From 8014a082c4be996a7238259855544f51b9e7c083 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 28 Feb 2018 16:25:22 +0100 Subject: [PATCH] 4.14-stable patches added patches: afs-fix-missing-error-handling-in-afs_write_end.patch arm-8731-1-fix-csum_partial_copy_from_user-stack-mismatch.patch arm-dts-ls1021a-fix-incorrect-clock-references.patch arm64-dts-renesas-ulcb-remove-renesas-no-ether-link-property.patch asoc-nau8825-fix-issue-that-pop-noise-when-start-capture.patch asoc-rsnd-fixup-adg-register-mask.patch block-drain-queue-before-waiting-for-q_usage_counter-becoming-zero.patch bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch bnxt_en-fix-population-of-flow_type-in-bnxt_hwrm_cfa_flow_alloc.patch bnxt_en-fix-the-invalid-vf-id-check-in-bnxt_vf_ndo_prep-routine.patch bpf-sockmap-missing-null-psock-check.patch btrfs-fix-flush-bio-leak.patch can-flex_can-correct-the-checking-for-frame-length-in-flexcan_start_xmit.patch cgroup-fix-deadlock-in-cpu-hotplug-path.patch crypto-af_alg-fix-race-around-ctx-rcvused-by-making-it-atomic_t.patch crypto-inside-secure-fix-request-allocations-in-invalidation-path.patch crypto-inside-secure-free-requests-even-if-their-handling-failed.patch crypto-inside-secure-per-request-invalidation.patch dmaengine-fsl-edma-disable-clks-on-all-error-paths.patch drm-nouveau-pci-do-a-msi-rearm-on-init.patch drm-ttm-check-the-return-value-of-kzalloc.patch e1000-fix-disabling-already-disabled-warning.patch exec-avoid-gcc-8-warning-for-get_task_comm.patch genirq-guard-handle_bad_irq-log-messages.patch i40e-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch i40e-i40evf-account-for-frags-split-over-multiple-descriptors-in-check-linearize.patch i915-reject-ccs-modifiers-for-pipe-c-on-geminilake.patch ia64-sched-cputime-fix-build-error-if-config_virt_cpu_accounting_native-y.patch ib-ipoib-fix-race-condition-in-neigh-creation.patch ib-mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch ib-mlx5-fix-mlx5_ib_alloc_mr-error-flow.patch input-xen-kbdfront-do-not-advertise-multi-touch-pressure-support.patch ip6_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch ip6_tunnel-allow-ip6gre-dev-mtu-to-be-set-below-1280.patch ip6_tunnel-get-the-min-mtu-properly-in-ip6_tnl_xmit.patch ip_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch led-core-fix-brightness-setting-when-setting-delay_off-0.patch leds-core-fix-regression-caused-by-commit-2b83ff96f51d.patch lib-mpi-fix-umul_ppmm-for-mips64r6.patch mac80211-mesh-drop-frames-appearing-to-be-from-us.patch mac80211_hwsim-fix-a-possible-sleep-in-atomic-bug-in-hwsim_get_radio_nl.patch macvlan-fix-one-possible-double-free.patch mdio-sun4i-fix-a-memory-leak.patch mlxsw-pci-wait-after-reset-before-accessing-hw.patch mm-frame_vector.c-release-a-semaphore-in-get_vaddr_frames.patch mtd-nand-brcmnand-zero-bitflip-is-not-an-error.patch mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch net-aquantia-fix-actual-speed-capabilities-reporting.patch net-aquantia-fix-hardware-dma-stream-overload-on-large-mrrs.patch net-arc_emac-fix-arc_emac_rx-error-paths.patch net-ena-unmask-msi-x-only-after-device-initialization-is-completed.patch net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch net-mediatek-setup-proper-state-for-disabled-gmac-on-the-default.patch net-mlx5-cleanup-irqs-in-case-of-unload-failure.patch net-mlx5-stay-in-polling-mode-when-command-eq-destroy-fails.patch net-mlx5e-fix-ets-bw-check.patch net-phy-fix-resume-handling.patch net-phy-xgene-disable-clk-on-error-paths.patch net-stmmac-fix-bad-rx-timestamp-extraction.patch net-stmmac-fix-tx-timestamp-calculation.patch net-usb-qmi_wwan-add-support-for-yuga-clm920-nc5-pid-0x9625.patch net-usb-qmi_wwan-add-telit-me910-pid-0x1101-support.patch netfilter-nf_tables-fix-chain-filter-in-nf_tables_dump_rules.patch netfilter-nf_tables-fix-potential-null-ptr-deref-in-nf_tables_dump_obj_done.patch netfilter-uapi-correct-untracked-conntrack-state-bit-number.patch nfp-always-unmask-aux-interrupts-at-init.patch nl80211-check-for-the-required-netlink-attribute-presence.patch nvme-check-hw-sectors-before-setting-chunk-sectors.patch nvme-fabrics-initialize-default-host-id-in-nvmf_host_default.patch nvme-fc-remove-double-put-reference-if-admin-connect-fails.patch of_mdio-avoid-mdio-bus-removal-when-a-phy-is-missing.patch parisc-reduce-thread-stack-to-16-kb.patch perf-x86-intel-plug-memory-leak-in-intel_pmu_init.patch phy-cpcap-usb-fix-platform_get_irq_byname-s-error-checking.patch powerpc-pseries-make-ras-irq-explicitly-dependent-on-dlpar-wq.patch rdma-netlink-fix-locking-around-__ib_get_device_by_index.patch rdma-vmw_pvrdma-call-ib_umem_release-on-destroy-qp-path.patch s390-dasd-fix-wrongly-assigned-configuration-data.patch scsi-aacraid-fix-i-o-drop-during-reset.patch scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch sctp-add-a-ceiling-to-optlen-in-some-sockopts.patch sctp-fix-the-issue-that-a-__u16-variable-may-overflow-in-sctp_ulpq_renege.patch sctp-make-use-of-pre-calculated-len.patch sget-handle-failures-of-register_shrinker.patch solutionengine771x-fix-ether-platform-data.patch spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch staging-ion-fix-ion_cma_heap-allocations.patch tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch tipc-error-path-leak-fixes-in-tipc_enable_bearer.patch tipc-fix-tipc_mon_delete-oops-in-tipc_enable_bearer-error-path.patch uapi-libc-compat-add-fallback-for-unsupported-libcs.patch vxlan-update-skb-dst-pmtu-on-tx-path.patch wcn36xx-fix-dynamic-power-saving.patch x86-64-xen-eliminate-w-x-mappings.patch x86-asm-allow-again-using-asm.h-when-building-for-the-bpf-clang-target.patch x86-efi-fix-kernel-param-add_efi_memmap-regression.patch x86-platform-intel-mid-revert-make-bt_sfi_data-const.patch x86-stacktrace-make-zombie-stack-traces-reliable.patch xen-balloon-mark-unallocated-host-memory-as-unusable.patch xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch xen-netfront-enable-device-after-manual-module-load.patch xfrm-reinject-transport-mode-packets-through-tasklet.patch xfs-quota-check-result-of-register_shrinker.patch xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch --- ...sing-error-handling-in-afs_write_end.patch | 46 +++ ...artial_copy_from_user-stack-mismatch.patch | 43 +++ ...1021a-fix-incorrect-clock-references.patch | 52 +++ ...emove-renesas-no-ether-link-property.patch | 60 +++ ...ue-that-pop-noise-when-start-capture.patch | 32 ++ .../asoc-rsnd-fixup-adg-register-mask.patch | 54 +++ ...ng-for-q_usage_counter-becoming-zero.patch | 79 ++++ ...ability-in-case-of-nested-pci-errors.patch | 90 +++++ ...low_type-in-bnxt_hwrm_cfa_flow_alloc.patch | 37 ++ ...id-check-in-bnxt_vf_ndo_prep-routine.patch | 40 ++ ...bpf-sockmap-missing-null-psock-check.patch | 46 +++ queue-4.14/btrfs-fix-flush-bio-leak.patch | 42 +++ ...r-frame-length-in-flexcan_start_xmit.patch | 38 ++ ...oup-fix-deadlock-in-cpu-hotplug-path.patch | 74 ++++ ...nd-ctx-rcvused-by-making-it-atomic_t.patch | 97 +++++ ...est-allocations-in-invalidation-path.patch | 96 +++++ ...quests-even-if-their-handling-failed.patch | 33 ++ ...side-secure-per-request-invalidation.patch | 354 ++++++++++++++++++ ...edma-disable-clks-on-all-error-paths.patch | 111 ++++++ ...m-nouveau-pci-do-a-msi-rearm-on-init.patch | 41 ++ ...tm-check-the-return-value-of-kzalloc.patch | 33 ++ ...x-disabling-already-disabled-warning.patch | 181 +++++++++ ...void-gcc-8-warning-for-get_task_comm.patch | 85 +++++ ...rq-guard-handle_bad_irq-log-messages.patch | 60 +++ ...netdev-dev_addr-when-syncing-uc-list.patch | 98 +++++ ...tiple-descriptors-in-check-linearize.patch | 122 ++++++ ...s-modifiers-for-pipe-c-on-geminilake.patch | 46 +++ ...-config_virt_cpu_accounting_native-y.patch | 42 +++ ...fix-race-condition-in-neigh-creation.patch | 136 +++++++ ...mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch | 46 +++ ...mlx5-fix-mlx5_ib_alloc_mr-error-flow.patch | 40 ++ ...vertise-multi-touch-pressure-support.patch | 38 ++ ...he-incorrect-mtu-limit-for-ipgre-tap.patch | 32 ++ ...-ip6gre-dev-mtu-to-be-set-below-1280.patch | 46 +++ ...the-min-mtu-properly-in-ip6_tnl_xmit.patch | 60 +++ ...he-incorrect-mtu-limit-for-ipgre-tap.patch | 41 ++ ...llow-icmp-messages-to-be-looped-back.patch | 44 +++ ...ess-setting-when-setting-delay_off-0.patch | 32 ++ ...ession-caused-by-commit-2b83ff96f51d.patch | 48 +++ .../lib-mpi-fix-umul_ppmm-for-mips64r6.patch | 78 ++++ ...-drop-frames-appearing-to-be-from-us.patch | 35 ++ ...-in-atomic-bug-in-hwsim_get_radio_nl.patch | 38 ++ ...macvlan-fix-one-possible-double-free.patch | 42 +++ queue-4.14/mdio-sun4i-fix-a-memory-leak.patch | 39 ++ ...wait-after-reset-before-accessing-hw.patch | 54 +++ ...ease-a-semaphore-in-get_vaddr_frames.patch | 44 +++ ...rcmnand-zero-bitflip-is-not-an-error.patch | 37 ++ ...n-a-erased-page-has-a-bitflip-at-bbm.patch | 63 ++++ ...