_processor-is-dom0-only.patch b/queue-4.14/xen-xen_acpi_processor-is-dom0-only.patch new file mode 100644 index 00000000000..74e3baa24f1 --- /dev/null +++ b/queue-4.14/xen-xen_acpi_processor-is-dom0-only.patch @@ -0,0 +1,32 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Jan Beulich +Date: Tue, 12 Dec 2017 03:18:11 -0700 +Subject: xen: XEN_ACPI_PROCESSOR is Dom0-only + +From: Jan Beulich + + +[ Upstream commit c4f9d9cb2c29ff04c6b4bb09b72802d8aedfc7cb ] + +Add a respective dependency. + +Signed-off-by: Jan Beulich +Reviewed-by: Juergen Gross +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/xen/Kconfig ++++ b/drivers/xen/Kconfig +@@ -258,7 +258,7 @@ config XEN_ACPI_HOTPLUG_CPU + + config XEN_ACPI_PROCESSOR + tristate "Xen ACPI processor" +- depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ ++ depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ + default m + help + This ACPI processor uploads Power Management information to the Xen diff --git a/queue-4.14/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch b/queue-4.14/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch new file mode 100644 index 00000000000..75126b5abc9 --- /dev/null +++ b/queue-4.14/xfrm-fix-stack-out-of-bounds-with-misconfigured-transport-mode-policies.patch @@ -0,0 +1,64 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Steffen Klassert +Date: Fri, 8 Dec 2017 08:07:25 +0100 +Subject: xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. + +From: Steffen Klassert + + +[ Upstream commit 732706afe1cc46ef48493b3d2b69c98f36314ae4 ] + +On policies with a transport mode template, we pass the addresses +from the flowi to xfrm_state_find(), assuming that the IP addresses +(and address family) don't change during transformation. + +Unfortunately our policy template validation is not strict enough. +It is possible to configure policies with transport mode template +where the address family of the template does not match the selectors +address family. This lead to stack-out-of-bound reads because +we compare arddesses of the wrong family. Fix this by refusing +such a configuration, address family can not change on transport +mode. + +We use the assumption that, on transport mode, the first templates +address family must match the address family of the policy selector. +Subsequent transport mode templates must mach the address family of +the previous template. + +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_user.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1417,11 +1417,14 @@ static void copy_templates(struct xfrm_p + + static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) + { ++ u16 prev_family; + int i; + + if (nr > XFRM_MAX_DEPTH) + return -EINVAL; + ++ prev_family = family; ++ + for (i = 0; i < nr; i++) { + /* We never validated the ut->family value, so many + * applications simply leave it at zero. The check was +@@ -1433,6 +1436,12 @@ static int validate_tmpl(int nr, struct + if (!ut[i].family) + ut[i].family = family; + ++ if ((ut[i].mode == XFRM_MODE_TRANSPORT) && ++ (ut[i].family != prev_family)) ++ return -EINVAL; ++ ++ prev_family = ut[i].family; ++ + switch (ut[i].family) { + case AF_INET: + break; diff --git a/queue-4.14/xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch b/queue-4.14/xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch new file mode 100644 index 00000000000..8c166a8d49a --- /dev/null +++ b/queue-4.14/xfrm-fix-xfrm_input-to-verify-state-is-valid-when-encap_type-0.patch @@ -0,0 +1,54 @@ +From foo@baz Fri Feb 23 11:45:09 CET 2018 +From: Aviv Heller +Date: Tue, 28 Nov 2017 19:55:40 +0200 +Subject: xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0) + +From: Aviv Heller + + +[ Upstream commit 4ce3dbe397d7b6b15f272ae757c78c35e9e4b61d ] + +Code path when (encap_type < 0) does not verify the state is valid +before progressing. + +This will result in a crash if, for instance, x->km.state == +XFRM_STATE_ACQ. + +Fixes: 7785bba299a8 ("esp: Add a software GRO codepath") +Signed-off-by: Aviv Heller +Signed-off-by: Yevgeny Kliteynik +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_input.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -207,7 +207,7 @@ int xfrm_input(struct sk_buff *skb, int + xfrm_address_t *daddr; + struct xfrm_mode *inner_mode; + u32 mark = skb->mark; +- unsigned int family; ++ unsigned int family = AF_UNSPEC; + int decaps = 0; + int async = 0; + bool xfrm_gro = false; +@@ -216,6 +216,16 @@ int xfrm_input(struct sk_buff *skb, int + + if (encap_type < 0) { + x = xfrm_input_state(skb); ++ ++ if (unlikely(x->km.state != XFRM_STATE_VALID)) { ++ if (x->km.state == XFRM_STATE_ACQ) ++ XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR); ++ else ++ XFRM_INC_STATS(net, ++ LINUX_MIB_XFRMINSTATEINVALID); ++ goto drop; ++ } ++ + family = x->outer_mode->afinfo->family; + + /* An encap_type of -1 indicates async resumption. */ -- 2.47.3