From 11282d1beec68e34b7e9d28645630e15133525a5 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 19 Jul 2021 09:16:49 -0400 Subject: [PATCH] Fixes for 4.9 Signed-off-by: Sasha Levin --- ...amba-fix-resource-name-in-proc-iomem.patch | 36 +++ ...-bebob-add-support-for-toneweal-fw66.patch | 105 ++++++++ ...a-add-irq-check-for-platform_get_irq.patch | 45 ++++ ...ror-return-code-in-snd_cmi8330_probe.patch | 39 +++ ...-error-return-code-in-snd_pmac_probe.patch | 41 +++ ...ntial-double-free-of-csp-mixer-eleme.patch | 47 ++++ ...probes-test-thumb-fix-for-llvm_ias-1.patch | 71 +++++ ...lign-ti-pindir-d0-out-d1-in-property.patch | 36 +++ ...ix-pwm-led-max-brightness-on-odroid-.patch | 47 ++++ ...-led-max-brightness-on-odroid-.patch-27262 | 37 +++ ...ts-r8a7779-marzen-fix-du-clock-names.patch | 56 ++++ ...x-the-error-return-code-in-snd_soc_o.patch | 37 +++ ...a-fix-return-code-of-.update_status-.patch | 74 ++++++ ...s-checks-and-warn_ons-from-ceph_set_.patch | 56 ++++ ...-fix-missing-error-code-in-lmloginit.patch | 39 +++ ...-return-value-of-pm_runtime_get_sync.patch | 40 +++ .../hexagon-use-common-discards-macro.patch | 62 +++++ ...isable-client-irq-on-reboot-shutdown.patch | 59 +++++ ...nlz4.c-correctly-handle-zero-padding.patch | 99 +++++++ ...ix-leak-of-io-mapping-on-probe-failu.patch | 48 ++++ ...ix-leak-of-private-memory-on-probe-f.patch | 45 ++++ ...e-add-and-modify-module_device_table.patch | 50 ++++ ...k-byteswap-helpers-into-decompressor.patch | 65 +++++ ...ranch-profiling-in-boot-decompress.o.patch | 48 ++++ ...vdso-invalid-gic-access-through-vdso.patch | 65 +++++ ...ule-fix-two-use-after-free-in-ibmasm.patch | 58 +++++ ...-acl-memory-leak-of-posix_acl_create.patch | 50 ++++ .../orangefs-fix-orangefs-df-output.patch | 34 +++ ...m_label_utf16s_to_utf8s-buffer-overr.patch | 47 ++++ ...-poweroff-add-missing-module_device_.patch | 36 +++ ...8500-add-missing-module_device_table.patch | 62 +++++ ...er-supply-ab8500-avoid-null-pointers.patch | 60 +++++ ...rger-manager-add-missing-module_devi.patch | 36 +++ ...033_battery-fix-device-tree-enumerat.patch | 67 +++++ ...t-fixup-device-tree-on-little-endian.patch | 243 ++++++++++++++++++ ...c-ps3-add-dma_mask-to-ps3_dma_region.patch | 93 +++++++ ...-modify-hw-state-in-.remove-callback.patch | 45 ++++ ...-modify-hw-state-in-.remove-callback.patch | 61 +++++ .../reset-bail-if-try_module_get-fails.patch | 44 ++++ ...b-oxfw-fix-kconfig-entry-for-mackie-.patch | 80 ++++++ ...-snprintf-checking-in-is_rtc_hctosys.patch | 44 ++++ ...220-fix-console-name-to-match-device.patch | 63 +++++ ...x-an-error-handling-path-in-beiscsi_.patch | 37 +++ ...-add-iscsi_cls_conn-refcount-helpers.patch | 97 +++++++ ...expected-timeout-error-in-direct-att.patch | 53 ++++ ...-powerpc-fix-no_handler-ebb-selftest.patch | 45 ++++ queue-4.9/series | 61 +++++ ...serial_cs-fix-a-memory-leak-in-error.patch | 55 ++++ ...puart-fix-the-potential-risk-of-divi.patch | 41 +++ ...i_linkable-under-i_lock-for-whiteout.patch | 79 ++++++ ...m-fix-error-return-code-in-slip_open.patch | 39 +++ ...fix-error-return-code-in-winch_tramp.patch | 39 +++ ...-fix-endianness-issue-with-descripto.patch | 45 ++++ ...id-fix-error-return-code-in-hid_bind.patch | 40 +++ ...emory-leak-among-suspend-resume-proc.patch | 37 +++ ...ssure-used-length-from-device-is-lim.patch | 47 ++++ ...eed-fix-hardware-timeout-calculation.patch | 40 +++ ...sible-use-after-free-by-calling-del_.patch | 59 +++++ ...ssible-use-after-free-in-wdt_startup.patch | 44 ++++ ...dt-fix-possible-use-after-free-in-wd.patch | 44 ++++ ...t-xstate-copy-size-in-xstateregs_set.patch | 39 +++ ...roper-error-codes-from-user-access-f.patch | 86 +++++++ 62 files changed, 3497 insertions(+) create mode 100644 queue-4.9/acpi-amba-fix-resource-name-in-proc-iomem.patch create mode 100644 queue-4.9/alsa-bebob-add-support-for-toneweal-fw66.patch create mode 100644 queue-4.9/alsa-hda-add-irq-check-for-platform_get_irq.patch create mode 100644 queue-4.9/alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch create mode 100644 queue-4.9/alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch create mode 100644 queue-4.9/alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch create mode 100644 queue-4.9/arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch create mode 100644 queue-4.9/arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch create mode 100644 queue-4.9/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch create mode 100644 queue-4.9/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-27262 create mode 100644 queue-4.9/arm-dts-r8a7779-marzen-fix-du-clock-names.patch create mode 100644 queue-4.9/asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch create mode 100644 queue-4.9/backlight-lm3630a-fix-return-code-of-.update_status-.patch create mode 100644 queue-4.9/ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch create mode 100644 queue-4.9/fs-jfs-fix-missing-error-code-in-lmloginit.patch create mode 100644 queue-4.9/gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch create mode 100644 queue-4.9/hexagon-use-common-discards-macro.patch create mode 100644 queue-4.9/i2c-core-disable-client-irq-on-reboot-shutdown.patch create mode 100644 queue-4.9/lib-decompress_unlz4.c-correctly-handle-zero-padding.patch create mode 100644 queue-4.9/memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch create mode 100644 queue-4.9/memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch create mode 100644 queue-4.9/mfd-da9052-stmpe-add-and-modify-module_device_table.patch create mode 100644 queue-4.9/mips-always-link-byteswap-helpers-into-decompressor.patch create mode 100644 queue-4.9/mips-disable-branch-profiling-in-boot-decompress.o.patch create mode 100644 queue-4.9/mips-vdso-invalid-gic-access-through-vdso.patch create mode 100644 queue-4.9/misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch create mode 100644 queue-4.9/nfs-fix-acl-memory-leak-of-posix_acl_create.patch create mode 100644 queue-4.9/orangefs-fix-orangefs-df-output.patch create mode 100644 queue-4.9/pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch create mode 100644 queue-4.9/power-reset-gpio-poweroff-add-missing-module_device_.patch create mode 100644 queue-4.9/power-supply-ab8500-add-missing-module_device_table.patch create mode 100644 queue-4.9/power-supply-ab8500-avoid-null-pointers.patch create mode 100644 queue-4.9/power-supply-charger-manager-add-missing-module_devi.patch create mode 100644 queue-4.9/power-supply-rt5033_battery-fix-device-tree-enumerat.patch create mode 100644 queue-4.9/powerpc-boot-fixup-device-tree-on-little-endian.patch create mode 100644 queue-4.9/powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch create mode 100644 queue-4.9/pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch create mode 100644 queue-4.9/pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch create mode 100644 queue-4.9/reset-bail-if-try_module_get-fails.patch create mode 100644 queue-4.9/revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch create mode 100644 queue-4.9/rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch create mode 100644 queue-4.9/s390-sclp_vt220-fix-console-name-to-match-device.patch create mode 100644 queue-4.9/scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch create mode 100644 queue-4.9/scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch create mode 100644 queue-4.9/scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch create mode 100644 queue-4.9/selftests-powerpc-fix-no_handler-ebb-selftest.patch create mode 100644 queue-4.9/tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch create mode 100644 queue-4.9/tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch create mode 100644 queue-4.9/ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch create mode 100644 queue-4.9/um-fix-error-return-code-in-slip_open.patch create mode 100644 queue-4.9/um-fix-error-return-code-in-winch_tramp.patch create mode 100644 queue-4.9/usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch create mode 100644 queue-4.9/usb-gadget-hid-fix-error-return-code-in-hid_bind.patch create mode 100644 queue-4.9/virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch create mode 100644 queue-4.9/virtio_console-assure-used-length-from-device-is-lim.patch create mode 100644 queue-4.9/watchdog-aspeed-fix-hardware-timeout-calculation.patch create mode 100644 queue-4.9/watchdog-fix-possible-use-after-free-by-calling-del_.patch create mode 100644 queue-4.9/watchdog-fix-possible-use-after-free-in-wdt_startup.patch create mode 100644 queue-4.9/watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch create mode 100644 queue-4.9/x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch create mode 100644 queue-4.9/x86-fpu-return-proper-error-codes-from-user-access-f.patch diff --git a/queue-4.9/acpi-amba-fix-resource-name-in-proc-iomem.patch b/queue-4.9/acpi-amba-fix-resource-name-in-proc-iomem.patch new file mode 100644 index 00000000000..f66feb92674 --- /dev/null +++ b/queue-4.9/acpi-amba-fix-resource-name-in-proc-iomem.patch @@ -0,0 +1,36 @@ +From 8673e5506667b826b7a1893984fc671f431aaad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 19:27:48 +0800 +Subject: ACPI: AMBA: Fix resource name in /proc/iomem + +From: Liguang Zhang + +[ Upstream commit 7718629432676b5ebd9a32940782fe297a0abf8d ] + +In function amba_handler_attach(), dev->res.name is initialized by +amba_device_alloc. But when address_found is false, dev->res.name is +assigned to null value, which leads to wrong resource name display in +/proc/iomem, "" is seen for those resources. + +Signed-off-by: Liguang Zhang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_amba.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/acpi_amba.c b/drivers/acpi/acpi_amba.c +index 7f77c071709a..eb09ee71ceb2 100644 +--- a/drivers/acpi/acpi_amba.c ++++ b/drivers/acpi/acpi_amba.c +@@ -70,6 +70,7 @@ static int amba_handler_attach(struct acpi_device *adev, + case IORESOURCE_MEM: + if (!address_found) { + dev->res = *rentry->res; ++ dev->res.name = dev_name(&dev->dev); + address_found = true; + } + break; +-- +2.30.2 + diff --git a/queue-4.9/alsa-bebob-add-support-for-toneweal-fw66.patch b/queue-4.9/alsa-bebob-add-support-for-toneweal-fw66.patch new file mode 100644 index 00000000000..e42038784c9 --- /dev/null +++ b/queue-4.9/alsa-bebob-add-support-for-toneweal-fw66.patch @@ -0,0 +1,105 @@ +From b8036b8d939d961b42b907c6b9bd45f76ff66869 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 17:39:22 +0900 +Subject: ALSA: bebob: add support for ToneWeal FW66 + +From: Takashi Sakamoto + +[ Upstream commit 50ebe56222bfa0911a932930f9229ee5995508d9 ] + +A user of FFADO project reported the issue of ToneWeal FW66. As a result, +the device is identified as one of applications of BeBoB solution. + +I note that in the report the device returns contradictory result in plug +discovery process for audio subunit. Fortunately ALSA BeBoB driver doesn't +perform it thus it's likely to handle the device without issues. + +I receive no reaction to test request for this patch yet, however it would +be worth to add support for it. + +daniel@gibbonmoon:/sys/bus/firewire/devices/fw1$ grep -r . * +Binary file config_rom matches +dev:244:1 +guid:0x0023270002000000 +hardware_version:0x000002 +is_local:0 +model:0x020002 +model_name:FW66 +power/runtime_active_time:0 +power/runtime_active_kids:0 +power/runtime_usage:0 +power/runtime_status:unsupported +power/async:disabled +power/runtime_suspended_time:0 +power/runtime_enabled:disabled +power/control:auto +subsystem/drivers_autoprobe:1 +uevent:MAJOR=244 +uevent:MINOR=1 +uevent:DEVNAME=fw1 +units:0x00a02d:0x010001 +vendor:0x002327 +vendor_name:ToneWeal +fw1.0/uevent:MODALIAS=ieee1394:ven00002327mo00020002sp0000A02Dver00010001 +fw1.0/power/runtime_active_time:0 +fw1.0/power/runtime_active_kids:0 +fw1.0/power/runtime_usage:0 +fw1.0/power/runtime_status:unsupported +fw1.0/power/async:disabled +fw1.0/power/runtime_suspended_time:0 +fw1.0/power/runtime_enabled:disabled +fw1.0/power/control:auto +fw1.0/model:0x020002 +fw1.0/rom_index:15 +fw1.0/specifier_id:0x00a02d +fw1.0/model_name:FW66 +fw1.0/version:0x010001 +fw1.0/modalias:ieee1394:ven00002327mo00020002sp0000A02Dver00010001 + +Cc: Daniel Jozsef +Reference: https://lore.kernel.org/alsa-devel/20200119164335.GA11974@workstation/ +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210619083922.16060-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/Kconfig | 1 + + sound/firewire/bebob/bebob.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index da9874d54676..82894330cae1 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -108,6 +108,7 @@ config SND_BEBOB + * M-Audio Ozonic/NRV10/ProfireLightBridge + * M-Audio FireWire 1814/ProjectMix IO + * Digidesign Mbox 2 Pro ++ * ToneWeal FW66 + + To compile this driver as a module, choose M here: the module + will be called snd-bebob. +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index c51564213365..4bb2cbe73f20 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -60,6 +60,7 @@ static DECLARE_BITMAP(devices_used, SNDRV_CARDS); + #define VEN_MAUDIO1 0x00000d6c + #define VEN_MAUDIO2 0x000007f5 + #define VEN_DIGIDESIGN 0x00a07e ++#define OUI_SHOUYO 0x002327 + + #define MODEL_FOCUSRITE_SAFFIRE_BOTH 0x00000000 + #define MODEL_MAUDIO_AUDIOPHILE_BOTH 0x00010060 +@@ -513,6 +514,8 @@ static const struct ieee1394_device_id bebob_id_table[] = { + &maudio_special_spec), + /* Digidesign Mbox 2 Pro */ + SND_BEBOB_DEV_ENTRY(VEN_DIGIDESIGN, 0x0000a9, &spec_normal), ++ // Toneweal FW66. ++ SND_BEBOB_DEV_ENTRY(OUI_SHOUYO, 0x020002, &spec_normal), + /* IDs are unknown but able to be supported */ + /* Apogee, Mini-ME Firewire */ + /* Apogee, Mini-DAC Firewire */ +-- +2.30.2 + diff --git a/queue-4.9/alsa-hda-add-irq-check-for-platform_get_irq.patch b/queue-4.9/alsa-hda-add-irq-check-for-platform_get_irq.patch new file mode 100644 index 00000000000..fa189db34d1 --- /dev/null +++ b/queue-4.9/alsa-hda-add-irq-check-for-platform_get_irq.patch @@ -0,0 +1,45 @@ +From 264872579eed3ef7c3145644d389c61209b8ee90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 21:19:42 +0800 +Subject: ALSA: hda: Add IRQ check for platform_get_irq() + +From: Jiajun Cao + +[ Upstream commit 8c13212443230d03ff25014514ec0d53498c0912 ] + +The function hda_tegra_first_init() neglects to check the return +value after executing platform_get_irq(). + +hda_tegra_first_init() should check the return value (if negative +error number) for errors so as to not pass a negative value to +the devm_request_irq(). + +Fix it by adding a check for the return value irq_id. + +Signed-off-by: Jiajun Cao +Signed-off-by: Xin Tan +Reviewed-by: Thierry Reding +Link: https://lore.kernel.org/r/20210622131947.94346-1-jjcao20@fudan.edu.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_tegra.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c +index e85fb04ec7be..b567c4bdae00 100644 +--- a/sound/pci/hda/hda_tegra.c ++++ b/sound/pci/hda/hda_tegra.c +@@ -363,6 +363,9 @@ static int hda_tegra_first_init(struct azx *chip, struct platform_device *pdev) + unsigned short gcap; + int irq_id = platform_get_irq(pdev, 0); + ++ if (irq_id < 0) ++ return irq_id; ++ + err = hda_tegra_init_chip(chip, pdev); + if (err) + return err; +-- +2.30.2 + diff --git a/queue-4.9/alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch b/queue-4.9/alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch new file mode 100644 index 00000000000..5be6fa8e821 --- /dev/null +++ b/queue-4.9/alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch @@ -0,0 +1,39 @@ +From 695b927a15d80e105351de7d70385b70806f50ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 15:40:51 +0800 +Subject: ALSA: isa: Fix error return code in snd_cmi8330_probe() + +From: Zhen Lei + +[ Upstream commit 31028cbed26a8afa25533a10425ffa2ab794c76c ] + +When 'SB_HW_16' check fails, the error code -ENODEV instead of 0 should be +returned, which is the same as that returned when 'WSS_HW_CMI8330' check +fails. + +Fixes: 43bcd973d6d0 ("[ALSA] Add snd_card_set_generic_dev() call to ISA drivers") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210707074051.2663-1-thunder.leizhen@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/isa/cmi8330.