-actual-speed-capabilities-reporting.patch | 150 ++++++++ ...re-dma-stream-overload-on-large-mrrs.patch | 85 +++++ ...arc_emac-fix-arc_emac_rx-error-paths.patch | 100 +++++ ...r-device-initialization-is-completed.patch | 82 ++++ ...t_fipers-to-spinlock-protecting-area.patch | 40 ++ ...ate-for-disabled-gmac-on-the-default.patch | 46 +++ ...eanup-irqs-in-case-of-unload-failure.patch | 92 +++++ ...g-mode-when-command-eq-destroy-fails.patch | 40 ++ queue-4.14/net-mlx5e-fix-ets-bw-check.patch | 50 +++ queue-4.14/net-phy-fix-resume-handling.patch | 135 +++++++ ...phy-xgene-disable-clk-on-error-paths.patch | 83 ++++ ...mmac-fix-bad-rx-timestamp-extraction.patch | 93 +++++ ...-stmmac-fix-tx-timestamp-calculation.patch | 46 +++ ...pport-for-yuga-clm920-nc5-pid-0x9625.patch | 37 ++ ...n-add-telit-me910-pid-0x1101-support.patch | 31 ++ ...chain-filter-in-nf_tables_dump_rules.patch | 33 ++ ...ptr-deref-in-nf_tables_dump_obj_done.patch | 39 ++ ...untracked-conntrack-state-bit-number.patch | 40 ++ ...always-unmask-aux-interrupts-at-init.patch | 52 +++ ...-required-netlink-attribute-presence.patch | 36 ++ ...sectors-before-setting-chunk-sectors.patch | 37 ++ ...default-host-id-in-nvmf_host_default.patch | 30 ++ ...put-reference-if-admin-connect-fails.patch | 34 ++ ...io-bus-removal-when-a-phy-is-missing.patch | 49 +++ .../parisc-reduce-thread-stack-to-16-kb.patch | 38 ++ ...l-plug-memory-leak-in-intel_pmu_init.patch | 61 +++ ...form_get_irq_byname-s-error-checking.patch | 36 ++ ...irq-explicitly-dependent-on-dlpar-wq.patch | 108 ++++++ ...king-around-__ib_get_device_by_index.patch | 192 ++++++++++ ...l-ib_umem_release-on-destroy-qp-path.patch | 41 ++ ...-wrongly-assigned-configuration-data.patch | 49 +++ ...si-aacraid-fix-i-o-drop-during-reset.patch | 50 +++ ...-assignments-in-storvsc_handle_error.patch | 45 +++ ...a-ceiling-to-optlen-in-some-sockopts.patch | 60 +++ ...ble-may-overflow-in-sctp_ulpq_renege.patch | 68 ++++ .../sctp-make-use-of-pre-calculated-len.patch | 94 +++++ queue-4.14/series | 107 ++++++ ...handle-failures-of-register_shrinker.patch | 32 ++ ...onengine771x-fix-ether-platform-data.patch | 65 ++++ ...n_lock-usage-inside-atmel_spi_remove.patch | 45 +++ ...ing-ion-fix-ion_cma_heap-allocations.patch | 108 ++++++ ...around-to-restrict-5762-mrrs-to-2048.patch | 64 ++++ ...hy-reset-in-mtu-change-path-for-5720.patch | 36 ++ ...ath-leak-fixes-in-tipc_enable_bearer.patch | 45 +++ ...ops-in-tipc_enable_bearer-error-path.patch | 82 ++++ ...t-add-fallback-for-unsupported-libcs.patch | 155 ++++++++ ...vxlan-update-skb-dst-pmtu-on-tx-path.patch | 68 ++++ .../wcn36xx-fix-dynamic-power-saving.patch | 84 +++++ .../x86-64-xen-eliminate-w-x-mappings.patch | 70 ++++ ...en-building-for-the-bpf-clang-target.patch | 202 ++++++++++ ...rnel-param-add_efi_memmap-regression.patch | 56 +++ ...el-mid-revert-make-bt_sfi_data-const.patch | 52 +++ ...ce-make-zombie-stack-traces-reliable.patch | 69 ++++ ...-unallocated-host-memory-as-unusable.patch | 262 +++++++++++++ ...-one-error-when-unmapping-with-holes.patch | 36 ++ ...tdev-fix-partial-gntdev_mmap-cleanup.patch | 42 +++ ...able-device-after-manual-module-load.patch | 45 +++ ...ansport-mode-packets-through-tasklet.patch | 200 ++++++++++ ...ta-check-result-of-register_shrinker.patch | 108 ++++++ ...a-fix-missed-destroy-of-qi_tree_lock.patch | 32 ++ 108 files changed, 7492 insertions(+) create mode 100644 queue-4.14/afs-fix-missing-error-handling-in-afs_write_end.patch create mode 100644 queue-4.14/arm-8731-1-fix-csum_partial_copy_from_user-stack-mismatch.patch create mode 100644 queue-4.14/arm-dts-ls1021a-fix-incorrect-clock-references.patch create mode 100644 queue-4.14/arm64-dts-renesas-ulcb-remove-renesas-no-ether-link-property.patch create mode 100644 queue-4.14/asoc-nau8825-fix-issue-that-pop-noise-when-start-capture.patch create mode 100644 queue-4.14/asoc-rsnd-fixup-adg-register-mask.patch create mode 100644 queue-4.14/block-drain-queue-before-waiting-for-q_usage_counter-becoming-zero.patch create mode 100644 queue-4.14/bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch create mode 100644 queue-4.14/bnxt_en-fix-population-of-flow_type-in-bnxt_hwrm_cfa_flow_alloc.patch create mode 100644 queue-4.14/bnxt_en-fix-the-invalid-vf-id-check-in-bnxt_vf_ndo_prep-routine.patch create mode 100644 queue-4.14/bpf-sockmap-missing-null-psock-check.patch create mode 100644 queue-4.14/btrfs-fix-flush-bio-leak.patch create mode 100644 queue-4.14/can-flex_can-correct-the-checking-for-frame-length-in-flexcan_start_xmit.patch create mode 100644 queue-4.14/cgroup-fix-deadlock-in-cpu-hotplug-path.patch create mode 100644 queue-4.14/crypto-af_alg-fix-race-around-ctx-rcvused-by-making-it-atomic_t.patch create mode 100644 queue-4.14/crypto-inside-secure-fix-request-allocations-in-invalidation-path.patch create mode 100644 queue-4.14/crypto-inside-secure-free-requests-even-if-their-handling-failed.patch create mode 100644 queue-4.14/crypto-inside-secure-per-request-invalidation.patch create mode 100644 queue-4.14/dmaengine-fsl-edma-disable-clks-on-all-error-paths.patch create mode 100644 queue-4.14/drm-nouveau-pci-do-a-msi-rearm-on-init.patch create mode 100644 queue-4.14/drm-ttm-check-the-return-value-of-kzalloc.patch create mode 100644 queue-4.14/e1000-fix-disabling-already-disabled-warning.patch create mode 100644 queue-4.14/exec-avoid-gcc-8-warning-for-get_task_comm.patch create mode 100644 queue-4.14/genirq-guard-handle_bad_irq-log-messages.patch create mode 100644 queue-4.14/i40e-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch create mode 100644 queue-4.14/i40e-i40evf-account-for-frags-split-over-multiple-descriptors-in-check-linearize.patch create mode 100644 queue-4.14/i915-reject-ccs-modifiers-for-pipe-c-on-geminilake.patch create mode 100644 queue-4.14/ia64-sched-cputime-fix-build-error-if-config_virt_cpu_accounting_native-y.patch create mode 100644 queue-4.14/ib-ipoib-fix-race-condition-in-neigh-creation.patch create mode 100644 queue-4.14/ib-mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch create mode 100644 queue-4.14/ib-mlx5-fix-mlx5_ib_alloc_mr-error-flow.patch create mode 100644 queue-4.14/input-xen-kbdfront-do-not-advertise-multi-touch-pressure-support.patch create mode 100644 queue-4.14/ip6_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch create mode 100644 queue-4.14/ip6_tunnel-allow-ip6gre-dev-mtu-to-be-set-below-1280.patch create mode 100644 queue-4.14/ip6_tunnel-get-the-min-mtu-properly-in-ip6_tnl_xmit.patch create mode 100644 queue-4.14/ip_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch create mode 100644 queue-4.14/ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch create mode 100644 queue-4.14/led-core-fix-brightness-setting-when-setting-delay_off-0.patch create mode 100644 queue-4.14/leds-core-fix-regression-caused-by-commit-2b83ff96f51d.patch create mode 100644 queue-4.14/lib-mpi-fix-umul_ppmm-for-mips64r6.patch create mode 100644 queue-4.14/mac80211-mesh-drop-frames-appearing-to-be-from-us.patch create mode 100644 queue-4.14/mac80211_hwsim-fix-a-possible-sleep-in-atomic-bug-in-hwsim_get_radio_nl.patch create mode 100644 queue-4.14/macvlan-fix-one-possible-double-free.patch create mode 100644 queue-4.14/mdio-sun4i-fix-a-memory-leak.patch create mode 100644 queue-4.14/mlxsw-pci-wait-after-reset-before-accessing-hw.patch create mode 100644 queue-4.14/mm-frame_vector.c-release-a-semaphore-in-get_vaddr_frames.patch create mode 100644 queue-4.14/mtd-nand-brcmnand-zero-bitflip-is-not-an-error.patch create mode 100644 queue-4.14/mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch create mode 100644 queue-4.14/net-aquantia-fix-actual-speed-capabilities-reporting.patch create mode 100644 queue-4.14/net-aquantia-fix-hardware-dma-stream-overload-on-large-mrrs.patch create mode 100644 queue-4.14/net-arc_emac-fix-arc_emac_rx-error-paths.patch create mode 100644 queue-4.14/net-ena-unmask-msi-x-only-after-device-initialization-is-completed.patch create mode 100644 queue-4.14/net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch create mode 100644 queue-4.14/net-mediatek-setup-proper-state-for-disabled-gmac-on-the-default.patch create mode 100644 queue-4.14/net-mlx5-cleanup-irqs-in-case-of-unload-failure.patch create mode 100644 queue-4.14/net-mlx5-stay-in-polling-mode-when-command-eq-destroy-fails.patch create mode 100644 queue-4.14/net-mlx5e-fix-ets-bw-check.patch create mode 100644 queue-4.14/net-phy-fix-resume-handling.patch create mode 100644 queue-4.14/net-phy-xgene-disable-clk-on-error-paths.patch create mode 100644 queue-4.14/net-stmmac-fix-bad-rx-timestamp-extraction.patch create mode 100644 queue-4.14/net-stmmac-fix-tx-timestamp-calculation.patch create mode 100644 queue-4.14/net-usb-qmi_wwan-add-support-for-yuga-clm920-nc5-pid-0x9625.patch create mode 100644 queue-4.14/net-usb-qmi_wwan-add-telit-me910-pid-0x1101-support.patch create mode 100644 queue-4.14/netfilter-nf_tables-fix-chain-filter-in-nf_tables_dump_rules.patch create mode 100644 queue-4.14/netfilter-nf_tables-fix-potential-null-ptr-deref-in-nf_tables_dump_obj_done.patch create mode 100644 queue-4.14/netfilter-uapi-correct-untracked-conntrack-state-bit-number.patch create