From 76674fdcbd76f0f253a8ceb82def3b9846ec3799 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 7 Feb 2020 10:45:29 +0100 Subject: [PATCH] 4.19-stable patches added patches: crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch crypto-ccree-fix-backlog-memory-leak.patch crypto-ccree-fix-pm-race-condition.patch crypto-ccree-fix-pm-wrongful-error-reporting.patch hv_balloon-balloon-up-according-to-request-page-number.patch mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch power-supply-ltc2941-battery-gauge-fix-use-after-free.patch scripts-find-unused-docs-fix-massive-false-positives.patch scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch --- ...-alg-under-lock-in-crypto_drop_spawn.patch | 39 ++++ ...crypto-ccree-fix-backlog-memory-leak.patch | 32 +++ .../crypto-ccree-fix-pm-race-condition.patch | 195 ++++++++++++++++++ ...cree-fix-pm-wrongful-error-reporting.patch | 32 +++ ...-up-according-to-request-page-number.patch | 77 +++++++ ...-axp20x_vbus_ipsout_mgmt-as-volatile.patch | 39 ++++ ...941-battery-gauge-fix-use-after-free.patch | 41 ++++ ...sed-docs-fix-massive-false-positives.patch | 41 ++++ ...xxx-fix-mtcp-dump-collection-failure.patch | 37 ++++ queue-4.19/series | 9 + 10 files changed, 542 insertions(+) create mode 100644 queue-4.19/crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch create mode 100644 queue-4.19/crypto-ccree-fix-backlog-memory-leak.patch create mode 100644 queue-4.19/crypto-ccree-fix-pm-race-condition.patch create mode 100644 queue-4.19/crypto-ccree-fix-pm-wrongful-error-reporting.patch create mode 100644 queue-4.19/hv_balloon-balloon-up-according-to-request-page-number.patch create mode 100644 queue-4.19/mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch create mode 100644 queue-4.19/power-supply-ltc2941-battery-gauge-fix-use-after-free.patch create mode 100644 queue-4.19/scripts-find-unused-docs-fix-massive-false-positives.patch create mode 100644 queue-4.19/scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch diff --git a/queue-4.19/crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch b/queue-4.19/crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch new file mode 100644 index 00000000000..14e17e16592 --- /dev/null +++ b/queue-4.19/crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch @@ -0,0 +1,39 @@ +From 7db3b61b6bba4310f454588c2ca6faf2958ad79f Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Fri, 6 Dec 2019 13:55:17 +0800 +Subject: crypto: api - Check spawn->alg under lock in crypto_drop_spawn + +From: Herbert Xu + +commit 7db3b61b6bba4310f454588c2ca6faf2958ad79f upstream. + +We need to check whether spawn->alg is NULL under lock as otherwise +the algorithm could be removed from under us after we have checked +it and found it to be non-NULL. This could cause us to remove the +spawn from a non-existent list. + +Fixes: 7ede5a5ba55a ("crypto: api - Fix crypto_drop_spawn crash...") +Cc: +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/algapi.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/crypto/algapi.c ++++ b/crypto/algapi.c +@@ -649,11 +649,9 @@ EXPORT_SYMBOL_GPL(crypto_grab_spawn); + + void crypto_drop_spawn(struct crypto_spawn *spawn) + { +- if (!spawn->alg) +- return; +- + down_write(&crypto_alg_sem); +- list_del(&spawn->list); ++ if (spawn->alg) ++ list_del(&spawn->list); + up_write(&crypto_alg_sem); + } + EXPORT_SYMBOL_GPL(crypto_drop_spawn); diff --git a/queue-4.19/crypto-ccree-fix-backlog-memory-leak.patch b/queue-4.19/crypto-ccree-fix-backlog-memory-leak.patch new file mode 100644 index 00000000000..8a448962a62 --- /dev/null +++ b/queue-4.19/crypto-ccree-fix-backlog-memory-leak.patch @@ -0,0 +1,32 @@ +From 4df2ef25b3b3618fd708ab484fe6239abd130fec Mon Sep 17 00:00:00 2001 +From: Gilad Ben-Yossef +Date: Wed, 27 Nov 2019 10:49:08 +0200 +Subject: crypto: ccree - fix backlog memory leak + +From: Gilad Ben-Yossef + +commit 4df2ef25b3b3618fd708ab484fe6239abd130fec upstream. + +Fix brown paper bag bug of not releasing backlog list item buffer +when backlog was consumed causing a memory leak when backlog is +used. + +Signed-off-by: Gilad Ben-Yossef +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccree/cc_request_mgr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/crypto/ccree/cc_request_mgr.c ++++ b/drivers/crypto/ccree/cc_request_mgr.c +@@ -403,6 +403,7 @@ static void cc_proc_backlog(struct cc_dr + spin_lock(&mgr->bl_lock); + list_del(&bli->list); + --mgr->bl_len; ++ kfree(bli); + } + + spin_unlock(&mgr->bl_lock); diff --git a/queue-4.19/crypto-ccree-fix-pm-race-condition.patch b/queue-4.19/crypto-ccree-fix-pm-race-condition.patch new file mode 100644 index 00000000000..4d73d3c8d83 --- /dev/null +++ b/queue-4.19/crypto-ccree-fix-pm-race-condition.patch @@ -0,0 +1,195 @@ +From 15fd2566bf54ee4d4781d8f170acfc9472a1541f Mon Sep 17 00:00:00 2001 +From: Gilad Ben-Yossef +Date: Thu, 16 Jan 2020 12:14:43 +0200 +Subject: crypto: ccree - fix PM race condition + +From: Gilad Ben-Yossef + +commit 15fd2566bf54ee4d4781d8f170acfc9472a1541f upstream. + +The PM code was racy, possibly causing the driver to submit +requests to a powered down device. Fix the race and while +at it simplify the PM code. + +Signed-off-by: Gilad Ben-Yossef +Fixes: 1358c13a48c4 ("crypto: ccree - fix resume race condition on init") +Cc: stable@kernel.org # v4.20 +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccree/cc_driver.h | 1 + drivers/crypto/ccree/cc_pm.c | 28 ++++--------------- + drivers/crypto/ccree/cc_request_mgr.c | 50 ---------------------------------- + drivers/crypto/ccree/cc_request_mgr.h | 8 ----- + 4 files changed, 7 insertions(+), 80 deletions(-) + +--- a/drivers/crypto/ccree/cc_driver.h ++++ b/drivers/crypto/ccree/cc_driver.h +@@ -131,6 +131,7 @@ struct cc_drvdata { + u32 axim_mon_offset; + u32 sig_offset; + u32 ver_offset; ++ bool pm_on; + }; + + struct cc_crypto_alg { +--- a/drivers/crypto/ccree/cc_pm.c ++++ b/drivers/crypto/ccree/cc_pm.c +@@ -23,14 +23,8 @@ const struct dev_pm_ops ccree_pm = { + int cc_pm_suspend(struct device *dev) + { + struct cc_drvdata *drvdata = dev_get_drvdata(dev); +- int rc; + + dev_dbg(dev, "set HOST_POWER_DOWN_EN\n"); +- rc = cc_suspend_req_queue(drvdata); +- if (rc) { +- dev_err(dev, "cc_suspend_req_queue (%x)\n", rc); +- return rc; +- } + fini_cc_regs(drvdata); + cc_iowrite(drvdata, CC_REG(HOST_POWER_DOWN_EN), POWER_DOWN_ENABLE); + cc_clk_off(drvdata); +@@ -59,13 +53,6 @@ int cc_pm_resume(struct device *dev) + /* check if tee fips error occurred during power down */ + cc_tee_handle_fips_error(drvdata); + +- rc = cc_resume_req_queue(drvdata); +- if (rc) { +- dev_err(dev, "cc_resume_req_queue (%x)\n", rc); +- return rc; +- } +- +- /* must be after the queue resuming as it uses the HW queue*/ + cc_init_hash_sram(drvdata); + + cc_init_iv_sram(drvdata); +@@ -77,10 +64,8 @@ int cc_pm_get(struct device *dev) + int rc = 0; + struct cc_drvdata *drvdata = dev_get_drvdata(dev); + +- if (cc_req_queue_suspended(drvdata)) ++ if (drvdata->pm_on) + rc = pm_runtime_get_sync(dev); +- else +- pm_runtime_get_noresume(dev); + + return (rc == 1 ? 