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c +index dfedfd85f205..463906882b95 100644 +--- a/sound/isa/cmi8330.c ++++ b/sound/isa/cmi8330.c +@@ -564,7 +564,7 @@ static int snd_cmi8330_probe(struct snd_card *card, int dev) + } + if (acard->sb->hardware != SB_HW_16) { + snd_printk(KERN_ERR PFX "SB16 not found during probe\n"); +- return err; ++ return -ENODEV; + } + + snd_wss_out(acard->wss, CS4231_MISC_INFO, 0x40); /* switch on MODE2 */ +-- +2.30.2 + diff --git a/queue-4.9/alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch b/queue-4.9/alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch new file mode 100644 index 00000000000..6f2afb36a22 --- /dev/null +++ b/queue-4.9/alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch @@ -0,0 +1,41 @@ +From 01f019ba54f85265808c36f9d576a0295b83d034 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 10:11:21 +0800 +Subject: ALSA: ppc: fix error return code in snd_pmac_probe() + +From: Yang Yingliang + +[ Upstream commit 80b9c1be567c3c6bbe0d4b290af578e630485b5d ] + +If snd_pmac_tumbler_init() or snd_pmac_tumbler_post_init() fails, +snd_pmac_probe() need return error code. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210616021121.1991502-1-yangyingliang@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/ppc/powermac.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c +index 33c6be9fb388..7c70ba5e2540 100644 +--- a/sound/ppc/powermac.c ++++ b/sound/ppc/powermac.c +@@ -90,7 +90,11 @@ static int snd_pmac_probe(struct platform_device *devptr) + sprintf(card->shortname, "PowerMac %s", name_ext); + sprintf(card->longname, "%s (Dev %d) Sub-frame %d", + card->shortname, chip->device_id, chip->subframe); +- if ( snd_pmac_tumbler_init(chip) < 0 || snd_pmac_tumbler_post_init() < 0) ++ err = snd_pmac_tumbler_init(chip); ++ if (err < 0) ++ goto __error; ++ err = snd_pmac_tumbler_post_init(); ++ if (err < 0) + goto __error; + break; + case PMAC_AWACS: +-- +2.30.2 + diff --git a/queue-4.9/alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch b/queue-4.9/alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch new file mode 100644 index 00000000000..f23322680d8 --- /dev/null +++ b/queue-4.9/alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch @@ -0,0 +1,47 @@ +From 5200f1c7423acd65b61cb3dcf0eb0042e04b0e8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 16:04:37 +0200 +Subject: ALSA: sb: Fix potential double-free of CSP mixer elements + +From: Takashi Iwai + +[ Upstream commit c305366a37441c2ac90b08711cb6f032b43672f2 ] + +snd_sb_qsound_destroy() contains the calls of removing the previously +created mixer controls, but it doesn't clear the pointers. As +snd_sb_qsound_destroy() itself may be repeatedly called via ioctl, +this could lead to double-free potentially. + +Fix it by clearing the struct fields properly afterwards. + +Link: https://lore.kernel.org/r/20210608140540.17885-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/isa/sb/sb16_csp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c +index 2cc068be7d3b..90fa57ad14c0 100644 +--- a/sound/isa/sb/sb16_csp.c ++++ b/sound/isa/sb/sb16_csp.c +@@ -1086,10 +1086,14 @@ static void snd_sb_qsound_destroy(struct snd_sb_csp * p) + card = p->chip->card; + + down_write(&card->controls_rwsem); +- if (p->qsound_switch) ++ if (p->qsound_switch) { + snd_ctl_remove(card, p->qsound_switch); +- if (p->qsound_space) ++ p->qsound_switch = NULL; ++ } ++ if (p->qsound_space) { + snd_ctl_remove(card, p->qsound_space); ++ p->qsound_space = NULL; ++ } + up_write(&card->controls_rwsem); + + /* cancel pending transfer of QSound parameters */ +-- +2.30.2 + diff --git a/queue-4.9/arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch b/queue-4.9/arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch new file mode 100644 index 00000000000..69ebeda00f1 --- /dev/null +++ b/queue-4.9/arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch @@ -0,0 +1,71 @@ +From 1bebcf965d4c2aa38a13673958d0b455504e30a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 20:29:26 +0100 +Subject: ARM: 9087/1: kprobes: test-thumb: fix for LLVM_IAS=1 + +From: Nick Desaulniers + +[ Upstream commit 8b95a7d90ce8160ac5cffd5bace6e2eba01a871e ] + +There's a few instructions that GAS infers operands but Clang doesn't; +from what I can tell the Arm ARM doesn't say these are optional. + +F5.1.257 TBB, TBH T1 Halfword variant +F5.1.238 STREXD T1 variant +F5.1.84 LDREXD T1 variant + +Link: https://github.com/ClangBuiltLinux/linux/issues/1309 + +Signed-off-by: Nick Desaulniers +Reviewed-by: Jian Cai +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/probes/kprobes/test-thumb.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/probes/kprobes/test-thumb.c b/arch/arm/probes/kprobes/test-thumb.c +index b683b4517458..4254391f3906 100644 +--- a/arch/arm/probes/kprobes/test-thumb.c ++++ b/arch/arm/probes/kprobes/test-thumb.c +@@ -444,21 +444,21 @@ void kprobe_thumb32_test_cases(void) + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,"]", ++ TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,"]", ++ TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RRX("tbh [r",1,9f, ", r",14,1,"]", ++ TEST_RRX("tbh [r",1,9f, ", r",14,1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" +@@ -471,10 +471,10 @@ void kprobe_thumb32_test_cases(void) + + TEST_UNSUPPORTED("strexb r0, r1, [r2]") + TEST_UNSUPPORTED("strexh r0, r1, [r2]") +- TEST_UNSUPPORTED("strexd r0, r1, [r2]") ++ TEST_UNSUPPORTED("strexd r0, r1, r2, [r2]") + TEST_UNSUPPORTED("ldrexb r0, [r1]") + TEST_UNSUPPORTED("ldrexh r0, [r1]") +- TEST_UNSUPPORTED("ldrexd r0, [r1]") ++ TEST_UNSUPPORTED("ldrexd r0, r1, [r1]") + + TEST_GROUP("Data-processing (shifted register) and (modified immediate)") + +-- +2.30.2 + diff --git a/queue-4.9/arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch b/queue-4.9/arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch new file mode 100644 index 00000000000..6ec3df5dc36 --- /dev/null +++ b/queue-4.9/arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch @@ -0,0 +1,36 @@ +From c4f79e241147237c31dd26cbd098a3b8038f5a66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 10:39:51 +0530 +Subject: ARM: dts: am335x: align ti,pindir-d0-out-d1-in property with dt-shema + +From: Aswath Govindraju + +[ Upstream commit 414bfe1d26b60ef20b58e36efd5363188a694bab ] + +ti,pindir-d0-out-d1-in property is expected to be of type boolean. +Therefore, fix the property accordingly. + +Fixes: 444d66fafab8 ("ARM: dts: add spi wifi support to cm-t335") +Signed-off-by: Aswath Govindraju +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am335x-cm-t335.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/am335x-cm-t335.dts b/arch/arm/boot/dts/am335x-cm-t335.dts +index 947c81b7aaaf..56a04d3086c3 100644 +--- a/arch/arm/boot/dts/am335x-cm-t335.dts ++++ b/arch/arm/boot/dts/am335x-cm-t335.dts +@@ -552,7 +552,7 @@ status = "okay"; + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&spi0_pins>; +- ti,pindir-d0-out-d1-in = <1>; ++ ti,pindir-d0-out-d1-in; + /* WLS1271 WiFi */ + wlcore: wlcore@1 { + compatible = "ti,wl1271"; +-- +2.30.2 + diff --git a/queue-4.9/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch b/queue-4.9/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch new file mode 100644 index 00000000000..dda309a898d --- /dev/null +++ b/queue-4.9/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch @@ -0,0 +1,47 @@ +From bed86e0c1c80db923067bdb107fb09416d7fc56a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 09:59:39 -0400 +Subject: ARM: dts: exynos: fix PWM LED max brightness on Odroid XU/XU3 + +From: Krzysztof Kozlowski + +[ Upstream commit 75121e1dc9fe4def41e63d57f6a53749b88006ed ] + +There is no "max_brightness" property. This brings the intentional +brightness reduce of green LED and dtschema checks as well: + + arch/arm/boot/dts/exynos5410-odroidxu.dt.yaml: led-controller-1: led-1: 'max-brightness' is a required property + +Fixes: 719f39fec586 ("ARM: dts: exynos5422-odroidxu3: Hook up PWM and use it for LEDs") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210505135941.59898-3-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi +index 0ed30206625c..f547f67f2783 100644 +--- a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi ++++ b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi +@@ -25,7 +25,7 @@ + * Green LED is much brighter than the others + * so limit its max brightness + */ +- max_brightness = <127>; ++ max-brightness = <127>; + linux,default-trigger = "mmc0"; + }; + +@@ -33,7 +33,7 @@ + label = "blue:heartbeat"; + pwms = <&pwm 2 2000000 0>; + pwm-names = "pwm2"; +- max_brightness = <255>; ++ max-brightness = <255>; + linux,default-trigger = "heartbeat"; + }; + }; +-- +2.30.2 + diff --git a/queue-4.9/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-27262 b/queue-4.9/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-27262 new file mode 100644 index 00000000000..7595e92d820 --- /dev/null +++ b/queue-4.9/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-27262 @@ -0,0 +1,37 @@ +From 2961fbdffee075fc47be49994fc9a3a80c138809 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 09:59:41 -0400 +Subject: ARM: dts: exynos: fix PWM LED max brightness on Odroid XU4 + +From: Krzysztof Kozlowski + +[ Upstream commit fd2f1717966535b7d0b6fe45cf0d79e94330da5f ] + +There is no "max_brightness" property as pointed out by dtschema: + + arch/arm/boot/dts/exynos5422-odroidxu4.dt.yaml: led-controller: led-1: 'max-brightness' is a required property + +Fixes: 6658356014cb ("ARM: dts: Add support Odroid XU4 board for exynos5422-odroidxu4") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210505135941.59898-5-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5422-odroidxu4.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidxu4.dts b/arch/arm/boot/dts/exynos5422-odroidxu4.dts +index 2faf88627a48..b45e2a0c3908 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidxu4.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidxu4.dts +@@ -26,7 +26,7 @@ + label = "blue:heartbeat"; + pwms = <&pwm 2 2000000 0>; + pwm-names = "pwm2"; +- max_brightness = <255>; ++ max-brightness = <255>; + linux,default-trigger = "heartbeat"; + }; + }; +-- +2.30.2 + diff --git a/queue-4.9/arm-dts-r8a7779-marzen-fix-du-clock-names.patch b/queue-4.9/arm-dts-r8a7779-marzen-fix-du-clock-names.patch new file mode 100644 index 00000000000..c1a0c6b0f17 --- /dev/null +++ b/queue-4.9/arm-dts-r8a7779-marzen-fix-du-clock-names.patch @@ -0,0 +1,56 @@ +From b97a8a9d3cdf08e5bb3d3720dae110aada38d34b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 14:41:15 +0200 +Subject: ARM: dts: r8a7779, marzen: Fix DU clock names + +From: Geert Uytterhoeven + +[ Upstream commit 6ab8c23096a29b69044209a5925758a6f88bd450 ] + +"make dtbs_check" complains: + + arch/arm/boot/dts/r8a7779-marzen.dt.yaml: display@fff80000: clock-names:0: 'du.0' was expected + +Change the first clock name to match the DT bindings. +This has no effect on actual operation, as the Display Unit driver in +Linux does not use the first clock name on R-Car H1, but just grabs the +first clock. + +Fixes: 665d79aa47cb3983 ("ARM: shmobile: marzen: Add DU external pixel clock to DT") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/9d5e1b371121883b3b3e10a3df43802a29c6a9da.1619699965.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/r8a7779-marzen.dts | 2 +- + arch/arm/boot/dts/r8a7779.dtsi | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/r8a7779-marzen.dts b/arch/arm/boot/dts/r8a7779-marzen.dts +index 541678df90a9..50ec24bb1d79 100644 +--- a/arch/arm/boot/dts/r8a7779-marzen.dts ++++ b/arch/arm/boot/dts/r8a7779-marzen.dts +@@ -136,7 +136,7 @@ + status = "okay"; + + clocks = <&mstp1_clks R8A7779_CLK_DU>, <&x3_clk>; +- clock-names = "du", "dclkin.0"; ++ clock-names = "du.0", "dclkin.0"; + + ports { + port@0 { +diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi +index 6c6d4893e92d..3fb0a8d2530b 100644 +--- a/arch/arm/boot/dts/r8a7779.dtsi ++++ b/arch/arm/boot/dts/r8a7779.dtsi +@@ -431,6 +431,7 @@ + reg = <0 0xfff80000 0 0x40000>; + interrupts = ; + clocks = <&mstp1_clks R8A7779_CLK_DU>; ++ clock-names = "du.0"; + power-domains = <&sysc R8A7779_PD_ALWAYS_ON>; + status = "disabled"; + +-- +2.30.2 + diff --git a/queue-4.9/asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch b/queue-4.9/asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch new file mode 100644 index 00000000000..722d0bb9f10 --- /dev/null +++ b/queue-4.9/asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch @@ -0,0 +1,37 @@ +From d89d3f3215881b05e87594d369021f183d2cfb9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 18:37:29 +0800 +Subject: ASoC: soc-core: Fix the error return code in + snd_soc_of_parse_audio_routing() + +From: Zhen Lei + +[ Upstream commit 7d3865a10b9ff2669c531d5ddd60bf46b3d48f1e ] + +When devm_kcalloc() fails, the error code -ENOMEM should be returned +instead of -EINVAL. + +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210617103729.1918-1-thunder.leizhen@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 168559b5e9f3..0344d4423167 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -3644,7 +3644,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card, + if (!routes) { + dev_err(card->dev, + "ASoC: Could not allocate DAPM route table\n"); +- return -EINVAL; ++ return -ENOMEM; + } + + for (i = 0; i < num_routes; i++) { +-- +2.30.2 + diff --git a/queue-4.9/backlight-lm3630a-fix-return-code-of-.update_status-.patch b/queue-4.9/backlight-lm3630a-fix-return-code-of-.update_status-.patch new file mode 100644 index 00000000000..36d29493e6b --- /dev/null +++ b/queue-4.9/backlight-lm3630a-fix-return-code-of-.update_status-.patch @@ -0,0 +1,74 @@ +From 8bb324855ca85f46853a7fd1bebb23a9b05ca3b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 14:21:47 +0200 +Subject: backlight: lm3630a: Fix return code of .update_status() callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit b9481a667a90ec739995e85f91f3672ca44d6ffa ] + +According to .update_status() is supposed to +return 0 on success and a negative error code otherwise. Adapt +lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status() to +actually do it. + +While touching that also add the error code to the failure message. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Daniel Thompson +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lm3630a_bl.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c +index 1771220b2437..90a24b975240 100644 +--- a/drivers/video/backlight/lm3630a_bl.c ++++ b/drivers/video/backlight/lm3630a_bl.c +@@ -183,7 +183,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl) + if ((pwm_ctrl & LM3630A_PWM_BANK_A) != 0) { + lm3630a_pwm_ctrl(pchip, bl->props.brightness, + bl->props.max_brightness); +- return bl->props.brightness; ++ return 0; + } + + /* disable sleep */ +@@ -203,8 +203,8 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl) + return 0; + + out_i2c_err: +- dev_err(pchip->dev, "i2c failed to access\n"); +- return bl->props.brightness; ++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret)); ++ return ret; + } + + static int lm3630a_bank_a_get_brightness(struct backlight_device *bl) +@@ -260,7 +260,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl) + if ((pwm_ctrl & LM3630A_PWM_BANK_B) != 0) { + lm3630a_pwm_ctrl(pchip, bl->props.brightness, + bl->props.max_brightness); +- return bl->props.brightness; ++ return 0; + } + + /* disable sleep */ +@@ -280,8 +280,8 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl) + return 0; + + out_i2c_err: +- dev_err(pchip->dev, "i2c failed to access REG_CTRL\n"); +- return bl->props.brightness; ++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret)); ++ return ret; + } + + static int lm3630a_bank_b_get_brightness(struct backlight_device *bl) +-- +2.30.2 + diff --git a/queue-4.9/ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch b/queue-4.9/ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch new file mode 100644 index 00000000000..5f6995b5dec --- /dev/null +++ b/queue-4.9/ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch @@ -0,0 +1,56 @@ +From 507cfda6df2e4e6c584e44be49974b8d9c32f80b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 10:08:30 -0400 +Subject: ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty + +From: Jeff Layton + +[ Upstream commit 22d41cdcd3cfd467a4af074165357fcbea1c37f5 ] + +The checks for page->mapping are odd, as set_page_dirty is an +address_space operation, and I don't see where it would be called on a +non-pagecache page. + +The warning about the page lock also seems bogus. The comment over +set_page_dirty() says that it can be called without the page lock in +some rare cases. I don't think we want to warn if that's the case. + +Reported-by: Matthew Wilcox +Signed-off-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/addr.