mode 100644 queue-4.14/nfp-always-unmask-aux-interrupts-at-init.patch create mode 100644 queue-4.14/nl80211-check-for-the-required-netlink-attribute-presence.patch create mode 100644 queue-4.14/nvme-check-hw-sectors-before-setting-chunk-sectors.patch create mode 100644 queue-4.14/nvme-fabrics-initialize-default-host-id-in-nvmf_host_default.patch create mode 100644 queue-4.14/nvme-fc-remove-double-put-reference-if-admin-connect-fails.patch create mode 100644 queue-4.14/of_mdio-avoid-mdio-bus-removal-when-a-phy-is-missing.patch create mode 100644 queue-4.14/parisc-reduce-thread-stack-to-16-kb.patch create mode 100644 queue-4.14/perf-x86-intel-plug-memory-leak-in-intel_pmu_init.patch create mode 100644 queue-4.14/phy-cpcap-usb-fix-platform_get_irq_byname-s-error-checking.patch create mode 100644 queue-4.14/powerpc-pseries-make-ras-irq-explicitly-dependent-on-dlpar-wq.patch create mode 100644 queue-4.14/rdma-netlink-fix-locking-around-__ib_get_device_by_index.patch create mode 100644 queue-4.14/rdma-vmw_pvrdma-call-ib_umem_release-on-destroy-qp-path.patch create mode 100644 queue-4.14/s390-dasd-fix-wrongly-assigned-configuration-data.patch create mode 100644 queue-4.14/scsi-aacraid-fix-i-o-drop-during-reset.patch create mode 100644 queue-4.14/scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch create mode 100644 queue-4.14/sctp-add-a-ceiling-to-optlen-in-some-sockopts.patch create mode 100644 queue-4.14/sctp-fix-the-issue-that-a-__u16-variable-may-overflow-in-sctp_ulpq_renege.patch create mode 100644 queue-4.14/sctp-make-use-of-pre-calculated-len.patch create mode 100644 queue-4.14/sget-handle-failures-of-register_shrinker.patch create mode 100644 queue-4.14/solutionengine771x-fix-ether-platform-data.patch create mode 100644 queue-4.14/spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch create mode 100644 queue-4.14/staging-ion-fix-ion_cma_heap-allocations.patch create mode 100644 queue-4.14/tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch create mode 100644 queue-4.14/tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch create mode 100644 queue-4.14/tipc-error-path-leak-fixes-in-tipc_enable_bearer.patch create mode 100644 queue-4.14/tipc-fix-tipc_mon_delete-oops-in-tipc_enable_bearer-error-path.patch create mode 100644 queue-4.14/uapi-libc-compat-add-fallback-for-unsupported-libcs.patch create mode 100644 queue-4.14/vxlan-update-skb-dst-pmtu-on-tx-path.patch create mode 100644 queue-4.14/wcn36xx-fix-dynamic-power-saving.patch create mode 100644 queue-4.14/x86-64-xen-eliminate-w-x-mappings.patch create mode 100644 queue-4.14/x86-asm-allow-again-using-asm.h-when-building-for-the-bpf-clang-target.patch create mode 100644 queue-4.14/x86-efi-fix-kernel-param-add_efi_memmap-regression.patch create mode 100644 queue-4.14/x86-platform-intel-mid-revert-make-bt_sfi_data-const.patch create mode 100644 queue-4.14/x86-stacktrace-make-zombie-stack-traces-reliable.patch create mode 100644 queue-4.14/xen-balloon-mark-unallocated-host-memory-as-unusable.patch create mode 100644 queue-4.14/xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch create mode 100644 queue-4.14/xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch create mode 100644 queue-4.14/xen-netfront-enable-device-after-manual-module-load.patch create mode 100644 queue-4.14/xfrm-reinject-transport-mode-packets-through-tasklet.patch create mode 100644 queue-4.14/xfs-quota-check-result-of-register_shrinker.patch create mode 100644 queue-4.14/xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch diff --git a/queue-4.14/afs-fix-missing-error-handling-in-afs_write_end.patch b/queue-4.14/afs-fix-missing-error-handling-in-afs_write_end.patch new file mode 100644 index 00000000000..4f340b23f58 --- /dev/null +++ b/queue-4.14/afs-fix-missing-error-handling-in-afs_write_end.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: David Howells +Date: Tue, 2 Jan 2018 10:02:19 +0000 +Subject: afs: Fix missing error handling in afs_write_end() + +From: David Howells + + +[ Upstream commit afae457d874860a7e299d334f59eede5f3ad4b47 ] + +afs_write_end() is missing page unlock and put if afs_fill_page() fails. + +Reported-by: Al Viro +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/afs/write.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -282,7 +282,7 @@ int afs_write_end(struct file *file, str + ret = afs_fill_page(vnode, key, pos + copied, + len - copied, page); + if (ret < 0) +- return ret; ++ goto out; + } + SetPageUptodate(page); + } +@@ -290,10 +290,12 @@ int afs_write_end(struct file *file, str + set_page_dirty(page); + if (PageDirty(page)) + _debug("dirtied"); ++ ret = copied; ++ ++out: + unlock_page(page); + put_page(page); +- +- return copied; ++ return ret; + } + + /* diff --git a/queue-4.14/arm-8731-1-fix-csum_partial_copy_from_user-stack-mismatch.patch b/queue-4.14/arm-8731-1-fix-csum_partial_copy_from_user-stack-mismatch.patch new file mode 100644 index 00000000000..e746639d0ac --- /dev/null +++ b/queue-4.14/arm-8731-1-fix-csum_partial_copy_from_user-stack-mismatch.patch @@ -0,0 +1,43 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Chunyan Zhang +Date: Fri, 1 Dec 2017 03:51:04 +0100 +Subject: ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch + +From: Chunyan Zhang + + +[ Upstream commit 36b0cb84ee858f02c256d26f0cb4229c78e3399e ] + +An additional 'ip' will be pushed to the stack, for restoring the +DACR later, if CONFIG_CPU_SW_DOMAIN_PAN defined. + +However, the fixup still get the err_ptr by add #8*4 to sp, which +results in the fact that the code area pointed by the LR will be +overwritten, or the kernel will crash if CONFIG_DEBUG_RODATA is enabled. + +This patch fixes the stack mismatch. + +Fixes: a5e090acbf54 ("ARM: software-based priviledged-no-access support") +Signed-off-by: Lvqiang Huang +Signed-off-by: Chunyan Zhang +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/lib/csumpartialcopyuser.S | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm/lib/csumpartialcopyuser.S ++++ b/arch/arm/lib/csumpartialcopyuser.S +@@ -85,7 +85,11 @@ + .pushsection .text.fixup,"ax" + .align 4 + 9001: mov r4, #-EFAULT ++#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++ ldr r5, [sp, #9*4] @ *err_ptr ++#else + ldr r5, [sp, #8*4] @ *err_ptr ++#endif + str r4, [r5] + ldmia sp, {r1, r2} @ retrieve dst, len + add r2, r2, r1 diff --git a/queue-4.14/arm-dts-ls1021a-fix-incorrect-clock-references.patch b/queue-4.14/arm-dts-ls1021a-fix-incorrect-clock-references.patch new file mode 100644 index 00000000000..b5a64aadd0c --- /dev/null +++ b/queue-4.14/arm-dts-ls1021a-fix-incorrect-clock-references.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Arnd Bergmann +Date: Thu, 21 Dec 2017 22:35:19 +0100 +Subject: ARM: dts: ls1021a: fix incorrect clock references + +From: Arnd Bergmann + + +[ Upstream commit 506e8a912661c97b41adc8a286b875d01323ec45 ] + +dtc warns about two 'clocks' properties that have an extraneous '1' +at the end: + +arch/arm/boot/dts/ls1021a-qds.dtb: Warning (clocks_property): arch/arm/boot/dts/ls1021a-twr.dtb: Warning (clocks_property): Property 'clocks', cell 1 is not a phandle reference in /soc/i2c@2180000/mux@77/i2c@4/sgtl5000@2a +arch/arm/boot/dts/ls1021a-qds.dtb: Warning (clocks_property): Missing property '#clock-cells' in node /soc/interrupt-controller@1400000 or bad phandle (referred from /soc/i2c@2180000/mux@77/i2c@4/sgtl5000@2a:clocks[1]) +Property 'clocks', cell 1 is not a phandle reference in /soc/i2c@2190000/sgtl5000@a +arch/arm/boot/dts/ls1021a-twr.dtb: Warning (clocks_property): Missing property '#clock-cells' in node /soc/interrupt-controller@1400000 or bad phandle (referred from /soc/i2c@2190000/sgtl5000@a:clocks[1]) + +The clocks that get referenced here are fixed-rate, so they do not +take any argument, and dtc interprets the next cell as a phandle, which +is invalid. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/ls1021a-qds.dts | 2 +- + arch/arm/boot/dts/ls1021a-twr.