0 : rc); + } +@@ -90,14 +75,11 @@ int cc_pm_put_suspend(struct device *dev + int rc = 0; + struct cc_drvdata *drvdata = dev_get_drvdata(dev); + +- if (!cc_req_queue_suspended(drvdata)) { ++ if (drvdata->pm_on) { + pm_runtime_mark_last_busy(dev); + rc = pm_runtime_put_autosuspend(dev); +- } else { +- /* Something wrong happens*/ +- dev_err(dev, "request to suspend already suspended queue"); +- rc = -EBUSY; + } ++ + return rc; + } + +@@ -108,7 +90,7 @@ int cc_pm_init(struct cc_drvdata *drvdat + /* must be before the enabling to avoid resdundent suspending */ + pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT); + pm_runtime_use_autosuspend(dev); +- /* activate the PM module */ ++ /* set us as active - note we won't do PM ops until cc_pm_go()! */ + return pm_runtime_set_active(dev); + } + +@@ -116,9 +98,11 @@ int cc_pm_init(struct cc_drvdata *drvdat + void cc_pm_go(struct cc_drvdata *drvdata) + { + pm_runtime_enable(drvdata_to_dev(drvdata)); ++ drvdata->pm_on = true; + } + + void cc_pm_fini(struct cc_drvdata *drvdata) + { + pm_runtime_disable(drvdata_to_dev(drvdata)); ++ drvdata->pm_on = false; + } +--- a/drivers/crypto/ccree/cc_request_mgr.c ++++ b/drivers/crypto/ccree/cc_request_mgr.c +@@ -41,7 +41,6 @@ struct cc_req_mgr_handle { + #else + struct tasklet_struct comptask; + #endif +- bool is_runtime_suspended; + }; + + struct cc_bl_item { +@@ -661,52 +660,3 @@ static void comp_handler(unsigned long d + + cc_proc_backlog(drvdata); + } +- +-/* +- * resume the queue configuration - no need to take the lock as this happens +- * inside the spin lock protection +- */ +-#if defined(CONFIG_PM) +-int cc_resume_req_queue(struct cc_drvdata *drvdata) +-{ +- struct cc_req_mgr_handle *request_mgr_handle = +- drvdata->request_mgr_handle; +- +- spin_lock_bh(&request_mgr_handle->hw_lock); +- request_mgr_handle->is_runtime_suspended = false; +- spin_unlock_bh(&request_mgr_handle->hw_lock); +- +- return 0; +-} +- +-/* +- * suspend the queue configuration. Since it is used for the runtime suspend +- * only verify that the queue can be suspended. +- */ +-int cc_suspend_req_queue(struct cc_drvdata *drvdata) +-{ +- struct cc_req_mgr_handle *request_mgr_handle = +- drvdata->request_mgr_handle; +- +- /* lock the send_request */ +- spin_lock_bh(&request_mgr_handle->hw_lock); +- if (request_mgr_handle->req_queue_head != +- request_mgr_handle->req_queue_tail) { +- spin_unlock_bh(&request_mgr_handle->hw_lock); +- return -EBUSY; +- } +- request_mgr_handle->is_runtime_suspended = true; +- spin_unlock_bh(&request_mgr_handle->hw_lock); +- +- return 0; +-} +- +-bool cc_req_queue_suspended(struct cc_drvdata *drvdata) +-{ +- struct cc_req_mgr_handle *request_mgr_handle = +- drvdata->request_mgr_handle; +- +- return request_mgr_handle->is_runtime_suspended; +-} +- +-#endif +--- a/drivers/crypto/ccree/cc_request_mgr.h ++++ b/drivers/crypto/ccree/cc_request_mgr.h +@@ -40,12 +40,4 @@ void complete_request(struct cc_drvdata + + void cc_req_mgr_fini(struct cc_drvdata *drvdata); + +-#if defined(CONFIG_PM) +-int cc_resume_req_queue(struct cc_drvdata *drvdata); +- +-int cc_suspend_req_queue(struct cc_drvdata *drvdata); +- +-bool cc_req_queue_suspended(struct cc_drvdata *drvdata); +-#endif +- + #endif /*__REQUEST_MGR_H__*/ diff --git a/queue-4.19/crypto-ccree-fix-pm-wrongful-error-reporting.patch b/queue-4.19/crypto-ccree-fix-pm-wrongful-error-reporting.patch new file mode 100644 index 00000000000..1b7968c9418 --- /dev/null +++ b/queue-4.19/crypto-ccree-fix-pm-wrongful-error-reporting.patch @@ -0,0 +1,32 @@ +From cedca59fae5834af8445b403c66c9953754375d7 Mon Sep 17 00:00:00 2001 +From: Gilad Ben-Yossef +Date: Thu, 16 Jan 