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index 36aa6d8cdff7..9791de2dc773 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -72,10 +72,6 @@ static int ceph_set_page_dirty(struct page *page) + struct inode *inode; + struct ceph_inode_info *ci; + struct ceph_snap_context *snapc; +- int ret; +- +- if (unlikely(!mapping)) +- return !TestSetPageDirty(page); + + if (PageDirty(page)) { + dout("%p set_page_dirty %p idx %lu -- already dirty\n", +@@ -121,11 +117,7 @@ static int ceph_set_page_dirty(struct page *page) + page->private = (unsigned long)snapc; + SetPagePrivate(page); + +- ret = __set_page_dirty_nobuffers(page); +- WARN_ON(!PageLocked(page)); +- WARN_ON(!page->mapping); +- +- return ret; ++ return __set_page_dirty_nobuffers(page); + } + + /* +-- +2.30.2 + diff --git a/queue-4.9/fs-jfs-fix-missing-error-code-in-lmloginit.patch b/queue-4.9/fs-jfs-fix-missing-error-code-in-lmloginit.patch new file mode 100644 index 00000000000..48ec60cf1cf --- /dev/null +++ b/queue-4.9/fs-jfs-fix-missing-error-code-in-lmloginit.patch @@ -0,0 +1,39 @@ +From 8e5fe008be93399b33ccbae9a037fff783473dcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 19:07:10 +0800 +Subject: fs/jfs: Fix missing error code in lmLogInit() + +From: Jiapeng Chong + +[ Upstream commit 492109333c29e1bb16d8732e1d597b02e8e0bf2e ] + +The error code is missing in this code scenario, add the error code +'-EINVAL' to the return value 'rc. + +Eliminate the follow smatch warning: + +fs/jfs/jfs_logmgr.c:1327 lmLogInit() warn: missing error code 'rc'. + +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index a21ea8b3e5fa..12555c4eeb2b 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -1338,6 +1338,7 @@ int lmLogInit(struct jfs_log * log) + } else { + if (memcmp(logsuper->uuid, log->uuid, 16)) { + jfs_warn("wrong uuid on JFS log device"); ++ rc = -EINVAL; + goto errout20; + } + log->size = le32_to_cpu(logsuper->size); +-- +2.30.2 + diff --git a/queue-4.9/gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch b/queue-4.9/gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch new file mode 100644 index 00000000000..df3f3c7c9d1 --- /dev/null +++ b/queue-4.9/gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch @@ -0,0 +1,40 @@ +From 07ba9d01901e3306b5f904d5a262df19a699abfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 19:38:05 +0530 +Subject: gpio: zynq: Check return value of pm_runtime_get_sync + +From: Srinivas Neeli + +[ Upstream commit a51b2fb94b04ab71e53a71b9fad03fa826941254 ] + +Return value of "pm_runtime_get_sync" API was neither captured nor checked. +Fixed it by capturing the return value and then checking for any warning. + +Addresses-Coverity: "check_return" +Signed-off-by: Srinivas Neeli +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-zynq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c +index 6b4d10d6e10f..5038d771ac6e 100644 +--- a/drivers/gpio/gpio-zynq.c ++++ b/drivers/gpio/gpio-zynq.c +@@ -778,8 +778,11 @@ err_pm_dis: + static int zynq_gpio_remove(struct platform_device *pdev) + { + struct zynq_gpio *gpio = platform_get_drvdata(pdev); ++ int ret; + +- pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_get_sync(&pdev->dev); ++ if (ret < 0) ++ dev_warn(&pdev->dev, "pm_runtime_get_sync() Failed\n"); + gpiochip_remove(&gpio->chip); + clk_disable_unprepare(gpio->clk); + device_set_wakeup_capable(&pdev->dev, 0); +-- +2.30.2 + diff --git a/queue-4.9/hexagon-use-common-discards-macro.patch b/queue-4.9/hexagon-use-common-discards-macro.patch new file mode 100644 index 00000000000..bde8cc8a4c9 --- /dev/null +++ b/queue-4.9/hexagon-use-common-discards-macro.patch @@ -0,0 +1,62 @@ +From abfe730a83914c8f5612f9efd2196798385bf7a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 18:07:41 -0700 +Subject: hexagon: use common DISCARDS macro + +From: Nathan Chancellor + +[ Upstream commit 681ba73c72302214686401e707e2087ed11a6556 ] + +ld.lld warns that the '.modinfo' section is not currently handled: + +ld.lld: warning: kernel/built-in.a(workqueue.o):(.modinfo) is being placed in '.modinfo' +ld.lld: warning: kernel/built-in.a(printk/printk.o):(.modinfo) is being placed in '.modinfo' +ld.lld: warning: kernel/built-in.a(irq/spurious.o):(.modinfo) is being placed in '.modinfo' +ld.lld: warning: kernel/built-in.a(rcu/update.o):(.modinfo) is being placed in '.modinfo' + +The '.modinfo' section was added in commit 898490c010b5 ("moduleparam: +Save information about built-in modules in separate file") to the DISCARDS +macro but Hexagon has never used that macro. The unification of DISCARDS +happened in commit 023bf6f1b8bf ("linker script: unify usage of discard +definition") in 2009, prior to Hexagon being added in 2011. + +Switch Hexagon over to the DISCARDS macro so that anything that is +expected to be discarded gets discarded. + +Link: https://lkml.kernel.org/r/20210521011239.1332345-3-nathan@kernel.org +Fixes: e95bf452a9e2 ("Hexagon: Add configuration and makefiles for the Hexagon architecture.") +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Acked-by: Brian Cain +Cc: David Rientjes +Cc: Oliver Glitta +Cc: Vlastimil Babka +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/hexagon/kernel/vmlinux.lds.S | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/arch/hexagon/kernel/vmlinux.lds.S b/arch/hexagon/kernel/vmlinux.lds.S +index ec87e67feb19..22c10102712a 100644 +--- a/arch/hexagon/kernel/vmlinux.lds.S ++++ b/arch/hexagon/kernel/vmlinux.lds.S +@@ -71,13 +71,8 @@ SECTIONS + + _end = .; + +- /DISCARD/ : { +- EXIT_TEXT +- EXIT_DATA +- EXIT_CALL +- } +- + STABS_DEBUG + DWARF_DEBUG + ++ DISCARDS + } +-- +2.30.2 + diff --git a/queue-4.9/i2c-core-disable-client-irq-on-reboot-shutdown.patch b/queue-4.9/i2c-core-disable-client-irq-on-reboot-shutdown.patch new file mode 100644 index 00000000000..6f245434b19 --- /dev/null +++ b/queue-4.9/i2c-core-disable-client-irq-on-reboot-shutdown.patch @@ -0,0 +1,59 @@ +From 8ec6e78dba33170f53c1d9d23af02f3addd3fa6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 16:27:44 -0700 +Subject: i2c: core: Disable client irq on reboot/shutdown + +From: Dmitry Torokhov + +[ Upstream commit b64210f2f7c11c757432ba3701d88241b2b98fb1 ] + +If an i2c client receives an interrupt during reboot or shutdown it may +be too late to service it by making an i2c transaction on the bus +because the i2c controller has already been shutdown. This can lead to +system hangs if the i2c controller tries to make a transfer that is +doomed to fail because the access to the i2c pins is already shut down, +or an iommu translation has been torn down so i2c controller register +access doesn't work. + +Let's simply disable the irq if there isn't a shutdown callback for an +i2c client when there is an irq associated with the device. This will +make sure that irqs don't come in later than the time that we can handle +it. We don't do this if the i2c client device already has a shutdown +callback because presumably they're doing the right thing and quieting +the device so irqs don't come in after the shutdown callback returns. + +Reported-by: kernel test robot +[swboyd@chromium.org: Dropped newline, added commit text, added +interrupt.h for robot build error] +Signed-off-by: Stephen Boyd +Signed-off-by: Dmitry Torokhov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c +index 4fd7bfda2f9d..67e44e990777 100644 +--- a/drivers/i2c/i2c-core.c ++++ b/drivers/i2c/i2c-core.c +@@ -42,6 +42,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1003,6 +1004,8 @@ static void i2c_device_shutdown(struct device *dev) + driver = to_i2c_driver(dev->driver); + if (driver->shutdown) + driver->shutdown(client); ++ else if (client->irq > 0) ++ disable_irq(client->irq); + } + + static void i2c_client_dev_release(struct device *dev) +-- +2.30.2 + diff --git a/queue-4.9/lib-decompress_unlz4.c-correctly-handle-zero-padding.patch b/queue-4.9/lib-decompress_unlz4.c-correctly-handle-zero-padding.patch new file mode 100644 index 00000000000..13870324408 --- /dev/null +++ b/queue-4.9/lib-decompress_unlz4.c-correctly-handle-zero-padding.patch @@ -0,0 +1,99 @@ +From bb7a7a2ad1d1bd84cb2110e7e1ab493ed94e492d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:56:16 -0700 +Subject: lib/decompress_unlz4.c: correctly handle zero-padding around initrds. + +From: Dimitri John Ledkov + +[ Upstream commit 2c484419efc09e7234c667aa72698cb79ba8d8ed ] + +lz4 compatible decompressor is simple. The format is underspecified and +relies on EOF notification to determine when to stop. Initramfs buffer +format[1] explicitly states that it can have arbitrary number of zero +padding. Thus when operating without a fill function, be extra careful to +ensure that sizes less than 4, or apperantly empty chunksizes are treated +as EOF. + +To test this I have created two cpio initrds, first a normal one, +main.cpio. And second one with just a single /test-file with content +"second" second.cpio. Then i compressed both of them with gzip, and with +lz4 -l. Then I created a padding of 4 bytes (dd if=/dev/zero of=pad4 bs=1 +count=4). To create four testcase initrds: + + 1) main.cpio.gzip + extra.cpio.gzip = pad0.gzip + 2) main.cpio.lz4 + extra.cpio.lz4 = pad0.lz4 + 3) main.cpio.gzip + pad4 + extra.cpio.gzip = pad4.gzip + 4) main.cpio.lz4 + pad4 + extra.cpio.lz4 = pad4.lz4 + +The pad4 test-cases replicate the initrd load by grub, as it pads and +aligns every initrd it loads. + +All of the above boot, however /test-file was not accessible in the initrd +for the testcase #4, as decoding in lz4 decompressor failed. Also an +error message printed which usually is harmless. + +Whith a patched kernel, all of the above testcases now pass, and +/test-file is accessible. + +This fixes lz4 initrd decompress warning on every boot with grub. And +more importantly this fixes inability to load multiple lz4 compressed +initrds with grub. This patch has been shipping in Ubuntu kernels since +January 2021. + +[1] ./Documentation/driver-api/early-userspace/buffer-format.rst + +BugLink: https://bugs.launchpad.net/bugs/1835660 +Link: https://lore.kernel.org/lkml/20210114200256.196589-1-xnox@ubuntu.com/ # v0 +Link: https://lkml.kernel.org/r/20210513104831.432975-1-dimitri.ledkov@canonical.com +Signed-off-by: Dimitri John Ledkov +Cc: Kyungsik Lee +Cc: Yinghai Lu +Cc: Bongkyu Kim +Cc: Kees Cook +Cc: Sven Schmidt <4sschmid@informatik.uni-hamburg.de> +Cc: Rajat Asthana +Cc: Nick Terrell +Cc: Gao Xiang +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/decompress_unlz4.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c +index 036fc882cd72..f1449244fdd4 100644 +--- a/lib/decompress_unlz4.c ++++ b/lib/decompress_unlz4.c +@@ -115,6 +115,9 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + error("data corrupted"); + goto exit_2; + } ++ } else if (size < 4) { ++ /* empty or end-of-file */ ++ goto exit_3; + } + + chunksize = get_unaligned_le32(inp); +@@ -128,6 +131,10 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + continue; + } + ++ if (!fill && chunksize == 0) { ++ /* empty or end-of-file */ ++ goto exit_3; ++ } + + if (posp) + *posp += 4; +@@ -184,6 +191,7 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + } + } + ++exit_3: + ret = 0; + exit_2: + if (!input) +-- +2.30.2 + diff --git a/queue-4.9/memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch b/queue-4.9/memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch new file mode 100644 index 00000000000..11decd4ad68 --- /dev/null +++ b/queue-4.9/memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch @@ -0,0 +1,48 @@ +From 464aa1fbf368c1a46b1427bb82e75d2f1b1a86bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 11:43:21 -0400 +Subject: memory: fsl_ifc: fix leak of IO mapping on probe failure + +From: Krzysztof Kozlowski + +[ Upstream commit 3b132ab67fc7a358fff35e808fa65d4bea452521 ] + +On probe error the driver should unmap the IO memory. Smatch reports: + + drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298. + +Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210527154322.81253-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/memory/fsl_ifc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c +index 1b182b117f9c..74bbbdc584f4 100644 +--- a/drivers/memory/fsl_ifc.c ++++ b/drivers/memory/fsl_ifc.c +@@ -231,8 +231,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + fsl_ifc_ctrl_dev->gregs = of_iomap(dev->dev.of_node, 0); + if (!fsl_ifc_ctrl_dev->gregs) { + dev_err(&dev->dev, "failed to get memory region\n"); +- ret = -ENODEV; +- goto err; ++ return -ENODEV; + } + + if (of_property_read_bool(dev->dev.of_node, "little-endian")) { +@@ -308,6 +307,7 @@ err_irq: + free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev); + irq_dispose_mapping(fsl_ifc_ctrl_dev->irq); + err: ++ iounmap(fsl_ifc_ctrl_dev->gregs); + return ret; + } + +-- +2.30.2 + diff --git a/queue-4.9/memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch b/queue-4.9/memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch new file mode 100644 index 00000000000..75cd89e7344 --- /dev/null +++ b/queue-4.9/memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch @@ -0,0 +1,45 @@ +From c1ef6c2aab9a66e61c871965d33df160155febc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 11:43:22 -0400 +Subject: memory: fsl_ifc: fix leak of private memory on probe failure + +From: Krzysztof Kozlowski + +[ Upstream commit 8e0d09b1232d0538066c40ed4c13086faccbdff6 ] + +On probe error the driver should free the memory allocated for private +structure. Fix this by using resource-managed allocation. + +Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210527154322.81253-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/memory/fsl_ifc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c +index 74bbbdc584f4..38b945eb410f 100644 +--- a/drivers/memory/fsl_ifc.c ++++ b/drivers/memory/fsl_ifc.c +@@ -109,7 +109,6 @@ static int fsl_ifc_ctrl_remove(struct platform_device *dev) + iounmap(ctrl->gregs); + + dev_set_drvdata(&dev->dev, NULL); +- kfree(ctrl); + + return 0; + } +@@ -221,7 +220,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + + dev_info(&dev->dev, "Freescale Integrated Flash Controller\n"); + +- fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL); ++ fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev), ++ GFP_KERNEL); + if (!fsl_ifc_ctrl_dev) + return -ENOMEM; + +-- +2.30.2 + diff --git a/queue-4.9/mfd-da9052-stmpe-add-and-modify-module_device_table.patch b/queue-4.9/mfd-da9052-stmpe-add-and-modify-module_device_table.patch new file mode 100644 index 00000000000..085fb0edbfc --- /dev/null +++ b/queue-4.9/mfd-da9052-stmpe-add-and-modify-module_device_table.patch @@ -0,0 +1,50 @@ +From 017e6a58a348690d77506d52c4d39241efb62945 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 14:33:46 +0800 +Subject: mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit 4700ef326556ed74aba188f12396740a8c1c21dd ] + +This patch adds/modifies MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-i2c.c | 1 + + drivers/mfd/stmpe-i2c.