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/ls1021a-qds.dts ++++ b/arch/arm/boot/dts/ls1021a-qds.dts +@@ -215,7 +215,7 @@ + reg = <0x2a>; + VDDA-supply = <®_3p3v>; + VDDIO-supply = <®_3p3v>; +- clocks = <&sys_mclk 1>; ++ clocks = <&sys_mclk>; + }; + }; + }; +--- a/arch/arm/boot/dts/ls1021a-twr.dts ++++ b/arch/arm/boot/dts/ls1021a-twr.dts +@@ -187,7 +187,7 @@ + reg = <0x0a>; + VDDA-supply = <®_3p3v>; + VDDIO-supply = <®_3p3v>; +- clocks = <&sys_mclk 1>; ++ clocks = <&sys_mclk>; + }; + }; + diff --git a/queue-4.14/arm64-dts-renesas-ulcb-remove-renesas-no-ether-link-property.patch b/queue-4.14/arm64-dts-renesas-ulcb-remove-renesas-no-ether-link-property.patch new file mode 100644 index 00000000000..493b7de9a58 --- /dev/null +++ b/queue-4.14/arm64-dts-renesas-ulcb-remove-renesas-no-ether-link-property.patch @@ -0,0 +1,60 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Bogdan Mirea +Date: Thu, 21 Dec 2017 17:18:59 +0200 +Subject: arm64: dts: renesas: ulcb: Remove renesas, no-ether-link property + +From: Bogdan Mirea + + +[ Upstream commit 7d2901f809c110bd9a261e879d59efe62e3bc758 ] + +The present change is a bug fix for AVB link iteratively up/down. + +Steps to reproduce: +- start AVB TX stream (Using aplay via MSE), +- disconnect+reconnect the eth cable, +- after a reconnection the eth connection goes iteratively up/down + without user interaction, +- this may heal after some seconds or even stay for minutes. + +As the documentation specifies, the "renesas,no-ether-link" option +should be used when a board does not provide a proper AVB_LINK signal. +There is no need for this option enabled on RCAR H3/M3 Salvator-X/XS +and ULCB starter kits since the AVB_LINK is correctly handled by HW. + +Choosing to keep or remove the "renesas,no-ether-link" option will +have impact on the code flow in the following ways: +- keeping this option enabled may lead to unexpected behavior since + the RX & TX are enabled/disabled directly from adjust_link function + without any HW interrogation, +- removing this option, the RX & TX will only be enabled/disabled after + HW interrogation. The HW check is made through the LMON pin in PSR + register which specifies AVB_LINK signal value (0 - at low level; + 1 - at high level). + +In conclusion, the present change is also a safety improvement because +it removes the "renesas,no-ether-link" option leading to a proper way +of detecting the link state based on HW interrogation and not on +software heuristic. + +Fixes: dc36965a8905 ("arm64: dts: r8a7796: salvator-x: Enable EthernetAVB") +Fixes: 6fa501c549aa ("arm64: dts: r8a7795: enable EthernetAVB on Salvator-X") +Signed-off-by: Bogdan Mirea +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/ulcb.dtsi | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm64/boot/dts/renesas/ulcb.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb.dtsi +@@ -145,7 +145,6 @@ + &avb { + pinctrl-0 = <&avb_pins>; + pinctrl-names = "default"; +- renesas,no-ether-link; + phy-handle = <&phy0>; + status = "okay"; + diff --git a/queue-4.14/asoc-nau8825-fix-issue-that-pop-noise-when-start-capture.patch b/queue-4.14/asoc-nau8825-fix-issue-that-pop-noise-when-start-capture.patch new file mode 100644 index 00000000000..e409d07a9f5 --- /dev/null +++ b/queue-4.14/asoc-nau8825-fix-issue-that-pop-noise-when-start-capture.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Abhijeet Kumar +Date: Tue, 12 Dec 2017 00:40:25 +0530 +Subject: ASoC: nau8825: fix issue that pop noise when start capture + +From: Abhijeet Kumar + + +[ Upstream commit d070f7c703ef26e3db613f24206823f916272fc6 ] + +In skylake platform, we hear a loud pop noise(0 dB) at start of +audio capture power up sequence. This patch removes the pop noise +from the recording by adding a delay before enabling ADC. + +Signed-off-by: Abhijeet Kumar +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/nau8825.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/codecs/nau8825.c ++++ b/sound/soc/codecs/nau8825.c +@@ -905,6 +905,7 @@ static int nau8825_adc_event(struct snd_ + + switch (event) { + case SND_SOC_DAPM_POST_PMU: ++ msleep(125); + regmap_update_bits(nau8825->regmap, NAU8825_REG_ENA_CTRL, + NAU8825_ENABLE_ADC, NAU8825_ENABLE_ADC); + break; diff --git a/queue-4.14/asoc-rsnd-fixup-adg-register-mask.patch b/queue-4.14/asoc-rsnd-fixup-adg-register-mask.patch new file mode 100644 index 00000000000..b963f359699 --- /dev/null +++ b/queue-4.14/asoc-rsnd-fixup-adg-register-mask.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Kuninori Morimoto +Date: Wed, 20 Dec 2017 06:11:59 +0000 +Subject: ASoC: rsnd: fixup ADG register mask + +From: Kuninori Morimoto + + +[ Upstream commit d5aa24825da5711f8cb829f873160ddf1a29b19c ] + +BRGCKR should use 0x80770000, instead of 0x80FF0000. + +R-Car Gen2 xxx_TIMSEL should use 0x0F1F, +R-Car Gen3 xxx_TIMSEL should use 0x1F1F. +Here, Gen3 doesn't support AVD, thus, both case can use 0x0F1F. + +Signed-off-by: Kuninori Morimoto +Reviewed-by: Hiroyuki Yokoyama +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sh/rcar/adg.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/soc/sh/rcar/adg.c ++++ b/sound/soc/sh/rcar/adg.c +@@ -216,7 +216,7 @@ int rsnd_adg_set_cmd_timsel_gen2(struct + NULL, &val, NULL); + + val = val << shift; +- mask = 0xffff << shift; ++ mask = 0x0f1f << shift; + + rsnd_mod_bset(adg_mod, CMDOUT_TIMSEL, mask, val); + +@@ -244,7 +244,7 @@ int rsnd_adg_set_src_timesel_gen2(struct + + in = in << shift; + out = out << shift; +- mask = 0xffff << shift; ++ mask = 0x0f1f << shift; + + switch (id / 2) { + case 0: +@@ -374,7 +374,7 @@ int rsnd_adg_ssi_clk_try_start(struct rs + ckr = 0x80000000; + } + +- rsnd_mod_bset(adg_mod, BRGCKR, 0x80FF0000, adg->ckr | ckr); ++ rsnd_mod_bset(adg_mod, BRGCKR, 0x80770000, adg->ckr | ckr); + rsnd_mod_write(adg_mod, BRRA, adg->rbga); + rsnd_mod_write(adg_mod, BRRB, adg->rbgb); + diff --git a/queue-4.14/block-drain-queue-before-waiting-for-q_usage_counter-becoming-zero.patch b/queue-4.14/block-drain-queue-before-waiting-for-q_usage_counter-becoming-zero.patch new file mode 100644 index 00000000000..51300c4cec7 --- /dev/null +++ b/queue-4.14/block-drain-queue-before-waiting-for-q_usage_counter-becoming-zero.patch @@ -0,0 +1,79 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Ming Lei +Date: Thu, 30 Nov 2017 07:56:35 +0800 +Subject: block: drain queue before waiting for q_usage_counter becoming zero + +From: Ming Lei + + +[ Upstream commit 454be724f6f99cc7e7bbf15067128be9868186c6 ] + +Now we track legacy requests with .q_usage_counter in commit 055f6e18e08f +("block: Make q_usage_counter also track legacy requests"), but that +commit never runs and drains legacy queue before waiting for this counter +becoming zero, then IO hang is caused in the test of pulling disk during IO. + +This patch fixes the issue by draining requests before waiting for +q_usage_counter becoming zero, both Mauricio and chenxiang reported this +issue, and observed that it can be fixed by this patch. + +Link: https://marc.info/?l=linux-block&m=151192424731797&w=2 +Fixes: 055f6e18e08f("block: Make q_usage_counter also track legacy requests") +Cc: Wen Xiong +Tested-by: "chenxiang (M)" +Tested-by: Mauricio Faria de Oliveira +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-core.c | 9 +++++++-- + block/blk-mq.c | 2 ++ + block/blk.h | 2 ++ + 3 files changed, 11 insertions(+), 2 deletions(-) + +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -531,6 +531,13 @@ static void __blk_drain_queue(struct req + } + } + ++void blk_drain_queue(struct request_queue *q) ++{ ++ spin_lock_irq(q->queue_lock); ++ __blk_drain_queue(q, true); ++ spin_unlock_irq(q->queue_lock); ++} ++ + /** + * blk_queue_bypass_start - enter queue bypass mode + * @q: queue of interest +@@ -655,8 +662,6 @@ void blk_cleanup_queue(struct request_qu + */ + blk_freeze_queue(q); + spin_lock_irq(lock); +- if (!q->mq_ops) +- __blk_drain_queue(q, true); + queue_flag_set(QUEUE_FLAG_DEAD, q); + spin_unlock_irq(lock); + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -159,6 +159,8 @@ void blk_freeze_queue(struct request_que + * exported to drivers as the only user for unfreeze is blk_mq. + */ + blk_freeze_queue_start(q); ++ if (!q->mq_ops) ++ blk_drain_queue(q); + blk_mq_freeze_queue_wait(q); + } + +--- a/block/blk.h ++++ b/block/blk.h +@@ -362,4 +362,6 @@ static inline void blk_queue_bounce(stru + } + #endif /* CONFIG_BOUNCE */ + ++extern void blk_drain_queue(struct request_queue *q); ++ + #endif /* BLK_INTERNAL_H */ diff --git a/queue-4.14/bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch b/queue-4.14/bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch new file mode 100644 index 00000000000..ef097a3ae0d --- /dev/null +++ b/queue-4.14/bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch @@ -0,0 +1,90 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: "Guilherme G. Piccoli" +Date: Fri, 22 Dec 2017 13:01:39 -0200 +Subject: bnx2x: Improve reliability in case of nested PCI errors + +From: "Guilherme G. Piccoli" + + +[ Upstream commit f7084059a9cb9e56a186e1677b1dcffd76c2cd24 ] + +While in recovery process of PCI error (called EEH on PowerPC arch), +another PCI transaction could be corrupted causing a situation of +nested PCI errors. Also, this scenario could be reproduced with +error injection mechanisms (for debug purposes). + +We observe that in case of nested PCI errors, bnx2x might attempt to +initialize its shmem and cause a kernel crash due to bad addresses +read from MCP. Multiple different stack traces were observed depending +on the point the second PCI error happens. + +This patch avoids the crashes by: + + * failing PCI recovery in case of nested errors (since multiple + PCI errors in a row are not expected to lead to a functional + adapter anyway), and by, + + * preventing access to adapter FW when MCP is failed (we mark it as + failed when shmem cannot get initialized properly). + +Reported-by: Abdul Haleem +Signed-off-by: Guilherme G. Piccoli +Acked-by: Shahed Shaikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 4 ++-- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 14 +++++++++++++- + 2 files changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -3030,7 +3030,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i + + del_timer_sync(&bp->timer); + +- if (IS_PF(bp)) { ++ if (IS_PF(bp) && !BP_NOMCP(bp)) { + /* Set ALWAYS_ALIVE bit in shmem */ + bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE; + bnx2x_drv_pulse(bp); +@@ -3116,7 +3116,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i + bp->cnic_loaded = false; + + /* Clear driver version indication in shmem */ +- if (IS_PF(bp)) ++ if (IS_PF(bp) && !BP_NOMCP(bp)) + bnx2x_update_mng_version(bp); + + /* Check if there are pending parity attentions. If there are - set +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9578,6 +9578,15 @@ static int bnx2x_init_shmem(struct bnx2x + + do { + bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR); ++ ++ /* If we read all 0xFFs, means we are in PCI error state and ++ * should bail out to avoid crashes on adapter's FW reads. ++ */ ++ if (bp->common.shmem_base == 0xFFFFFFFF) { ++ bp->flags |= NO_MCP_FLAG; ++ return -ENODEV; ++ } ++ + if (bp->common.shmem_base) { + val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]); + if (val & SHR_MEM_VALIDITY_MB) +@@ -14315,7 +14324,10 @@ static pci_ers_result_t bnx2x_io_slot_re + BNX2X_ERR("IO slot reset --> driver unload\n"); + + /* MCP should have been reset; Need to wait for validity */ +- bnx2x_init_shmem(bp); ++ if (bnx2x_init_shmem(bp)) { ++ rtnl_unlock(); ++ return PCI_ERS_RESULT_DISCONNECT; ++ } + + if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) { + u32 v; diff --git a/queue-4.14/bnxt_en-fix-population-of-flow_type-in-bnxt_hwrm_cfa_flow_alloc.patch b/queue-4.14/bnxt_en-fix-population-of-flow_type-in-bnxt_hwrm_cfa_flow_alloc.patch new file mode 100644 index 00000000000..1eaf90ff7ae --- /dev/null +++ b/queue-4.14/bnxt_en-fix-population-of-flow_type-in-bnxt_hwrm_cfa_flow_alloc.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Sunil Challa +Date: Thu, 4 Jan 2018 18:46:54 -0500 +Subject: bnxt_en: Fix population of flow_type in bnxt_hwrm_cfa_flow_alloc() + +From: Sunil Challa + + +[ Upstream commit 7deea450eb912f269d999de62c8ab922d1461748 ] + +flow_type in HWRM_FLOW_ALLOC is not being populated correctly due to +incorrect passing of pointer and size of l3_mask argument of is_wildcard(). +Fixed this. + +Fixes: db1d36a27324 ("bnxt_en: add TC flower offload flow_alloc/free FW cmds") +Signed-off-by: Sunil Challa +Reviewed-by: Sathya Perla +Reviewed-by: Venkat Duvvuru +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +@@ -327,7 +327,7 @@ static int bnxt_hwrm_cfa_flow_alloc(stru + } + + /* If all IP and L4 fields are wildcarded then this is an L2 flow */ +- if (is_wildcard(&l3_mask, sizeof(l3_mask)) && ++ if (is_wildcard(l3_mask, sizeof(*l3_mask)) && + is_wildcard(&flow->l4_mask, sizeof(flow->l4_mask))) { + flow_flags |= CFA_FLOW_ALLOC_REQ_FLAGS_FLOWTYPE_L2; + } else { diff --git a/queue-4.14/bnxt_en-fix-the-invalid-vf-id-check-in-bnxt_vf_ndo_prep-routine.patch b/queue-4.14/bnxt_en-fix-the-invalid-vf-id-check-in-bnxt_vf_ndo_prep-routine.patch new file mode 100644 index 00000000000..3a155a8ebd3 --- /dev/null +++ b/queue-4.14/bnxt_en-fix-the-invalid-vf-id-check-in-bnxt_vf_ndo_prep-routine.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Venkat Duvvuru +Date: Thu, 4 Jan 2018 18:46:55 -0500 +Subject: bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine. + +From: Venkat Duvvuru + + +[ Upstream commit 78f300049335ae81a5cc6b4b232481dc5e1f9d41 ] + +In bnxt_vf_ndo_prep (which is called by bnxt_get_vf_config ndo), there is a +check for "Invalid VF id". Currently, the check is done against max_vfs. +However, the user doesn't always create max_vfs. So, the check should be +against the created number of VFs. The number of bnxt_vf_info structures +that are allocated in bnxt_alloc_vf_resources routine is the "number of +requested VFs". So, if an "invalid VF id" falls between the requested +number of VFs and the max_vfs, the driver will be dereferencing an invalid +pointer. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Venkat Devvuru +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -70,7 +70,7 @@ static int bnxt_vf_ndo_prep(struct bnxt + netdev_err(bp->dev, "vf ndo called though sriov is disabled\n"); + return -EINVAL; + } +- if (vf_id >= bp->pf.max_vfs) { ++ if (vf_id >= bp->pf.active_vfs) { + netdev_err(bp->dev, "Invalid VF id %d\n", vf_id); + return -EINVAL; + } diff --git a/queue-4.14/bpf-sockmap-missing-null-psock-check.patch b/queue-4.14/bpf-sockmap-missing-null-psock-check.patch new file mode 100644 index 00000000000..c2e565de1f5 --- /dev/null +++ b/queue-4.14/bpf-sockmap-missing-null-psock-check.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: John Fastabend +Date: Thu, 4 Jan 2018 20:02:09 -0800 +Subject: bpf: sockmap missing NULL psock check + +From: John Fastabend + + +[ Upstream commit 5731a879d03bdaa00265f8ebc32dfd0e65d25276 ] + +Add psock NULL check to handle a racing sock event that can get the +sk_callback_lock before this case but after xchg happens causing the +refcnt to hit zero and sock user data (psock) to be null and queued +for garbage collection. + +Also add a comment in the code because this is a bit subtle and +not obvious in my opinion. + +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/sockmap.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/kernel/bpf/sockmap.c ++++ b/kernel/bpf/sockmap.c +@@ -588,8 +588,15 @@ static void sock_map_free(struct bpf_map + + write_lock_bh(&sock->sk_callback_lock); + psock = smap_psock_sk(sock); +- smap_list_remove(psock, &stab->sock_map[i]); +- smap_release_sock(psock, sock); ++ /* This check handles a racing sock event that can get the ++ * sk_callback_lock before this case but after xchg happens ++ * causing the refcnt to hit zero and sock user data (psock) ++ * to be null and queued for garbage collection. ++ */ ++ if (likely(psock)) { ++ smap_list_remove(psock, &stab->sock_map[i]); ++ smap_release_sock(psock, sock); ++ } + write_unlock_bh(&sock->sk_callback_lock); + } + rcu_read_unlock(); diff --git a/queue-4.14/btrfs-fix-flush-bio-leak.patch b/queue-4.14/btrfs-fix-flush-bio-leak.patch new file mode 100644 index 00000000000..9227706a12d --- /dev/null +++ b/queue-4.14/btrfs-fix-flush-bio-leak.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Nikolay Borisov +Date: Wed, 13 Dec 2017 13:50:07 +0200 +Subject: btrfs: Fix flush bio leak + +From: Nikolay Borisov + + +[ Upstream commit beed9263f4000c48a5c48912f26576f6fa091181 ] + +Commit e0ae99941423 ("btrfs: preallocate device flush bio") reworked +the way the flush bio is allocated and used. Concretely it allocates +the bio in __alloc_device and then re-uses it multiple times with a +very simple endio routine that just calls complete() without consuming +a reference. Allocated bios by default come with a ref count of 1, +which is then consumed by the endio routine (or not, in which case they +should be bio_put by the caller). The way the impleementation works now +is that the flush bio has a refcount of 2 and we only ever bio_put it +once, leaving it to hang indefinitely. Fix this by removing the extra +bio_get in __alloc_device. + +Fixes: e0ae99941423 ("btrfs: preallocate device flush bio") +Signed-off-by: Nikolay Borisov +Reviewed-by: Liu Bo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/volumes.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -236,7 +236,6 @@ static struct btrfs_device *__alloc_devi + kfree(dev); + return ERR_PTR(-ENOMEM); + } +- bio_get(dev->flush_bio); + + INIT_LIST_HEAD(&dev->dev_list); + INIT_LIST_HEAD(&dev->dev_alloc_list); diff --git a/queue-4.14/can-flex_can-correct-the-checking-for-frame-length-in-flexcan_start_xmit.patch b/queue-4.14/can-flex_can-correct-the-checking-for-frame-length-in-flexcan_start_xmit.patch new file mode 100644 index 00000000000..7dec89c4f82 --- /dev/null +++ b/queue-4.14/can-flex_can-correct-the-checking-for-frame-length-in-flexcan_start_xmit.patch @@ -0,0 +1,38 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Luu An Phu +Date: Tue, 2 Jan 2018 10:44:18 +0700 +Subject: can: flex_can: Correct the checking for frame length in flexcan_start_xmit() + +From: Luu An Phu + + +[ Upstream commit 13454c14550065fcc1705d6bd4ee6d40e057099f ] + +The flexcan_start_xmit() function compares the frame length with data +register length to write frame content into data[0] and data[1] +register. Data register length is 4 bytes and frame maximum length is 8 +bytes. + +Fix the check that compares frame length with 3. Because the register +length is 4. + +Signed-off-by: Luu An Phu +Reviewed-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/flexcan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -526,7 +526,7 @@ static int flexcan_start_xmit(struct sk_ + data = be32_to_cpup((__be32 *)&cf->data[0]); + flexcan_write(data, &priv->tx_mb->data[0]); + } +- if (cf->can_dlc > 3) { ++ if (cf->can_dlc > 4) { + data = be32_to_cpup((__be32 *)&cf->data[4]); + flexcan_write(data, &priv->tx_mb->data[1]); + } diff --git a/queue-4.14/cgroup-fix-deadlock-in-cpu-hotplug-path.patch b/queue-4.14/cgroup-fix-deadlock-in-cpu-hotplug-path.patch new file mode 100644 index 00000000000..cddd24bd111 --- /dev/null +++ b/queue-4.14/cgroup-fix-deadlock-in-cpu-hotplug-path.patch @@ -0,0 +1,74 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Prateek Sood +Date: Tue, 19 Dec 2017 12:56:57 +0530 +Subject: cgroup: Fix deadlock in cpu hotplug path + +From: Prateek Sood + + +[ Upstream commit 116d2f7496c51b2e02e8e4ecdd2bdf5fb9d5a641 ] + +Deadlock during cgroup migration from cpu hotplug path when a task T is +being moved from source to destination cgroup. + +kworker/0:0 +cpuset_hotplug_workfn() + cpuset_hotplug_update_tasks() + hotplug_update_tasks_legacy() + remove_tasks_in_empty_cpuset() + cgroup_transfer_tasks() // stuck in iterator loop + cgroup_migrate() + cgroup_migrate_add_task() + +In cgroup_migrate_add_task() it checks for PF_EXITING flag of task T. +Task T will not migrate to destination cgroup. css_task_iter_start() +will keep pointing to task T in loop waiting for task T cg_list node +to be removed. + +Task T +do_exit() + exit_signals() // sets PF_EXITING + exit_task_namespaces() + switch_task_namespaces() + free_nsproxy() + put_mnt_ns() + drop_collected_mounts() + namespace_unlock() + synchronize_rcu() + _synchronize_rcu_expedited() + schedule_work() // on cpu0 low priority worker pool + wait_event() // waiting for work item to execute + +Task T inserted a work item in the worklist of cpu0 low priority +worker pool. It is waiting for expedited grace period work item +to execute. This work item will only be executed once kworker/0:0 +complete execution of cpuset_hotplug_workfn(). + +kworker/0:0 ==> Task T ==>kworker/0:0 + +In case of PF_EXITING task being migrated from source to destination +cgroup, migrate next available task in source cgroup. + +Signed-off-by: Prateek Sood +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cgroup/cgroup-v1.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -123,7 +123,11 @@ int cgroup_transfer_tasks(struct cgroup + */ + do { + css_task_iter_start(&from->self, 0, &it); +- task = css_task_iter_next(&it); ++ ++ do { ++ task = css_task_iter_next(&it); ++ } while (task && (task->flags & PF_EXITING)); ++ + if (task) + get_task_struct(task); + css_task_iter_end(&it); diff --git a/queue-4.14/crypto-af_alg-fix-race-around-ctx-rcvused-by-making-it-atomic_t.patch b/queue-4.14/crypto-af_alg-fix-race-around-ctx-rcvused-by-making-it-atomic_t.patch new file mode 100644 index 00000000000..7daf0df4df7 --- /dev/null +++ b/queue-4.14/crypto-af_alg-fix-race-around-ctx-rcvused-by-making-it-atomic_t.patch @@ -0,0 +1,97 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Jonathan Cameron +Date: Tue, 19 Dec 2017 10:27:24 +0000 +Subject: crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t + +From: Jonathan Cameron + + +[ Upstream commit af955bf15d2c27496b0269b1f05c26f758c68314 ] + +This variable was increased and decreased without any protection. +Result was an occasional misscount and negative wrap around resulting +in false resource allocation failures. + +Fixes: 7d2c3f54e6f6 ("crypto: af_alg - remove locking in async callback") +Signed-off-by: Jonathan Cameron +Reviewed-by: Stephan Mueller +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + crypto/af_alg.c | 4 ++-- + crypto/algif_aead.c | 2 +- + crypto/algif_skcipher.c | 2 +- + include/crypto/if_alg.h | 5 +++-- + 4 files changed, 7 insertions(+), 6 deletions(-) + +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -693,7 +693,7 @@ void af_alg_free_areq_sgls(struct af_alg + unsigned int i; + + list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) { +- ctx->rcvused -= rsgl->sg_num_bytes; ++ atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused); + af_alg_free_sg(&rsgl->sgl); + list_del(&rsgl->list); + if (rsgl != &areq->first_rsgl) +@@ -1192,7 +1192,7 @@ int af_alg_get_rsgl(struct sock *sk, str + + areq->last_rsgl = rsgl; + len += err; +- ctx->rcvused += err; ++ atomic_add(err, &ctx->rcvused); + rsgl->sg_num_bytes = err; + iov_iter_advance(&msg->msg_iter, err); + } +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -571,7 +571,7 @@ static int aead_accept_parent_nokey(void + INIT_LIST_HEAD(&ctx->tsgl_list); + ctx->len = len; + ctx->used = 0; +- ctx->rcvused = 0; ++ atomic_set(&ctx->rcvused, 0); + ctx->more = 0; + ctx->merge = 0; + ctx->enc = 0; +--- a/crypto/algif_skcipher.c ++++ b/crypto/algif_skcipher.c +@@ -391,7 +391,7 @@ static int skcipher_accept_parent_nokey( + INIT_LIST_HEAD(&ctx->tsgl_list); + ctx->len = len; + ctx->used = 0; +- ctx->rcvused = 0; ++ atomic_set(&ctx->rcvused, 0); + ctx->more = 0; + ctx->merge = 0; + ctx->enc = 0; +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -155,7 +156,7 @@ struct af_alg_ctx { + struct af_alg_completion completion; + + size_t used; +- size_t rcvused; ++ atomic_t rcvused; + + bool more; + bool merge; +@@ -228,7 +229,7 @@ static inline int af_alg_rcvbuf(struct s + struct af_alg_ctx *ctx = ask->private; + + return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) - +- ctx->rcvused, 0); ++ atomic_read(&ctx->rcvused), 0); + } + + /** diff --git a/queue-4.14/crypto-inside-secure-fix-request-allocations-in-invalidation-path.patch b/queue-4.14/crypto-inside-secure-fix-request-allocations-in-invalidation-path.patch new file mode 100644 index 00000000000..458d0ade51e --- /dev/null +++ b/queue-4.14/crypto-inside-secure-fix-request-allocations-in-invalidation-path.patch @@ -0,0 +1,96 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: "Antoine Ténart" +Date: Mon, 11 Dec 2017 12:10:57 +0100 +Subject: crypto: inside-secure - fix request allocations in invalidation path + +From: "Antoine Ténart" + + +[ Upstream commit 7cad2fabd5691dbb17762877d4e7f236fe4bc181 ] + +This patch makes use of the SKCIPHER_REQUEST_ON_STACK and +AHASH_REQUEST_ON_STACK helpers to allocate enough memory to contain both +the crypto request structures and their embedded context (__ctx). + +Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver") +Suggested-by: Ofer Heifetz +Signed-off-by: Antoine Tenart +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/inside-secure/safexcel_cipher.c | 16 ++++++++-------- + drivers/crypto/inside-secure/safexcel_hash.c | 14 +++++++------- + 2 files changed, 15 insertions(+), 15 deletions(-) + +--- a/drivers/crypto/inside-secure/safexcel_cipher.c ++++ b/drivers/crypto/inside-secure/safexcel_cipher.c +@@ -422,25 +422,25 @@ static int safexcel_cipher_exit_inv(stru + { + struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm); + struct safexcel_crypto_priv *priv = ctx->priv; +- struct skcipher_request req; +- struct safexcel_cipher_req *sreq = skcipher_request_ctx(&req); ++ SKCIPHER_REQUEST_ON_STACK(req, __crypto_skcipher_cast(tfm)); ++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(req); + struct safexcel_inv_result result = {}; + int ring = ctx->base.ring; + +- memset(&req, 0, sizeof(struct skcipher_request)); ++ memset(req, 0, sizeof(struct skcipher_request)); + + /* create invalidation request */ + init_completion(&result.completion); +- skcipher_request_set_callback(&req, CRYPTO_TFM_REQ_MAY_BACKLOG, +- safexcel_inv_complete, &result); ++ skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, ++ safexcel_inv_complete, &result); + +- skcipher_request_set_tfm(&req, __crypto_skcipher_cast(tfm)); +- ctx = crypto_tfm_ctx(req.base.tfm); ++ skcipher_request_set_tfm(req, __crypto_skcipher_cast(tfm)); ++ ctx = crypto_tfm_ctx(req->base.tfm); + ctx->base.exit_inv = true; + sreq->needs_inv = true; + + spin_lock_bh(&priv->ring[ring].queue_lock); +- crypto_enqueue_request(&priv->ring[ring].queue, &req.base); ++ crypto_enqueue_request(&priv->ring[ring].queue, &req->base); + spin_unlock_bh(&priv->ring[ring].queue_lock); + + if (!priv->ring[ring].need_dequeue) +--- a/drivers/crypto/inside-secure/safexcel_hash.c ++++ b/drivers/crypto/inside-secure/safexcel_hash.c +@@ -470,25 +470,25 @@ static int safexcel_ahash_exit_inv(struc + { + struct safexcel_ahash_ctx *ctx = crypto_tfm_ctx(tfm); + struct safexcel_crypto_priv *priv = ctx->priv; +- struct ahash_request req; +- struct safexcel_ahash_req *rctx = ahash_request_ctx(&req); ++ AHASH_REQUEST_ON_STACK(req, __crypto_ahash_cast(tfm)); ++ struct safexcel_ahash_req *rctx = ahash_request_ctx(req); + struct safexcel_inv_result result = {}; + int ring = ctx->base.ring; + +- memset(&req, 0, sizeof(struct ahash_request)); ++ memset(req, 0, sizeof(struct ahash_request)); + + /* create invalidation request */ + init_completion(&result.completion); +- ahash_request_set_callback(&req, CRYPTO_TFM_REQ_MAY_BACKLOG, ++ ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, + safexcel_inv_complete, &result); + +- ahash_request_set_tfm(&req, __crypto_ahash_cast(tfm)); +- ctx = crypto_tfm_ctx(req.base.tfm); ++ ahash_request_set_tfm(req, __crypto_ahash_cast(tfm)); ++ ctx = crypto_tfm_ctx(req->base.tfm); + ctx->base.exit_inv = true; + rctx->needs_inv = true; + + spin_lock_bh(&priv->ring[ring].queue_lock); +- crypto_enqueue_request(&priv->ring[ring].queue, &req.base); ++ crypto_enqueue_request(&priv->ring[ring].queue, &req->base); + spin_unlock_bh(&priv->ring[ring].queue_lock); + + if (!priv->ring[ring].need_dequeue) diff --git a/queue-4.14/crypto-inside-secure-free-requests-even-if-their-handling-failed.patch b/queue-4.14/crypto-inside-secure-free-requests-even-if-their-handling-failed.patch new file mode 100644 index 00000000000..d8a13f73a27 --- /dev/null +++ b/queue-4.14/crypto-inside-secure-free-requests-even-if-their-handling-failed.