2020 12:14:40 +0200 +Subject: crypto: ccree - fix pm wrongful error reporting + +From: Gilad Ben-Yossef + +commit cedca59fae5834af8445b403c66c9953754375d7 upstream. + +pm_runtime_get_sync() can return 1 as a valid (none error) return +code. Treat it as such. + +Signed-off-by: Gilad Ben-Yossef +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccree/cc_pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/ccree/cc_pm.c ++++ b/drivers/crypto/ccree/cc_pm.c +@@ -82,7 +82,7 @@ int cc_pm_get(struct device *dev) + else + pm_runtime_get_noresume(dev); + +- return rc; ++ return (rc == 1 ? 0 : rc); + } + + int cc_pm_put_suspend(struct device *dev) diff --git a/queue-4.19/hv_balloon-balloon-up-according-to-request-page-number.patch b/queue-4.19/hv_balloon-balloon-up-according-to-request-page-number.patch new file mode 100644 index 00000000000..da4d2f56046 --- /dev/null +++ b/queue-4.19/hv_balloon-balloon-up-according-to-request-page-number.patch @@ -0,0 +1,77 @@ +From d33c240d47dab4fd15123d9e73fc8810cbc6ed6a Mon Sep 17 00:00:00 2001 +From: Tianyu Lan +Date: Sat, 25 Jan 2020 16:50:47 -0500 +Subject: hv_balloon: Balloon up according to request page number + +From: Tianyu Lan + +commit d33c240d47dab4fd15123d9e73fc8810cbc6ed6a upstream. + +Current code has assumption that balloon request memory size aligns +with 2MB. But actually Hyper-V doesn't guarantee such alignment. When +balloon driver receives non-aligned balloon request, it produces warning +and balloon up more memory than requested in order to keep 2MB alignment. +Remove the warning and balloon up memory according to actual requested +memory size. + +Fixes: f6712238471a ("hv: hv_balloon: avoid memory leak on alloc_error of 2MB memory block") +Cc: stable@vger.kernel.org +Reviewed-by: Vitaly Kuznetsov +Signed-off-by: Tianyu Lan +Reviewed-by: Michael Kelley +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/hv_balloon.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -1215,10 +1215,7 @@ static unsigned int alloc_balloon_pages( + unsigned int i = 0; + struct page *pg; + +- if (num_pages < alloc_unit) +- return 0; +- +- for (i = 0; (i * alloc_unit) < num_pages; i++) { ++ for (i = 0; i < num_pages / alloc_unit; i++) { + if (bl_resp->hdr.size + sizeof(union dm_mem_page_range) > + PAGE_SIZE) + return i * alloc_unit; +@@ -1252,7 +1249,7 @@ static unsigned int alloc_balloon_pages( + + } + +- return num_pages; ++ return i * alloc_unit; + } + + static void balloon_up(struct work_struct *dummy) +@@ -1267,9 +1264,6 @@ static void balloon_up(struct work_struc + long avail_pages; + unsigned long floor; + +- /* The host balloons pages in 2M granularity. */ +- WARN_ON_ONCE(num_pages % PAGES_IN_2M != 0); +- + /* + * We will attempt 2M allocations. However, if we fail to + * allocate 2M chunks, we will go back to 4k allocations. +@@ -1279,14 +1273,13 @@ static void balloon_up(struct work_struc + avail_pages = si_mem_available(); + floor = compute_balloon_floor(); + +- /* Refuse to balloon below the floor, keep the 2M granularity. */ ++ /* Refuse to balloon below the floor. */ + if (avail_pages < num_pages || avail_pages - num_pages < floor) { + pr_warn("Balloon request will be partially fulfilled. %s\n", + avail_pages < num_pages ? "Not enough memory." : + "Balloon floor reached."); + + num_pages = avail_pages > floor ? (avail_pages - floor) : 0; +- num_pages -= num_pages % PAGES_IN_2M; + } + + while (!done) { diff --git a/queue-4.19/mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch b/queue-4.19/mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch new file mode 