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-i2c.c b/drivers/mfd/da9052-i2c.c +index 578e881067a5..4094f97ec7dc 100644 +--- a/drivers/mfd/da9052-i2c.c ++++ b/drivers/mfd/da9052-i2c.c +@@ -118,6 +118,7 @@ static const struct i2c_device_id da9052_i2c_id[] = { + {"da9053-bc", DA9053_BC}, + {} + }; ++MODULE_DEVICE_TABLE(i2c, da9052_i2c_id); + + #ifdef CONFIG_OF + static const struct of_device_id dialog_dt_ids[] = { +diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c +index 863c39a3353c..d284df25c76b 100644 +--- a/drivers/mfd/stmpe-i2c.c ++++ b/drivers/mfd/stmpe-i2c.c +@@ -109,7 +109,7 @@ static const struct i2c_device_id stmpe_i2c_id[] = { + { "stmpe2403", STMPE2403 }, + { } + }; +-MODULE_DEVICE_TABLE(i2c, stmpe_id); ++MODULE_DEVICE_TABLE(i2c, stmpe_i2c_id); + + static struct i2c_driver stmpe_i2c_driver = { + .driver = { +-- +2.30.2 + diff --git a/queue-4.9/mips-always-link-byteswap-helpers-into-decompressor.patch b/queue-4.9/mips-always-link-byteswap-helpers-into-decompressor.patch new file mode 100644 index 00000000000..8e6790a4e21 --- /dev/null +++ b/queue-4.9/mips-always-link-byteswap-helpers-into-decompressor.patch @@ -0,0 +1,65 @@ +From 124986bc0fad240131869c42d5e957c2ce495745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jul 2021 16:28:37 +0200 +Subject: mips: always link byteswap helpers into decompressor + +From: Arnd Bergmann + +[ Upstream commit cddc40f5617e53f97ef019d5b29c1bd6cbb031ec ] + +My series to clean up the unaligned access implementation +across architectures caused some mips randconfig builds to +fail with: + + mips64-linux-ld: arch/mips/boot/compressed/decompress.o: in function `decompress_kernel': + decompress.c:(.text.decompress_kernel+0x54): undefined reference to `__bswapsi2' + +It turns out that this problem has already been fixed for the XZ +decompressor but now it also shows up in (at least) LZO and LZ4. From my +analysis I concluded that the compiler could always have emitted those +calls, but the different implementation allowed it to make otherwise +better decisions about not inlining the byteswap, which results in the +link error when the out-of-line code is missing. + +While it could be addressed by adding it to the two decompressor +implementations that are known to be affected, but as this only adds +112 bytes to the kernel, the safer choice is to always add them. + +Fixes: c50ec6787536 ("MIPS: zboot: Fix the build with XZ compression on older GCC versions") +Fixes: 0652035a5794 ("asm-generic: unaligned: remove byteshift helpers") +Link: https://lore.kernel.org/linux-mm/202106301304.gz2wVY9w-lkp@intel.com/ +Link: https://lore.kernel.org/linux-mm/202106260659.TyMe8mjr-lkp@intel.com/ +Link: https://lore.kernel.org/linux-mm/202106172016.onWT6Tza-lkp@intel.com/ +Link: https://lore.kernel.org/linux-mm/202105231743.JJcALnhS-lkp@intel.com/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/compressed/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile +index 0fa91c981658..3e93eea5a5f5 100644 +--- a/arch/mips/boot/compressed/Makefile ++++ b/arch/mips/boot/compressed/Makefile +@@ -33,7 +33,7 @@ KBUILD_AFLAGS := $(LINUXINCLUDE) $(KBUILD_AFLAGS) -D__ASSEMBLY__ \ + KCOV_INSTRUMENT := n + + # decompressor objects (linked with vmlinuz) +-vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o ++vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o $(obj)/bswapsi.o + + ifdef CONFIG_DEBUG_ZBOOT + vmlinuzobjs-$(CONFIG_DEBUG_ZBOOT) += $(obj)/dbg.o +@@ -47,7 +47,7 @@ extra-y += uart-ath79.c + $(obj)/uart-ath79.c: $(srctree)/arch/mips/ath79/early_printk.c + $(call cmd,shipped) + +-vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o $(obj)/bswapsi.o ++vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o + + extra-y += ashldi3.c bswapsi.c + $(obj)/ashldi3.o $(obj)/bswapsi.o: KBUILD_CFLAGS += -I$(srctree)/arch/mips/lib +-- +2.30.2 + diff --git a/queue-4.9/mips-disable-branch-profiling-in-boot-decompress.o.patch b/queue-4.9/mips-disable-branch-profiling-in-boot-decompress.o.patch new file mode 100644 index 00000000000..d71e3a84aa8 --- /dev/null +++ b/queue-4.9/mips-disable-branch-profiling-in-boot-decompress.o.patch @@ -0,0 +1,48 @@ +From 6c7e4d3939928eea5bd36834851628ae52391aee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 16:02:11 -0700 +Subject: mips: disable branch profiling in boot/decompress.o + +From: Randy Dunlap + +[ Upstream commit 97e488073cfca0eea84450169ca4cbfcc64e33e3 ] + +Use DISABLE_BRANCH_PROFILING for arch/mips/boot/compressed/decompress.o +to prevent linkage errors. + +mips64-linux-ld: arch/mips/boot/compressed/decompress.o: in function `LZ4_decompress_fast_extDict': +decompress.c:(.text+0x8c): undefined reference to `ftrace_likely_update' +mips64-linux-ld: decompress.c:(.text+0xf4): undefined reference to `ftrace_likely_update' +mips64-linux-ld: decompress.c:(.text+0x200): undefined reference to `ftrace_likely_update' +mips64-linux-ld: decompress.c:(.text+0x230): undefined reference to `ftrace_likely_update' +mips64-linux-ld: decompress.c:(.text+0x320): undefined reference to `ftrace_likely_update' +mips64-linux-ld: arch/mips/boot/compressed/decompress.o:decompress.c:(.text+0x3f4): more undefined references to `ftrace_likely_update' follow + +Fixes: e76e1fdfa8f8 ("lib: add support for LZ4-compressed kernel") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Cc: Kyungsik Lee +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/compressed/decompress.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c +index 3a015e41b762..66096c766a60 100644 +--- a/arch/mips/boot/compressed/decompress.c ++++ b/arch/mips/boot/compressed/decompress.c +@@ -11,6 +11,8 @@ + * option) any later version. + */ + ++#define DISABLE_BRANCH_PROFILING ++ + #include + #include + #include +-- +2.30.2 + diff --git a/queue-4.9/mips-vdso-invalid-gic-access-through-vdso.patch b/queue-4.9/mips-vdso-invalid-gic-access-through-vdso.patch new file mode 100644 index 00000000000..c138f76a361 --- /dev/null +++ b/queue-4.9/mips-vdso-invalid-gic-access-through-vdso.patch @@ -0,0 +1,65 @@ +From 4d109da86283362e99fad7dbac3d7f9764d7d99b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 02:03:54 +0200 +Subject: MIPS: vdso: Invalid GIC access through VDSO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Fäcknitz + +[ Upstream commit 47ce8527fbba145a7723685bc9a27d9855e06491 ] + +Accessing raw timers (currently only CLOCK_MONOTONIC_RAW) through VDSO +doesn't return the correct time when using the GIC as clock source. +The address of the GIC mapped page is in this case not calculated +correctly. The GIC mapped page is calculated from the VDSO data by +subtracting PAGE_SIZE: + + void *get_gic(const struct vdso_data *data) { + return (void __iomem *)data - PAGE_SIZE; + } + +However, the data pointer is not page aligned for raw clock sources. +This is because the VDSO data for raw clock sources (CS_RAW = 1) is +stored after the VDSO data for coarse clock sources (CS_HRES_COARSE = 0). +Therefore, only the VDSO data for CS_HRES_COARSE is page aligned: + + +--------------------+ + | | + | vd[CS_RAW] | ---+ + | vd[CS_HRES_COARSE] | | + +--------------------+ | -PAGE_SIZE + | | | + | GIC mapped page | <--+ + | | + +--------------------+ + +When __arch_get_hw_counter() is called with &vd[CS_RAW], get_gic returns +the wrong address (somewhere inside the GIC mapped page). The GIC counter +values are not returned which results in an invalid time. + +Fixes: a7f4df4e21dd ("MIPS: VDSO: Add implementations of gettimeofday() and clock_gettime()") +Signed-off-by: Martin Fäcknitz +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/vdso/vdso.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/vdso/vdso.h b/arch/mips/vdso/vdso.h +index cfb1be441dec..921589b45bc2 100644 +--- a/arch/mips/vdso/vdso.h ++++ b/arch/mips/vdso/vdso.h +@@ -81,7 +81,7 @@ static inline const union mips_vdso_data *get_vdso_data(void) + + static inline void __iomem *get_gic(const union mips_vdso_data *data) + { +- return (void __iomem *)data - PAGE_SIZE; ++ return (void __iomem *)((unsigned long)data & PAGE_MASK) - PAGE_SIZE; + } + + #endif /* CONFIG_CLKSRC_MIPS_GIC */ +-- +2.30.2 + diff --git a/queue-4.9/misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch b/queue-4.9/misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch new file mode 100644 index 00000000000..d252d7448db --- /dev/null +++ b/queue-4.9/misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch @@ -0,0 +1,58 @@ +From c4c01978b088a82e63fedcd523f9c904aa36cff4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 10:06:20 -0700 +Subject: misc/libmasm/module: Fix two use after free in ibmasm_init_one + +From: Lv Yunlong + +[ Upstream commit 7272b591c4cb9327c43443f67b8fbae7657dd9ae ] + +In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). +Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are +allocated by input_allocate_device(), and assigned to +sp->remote.mouse_dev and sp->remote.keybd_dev respectively. + +In the err_free_devices error branch of ibmasm_init_one, +mouse_dev and keybd_dev are freed by input_free_device(), and return +error. Then the execution runs into error_send_message error branch +of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called +to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. + +My patch add a "error_init_remote" label to handle the error of +ibmasm_init_remote_input_dev(), to avoid the uaf bugs. + +Signed-off-by: Lv Yunlong +Link: https://lore.kernel.org/r/20210426170620.10546-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/ibmasm/module.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c +index 6b3bf9ab051d..706decef68a0 100644 +--- a/drivers/misc/ibmasm/module.c ++++ b/drivers/misc/ibmasm/module.c +@@ -123,7 +123,7 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + result = ibmasm_init_remote_input_dev(sp); + if (result) { + dev_err(sp->dev, "Failed to initialize remote queue\n"); +- goto error_send_message; ++ goto error_init_remote; + } + + result = ibmasm_send_driver_vpd(sp); +@@ -143,8 +143,9 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + return 0; + + error_send_message: +- disable_sp_interrupts(sp->base_address); + ibmasm_free_remote_input_dev(sp); ++error_init_remote: ++ disable_sp_interrupts(sp->base_address); + free_irq(sp->irq, (void *)sp); + error_request_irq: + iounmap(sp->base_address); +-- +2.30.2 + diff --git a/queue-4.9/nfs-fix-acl-memory-leak-of-posix_acl_create.patch b/queue-4.9/nfs-fix-acl-memory-leak-of-posix_acl_create.patch new file mode 100644 index 00000000000..5a372179a75 --- /dev/null +++ b/queue-4.9/nfs-fix-acl-memory-leak-of-posix_acl_create.patch @@ -0,0 +1,50 @@ +From fd911b91a11efc7f89fc3cdbb3d71de2c375a002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 12:20:55 +0800 +Subject: nfs: fix acl memory leak of posix_acl_create() + +From: Gao Xiang + +[ Upstream commit 1fcb6fcd74a222d9ead54d405842fc763bb86262 ] + +When looking into another nfs xfstests report, I found acl and +default_acl in nfs3_proc_create() and nfs3_proc_mknod() error +paths are possibly leaked. Fix them in advance. + +Fixes: 013cdf1088d7 ("nfs: use generic posix ACL infrastructure for v3 Posix ACLs") +Cc: Trond Myklebust +Cc: Anna Schumaker +Cc: Christoph Hellwig +Cc: Joseph Qi +Signed-off-by: Gao Xiang +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs3proc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c +index dc925b531f32..41bda33b630f 100644 +--- a/fs/nfs/nfs3proc.c ++++ b/fs/nfs/nfs3proc.c +@@ -363,7 +363,7 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr, + break; + + case NFS3_CREATE_UNCHECKED: +- goto out; ++ goto out_release_acls; + } + nfs_fattr_init(data->res.dir_attr); + nfs_fattr_init(data->res.fattr); +@@ -708,7 +708,7 @@ nfs3_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr, + break; + default: + status = -EINVAL; +- goto out; ++ goto out_release_acls; + } + + status = nfs3_do_create(dir, dentry, data); +-- +2.30.2 + diff --git a/queue-4.9/orangefs-fix-orangefs-df-output.patch b/queue-4.9/orangefs-fix-orangefs-df-output.patch new file mode 100644 index 00000000000..2102357b247 --- /dev/null +++ b/queue-4.9/orangefs-fix-orangefs-df-output.patch @@ -0,0 +1,34 @@ +From 7fa9dfb0507b0846b8ed8962810083fc8ca7fb68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 08:09:13 -0400 +Subject: orangefs: fix orangefs df output. + +From: Mike Marshall + +[ Upstream commit 0fdec1b3c9fbb5e856a40db5993c9eaf91c74a83 ] + +Orangefs df output is whacky. Walt Ligon suggested this might fix it. +It seems way more in line with reality now... + +Signed-off-by: Mike Marshall +Signed-off-by: Sasha Levin +--- + fs/orangefs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c +index 6e35ef6521b4..8972ebc87016 100644 +--- a/fs/orangefs/super.c ++++ b/fs/orangefs/super.c +@@ -185,7 +185,7 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf) + buf->f_bavail = (sector_t) new_op->downcall.resp.statfs.blocks_avail; + buf->f_files = (sector_t) new_op->downcall.resp.statfs.files_total; + buf->f_ffree = (sector_t) new_op->downcall.resp.statfs.files_avail; +- buf->f_frsize = sb->s_blocksize; ++ buf->f_frsize = 0; + + out_op_release: + op_release(new_op); +-- +2.30.2 + diff --git a/queue-4.9/pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch b/queue-4.9/pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch new file mode 100644 index 00000000000..399093880c3 --- /dev/null +++ b/queue-4.9/pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch @@ -0,0 +1,47 @@ +From 117e3c1d2683337d22a4fab55af06a97779af3ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 00:01:12 +0000 +Subject: PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Wilczyński + +[ Upstream commit bdcdaa13ad96f1a530711c29e6d4b8311eff767c ] + +"utf16s_to_utf8s(..., buf, PAGE_SIZE)" puts up to PAGE_SIZE bytes into +"buf" and returns the number of bytes it actually put there. If it wrote +PAGE_SIZE bytes, the newline added by dsm_label_utf16s_to_utf8s() would +overrun "buf". + +Reduce the size available for utf16s_to_utf8s() to use so there is always +space for the newline. + +[bhelgaas: reorder patch in series, commit log] +Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs") +Link: https://lore.kernel.org/r/20210603000112.703037-7-kw@linux.com +Reported-by: Joe Perches +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-label.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c +index 51357377efbc..ac169cf0fa02 100644 +--- a/drivers/pci/pci-label.c ++++ b/drivers/pci/pci-label.c +@@ -157,7 +157,7 @@ static void dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf) + len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer, + obj->buffer.length, + UTF16_LITTLE_ENDIAN, +- buf, PAGE_SIZE); ++ buf, PAGE_SIZE - 1); + buf[len] = '\n'; + } + +-- +2.30.2 + diff --git a/queue-4.9/power-reset-gpio-poweroff-add-missing-module_device_.patch b/queue-4.9/power-reset-gpio-poweroff-add-missing-module_device_.patch new file mode 100644 index 00000000000..0d363f8c681 --- /dev/null +++ b/queue-4.9/power-reset-gpio-poweroff-add-missing-module_device_.patch @@ -0,0 +1,36 @@ +From f3fe6e7d03fe65d1d04b7dc09e9626c89fb4c949 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:14:59 +0800 +Subject: power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE + +From: Bixuan Cui + +[ Upstream commit ed3443fb4df4e140a22f65144546c8a8e1e27f4e ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Bixuan Cui +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/reset/gpio-poweroff.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c +index be3d81ff51cc..a44e3427fdeb 100644 +--- a/drivers/power/reset/gpio-poweroff.c ++++ b/drivers/power/reset/gpio-poweroff.c +@@ -84,6 +84,7 @@ static const struct of_device_id of_gpio_poweroff_match[] = { + { .compatible = "gpio-poweroff", }, + {}, + }; ++MODULE_DEVICE_TABLE(of, of_gpio_poweroff_match); + + static struct platform_driver gpio_poweroff_driver = { + .probe = gpio_poweroff_probe, +-- +2.30.2 + diff --git a/queue-4.9/power-supply-ab8500-add-missing-module_device_table.patch b/queue-4.9/power-supply-ab8500-add-missing-module_device_table.patch new file mode 100644 index 00000000000..edcf117e60d --- /dev/null +++ b/queue-4.9/power-supply-ab8500-add-missing-module_device_table.patch @@ -0,0 +1,62 @@ +From cce5b28ce03d5ebaeaa3c45884b6d5889a541075 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jun 2021 09:21:41 +0800 +Subject: power: supply: ab8500: add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit dfe52db13ab8d24857a9840ec7ca75eef800c26c ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/ab8500_btemp.c | 1 + + drivers/power/supply/ab8500_charger.c | 1 + + drivers/power/supply/ab8500_fg.