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: "Antoine Ténart" +Date: Mon, 11 Dec 2017 12:10:56 +0100 +Subject: crypto: inside-secure - free requests even if their handling failed + +From: "Antoine Ténart" + + +[ Upstream commit 0a02dcca126280595950f3ea809f77c9cb0a235c ] + +This patch frees the request private data even if its handling failed, +as it would never be freed otherwise. + +Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver") +Suggested-by: Ofer Heifetz +Signed-off-by: Antoine Tenart +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/inside-secure/safexcel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -607,6 +607,7 @@ static inline void safexcel_handle_resul + ndesc = ctx->handle_result(priv, ring, sreq->req, + &should_complete, &ret); + if (ndesc < 0) { ++ kfree(sreq); + dev_err(priv->dev, "failed to handle result (%d)", ndesc); + return; + } diff --git a/queue-4.14/crypto-inside-secure-per-request-invalidation.patch b/queue-4.14/crypto-inside-secure-per-request-invalidation.patch new file mode 100644 index 00000000000..ba2a71068f8 --- /dev/null +++ b/queue-4.14/crypto-inside-secure-per-request-invalidation.patch @@ -0,0 +1,354 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Ofer Heifetz +Date: Mon, 11 Dec 2017 12:10:55 +0100 +Subject: crypto: inside-secure - per request invalidation + +From: Ofer Heifetz + + +[ Upstream commit 1eb7b40386c97f6c4d1c62931bf306f4535a4bd6 ] + +When an invalidation request is needed we currently override the context +.send and .handle_result helpers. This is wrong as under high load other +requests can already be queued and overriding the context helpers will +make them execute the wrong .send and .handle_result functions. + +This commit fixes this by adding a needs_inv flag in the request to +choose the action to perform when sending requests or handling their +results. This flag will be set when needed (i.e. when the context flag +will be set). + +Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver") +Signed-off-by: Ofer Heifetz +[Antoine: commit message, and removed non related changes from the +original commit] +Signed-off-by: Antoine Tenart +Signed-off-by: Herbert Xu + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/inside-secure/safexcel_cipher.c | 71 ++++++++++++++++++++----- + drivers/crypto/inside-secure/safexcel_hash.c | 67 ++++++++++++++++++----- + 2 files changed, 111 insertions(+), 27 deletions(-) + +--- a/drivers/crypto/inside-secure/safexcel_cipher.c ++++ b/drivers/crypto/inside-secure/safexcel_cipher.c +@@ -14,6 +14,7 @@ + + #include + #include ++#include + + #include "safexcel.h" + +@@ -33,6 +34,10 @@ struct safexcel_cipher_ctx { + unsigned int key_len; + }; + ++struct safexcel_cipher_req { ++ bool needs_inv; ++}; ++ + static void safexcel_cipher_token(struct safexcel_cipher_ctx *ctx, + struct crypto_async_request *async, + struct safexcel_command_desc *cdesc, +@@ -126,9 +131,9 @@ static int safexcel_context_control(stru + return 0; + } + +-static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring, +- struct crypto_async_request *async, +- bool *should_complete, int *ret) ++static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int ring, ++ struct crypto_async_request *async, ++ bool *should_complete, int *ret) + { + struct skcipher_request *req = skcipher_request_cast(async); + struct safexcel_result_desc *rdesc; +@@ -265,7 +270,6 @@ static int safexcel_aes_send(struct cryp + spin_unlock_bh(&priv->ring[ring].egress_lock); + + request->req = &req->base; +- ctx->base.handle_result = safexcel_handle_result; + + *commands = n_cdesc; + *results = n_rdesc; +@@ -341,8 +345,6 @@ static int safexcel_handle_inv_result(st + + ring = safexcel_select_ring(priv); + ctx->base.ring = ring; +- ctx->base.needs_inv = false; +- ctx->base.send = safexcel_aes_send; + + spin_lock_bh(&priv->ring[ring].queue_lock); + enq_ret = crypto_enqueue_request(&priv->ring[ring].queue, async); +@@ -359,6 +361,26 @@ static int safexcel_handle_inv_result(st + return ndesc; + } + ++static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring, ++ struct crypto_async_request *async, ++ bool *should_complete, int *ret) ++{ ++ struct skcipher_request *req = skcipher_request_cast(async); ++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(req); ++ int err; ++ ++ if (sreq->needs_inv) { ++ sreq->needs_inv = false; ++ err = safexcel_handle_inv_result(priv, ring, async, ++ should_complete, ret); ++ } else { ++ err = safexcel_handle_req_result(priv, ring, async, ++ should_complete, ret); ++ } ++ ++ return err; ++} ++ + static int safexcel_cipher_send_inv(struct crypto_async_request *async, + int ring, struct safexcel_request *request, + int *commands, int *results) +@@ -368,8 +390,6 @@ static int safexcel_cipher_send_inv(stru + struct safexcel_crypto_priv *priv = ctx->priv; + int ret; + +- ctx->base.handle_result = safexcel_handle_inv_result; +- + ret = safexcel_invalidate_cache(async, &ctx->base, priv, + ctx->base.ctxr_dma, ring, request); + if (unlikely(ret)) +@@ -381,11 +401,29 @@ static int safexcel_cipher_send_inv(stru + return 0; + } + ++static int safexcel_send(struct crypto_async_request *async, ++ int ring, struct safexcel_request *request, ++ int *commands, int *results) ++{ ++ struct skcipher_request *req = skcipher_request_cast(async); ++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(req); ++ int ret; ++ ++ if (sreq->needs_inv) ++ ret = safexcel_cipher_send_inv(async, ring, request, ++ commands, results); ++ else ++ ret = safexcel_aes_send(async, ring, request, ++ commands, results); ++ return ret; ++} ++ + static int safexcel_cipher_exit_inv(struct crypto_tfm *tfm) + { + struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm); + struct safexcel_crypto_priv *priv = ctx->priv; + struct skcipher_request req; ++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(&req); + struct safexcel_inv_result result = {}; + int ring = ctx->base.ring; + +@@ -399,7 +437,7 @@ static int safexcel_cipher_exit_inv(stru + skcipher_request_set_tfm(&req, __crypto_skcipher_cast(tfm)); + ctx = crypto_tfm_ctx(req.base.tfm); + ctx->base.exit_inv = true; +- ctx->base.send = safexcel_cipher_send_inv; ++ sreq->needs_inv = true; + + spin_lock_bh(&priv->ring[ring].queue_lock); + crypto_enqueue_request(&priv->ring[ring].queue, &req.base); +@@ -424,19 +462,21 @@ static int safexcel_aes(struct skcipher_ + enum safexcel_cipher_direction dir, u32 mode) + { + struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(req->base.tfm); ++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(req); + struct safexcel_crypto_priv *priv = ctx->priv; + int ret, ring; + ++ sreq->needs_inv = false; + ctx->direction = dir; + ctx->mode = mode; + + if (ctx->base.ctxr) { +- if (ctx->base.needs_inv) +- ctx->base.send = safexcel_cipher_send_inv; ++ if (ctx->base.needs_inv) { ++ sreq->needs_inv = true; ++ ctx->base.needs_inv = false; ++ } + } else { + ctx->base.ring = safexcel_select_ring(priv); +- ctx->base.send = safexcel_aes_send; +- + ctx->base.ctxr = dma_pool_zalloc(priv->context_pool, + EIP197_GFP_FLAGS(req->base), + &ctx->base.ctxr_dma); +@@ -476,6 +516,11 @@ static int safexcel_skcipher_cra_init(st + alg.skcipher.base); + + ctx->priv = tmpl->priv; ++ ctx->base.send = safexcel_send; ++ ctx->base.handle_result = safexcel_handle_result; ++ ++ crypto_skcipher_set_reqsize(__crypto_skcipher_cast(tfm), ++ sizeof(struct safexcel_cipher_req)); + + return 0; + } +--- a/drivers/crypto/inside-secure/safexcel_hash.c ++++ b/drivers/crypto/inside-secure/safexcel_hash.c +@@ -32,6 +32,7 @@ struct safexcel_ahash_req { + bool last_req; + bool finish; + bool hmac; ++ bool needs_inv; + + int nents; + +@@ -121,9 +122,9 @@ static void safexcel_context_control(str + } + } + +-static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring, +- struct crypto_async_request *async, +- bool *should_complete, int *ret) ++static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int ring, ++ struct crypto_async_request *async, ++ bool *should_complete, int *ret) + { + struct safexcel_result_desc *rdesc; + struct ahash_request *areq = ahash_request_cast(async); +@@ -169,9 +170,9 @@ static int safexcel_handle_result(struct + return 1; + } + +-static int safexcel_ahash_send(struct crypto_async_request *async, int ring, +- struct safexcel_request *request, int *commands, +- int *results) ++static int