100644 index 00000000000..e8487bb90db --- /dev/null +++ b/queue-4.19/mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch @@ -0,0 +1,39 @@ +From dc91c3b6fe66a13ac76f6cb3b2100c0779cd3350 Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Sat, 4 Jan 2020 19:24:08 -0600 +Subject: mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile + +From: Samuel Holland + +commit dc91c3b6fe66a13ac76f6cb3b2100c0779cd3350 upstream. + +On AXP288 and newer PMICs, bit 7 of AXP20X_VBUS_IPSOUT_MGMT can be set +to prevent using the VBUS input. However, when the VBUS unplugged and +plugged back in, the bit automatically resets to zero. + +We need to set the register as volatile to prevent regmap from caching +that bit. Otherwise, regcache will think the bit is already set and not +write the register. + +Fixes: cd53216625a0 ("mfd: axp20x: Fix axp288 volatile ranges") +Cc: stable@vger.kernel.org +Signed-off-by: Samuel Holland +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/axp20x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -128,7 +128,7 @@ static const struct regmap_range axp288_ + static const struct regmap_range axp288_volatile_ranges[] = { + regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON), + regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL), +- regmap_reg_range(AXP288_BC_DET_STAT, AXP288_BC_DET_STAT), ++ regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT), + regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL), + regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L), + regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL), diff --git a/queue-4.19/power-supply-ltc2941-battery-gauge-fix-use-after-free.patch b/queue-4.19/power-supply-ltc2941-battery-gauge-fix-use-after-free.patch new file mode 100644 index 00000000000..581ad40e902 --- /dev/null +++ b/queue-4.19/power-supply-ltc2941-battery-gauge-fix-use-after-free.patch @@ -0,0 +1,41 @@ +From a60ec78d306c6548d4adbc7918b587a723c555cc Mon Sep 17 00:00:00 2001 +From: Sven Van Asbroeck +Date: Thu, 19 Sep 2019 11:11:37 -0400 +Subject: power: supply: ltc2941-battery-gauge: fix use-after-free + +From: Sven Van Asbroeck + +commit a60ec78d306c6548d4adbc7918b587a723c555cc upstream. + +This driver's remove path calls cancel_delayed_work(). +However, that function does not wait until the work function +finishes. This could mean that the work function is still +running after the driver's remove function has finished, +which would result in a use-after-free. + +Fix by calling cancel_delayed_work_sync(), which ensures that +that the work is properly cancelled, no longer running, and +unable to re-schedule itself. + +This issue was detected with the help of Coccinelle. + +Cc: stable +Signed-off-by: Sven Van Asbroeck +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/supply/ltc2941-battery-gauge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/power/supply/ltc2941-battery-gauge.c ++++ b/drivers/power/supply/ltc2941-battery-gauge.c +@@ -448,7 +448,7 @@ static int ltc294x_i2c_remove(struct i2c + { + struct ltc294x_info *info = i2c_get_clientdata(client); + +- cancel_delayed_work(&info->work); ++ cancel_delayed_work_sync(&info->work); + power_supply_unregister(info->supply); + return 0; + } diff --git a/queue-4.19/scripts-find-unused-docs-fix-massive-false-positives.patch b/queue-4.19/scripts-find-unused-docs-fix-massive-false-positives.patch new file mode 100644 index 00000000000..7eb9b7338b5 --- /dev/null +++ b/queue-4.19/scripts-find-unused-docs-fix-massive-false-positives.patch @@ -0,0 +1,41 @@ +From 