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/drivers/power/supply/ab8500_btemp.c b/drivers/power/supply/ab8500_btemp.c +index 6ffdc18f2599..9f17d81767ea 100644 +--- a/drivers/power/supply/ab8500_btemp.c ++++ b/drivers/power/supply/ab8500_btemp.c +@@ -1181,6 +1181,7 @@ static const struct of_device_id ab8500_btemp_match[] = { + { .compatible = "stericsson,ab8500-btemp", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_btemp_match); + + static struct platform_driver ab8500_btemp_driver = { + .probe = ab8500_btemp_probe, +diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c +index 2d44a68b62c0..56b502331433 100644 +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -3752,6 +3752,7 @@ static const struct of_device_id ab8500_charger_match[] = { + { .compatible = "stericsson,ab8500-charger", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_charger_match); + + static struct platform_driver ab8500_charger_driver = { + .probe = ab8500_charger_probe, +diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c +index ea8c26a108f0..d6079e892e11 100644 +--- a/drivers/power/supply/ab8500_fg.c ++++ b/drivers/power/supply/ab8500_fg.c +@@ -3229,6 +3229,7 @@ static const struct of_device_id ab8500_fg_match[] = { + { .compatible = "stericsson,ab8500-fg", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_fg_match); + + static struct platform_driver ab8500_fg_driver = { + .probe = ab8500_fg_probe, +-- +2.30.2 + diff --git a/queue-4.9/power-supply-ab8500-avoid-null-pointers.patch b/queue-4.9/power-supply-ab8500-avoid-null-pointers.patch new file mode 100644 index 00000000000..28a7db98f37 --- /dev/null +++ b/queue-4.9/power-supply-ab8500-avoid-null-pointers.patch @@ -0,0 +1,60 @@ +From 237aee4bbbef97272c4744a518a009cc63d2a235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 May 2021 00:50:41 +0200 +Subject: power: supply: ab8500: Avoid NULL pointers + +From: Linus Walleij + +[ Upstream commit 5bcb5087c9dd3dca1ff0ebd8002c5313c9332b56 ] + +Sometimes the code will crash because we haven't enabled +AC or USB charging and thus not created the corresponding +psy device. Fix it by checking that it is there before +notifying. + +Signed-off-by: Linus Walleij +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/ab8500_charger.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c +index 48a11fd86a7f..2d44a68b62c0 100644 +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -409,6 +409,14 @@ disable_otp: + static void ab8500_power_supply_changed(struct ab8500_charger *di, + struct power_supply *psy) + { ++ /* ++ * This happens if we get notifications or interrupts and ++ * the platform has been configured not to support one or ++ * other type of charging. ++ */ ++ if (!psy) ++ return; ++ + if (di->autopower_cfg) { + if (!di->usb.charger_connected && + !di->ac.charger_connected && +@@ -435,7 +443,15 @@ static void ab8500_charger_set_usb_connected(struct ab8500_charger *di, + if (!connected) + di->flags.vbus_drop_end = false; + +- sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, "present"); ++ /* ++ * Sometimes the platform is configured not to support ++ * USB charging and no psy has been created, but we still ++ * will get these notifications. ++ */ ++ if (di->usb_chg.psy) { ++ sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, ++ "present"); ++ } + + if (connected) { + mutex_lock(&di->charger_attached_mutex); +-- +2.30.2 + diff --git a/queue-4.9/power-supply-charger-manager-add-missing-module_devi.patch b/queue-4.9/power-supply-charger-manager-add-missing-module_devi.patch new file mode 100644 index 00000000000..c6e3d979b28 --- /dev/null +++ b/queue-4.9/power-supply-charger-manager-add-missing-module_devi.patch @@ -0,0 +1,36 @@ +From f0f9b6ce53e735dc0e6ab93afc7f58e5c48639fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jun 2021 09:21:54 +0800 +Subject: power: supply: charger-manager: add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit 073b5d5b1f9cc94a3eea25279fbafee3f4f5f097 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/charger-manager.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c +index 13f23c00538b..043836e6d347 100644 +--- a/drivers/power/supply/charger-manager.c ++++ b/drivers/power/supply/charger-manager.c +@@ -1489,6 +1489,7 @@ static const struct of_device_id charger_manager_match[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(of, charger_manager_match); + + static struct charger_desc *of_cm_parse_desc(struct device *dev) + { +-- +2.30.2 + diff --git a/queue-4.9/power-supply-rt5033_battery-fix-device-tree-enumerat.patch b/queue-4.9/power-supply-rt5033_battery-fix-device-tree-enumerat.patch new file mode 100644 index 00000000000..d5a9cfe030a --- /dev/null +++ b/queue-4.9/power-supply-rt5033_battery-fix-device-tree-enumerat.patch @@ -0,0 +1,67 @@ +From 9e3f4b0fe4697393837b92b96927f950524c6361 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 12:51:12 +0200 +Subject: power: supply: rt5033_battery: Fix device tree enumeration + +From: Stephan Gerhold + +[ Upstream commit f3076cd8d1d5fa64b5e1fa5affc045c2fc123baa ] + +The fuel gauge in the RT5033 PMIC has its own I2C bus and interrupt +line. Therefore, it is not actually part of the RT5033 MFD and needs +its own of_match_table to probe properly. + +Also, given that it's independent of the MFD, there is actually +no need to make the Kconfig depend on MFD_RT5033. Although the driver +uses the shared header, there is no compile +or runtime dependency on the RT5033 MFD driver. + +Cc: Beomho Seo +Cc: Chanwoo Choi +Fixes: b847dd96e659 ("power: rt5033_battery: Add RT5033 Fuel gauge device driver") +Signed-off-by: Stephan Gerhold +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/Kconfig | 3 ++- + drivers/power/supply/rt5033_battery.c | 7 +++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig +index 0de9a958b29a..b825e70a5196 100644 +--- a/drivers/power/supply/Kconfig ++++ b/drivers/power/supply/Kconfig +@@ -490,7 +490,8 @@ config BATTERY_GOLDFISH + + config BATTERY_RT5033 + tristate "RT5033 fuel gauge support" +- depends on MFD_RT5033 ++ depends on I2C ++ select REGMAP_I2C + help + This adds support for battery fuel gauge in Richtek RT5033 PMIC. + The fuelgauge calculates and determines the battery state of charge +diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c +index bcdd83048492..9310b85f3405 100644 +--- a/drivers/power/supply/rt5033_battery.c ++++ b/drivers/power/supply/rt5033_battery.c +@@ -167,9 +167,16 @@ static const struct i2c_device_id rt5033_battery_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, rt5033_battery_id); + ++static const struct of_device_id rt5033_battery_of_match[] = { ++ { .compatible = "richtek,rt5033-battery", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, rt5033_battery_of_match); ++ + static struct i2c_driver rt5033_battery_driver = { + .driver = { + .name = "rt5033-battery", ++ .of_match_table = rt5033_battery_of_match, + }, + .probe = rt5033_battery_probe, + .remove = rt5033_battery_remove, +-- +2.30.2 + diff --git a/queue-4.9/powerpc-boot-fixup-device-tree-on-little-endian.patch b/queue-4.9/powerpc-boot-fixup-device-tree-on-little-endian.patch new file mode 100644 index 00000000000..970f7a8a0b0 --- /dev/null +++ b/queue-4.9/powerpc-boot-fixup-device-tree-on-little-endian.patch @@ -0,0 +1,243 @@ +From 030b9e56a3ec5a4a1f8d822bf8d92beedf75ee0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 13:49:00 +1000 +Subject: powerpc/boot: Fixup device-tree on little endian + +From: Benjamin Herrenschmidt + +[ Upstream commit c93f80849bdd9b45d834053ae1336e28f0026c84 ] + +This fixes the core devtree.c functions and the ns16550 UART backend. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Paul Mackerras +Reviewed-by: Segher Boessenkool +Acked-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/YMwXrPT8nc4YUdJ9@thinks.paulus.ozlabs.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/devtree.c | 59 +++++++++++++++++++++---------------- + arch/powerpc/boot/ns16550.c | 9 ++++-- + 2 files changed, 41 insertions(+), 27 deletions(-) + +diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c +index a7e21a35c03a..27c84b82b588 100644 +--- a/arch/powerpc/boot/devtree.c ++++ b/arch/powerpc/boot/devtree.c +@@ -17,6 +17,7 @@ + #include "string.h" + #include "stdio.h" + #include "ops.h" ++#include "of.h" + + void dt_fixup_memory(u64 start, u64 size) + { +@@ -27,21 +28,25 @@ void dt_fixup_memory(u64 start, u64 size) + root = finddevice("/"); + if (getprop(root, "#address-cells", &naddr, sizeof(naddr)) < 0) + naddr = 2; ++ else ++ naddr = be32_to_cpu(naddr); + if (naddr < 1 || naddr > 2) + fatal("Can't cope with #address-cells == %d in /\n\r", naddr); + + if (getprop(root, "#size-cells", &nsize, sizeof(nsize)) < 0) + nsize = 1; ++ else ++ nsize = be32_to_cpu(nsize); + if (nsize < 1 || nsize > 2) + fatal("Can't cope with #size-cells == %d in /\n\r", nsize); + + i = 0; + if (naddr == 2) +- memreg[i++] = start >> 32; +- memreg[i++] = start & 0xffffffff; ++ memreg[i++] = cpu_to_be32(start >> 32); ++ memreg[i++] = cpu_to_be32(start & 0xffffffff); + if (nsize == 2) +- memreg[i++] = size >> 32; +- memreg[i++] = size & 0xffffffff; ++ memreg[i++] = cpu_to_be32(size >> 32); ++ memreg[i++] = cpu_to_be32(size & 0xffffffff); + + memory = finddevice("/memory"); + if (! memory) { +@@ -49,9 +54,9 @@ void dt_fixup_memory(u64 start, u64 size) + setprop_str(memory, "device_type", "memory"); + } + +- printf("Memory <- <0x%x", memreg[0]); ++ printf("Memory <- <0x%x", be32_to_cpu(memreg[0])); + for (i = 1; i < (naddr + nsize); i++) +- printf(" 0x%x", memreg[i]); ++ printf(" 0x%x", be32_to_cpu(memreg[i])); + printf("> (%ldMB)\n\r", (unsigned long)(size >> 20)); + + setprop(memory, "reg", memreg, (naddr + nsize)*sizeof(u32)); +@@ -69,10 +74,10 @@ void dt_fixup_cpu_clocks(u32 cpu, u32 tb, u32 bus) + printf("CPU bus-frequency <- 0x%x (%dMHz)\n\r", bus, MHZ(bus)); + + while ((devp = find_node_by_devtype(devp, "cpu"))) { +- setprop_val(devp, "clock-frequency", cpu); +- setprop_val(devp, "timebase-frequency", tb); ++ setprop_val(devp, "clock-frequency", cpu_to_be32(cpu)); ++ setprop_val(devp, "timebase-frequency", cpu_to_be32(tb)); + if (bus > 0) +- setprop_val(devp, "bus-frequency", bus); ++ setprop_val(devp, "bus-frequency", cpu_to_be32(bus)); + } + + timebase_period_ns = 1000000000 / tb; +@@ -84,7 +89,7 @@ void dt_fixup_clock(const char *path, u32 freq) + + if (devp) { + printf("%s: clock-frequency <- %x (%dMHz)\n\r", path, freq, MHZ(freq)); +- setprop_val(devp, "clock-frequency", freq); ++ setprop_val(devp, "clock-frequency", cpu_to_be32(freq)); + } + } + +@@ -137,8 +142,12 @@ void dt_get_reg_format(void *node, u32 *naddr, u32 *nsize) + { + if (getprop(node, "#address-cells", naddr, 4) != 4) + *naddr = 2; ++ else ++ *naddr = be32_to_cpu(*naddr); + if (getprop(node, "#size-cells", nsize, 4) != 4) + *nsize = 1; ++ else ++ *nsize = be32_to_cpu(*nsize); + } + + static void copy_val(u32 *dest, u32 *src, int naddr) +@@ -167,9 +176,9 @@ static int add_reg(u32 *reg, u32 *add, int naddr) + int i, carry = 0; + + for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) { +- u64 tmp = (u64)reg[i] + add[i] + carry; ++ u64 tmp = (u64)be32_to_cpu(reg[i]) + be32_to_cpu(add[i]) + carry; + carry = tmp >> 32; +- reg[i] = (u32)tmp; ++ reg[i] = cpu_to_be32((u32)tmp); + } + + return !carry; +@@ -184,18 +193,18 @@ static int compare_reg(u32 *reg, u32 *range, u32 *rangesize) + u32 end; + + for (i = 0; i < MAX_ADDR_CELLS; i++) { +- if (reg[i] < range[i]) ++ if (be32_to_cpu(reg[i]) < be32_to_cpu(range[i])) + return 0; +- if (reg[i] > range[i]) ++ if (be32_to_cpu(reg[i]) > be32_to_cpu(range[i])) + break; + } + + for (i = 0; i < MAX_ADDR_CELLS; i++) { +- end = range[i] + rangesize[i]; ++ end = be32_to_cpu(range[i]) + be32_to_cpu(rangesize[i]); + +- if (reg[i] < end) ++ if (be32_to_cpu(reg[i]) < end) + break; +- if (reg[i] > end) ++ if (be32_to_cpu(reg[i]) > end) + return 0; + } + +@@ -244,7 +253,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + return 0; + + dt_get_reg_format(parent, &naddr, &nsize); +- + if (nsize > 2) + return 0; + +@@ -256,10 +264,10 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + + copy_val(last_addr, prop_buf + offset, naddr); + +- ret_size = prop_buf[offset + naddr]; ++ ret_size = be32_to_cpu(prop_buf[offset + naddr]); + if (nsize == 2) { + ret_size <<= 32; +- ret_size |= prop_buf[offset + naddr + 1]; ++ ret_size |= be32_to_cpu(prop_buf[offset + naddr + 1]); + } + + for (;;) { +@@ -282,7 +290,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + + offset = find_range(last_addr, prop_buf, prev_naddr, + naddr, prev_nsize, buflen / 4); +- + if (offset < 0) + return 0; + +@@ -300,8 +307,7 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + if (naddr > 2) + return 0; + +- ret_addr = ((u64)last_addr[2] << 32) | last_addr[3]; +- ++ ret_addr = ((u64)be32_to_cpu(last_addr[2]) << 32) | be32_to_cpu(last_addr[3]); + if (sizeof(void *) == 4 && + (ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL || + ret_addr + ret_size > 0x100000000ULL)) +@@ -354,11 +360,14 @@ int dt_is_compatible(void *node, const char *compat) + int dt_get_virtual_reg(void *node, void **addr, int nres) + { + unsigned long xaddr; +- int n; ++ int n, i; + + n = getprop(node, "virtual-reg", addr, nres * 4); +- if (n > 0) ++ if (n > 0) { ++ for (i = 0; i < n/4; i ++) ++ ((u32 *)addr)[i] = be32_to_cpu(((u32 *)addr)[i]); + return n / 4; ++ } + + for (n = 0; n < nres; n++) { + if (!dt_xlate_reg(node, n, &xaddr, NULL)) +diff --git a/arch/powerpc/boot/ns16550.c b/arch/powerpc/boot/ns16550.c +index 8c9ead94be06..cea34a20085c 100644 +--- a/arch/powerpc/boot/ns16550.c ++++ b/arch/powerpc/boot/ns16550.c +@@ -14,6 +14,7 @@ + #include "stdio.h" + #include "io.h" + #include "ops.h" ++#include "of.h" + + #define UART_DLL 0 /* Out: Divisor Latch Low */ + #define UART_DLM 1 /* Out: Divisor Latch High */ +@@ -57,16 +58,20 @@ int ns16550_console_init(void *devp, struct serial_console_data *scdp) + int n; + u32 reg_offset; + +- if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1) ++ if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1) { ++ printf("virt reg parse fail...\r\n"); + return -1; ++ } + + n = getprop(devp, "reg-offset", ®_offset, sizeof(reg_offset)); + if (n == sizeof(reg_offset)) +- reg_base += reg_offset; ++ reg_base += be32_to_cpu(reg_offset); + + n = getprop(devp, "reg-shift", ®_shift, sizeof(reg_shift)); + if (n != sizeof(reg_shift)) + reg_shift = 0; ++ else ++ reg_shift = be32_to_cpu(reg_shift); + + scdp->open = ns16550_open; + scdp->putc = ns16550_putc; +-- +2.30.2 + diff --git a/queue-4.9/powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch b/queue-4.9/powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch new file mode 100644 index 00000000000..ff4e4631579 --- /dev/null +++ b/queue-4.9/powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch @@ -0,0 +1,93 @@ +From 69b5c603735bdefacc35788d416b43650151fbe1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 19:17:02 +0000 +Subject: powerpc/ps3: Add dma_mask to ps3_dma_region + +From: Geoff Levand + +[ Upstream commit 9733862e50fdba55e7f1554e4286fcc5302ff28e ] + +Commit f959dcd6ddfd29235030e8026471ac1b022ad2b0 (dma-direct: Fix +potential NULL pointer dereference) added a null check on the +dma_mask pointer of the kernel's device structure. + +Add a dma_mask variable to the ps3_dma_region structure and set +the device structure's dma_mask pointer to point to this new variable. + +Fixes runtime errors like these: +# WARNING: Fixes tag on line 10 doesn't match correct format +# WARNING: Fixes tag on line 10 doesn't match correct format + + ps3_system_bus_match:349: dev=8.0(sb_01), drv=8.0(ps3flash): match + WARNING: CPU: 0 PID: 1 at kernel/dma/mapping.c:151 .dma_map_page_attrs+0x34/0x1e0 + ps3flash sb_01: ps3stor_setup:193: map DMA region failed + +Signed-off-by: Geoff Levand +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/562d0c9ea0100a30c3b186bcc7adb34b0bbd2cd7.1622746428.git.geoff@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/ps3.h | 2 ++ + arch/powerpc/platforms/ps3/mm.c | 12 ++++++++++++ + 2 files changed, 14 insertions(+) + +diff --git a/arch/powerpc/include/asm/ps3.h b/arch/powerpc/include/asm/ps3.h +index a19f831a4cc9..83a6d99e9994 100644 +--- a/arch/powerpc/include/asm/ps3.h ++++ b/arch/powerpc/include/asm/ps3.h +@@ -83,6 +83,7 @@ struct ps3_dma_region_ops; + * @bus_addr: The 'translated' bus address of the region. + * @len: The length in bytes of the region. + * @offset: The offset from the start of memory of the region. ++ * @dma_mask: Device dma_mask. + * @ioid: The IOID of the device who owns this region + * @chunk_list: Opaque variable used by the ioc page manager. + * @region_ops: struct ps3_dma_region_ops - dma region operations +@@ -97,6 +98,7 @@ struct ps3_dma_region { + enum ps3_dma_region_type region_type; + unsigned long len; + unsigned long offset; ++ u64 dma_mask; + + /* driver variables (set by ps3_dma_region_create) */ + unsigned long bus_addr; +diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c +index 19bae78b1f25..76cbf1be9962 100644 +--- a/arch/powerpc/platforms/ps3/mm.c ++++ b/arch/powerpc/platforms/ps3/mm.c +@@ -18,6 +18,7 @@ + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + ++#include + #include + #include + #include +@@ -1132,6 +1133,7 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev, + enum ps3_dma_region_type region_type, void *addr, unsigned long len) + { + unsigned long lpar_addr; ++ int result; + + lpar_addr = addr ? ps3_mm_phys_to_lpar(__pa(addr)) : 0; + +@@ -1143,6 +1145,16 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev, + r->offset -= map.r1.offset; + r->len = len ? len : _ALIGN_UP(map.total, 1 << r->page_size); + ++ dev->core.dma_mask = &r->dma_mask; ++ ++ result = dma_set_mask_and_coherent(&dev->core, DMA_BIT_MASK(32)); ++ ++ if (result < 0) { ++ dev_err(&dev->core, "%s:%d: dma_set_mask_and_coherent failed: %d\n", ++ __func__, __LINE__, result); ++ return result; ++ } ++ + switch (dev->dev_type) { + case PS3_DEVICE_TYPE_SB: + r->region_ops = (USE_DYNAMIC_DMA) +-- +2.30.2 + diff --git a/queue-4.9/pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch b/queue-4.9/pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch new file mode 100644 index 00000000000..d80b4b2bfd1 --- /dev/null +++ b/queue-4.9/pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch @@ -0,0 +1,45 @@ +From dd025e5519c8df8d16fccc620193ee079d7f377a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 11:05:24 +0200 +Subject: pwm: spear: Don't modify HW state in .remove callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit b601a18f12383001e7a8da238de7ca1559ebc450 ] + +A consumer is expected to disable a PWM before calling pwm_put(). And if +they didn't there is hopefully a good reason (or the consumer needs +fixing). Also if disabling an enabled PWM was the right thing to do, +this should better be done in the framework instead of in each low level +driver. + +So drop the hardware modification from the .remove() callback. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-spear.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/pwm/pwm-spear.c b/drivers/pwm/pwm-spear.c +index 6c6b44fd3f43..2d11ac277de8 100644 +--- a/drivers/pwm/pwm-spear.c ++++ b/drivers/pwm/pwm-spear.c +@@ -231,10 +231,6 @@ static int spear_pwm_probe(struct platform_device *pdev) + static int spear_pwm_remove(struct platform_device *pdev) + { + struct spear_pwm_chip *pc = platform_get_drvdata(pdev); +- int i; +- +- for (i = 0; i < NUM_PWM; i++) +- pwm_disable(&pc->chip.pwms[i]); + + /* clk was prepared in probe, hence unprepare it here */ + clk_unprepare(pc->clk); +-- +2.30.2 + diff --git a/queue-4.9/pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch b/queue-4.9/pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch new file mode 100644 index 00000000000..c0268ce76b6 --- /dev/null +++ b/queue-4.9/pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch @@ -0,0 +1,61 @@ +From a3aca25439afe30cf431ab70d22c4f913b6b5816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 11:51:41 +0200 +Subject: pwm: tegra: Don't modify HW state in .remove callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 86f7fa71cd830d18d7ebcaf719dffd5ddfe1acdd ] + +A consumer is expected to disable a PWM before calling pwm_put(). And if +they didn't there is hopefully a good reason (or the consumer needs +fixing). Also if disabling an enabled PWM was the right thing to do, +this should better be done in the framework instead of in each low level +driver. + +So drop the hardware modification from the .remove() callback. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tegra.c | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c +index 7e8906d6ab7a..d76698ce6472 100644 +--- a/drivers/pwm/pwm-tegra.c ++++ b/drivers/pwm/pwm-tegra.c +@@ -228,7 +228,6 @@ static int tegra_pwm_probe(struct platform_device *pdev) + static int tegra_pwm_remove(struct platform_device *pdev) + { + struct tegra_pwm_chip *pc = platform_get_drvdata(pdev); +- unsigned int i; + int err; + + if (WARN_ON(!pc)) +@@ -238,18 +237,6 @@ static int tegra_pwm_remove(struct platform_device *pdev) + if (err < 0) + return err; + +- for (i = 0; i < pc->chip.npwm; i++) { +- struct pwm_device *pwm = &pc->chip.pwms[i]; +- +- if (!pwm_is_enabled(pwm)) +- if (clk_prepare_enable(pc->clk) < 0) +- continue; +- +- pwm_writel(pc, i, 0); +- +- clk_disable_unprepare(pc->clk); +- } +- + reset_control_assert(pc->rst); + clk_disable_unprepare(pc->clk); + +-- +2.30.2 + diff --git a/queue-4.9/reset-bail-if-try_module_get-fails.patch b/queue-4.9/reset-bail-if-try_module_get-fails.patch new file mode 100644 index 00000000000..7f25a7400d9 --- /dev/null +++ b/queue-4.9/reset-bail-if-try_module_get-fails.patch @@ -0,0 +1,44 @@ +From b853dff0702497a3acbb4792e0d1f3e3817ca892 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 10:26:15 +0200 +Subject: reset: bail if try_module_get() fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philipp Zabel + +[ Upstream commit 4fb26fb83f0def3d39c14e268bcd4003aae8fade ] + +Abort instead of returning a new reset control for a reset controller +device that is going to have its module unloaded. + +Reported-by: Uwe Kleine-König +Fixes: 61fc41317666 ("reset: Add reset controller API") +Acked-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20210607082615.15160-1-p.zabel@pengutronix.de +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index d0ebca301afc..c15c898fe0dc 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -263,7 +263,10 @@ static struct reset_control *__reset_control_get_internal( + if (!rstc) + return ERR_PTR(-ENOMEM); + +- try_module_get(rcdev->owner); ++ if (!try_module_get(rcdev->owner)) { ++ kfree(rstc); ++ return ERR_PTR(-ENODEV); ++ } + + rstc->rcdev = rcdev; + list_add(&rstc->list, &rcdev->reset_control_head); +-- +2.30.2 + diff --git a/queue-4.9/revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch b/queue-4.9/revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch new file mode 100644 index 00000000000..67299c6b351 --- /dev/null +++ b/queue-4.9/revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch @@ -0,0 +1,80 @@ +From cf21baf55a6402c62612881b4b68d581bb2995a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 17:45:47 +0900 +Subject: Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro" + +From: Takashi Sakamoto + +[ Upstream commit 5d6fb80a142b5994355ce675c517baba6089d199 ] + +This reverts commit 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f. + +I've explained that optional FireWire card for d.2 is also built-in to +d.2 Pro, however it's wrong. The optional card uses DM1000 ASIC and has +'Mackie DJ Mixer' in its model name of configuration ROM. On the other +hand, built-in FireWire card for d.2 Pro and d.4 Pro uses OXFW971 ASIC +and has 'd.Pro' in its model name according to manuals and user +experiences. The former card is not the card for d.2 Pro. They are similar +in appearance but different internally. + +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210518084557.102681-2-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/Kconfig | 4 ++-- + sound/firewire/bebob/bebob.c | 2 +- + sound/firewire/oxfw/oxfw.c | 2 +- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index f7b8dcb57815..da9874d54676 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -36,7 +36,7 @@ config SND_OXFW + * Mackie(Loud) Onyx-i series (former models) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.4 pro ++ * Mackie(Loud) d.2 pro/d.4 pro (built-in FireWire card with OXFW971 ASIC) + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -82,7 +82,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) and d.2 Pro ++ * Mackie d.2 (optional FireWire card with DM1000 ASIC) + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 9d620a7c283f..c51564213365 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -414,7 +414,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). ++ // Mackie, d.2 (optional Firewire card with DM1000). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index 44ecf2f5f65f..e2932ac9d487 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -405,7 +405,7 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.4 pro: Unknown ++ * d.2 pro/d.4 pro (built-in card): Unknown + * U.420: Unknown + * U.420d: Unknown + */ +-- +2.30.2 + diff --git a/queue-4.9/rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch b/queue-4.9/rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch new file mode 100644 index 00000000000..d871d8259c8 --- /dev/null +++ b/queue-4.9/rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch @@ -0,0 +1,44 @@ +From 1f29df3fd56467fd5460730daa185bb603b5e9af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 10:19:26 +0300 +Subject: rtc: fix snprintf() checking in is_rtc_hctosys() + +From: Dan Carpenter + +[ Upstream commit 54b909436ede47e0ee07f1765da27ec2efa41e84 ] + +The scnprintf() function silently truncates the printf() and returns +the number bytes that it was able to copy (not counting the NUL +terminator). Thus, the highest value it can return here is +"NAME_SIZE - 1" and the overflow check is dead code. Fix this by +using the snprintf() function which returns the number of bytes that +would have been copied if there was enough space and changing the +condition from "> NAME_SIZE" to ">= NAME_SIZE". + +Fixes: 92589c986b33 ("rtc-proc: permit the /proc/driver/rtc device to use other devices") +Signed-off-by: Dan Carpenter +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/YJov/pcGmhLi2pEl@mwanda +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-proc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/rtc-proc.c b/drivers/rtc/rtc-proc.c +index 31e7e23cc5be..9396b69f75e8 100644 +--- a/drivers/rtc/rtc-proc.c ++++ b/drivers/rtc/rtc-proc.c +@@ -26,8 +26,8 @@ static bool is_rtc_hctosys(struct rtc_device *rtc) + int size; + char name[NAME_SIZE]; + +- size = scnprintf(name, NAME_SIZE, "rtc%d", rtc->id); +- if (size > NAME_SIZE) ++ size = snprintf(name, NAME_SIZE, "rtc%d", rtc->id); ++ if (size >= NAME_SIZE) + return false; + + return !strncmp(name, CONFIG_RTC_HCTOSYS_DEVICE, NAME_SIZE); +-- +2.30.2 + diff --git a/queue-4.9/s390-sclp_vt220-fix-console-name-to-match-device.patch b/queue-4.9/s390-sclp_vt220-fix-console-name-to-match-device.patch new file mode 100644 index 00000000000..e37c1c89c2a --- /dev/null +++ b/queue-4.9/s390-sclp_vt220-fix-console-name-to-match-device.patch @@ -0,0 +1,63 @@ +From 5198ac27ee0ac2ccc26cfcaa582d5e0edba5bcbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 21:40:10 +0200 +Subject: s390/sclp_vt220: fix console name to match device + +From: Valentin Vidic + +[ Upstream commit b7d91d230a119fdcc334d10c9889ce9c5e15118b ] + +Console name reported in /proc/consoles: + + ttyS1 -W- (EC p ) 4:65 + +does not match the char device name: + + crw--w---- 1 root root 4, 65 May 17 12:18 /dev/ttysclp0 + +so debian-installer inside a QEMU s390x instance gets confused and fails +to start with the following error: + + steal-ctty: No such file or directory + +Signed-off-by: Valentin Vidic +Link: https://lore.kernel.org/r/20210427194010.9330-1-vvidic@valentin-vidic.from.hr +Signed-off-by: Christian Borntraeger +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/setup.c | 2 +- + drivers/s390/char/sclp_vt220.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index ce49c2b9db7e..9939879f5f25 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -137,7 +137,7 @@ static void __init set_preferred_console(void) + else if (CONSOLE_IS_3270) + add_preferred_console("tty3270", 0, NULL); + else if (CONSOLE_IS_VT220) +- add_preferred_console("ttyS", 1, NULL); ++ add_preferred_console("ttysclp", 0, NULL); + else if (CONSOLE_IS_HVC) + add_preferred_console("hvc", 0, NULL); + } +diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c +index 68d6ee7ae504..3e8b5906548f 100644 +--- a/drivers/s390/char/sclp_vt220.c ++++ b/drivers/s390/char/sclp_vt220.c +@@ -34,8 +34,8 @@ + #define SCLP_VT220_MINOR 65 + #define SCLP_VT220_DRIVER_NAME "sclp_vt220" + #define SCLP_VT220_DEVICE_NAME "ttysclp" +-#define SCLP_VT220_CONSOLE_NAME "ttyS" +-#define SCLP_VT220_CONSOLE_INDEX 1 /* console=ttyS1 */ ++#define SCLP_VT220_CONSOLE_NAME "ttysclp" ++#define SCLP_VT220_CONSOLE_INDEX 0 /* console=ttysclp0 */ + + /* Representation of a single write request */ + struct sclp_vt220_request { +-- +2.30.2 + diff --git a/queue-4.9/scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch b/queue-4.9/scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch new file mode 100644 index 00000000000..8537037d7e7 --- /dev/null +++ b/queue-4.9/scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch @@ -0,0 +1,37 @@ +From 87e7964433daeb25a070ceb7bbe3883b945c85b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jun 2021 09:18:34 +0200 +Subject: scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() + +From: Christophe JAILLET + +[ Upstream commit 030e4138d11fced3b831c2761e4cecf347bae99c ] + +If an error occurs after a pci_enable_pcie_error_reporting() call, it must +be undone by a corresponding pci_disable_pcie_error_reporting() call, as +already done in the remove function. + +Link: https://lore.kernel.org/r/77adb02cfea7f1364e5603ecf3930d8597ae356e.1623482155.git.christophe.jaillet@wanadoo.fr +Fixes: 3567f36a09d1 ("[SCSI] be2iscsi: Fix AER handling in driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/be2iscsi/be_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index 741cc96379cb..628bf2e6a526 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -5847,6 +5847,7 @@ hba_free: + pci_disable_msix(phba->pcidev); + pci_dev_put(phba->pcidev); + iscsi_host_free(phba->shost); ++ pci_disable_pcie_error_reporting(pcidev); + pci_set_drvdata(pcidev, NULL); + disable_pci: + pci_release_regions(pcidev); +-- +2.30.2 + diff --git a/queue-4.9/scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch b/queue-4.9/scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch new file mode 100644 index 00000000000..c7de2b3ea24 --- /dev/null +++ b/queue-4.9/scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch @@ -0,0 +1,97 @@ +From b51ab97870370ba5185387369ad74a7dcb923091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:18:03 -0500 +Subject: scsi: iscsi: Add iscsi_cls_conn refcount helpers + +From: Mike Christie + +[ Upstream commit b1d19e8c92cfb0ded180ef3376c20e130414e067 ] + +There are a couple places where we could free the iscsi_cls_conn while it's +still in use. This adds some helpers to get/put a refcount on the struct +and converts an exiting user. Subsequent commits will then use the helpers +to fix 2 bugs in the eh code. + +Link: https://lore.kernel.org/r/20210525181821.7617-11-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libiscsi.c | 7 ++----- + drivers/scsi/scsi_transport_iscsi.c | 12 ++++++++++++ + include/scsi/scsi_transport_iscsi.h | 2 ++ + 3 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 50e2943c3337..30e954bb6c81 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1384,7 +1384,6 @@ void iscsi_session_failure(struct iscsi_session *session, + enum iscsi_err err) + { + struct iscsi_conn *conn; +- struct device *dev; + + spin_lock_bh(&session->frwd_lock); + conn = session->leadconn; +@@ -1393,10 +1392,8 @@ void iscsi_session_failure(struct iscsi_session *session, + return; + } + +- dev = get_device(&conn->cls_conn->dev); ++ iscsi_get_conn(conn->cls_conn); + spin_unlock_bh(&session->frwd_lock); +- if (!dev) +- return; + /* + * if the host is being removed bypass the connection + * recovery initialization because we are going to kill +@@ -1406,7 +1403,7 @@ void iscsi_session_failure(struct iscsi_session *session, + iscsi_conn_error_event(conn->cls_conn, err); + else + iscsi_conn_failure(conn, err); +- put_device(dev); ++ iscsi_put_conn(conn->cls_conn); + } + EXPORT_SYMBOL_GPL(iscsi_session_failure); + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 4f4d2d65a4a7..337aad0660fa 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2327,6 +2327,18 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) + } + EXPORT_SYMBOL_GPL(iscsi_destroy_conn); + ++void iscsi_put_conn(struct iscsi_cls_conn *conn) ++{ ++ put_device(&conn->dev); ++} ++EXPORT_SYMBOL_GPL(iscsi_put_conn); ++ ++void iscsi_get_conn(struct iscsi_cls_conn *conn) ++{ ++ get_device(&conn->dev); ++} ++EXPORT_SYMBOL_GPL(iscsi_get_conn); ++ + /* + * iscsi interface functions + */ +diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h +index 6183d20a01fb..e673c7c9c5fb 100644 +--- a/include/scsi/scsi_transport_iscsi.h ++++ b/include/scsi/scsi_transport_iscsi.h +@@ -437,6 +437,8 @@ extern void iscsi_free_session(struct iscsi_cls_session *session); + extern int iscsi_destroy_session(struct iscsi_cls_session *session); + extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess, + int dd_size, uint32_t cid); ++extern void iscsi_put_conn(struct iscsi_cls_conn *conn); ++extern void iscsi_get_conn(struct iscsi_cls_conn *conn); + extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn); + extern void iscsi_unblock_session(struct iscsi_cls_session *session); + extern void iscsi_block_session(struct iscsi_cls_session *session); +-- +2.30.2 + diff --git a/queue-4.9/scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch b/queue-4.9/scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch new file mode 100644 index 00000000000..d79572882b6 --- /dev/null +++ b/queue-4.9/scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch @@ -0,0 +1,53 @@ +From bdd8b831b7b10287013902f621e19e10ccb52307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 12:55:51 -0700 +Subject: scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology + +From: James Smart + +[ Upstream commit e30d55137edef47434c40d7570276a0846fe922c ] + +An 'unexpected timeout' message may be seen in a point-2-point topology. +The message occurs when a PLOGI is received before the driver is notified +of FLOGI completion. The FLOGI completion failure causes discovery to be +triggered for a second time. The discovery timer is restarted but no new +discovery activity is initiated, thus the timeout message eventually +appears. + +In point-2-point, when discovery has progressed before the FLOGI completion +is processed, it is not a failure. Add code to FLOGI completion to detect +that discovery has progressed and exit the FLOGI handling (noop'ing it). + +Link: https://lore.kernel.org/r/20210514195559.119853-4-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 7d4a5bb91606..f17adfe1326b 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -1159,6 +1159,15 @@ stop_rr_fcf_flogi: + phba->fcf.fcf_redisc_attempted = 0; /* reset */ + goto out; + } ++ } else if (vport->port_state > LPFC_FLOGI && ++ vport->fc_flag & FC_PT2PT) { ++ /* ++ * In a p2p topology, it is possible that discovery has ++ * already progressed, and this completion can be ignored. ++ * Recheck the indicated topology. ++ */ ++ if (!sp->cmn.fPort) ++ goto out; + } + + flogifail: +-- +2.30.2 + diff --git a/queue-4.9/selftests-powerpc-fix-no_handler-ebb-selftest.patch b/queue-4.9/selftests-powerpc-fix-no_handler-ebb-selftest.patch new file mode 100644 index 00000000000..5c93a7896d3 --- /dev/null +++ b/queue-4.9/selftests-powerpc-fix-no_handler-ebb-selftest.patch @@ -0,0 +1,45 @@ +From cded51625048c8e6160e900a02ec595e59acc8f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 09:51:42 -0400 +Subject: selftests/powerpc: Fix "no_handler" EBB selftest + +From: Athira Rajeev + +[ Upstream commit 45677c9aebe926192e59475b35a1ff35ff2d4217 ] + +The "no_handler_test" in ebb selftests attempts to read the PMU +registers twice via helper function "dump_ebb_state". First dump is +just before closing of event and the second invocation is done after +closing of the event. The original intention of second +dump_ebb_state was to dump the state of registers at the end of +the test when the counters are frozen. But this will be achieved +with the first call itself since sample period is set to low value +and PMU will be frozen by then. Hence patch removes the +dump which was done before closing of the event. + +Reported-by: Shirisha Ganta +Signed-off-by: Athira Rajeev +Tested-by: Nageswara R Sastry > +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1621950703-1532-2-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c +index 8341d7778d5e..87630d44fb4c 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c +@@ -50,8 +50,6 @@ static int no_handler_test(void) + + event_close(&event); + +- dump_ebb_state(); +- + /* The real test is that we never took an EBB at 0x0 */ + + return 0; +-- +2.30.2 + diff --git a/queue-4.9/series b/queue-4.9/series index 7323bc9e95f..ed128577024 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -182,3 +182,64 @@ kvm-x86-disable-hardware-breakpoints-unconditionally-before-kvm_x86-run.patch scsi-core-fix-bad-pointer-dereference-when-ehandler-kthread-is-invalid.patch tracing-do-not-reference-char-as-a-string-in-histograms.patch fscrypt-don-t-ignore-minor_hash-when-hash-is-0.patch +tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch +misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch +revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch +scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch +tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch +fs-jfs-fix-missing-error-code-in-lmloginit.patch +scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch +mfd-da9052-stmpe-add-and-modify-module_device_table.patch +s390-sclp_vt220-fix-console-name-to-match-device.patch +alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch +powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch +gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch +alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch +selftests-powerpc-fix-no_handler-ebb-selftest.patch +asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch +alsa-bebob-add-support-for-toneweal-fw66.patch +usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch +usb-gadget-hid-fix-error-return-code-in-hid_bind.patch +powerpc-boot-fixup-device-tree-on-little-endian.patch +backlight-lm3630a-fix-return-code-of-.update_status-.patch +alsa-hda-add-irq-check-for-platform_get_irq.patch +i2c-core-disable-client-irq-on-reboot-shutdown.patch +lib-decompress_unlz4.c-correctly-handle-zero-padding.patch +pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch +power-supply-ab8500-avoid-null-pointers.patch +power-reset-gpio-poweroff-add-missing-module_device_.patch +arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch +watchdog-fix-possible-use-after-free-in-wdt_startup.patch +watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch +watchdog-fix-possible-use-after-free-by-calling-del_.patch +x86-fpu-return-proper-error-codes-from-user-access-f.patch +orangefs-fix-orangefs-df-output.patch +ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch +power-supply-charger-manager-add-missing-module_devi.patch +power-supply-ab8500-add-missing-module_device_table.patch +pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch +acpi-amba-fix-resource-name-in-proc-iomem.patch +virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch +virtio_console-assure-used-length-from-device-is-lim.patch +pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch +power-supply-rt5033_battery-fix-device-tree-enumerat.patch +um-fix-error-return-code-in-slip_open.patch +um-fix-error-return-code-in-winch_tramp.patch +watchdog-aspeed-fix-hardware-timeout-calculation.patch +nfs-fix-acl-memory-leak-of-posix_acl_create.patch +ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch +x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch +alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch +hexagon-use-common-discards-macro.patch +arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch +arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-27262 +rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch +arm-dts-r8a7779-marzen-fix-du-clock-names.patch +reset-bail-if-try_module_get-fails.patch +memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch +memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch +arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch +scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch +mips-always-link-byteswap-helpers-into-decompressor.patch +mips-disable-branch-profiling-in-boot-decompress.o.patch +mips-vdso-invalid-gic-access-through-vdso.patch diff --git a/queue-4.9/tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch b/queue-4.9/tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch new file mode 100644 index 00000000000..42aadd79493 --- /dev/null +++ b/queue-4.9/tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch @@ -0,0 +1,55 @@ +From 6b812e74efd4eb2add88f8675ac6aadca7839738 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 21:44:04 +0200 +Subject: tty: serial: 8250: serial_cs: Fix a memory leak in error handling + path + +From: Christophe JAILLET + +[ Upstream commit fad92b11047a748c996ebd6cfb164a63814eeb2e ] + +In the probe function, if the final 'serial_config()' fails, 'info' is +leaking. + +Add a resource handling path to free this memory. + +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/dc25f96b7faebf42e60fe8d02963c941cf4d8124.1621971720.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/serial_cs.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c +index ba9731ace0e4..3747991024d5 100644 +--- a/drivers/tty/serial/8250/serial_cs.c ++++ b/drivers/tty/serial/8250/serial_cs.c +@@ -305,6 +305,7 @@ static int serial_resume(struct pcmcia_device *link) + static int serial_probe(struct pcmcia_device *link) + { + struct serial_info *info; ++ int ret; + + dev_dbg(&link->dev, "serial_attach()\n"); + +@@ -319,7 +320,15 @@ static int serial_probe(struct pcmcia_device *link) + if (do_sound) + link->config_flags |= CONF_ENABLE_SPKR; + +- return serial_config(link); ++ ret = serial_config(link); ++ if (ret) ++ goto free_info; ++ ++ return 0; ++ ++free_info: ++ kfree(info); ++ return ret; + } + + static void serial_detach(struct pcmcia_device *link) +-- +2.30.2 + diff --git a/queue-4.9/tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch b/queue-4.9/tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch new file mode 100644 index 00000000000..e104ed71eed --- /dev/null +++ b/queue-4.9/tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch @@ -0,0 +1,41 @@ +From 9fe87b503ab98c6bf5c2846a6c094dcfeb94cb3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 10:12:26 +0800 +Subject: tty: serial: fsl_lpuart: fix the potential risk of division or modulo + by zero + +From: Sherry Sun + +[ Upstream commit fcb10ee27fb91b25b68d7745db9817ecea9f1038 ] + +We should be very careful about the register values that will be used +for division or modulo operations, althrough the possibility that the +UARTBAUD register value is zero is very low, but we had better to deal +with the "bad data" of hardware in advance to avoid division or modulo +by zero leading to undefined kernel behavior. + +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20210427021226.27468-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 5b6093dc3ff2..a4c1797e30d7 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1766,6 +1766,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud, + + bd = lpuart32_read(sport->port.membase + UARTBAUD); + bd &= UARTBAUD_SBR_MASK; ++ if (!bd) ++ return; ++ + sbr = bd; + uartclk = clk_get_rate(sport->clk); + /* +-- +2.30.2 + diff --git a/queue-4.9/ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch b/queue-4.9/ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch new file mode 100644 index 00000000000..25c6a5f4eb1 --- /dev/null +++ b/queue-4.9/ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch @@ -0,0 +1,79 @@ +From 63eef9319200f3f1543e44891733b978f4d08e37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 16:11:03 +0800 +Subject: ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode + +From: Zhihao Cheng + +[ Upstream commit a801fcfeef96702fa3f9b22ad56c5eb1989d9221 ] + +xfstests-generic/476 reports a warning message as below: + +WARNING: CPU: 2 PID: 30347 at fs/inode.c:361 inc_nlink+0x52/0x70 +Call Trace: + do_rename+0x502/0xd40 [ubifs] + ubifs_rename+0x8b/0x180 [ubifs] + vfs_rename+0x476/0x1080 + do_renameat2+0x67c/0x7b0 + __x64_sys_renameat2+0x6e/0x90 + do_syscall_64+0x66/0xe0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Following race case can cause this: + rename_whiteout(Thread 1) wb_workfn(Thread 2) +ubifs_rename + do_rename + __writeback_single_inode + spin_lock(&inode->i_lock) + whiteout->i_state |= I_LINKABLE + inode->i_state &= ~dirty; +---- How race happens on i_state: + (tmp = whiteout->i_state | I_LINKABLE) + (tmp = inode->i_state & ~dirty) + (whiteout->i_state = tmp) + (inode->i_state = tmp) +---- + spin_unlock(&inode->i_lock) + inc_nlink(whiteout) + WARN_ON(!(inode->i_state & I_LINKABLE)) !!! + +Fix to add i_lock to avoid i_state update race condition. + +Fixes: 9e0a1fff8db56ea ("ubifs: Implement RENAME_WHITEOUT") +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/dir.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index 87ab02e2d666..56eed54633cf 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -1144,7 +1144,10 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + return err; + } + ++ spin_lock(&whiteout->i_lock); + whiteout->i_state |= I_LINKABLE; ++ spin_unlock(&whiteout->i_lock); ++ + whiteout_ui = ubifs_inode(whiteout); + whiteout_ui->data = dev; + whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0)); +@@ -1239,7 +1242,11 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + + inc_nlink(whiteout); + mark_inode_dirty(whiteout); ++ ++ spin_lock(&whiteout->i_lock); + whiteout->i_state &= ~I_LINKABLE; ++ spin_unlock(&whiteout->i_lock); ++ + iput(whiteout); + } + +-- +2.30.2 + diff --git a/queue-4.9/um-fix-error-return-code-in-slip_open.patch b/queue-4.9/um-fix-error-return-code-in-slip_open.patch new file mode 100644 index 00000000000..3b5b119e4e8 --- /dev/null +++ b/queue-4.9/um-fix-error-return-code-in-slip_open.patch @@ -0,0 +1,39 @@ +From 78e3de0c335d006fb54a74f9b4b8759b3393b744 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:13:54 +0800 +Subject: um: fix error return code in slip_open() + +From: Zhen Lei + +[ Upstream commit b77e81fbe5f5fb4ad9a61ec80f6d1e30b6da093a ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: a3c77c67a443 ("[PATCH] uml: slirp and slip driver cleanups and fixes") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Acked-By: anton.ivanov@cambridgegreys.com +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/slip_user.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c +index 0d6b66c64a81..76d155631c5d 100644 +--- a/arch/um/drivers/slip_user.c ++++ b/arch/um/drivers/slip_user.c +@@ -145,7 +145,8 @@ static int slip_open(void *data) + } + sfd = err; + +- if (set_up_tty(sfd)) ++ err = set_up_tty(sfd); ++ if (err) + goto out_close2; + + pri->slave = sfd; +-- +2.30.2 + diff --git a/queue-4.9/um-fix-error-return-code-in-winch_tramp.patch b/queue-4.9/um-fix-error-return-code-in-winch_tramp.patch new file mode 100644 index 00000000000..7176c48f76e --- /dev/null +++ b/queue-4.9/um-fix-error-return-code-in-winch_tramp.patch @@ -0,0 +1,39 @@ +From a3301d314125b44e427389e06a116c717929cdef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:22:39 +0800 +Subject: um: fix error return code in winch_tramp() + +From: Zhen Lei + +[ Upstream commit ccf1236ecac476d9d2704866d9a476c86e387971 ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 89df6bfc0405 ("uml: DEBUG_SHIRQ fixes") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Acked-By: anton.ivanov@cambridgegreys.com +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/chan_user.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c +index 3fd7c3efdb18..feb7f5ab4084 100644 +--- a/arch/um/drivers/chan_user.c ++++ b/arch/um/drivers/chan_user.c +@@ -256,7 +256,8 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out, + goto out_close; + } + +- if (os_set_fd_block(*fd_out, 0)) { ++ err = os_set_fd_block(*fd_out, 0); ++ if (err) { + printk(UM_KERN_ERR "winch_tramp: failed to set thread_fd " + "non-blocking.\n"); + goto out_close; +-- +2.30.2 + diff --git a/queue-4.9/usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch b/queue-4.9/usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch new file mode 100644 index 00000000000..0ca3481b2c5 --- /dev/null +++ b/queue-4.9/usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch @@ -0,0 +1,45 @@ +From 8ca4e4c066442be9d55d27177831386bd8c5bdc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 19:27:55 +0300 +Subject: usb: gadget: f_hid: fix endianness issue with descriptors + +From: Ruslan Bilovol + +[ Upstream commit 33cb46c4676d01956811b68a29157ea969a5df70 ] + +Running sparse checker it shows warning message about +incorrect endianness used for descriptor initialization: + +| f_hid.c:91:43: warning: incorrect type in initializer (different base types) +| f_hid.c:91:43: expected restricted __le16 [usertype] bcdHID +| f_hid.c:91:43: got int + +Fixing issue with cpu_to_le16() macro, however this is not a real issue +as the value is the same both endians. + +Cc: Fabien Chouteau +Cc: Segiy Stetsyuk +Signed-off-by: Ruslan Bilovol +Link: https://lore.kernel.org/r/20210617162755.29676-1-ruslan.bilovol@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_hid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index 42e5677d932d..dd415b1589b5 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -91,7 +91,7 @@ static struct usb_interface_descriptor hidg_interface_desc = { + static struct hid_descriptor hidg_desc = { + .bLength = sizeof hidg_desc, + .bDescriptorType = HID_DT_HID, +- .bcdHID = 0x0101, ++ .bcdHID = cpu_to_le16(0x0101), + .bCountryCode = 0x00, + .bNumDescriptors = 0x1, + /*.desc[0].bDescriptorType = DYNAMIC */ +-- +2.30.2 + diff --git a/queue-4.9/usb-gadget-hid-fix-error-return-code-in-hid_bind.patch b/queue-4.9/usb-gadget-hid-fix-error-return-code-in-hid_bind.patch new file mode 100644 index 00000000000..3bec27e2999 --- /dev/null +++ b/queue-4.9/usb-gadget-hid-fix-error-return-code-in-hid_bind.patch @@ -0,0 +1,40 @@ +From 08e671b087a3d9a2e381a8e5520f2695c6bd3a75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 12:38:35 +0800 +Subject: usb: gadget: hid: fix error return code in hid_bind() + +From: Yang Yingliang + +[ Upstream commit 88693f770bb09c196b1eb5f06a484a254ecb9924 ] + +Fix to return a negative error code from the error handling +case instead of 0. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210618043835.2641360-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/legacy/hid.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c +index a71a884f79fc..cccbb948821b 100644 +--- a/drivers/usb/gadget/legacy/hid.c ++++ b/drivers/usb/gadget/legacy/hid.c +@@ -175,8 +175,10 @@ static int hid_bind(struct usb_composite_dev *cdev) + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto put; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; +-- +2.30.2 + diff --git a/queue-4.9/virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch b/queue-4.9/virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch new file mode 100644 index 00000000000..c5fddff1841 --- /dev/null +++ b/queue-4.9/virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch @@ -0,0 +1,37 @@ +From 920f99747cc94f8394a23b218df1e64bc1011327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:43:32 +0800 +Subject: virtio-blk: Fix memory leak among suspend/resume procedure + +From: Xie Yongji + +[ Upstream commit b71ba22e7c6c6b279c66f53ee7818709774efa1f ] + +The vblk->vqs should be freed before we call init_vqs() +in virtblk_restore(). + +Signed-off-by: Xie Yongji +Link: https://lore.kernel.org/r/20210517084332.280-1-xieyongji@bytedance.com +Acked-by: Jason Wang +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index e57a1f6e39d5..302260e9002c 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -800,6 +800,8 @@ static int virtblk_freeze(struct virtio_device *vdev) + blk_mq_stop_hw_queues(vblk->disk->queue); + + vdev->config->del_vqs(vdev); ++ kfree(vblk->vqs); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-4.9/virtio_console-assure-used-length-from-device-is-lim.patch b/queue-4.9/virtio_console-assure-used-length-from-device-is-lim.patch new file mode 100644 index 00000000000..d7e9c85a0e9 --- /dev/null +++ b/queue-4.9/virtio_console-assure-used-length-from-device-is-lim.patch @@ -0,0 +1,47 @@ +From e33adcfe8d8bcf6042243b08943dc065cab1da53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 20:56:22 +0800 +Subject: virtio_console: Assure used length from device is limited + +From: Xie Yongji + +[ Upstream commit d00d8da5869a2608e97cfede094dfc5e11462a46 ] + +The buf->len might come from an untrusted device. This +ensures the value would not exceed the size of the buffer +to avoid data corruption or loss. + +Signed-off-by: Xie Yongji +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20210525125622.1203-1-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/char/virtio_console.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index 4ec08c7a7b65..2632b0fdb1b5 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -492,7 +492,7 @@ static struct port_buffer *get_inbuf(struct port *port) + + buf = virtqueue_get_buf(port->in_vq, &len); + if (buf) { +- buf->len = len; ++ buf->len = min_t(size_t, len, buf->size); + buf->offset = 0; + port->stats.bytes_received += len; + } +@@ -1758,7 +1758,7 @@ static void control_work_handler(struct work_struct *work) + while ((buf = virtqueue_get_buf(vq, &len))) { + spin_unlock(&portdev->c_ivq_lock); + +- buf->len = len; ++ buf->len = min_t(size_t, len, buf->size); + buf->offset = 0; + + handle_control_message(vq->vdev, portdev, buf); +-- +2.30.2 + diff --git a/queue-4.9/watchdog-aspeed-fix-hardware-timeout-calculation.patch b/queue-4.9/watchdog-aspeed-fix-hardware-timeout-calculation.patch new file mode 100644 index 00000000000..d3d294ee680 --- /dev/null +++ b/queue-4.9/watchdog-aspeed-fix-hardware-timeout-calculation.patch @@ -0,0 +1,40 @@ +From a14b19a6519a9ea3013d947eee4bed27ea4b0243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 20:42:49 -0700 +Subject: watchdog: aspeed: fix hardware timeout calculation + +From: Tao Ren + +[ Upstream commit e7dc481c92060f9ce872878b0b7a08c24713a7e5 ] + +Fix hardware timeout calculation in aspeed_wdt_set_timeout function to +ensure the reload value does not exceed the hardware limit. + +Fixes: efa859f7d786 ("watchdog: Add Aspeed watchdog driver") +Reported-by: Amithash Prasad +Signed-off-by: Tao Ren +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20210417034249.5978-1-rentao.bupt@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/aspeed_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c +index f5ad8023c2e6..1c47e6345b57 100644 +--- a/drivers/watchdog/aspeed_wdt.c ++++ b/drivers/watchdog/aspeed_wdt.c +@@ -100,7 +100,7 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd, + + wdd->timeout = timeout; + +- actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000); ++ actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000); + + writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE); + writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART); +-- +2.30.2 + diff --git a/queue-4.9/watchdog-fix-possible-use-after-free-by-calling-del_.patch b/queue-4.9/watchdog-fix-possible-use-after-free-by-calling-del_.patch new file mode 100644 index 00000000000..5c1f99543ce --- /dev/null +++ b/queue-4.9/watchdog-fix-possible-use-after-free-by-calling-del_.patch @@ -0,0 +1,59 @@ +From 64e6e83d29cce27d36033b8c79aff5cdeddb2390 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 14:57:56 +0800 +Subject: watchdog: Fix possible use-after-free by calling del_timer_sync() + +From: Zou Wei + +[ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ] + +This driver's remove path calls del_timer(). However, that function +does not wait until the timer handler finishes. This means that the +timer handler may still be running after the driver's remove function +has finished, which would result in a use-after-free. + +Fix by calling del_timer_sync(), which makes sure the timer handler +has finished, and unable to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Reviewed-by: Guenter Roeck +Acked-by: Vladimir Zapolskiy +Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/lpc18xx_wdt.c | 2 +- + drivers/watchdog/w83877f_wdt.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c +index fd171e6caa16..1b63d1d85aa0 100644 +--- a/drivers/watchdog/lpc18xx_wdt.c ++++ b/drivers/watchdog/lpc18xx_wdt.c +@@ -300,7 +300,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev) + struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev); + + dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n"); +- del_timer(&lpc18xx_wdt->timer); ++ del_timer_sync(&lpc18xx_wdt->timer); + + watchdog_unregister_device(&lpc18xx_wdt->wdt_dev); + clk_disable_unprepare(lpc18xx_wdt->wdt_clk); +diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c +index f0483c75ed32..4b52cf321747 100644 +--- a/drivers/watchdog/w83877f_wdt.c ++++ b/drivers/watchdog/w83877f_wdt.c +@@ -170,7 +170,7 @@ static void wdt_startup(void) + static void wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + + wdt_change(WDT_DISABLE); + +-- +2.30.2 + diff --git a/queue-4.9/watchdog-fix-possible-use-after-free-in-wdt_startup.patch b/queue-4.9/watchdog-fix-possible-use-after-free-in-wdt_startup.patch new file mode 100644 index 00000000000..1e341eb66cf --- /dev/null +++ b/queue-4.9/watchdog-fix-possible-use-after-free-in-wdt_startup.patch @@ -0,0 +1,44 @@ +From 9957a02626493875da5f03a4795aa0f069e1a321 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 15:01:35 +0800 +Subject: watchdog: Fix possible use-after-free in wdt_startup() + +From: Zou Wei + +[ Upstream commit c08a6b31e4917034f0ed0cb457c3bb209576f542 ] + +This module's remove path calls del_timer(). However, that function +does not wait until the timer handler finishes. This means that the +timer handler may still be running after the driver's remove function +has finished, which would result in a use-after-free. + +Fix by calling del_timer_sync(), which makes sure the timer handler +has finished, and unable to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/1620716495-108352-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/sbc60xxwdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/sbc60xxwdt.c b/drivers/watchdog/sbc60xxwdt.c +index 2eef58a0cf05..152db059d5aa 100644 +--- a/drivers/watchdog/sbc60xxwdt.c ++++ b/drivers/watchdog/sbc60xxwdt.c +@@ -152,7 +152,7 @@ static void wdt_startup(void) + static void wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + inb_p(wdt_stop); + pr_info("Watchdog timer is now disabled...\n"); + } +-- +2.30.2 + diff --git a/queue-4.9/watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch b/queue-4.9/watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch new file mode 100644 index 00000000000..d1725e1a8b7 --- /dev/null +++ b/queue-4.9/watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch @@ -0,0 +1,44 @@ +From 06a604a35d51b12f6c7abb32ef046c1aac4576c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 15:04:51 +0800 +Subject: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff() + +From: Zou Wei + +[ Upstream commit 90b7c141132244e8e49a34a4c1e445cce33e07f4 ] + +This module's remove path calls del_timer(). However, that function +does not wait until the timer handler finishes. This means that the +timer handler may still be running after the driver's remove function +has finished, which would result in a use-after-free. + +Fix by calling del_timer_sync(), which makes sure the timer handler +has finished, and unable to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/1620716691-108460-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/sc520_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/sc520_wdt.c b/drivers/watchdog/sc520_wdt.c +index 1cfd3f6a13d5..08500db8324f 100644 +--- a/drivers/watchdog/sc520_wdt.c ++++ b/drivers/watchdog/sc520_wdt.c +@@ -190,7 +190,7 @@ static int wdt_startup(void) + static int wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + + /* Stop the watchdog */ + wdt_config(0); +-- +2.30.2 + diff --git a/queue-4.9/x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch b/queue-4.9/x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch new file mode 100644 index 00000000000..111c0ef7da3 --- /dev/null +++ b/queue-4.9/x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch @@ -0,0 +1,39 @@ +From 0ff555af5e06137228c43e88790c0e99cb34864f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 14:01:35 +0200 +Subject: x86/fpu: Limit xstate copy size in xstateregs_set() + +From: Thomas Gleixner + +[ Upstream commit 07d6688b22e09be465652cf2da0da6bf86154df6 ] + +If the count argument is larger than the xstate size, this will happily +copy beyond the end of xstate. + +Fixes: 91c3dba7dbc1 ("x86/fpu/xstate: Fix PTRACE frames for XSAVES") +Signed-off-by: Thomas Gleixner +Signed-off-by: Borislav Petkov +Reviewed-by: Andy Lutomirski +Reviewed-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20210623121452.120741557@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/fpu/regset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c +index 7052d9a65fe9..e1c9e94fcce6 100644 +--- a/arch/x86/kernel/fpu/regset.c ++++ b/arch/x86/kernel/fpu/regset.c +@@ -123,7 +123,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, + /* + * A whole standard-format XSAVE buffer is needed: + */ +- if ((pos != 0) || (count < fpu_user_xstate_size)) ++ if (pos != 0 || count != fpu_user_xstate_size) + return -EFAULT; + + xsave = &fpu->state.xsave; +-- +2.30.2 + diff --git a/queue-4.9/x86-fpu-return-proper-error-codes-from-user-access-f.patch b/queue-4.9/x86-fpu-return-proper-error-codes-from-user-access-f.patch new file mode 100644 index 00000000000..61ca763c10b --- /dev/null +++ b/queue-4.9/x86-fpu-return-proper-error-codes-from-user-access-f.patch @@ -0,0 +1,86 @@ +From a7ba1dc4224dcd7a1d5578976c99ffa4a30dc6c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 14:02:30 +0200 +Subject: x86/fpu: Return proper error codes from user access functions + +From: Thomas Gleixner + +[ Upstream commit aee8c67a4faa40a8df4e79316dbfc92d123989c1 ] + +When *RSTOR from user memory raises an exception, there is no way to +differentiate them. That's bad because it forces the slow path even when +the failure was not a fault. If the operation raised eg. #GP then going +through the slow path is pointless. + +Use _ASM_EXTABLE_FAULT() which stores the trap number and let the exception +fixup return the negated trap number as error. + +This allows to separate the fast path and let it handle faults directly and +avoid the slow path for all other exceptions. + +Signed-off-by: Thomas Gleixner +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20210623121457.601480369@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/fpu/internal.h | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h +index 21d6fa27b4a9..ebda4718eb8f 100644 +--- a/arch/x86/include/asm/fpu/internal.h ++++ b/arch/x86/include/asm/fpu/internal.h +@@ -94,6 +94,7 @@ static inline void fpstate_init_fxstate(struct fxregs_state *fx) + } + extern void fpstate_sanitize_xstate(struct fpu *fpu); + ++/* Returns 0 or the negated trap number, which results in -EFAULT for #PF */ + #define user_insn(insn, output, input...) \ + ({ \ + int err; \ +@@ -101,14 +102,14 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu); + might_fault(); \ + \ + asm volatile(ASM_STAC "\n" \ +- "1:" #insn "\n\t" \ ++ "1: " #insn "\n" \ + "2: " ASM_CLAC "\n" \ + ".section .fixup,\"ax\"\n" \ +- "3: movl $-1,%[err]\n" \ ++ "3: negl %%eax\n" \ + " jmp 2b\n" \ + ".previous\n" \ +- _ASM_EXTABLE(1b, 3b) \ +- : [err] "=r" (err), output \ ++ _ASM_EXTABLE_FAULT(1b, 3b) \ ++ : [err] "=a" (err), output \ + : "0"(0), input); \ + err; \ + }) +@@ -227,16 +228,20 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) + #define XRSTOR ".byte " REX_PREFIX "0x0f,0xae,0x2f" + #define XRSTORS ".byte " REX_PREFIX "0x0f,0xc7,0x1f" + ++/* ++ * After this @err contains 0 on success or the negated trap number when ++ * the operation raises an exception. For faults this results in -EFAULT. ++ */ + #define XSTATE_OP(op, st, lmask, hmask, err) \ + asm volatile("1:" op "\n\t" \ + "xor %[err], %[err]\n" \ + "2:\n\t" \ + ".pushsection .fixup,\"ax\"\n\t" \ +- "3: movl $-2,%[err]\n\t" \ ++ "3: negl %%eax\n\t" \ + "jmp 2b\n\t" \ + ".popsection\n\t" \ +- _ASM_EXTABLE(1b, 3b) \ +- : [err] "=r" (err) \ ++ _ASM_EXTABLE_FAULT(1b, 3b) \ ++ : [err] "=a" (err) \ + : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \ + : "memory") + +-- +2.30.2 + -- 2.47.3