1630146db2111412e7524d05d812ff8f2c75977e Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 27 Jan 2020 10:31:07 +0100 +Subject: scripts/find-unused-docs: Fix massive false positives + +From: Geert Uytterhoeven + +commit 1630146db2111412e7524d05d812ff8f2c75977e upstream. + +scripts/find-unused-docs.sh invokes scripts/kernel-doc to find out if a +source file contains kerneldoc or not. + +However, as it passes the no longer supported "-text" option to +scripts/kernel-doc, the latter prints out its help text, causing all +files to be considered containing kerneldoc. + +Get rid of these false positives by removing the no longer supported +"-text" option from the scripts/kernel-doc invocation. + +Cc: stable@vger.kernel.org # 4.16+ +Fixes: b05142675310d2ac ("scripts: kernel-doc: get rid of unused output formats") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20200127093107.26401-1-geert+renesas@glider.be +Signed-off-by: Jonathan Corbet +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/find-unused-docs.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/find-unused-docs.sh ++++ b/scripts/find-unused-docs.sh +@@ -54,7 +54,7 @@ for file in `find $1 -name '*.c'`; do + if [[ ${FILES_INCLUDED[$file]+_} ]]; then + continue; + fi +- str=$(scripts/kernel-doc -text -export "$file" 2>/dev/null) ++ str=$(scripts/kernel-doc -export "$file" 2>/dev/null) + if [[ -n "$str" ]]; then + echo "$file" + fi diff --git a/queue-4.19/scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch b/queue-4.19/scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch new file mode 100644 index 00000000000..0cdf334d282 --- /dev/null +++ b/queue-4.19/scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch @@ -0,0 +1,37 @@ +From 641e0efddcbde52461e017136acd3ce7f2ef0c14 Mon Sep 17 00:00:00 2001 +From: Quinn Tran +Date: Tue, 17 Dec 2019 14:06:16 -0800 +Subject: scsi: qla2xxx: Fix mtcp dump collection failure + +From: Quinn Tran + +commit 641e0efddcbde52461e017136acd3ce7f2ef0c14 upstream. + +MTCP dump failed due to MB Reg 10 was picking garbage data from stack +memory. + +Fixes: 81178772b636a ("[SCSI] qla2xxx: Implemetation of mctp.") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20191217220617.28084-14-hmadhani@marvell.com +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_mbx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -5994,9 +5994,8 @@ qla2x00_dump_mctp_data(scsi_qla_host_t * + mcp->mb[7] = LSW(MSD(req_dma)); + mcp->mb[8] = MSW(addr); + /* Setting RAM ID to valid */ +- mcp->mb[10] |= BIT_7; + /* For MCTP RAM ID is 0x40 */ +- mcp->mb[10] |= 0x40; ++ mcp->mb[10] = BIT_7 | 0x40; + + mcp->out_mb |= MBX_10|MBX_8|MBX_7|MBX_6|MBX_5|MBX_4|MBX_3|MBX_2|MBX_1| + MBX_0; diff --git a/queue-4.19/series b/queue-4.19/series index e05c8e806ac..6dd905996ec 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -68,3 +68,12 @@ ubifs-fix-deadlock-in-concurrent-bulk-read-and-writepage.patch crypto-geode-aes-convert-to-skcipher-api-and-make-thread-safe.patch pci-keystone-fix-link-training-retries-initiation.patch mmc-sdhci-of-at91-fix-memleak-on-clk_get-failure.patch +hv_balloon-balloon-up-according-to-request-page-number.patch +mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch +crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch +crypto-ccree-fix-backlog-memory-leak.patch +crypto-ccree-fix-pm-wrongful-error-reporting.patch +crypto-ccree-fix-pm-race-condition.patch +scripts-find-unused-docs-fix-massive-false-positives.patch +scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch +power-supply-ltc2941-battery-gauge-fix-use-after-free.patch -- 2.47.3