safexcel_ahash_send_req(struct crypto_async_request *async, int ring, ++ struct safexcel_request *request, ++ int *commands, int *results) + { + struct ahash_request *areq = ahash_request_cast(async); + struct crypto_ahash *ahash = crypto_ahash_reqtfm(areq); +@@ -310,7 +311,6 @@ send_command: + + req->processed += len; + request->req = &areq->base; +- ctx->base.handle_result = safexcel_handle_result; + + *commands = n_cdesc; + *results = 1; +@@ -394,8 +394,6 @@ static int safexcel_handle_inv_result(st + + ring = safexcel_select_ring(priv); + ctx->base.ring = ring; +- ctx->base.needs_inv = false; +- ctx->base.send = safexcel_ahash_send; + + spin_lock_bh(&priv->ring[ring].queue_lock); + enq_ret = crypto_enqueue_request(&priv->ring[ring].queue, async); +@@ -412,6 +410,26 @@ static int safexcel_handle_inv_result(st + return 1; + } + ++static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring, ++ struct crypto_async_request *async, ++ bool *should_complete, int *ret) ++{ ++ struct ahash_request *areq = ahash_request_cast(async); ++ struct safexcel_ahash_req *req = ahash_request_ctx(areq); ++ int err; ++ ++ if (req->needs_inv) { ++ req->needs_inv = false; ++ err = safexcel_handle_inv_result(priv, ring, async, ++ should_complete, ret); ++ } else { ++ err = safexcel_handle_req_result(priv, ring, async, ++ should_complete, ret); ++ } ++ ++ return err; ++} ++ + static int safexcel_ahash_send_inv(struct crypto_async_request *async, + int ring, struct safexcel_request *request, + int *commands, int *results) +@@ -420,7 +438,6 @@ static int safexcel_ahash_send_inv(struc + struct safexcel_ahash_ctx *ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(areq)); + int ret; + +- ctx->base.handle_result = safexcel_handle_inv_result; + ret = safexcel_invalidate_cache(async, &ctx->base, ctx->priv, + ctx->base.ctxr_dma, ring, request); + if (unlikely(ret)) +@@ -432,11 +449,29 @@ static int safexcel_ahash_send_inv(struc + return 0; + } + ++static int safexcel_ahash_send(struct crypto_async_request *async, ++ int ring, struct safexcel_request *request, ++ int *commands, int *results) ++{ ++ struct ahash_request *areq = ahash_request_cast(async); ++ struct safexcel_ahash_req *req = ahash_request_ctx(areq); ++ int ret; ++ ++ if (req->needs_inv) ++ ret = safexcel_ahash_send_inv(async, ring, request, ++ commands, results); ++ else ++ ret = safexcel_ahash_send_req(async, ring, request, ++ commands, results); ++ return ret; ++} ++ + static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm) + { + struct safexcel_ahash_ctx *ctx = crypto_tfm_ctx(tfm); + struct safexcel_crypto_priv *priv = ctx->priv; + struct ahash_request req; ++ struct safexcel_ahash_req *rctx = ahash_request_ctx(&req); + struct safexcel_inv_result result = {}; + int ring = ctx->base.ring; + +@@ -450,7 +485,7 @@ static int safexcel_ahash_exit_inv(struc + ahash_request_set_tfm(&req, __crypto_ahash_cast(tfm)); + ctx = crypto_tfm_ctx(req.base.tfm); + ctx->base.exit_inv = true; +- ctx->base.send = safexcel_ahash_send_inv; ++ rctx->needs_inv = true; + + spin_lock_bh(&priv->ring[ring].queue_lock); + crypto_enqueue_request(&priv->ring[ring].queue, &req.base); +@@ -501,14 +536,16 @@ static int safexcel_ahash_enqueue(struct + struct safexcel_crypto_priv *priv = ctx->priv; + int ret, ring; + +- ctx->base.send = safexcel_ahash_send; ++ req->needs_inv = false; + + if (req->processed && ctx->digest == CONTEXT_CONTROL_DIGEST_PRECOMPUTED) + ctx->base.needs_inv = safexcel_ahash_needs_inv_get(areq); + + if (ctx->base.ctxr) { +- if (ctx->base.needs_inv) +- ctx->base.send = safexcel_ahash_send_inv; ++ if (ctx->base.needs_inv) { ++ ctx->base.needs_inv = false; ++ req->needs_inv = true; ++ } + } else { + ctx->base.ring = safexcel_select_ring(priv); + ctx->base.ctxr = dma_pool_zalloc(priv->context_pool, +@@ -642,6 +679,8 @@ static int safexcel_ahash_cra_init(struc + struct safexcel_alg_template, alg.ahash); + + ctx->priv = tmpl->priv; ++ ctx->base.send = safexcel_ahash_send; ++ ctx->base.handle_result = safexcel_handle_result; + + crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm), + sizeof(struct safexcel_ahash_req)); diff --git a/queue-4.14/dmaengine-fsl-edma-disable-clks-on-all-error-paths.patch b/queue-4.14/dmaengine-fsl-edma-disable-clks-on-all-error-paths.patch new file mode 100644 index 00000000000..33e7c1f99be --- /dev/null +++ b/queue-4.14/dmaengine-fsl-edma-disable-clks-on-all-error-paths.patch @@ -0,0 +1,111 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Andreas Platschek +Date: Thu, 14 Dec 2017 12:50:51 +0100 +Subject: dmaengine: fsl-edma: disable clks on all error paths + +From: Andreas Platschek + + +[ Upstream commit 2610acf46b9ed528ec2cacd717bc9d354e452b73 ] + +Previously enabled clks are only disabled if clk_prepare_enable() fails. +However, there are other error paths were the previously enabled +clocks are not disabled. + +To fix the problem, fsl_disable_clocks() now takes the number of clocks +that shall be disabled + unprepared. For existing calls were all clocks +were already successfully prepared + enabled, DMAMUX_NR is passed to +disable + unprepare all clocks. + +In error paths were only some clocks were successfully prepared + +enabled the loop counter is passed, in order to disable + unprepare +all successfully prepared + enabled clocks. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Andreas Platschek +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/fsl-edma.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +--- a/drivers/dma/fsl-edma.c ++++ b/drivers/dma/fsl-edma.c +@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit( + } + } + +-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma) ++static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks) + { + int i; + +- for (i = 0; i < DMAMUX_NR; i++) ++ for (i = 0; i < nr_clocks; i++) + clk_disable_unprepare(fsl_edma->muxclk[i]); + } + +@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platfor + + res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i); + fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(fsl_edma->muxbase[i])) ++ if (IS_ERR(fsl_edma->muxbase[i])) { ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + return PTR_ERR(fsl_edma->muxbase[i]); ++ } + + sprintf(clkname, "dmamux%d", i); + fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname); + if (IS_ERR(fsl_edma->muxclk[i])) { + dev_err(&pdev->dev, "Missing DMAMUX block clock.\n"); ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + return PTR_ERR(fsl_edma->muxclk[i]); + } + + ret = clk_prepare_enable(fsl_edma->muxclk[i]); +- if (ret) { +- /* disable only clks which were enabled on error */ +- for (; i >= 0; i--) +- clk_disable_unprepare(fsl_edma->muxclk[i]); +- +- dev_err(&pdev->dev, "DMAMUX clk block failed.\n"); +- return ret; +- } ++ if (ret) ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + + } + +@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platfor + if (ret) { + dev_err(&pdev->dev, + "Can't register Freescale eDMA engine. (%d)\n", ret); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + return ret; + } + +@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platfor + dev_err(&pdev->dev, + "Can't register Freescale eDMA of_dma. (%d)\n", ret); + dma_async_device_unregister(&fsl_edma->dma_dev); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + return ret; + } + +@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platfo + fsl_edma_cleanup_vchan(&fsl_edma->dma_dev); + of_dma_controller_free(np); + dma_async_device_unregister(&fsl_edma->dma_dev); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + + return 0; + } diff --git a/queue-4.14/drm-nouveau-pci-do-a-msi-rearm-on-init.patch b/queue-4.14/drm-nouveau-pci-do-a-msi-rearm-on-init.patch new file mode 100644 index 00000000000..9dc7845fd74 --- /dev/null +++ b/queue-4.14/drm-nouveau-pci-do-a-msi-rearm-on-init.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Karol Herbst +Date: Fri, 24 Nov 2017 03:56:26 +0100 +Subject: drm/nouveau/pci: do a msi rearm on init + +From: Karol Herbst + + +[ Upstream commit a121027d2747168df0aac0c3da35509eea39f61c ] + +On my GP107 when I load nouveau after unloading it, for some reason the +GPU stopped sending or the CPU stopped receiving interrupts if MSI was +enabled. + +Doing a rearm once before getting any interrupts fixes this. + +Signed-off-by: Karol Herbst +Reviewed-by: Thierry Reding +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +@@ -136,6 +136,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev + return ret; + + pci->irq = pdev->irq; ++ ++ /* Ensure MSI interrupts are armed, for the case where there are ++ * already interrupts pending (for whatever reason) at load time. ++ */ ++ if (pci->msi) ++ pci->func->msi_rearm(pci); ++ + return ret; + } + diff --git a/queue-4.14/drm-ttm-check-the-return-value-of-kzalloc.patch b/queue-4.14/drm-ttm-check-the-return-value-of-kzalloc.patch new file mode 100644 index 00000000000..4b0f1f02379 --- /dev/null +++ b/queue-4.14/drm-ttm-check-the-return-value-of-kzalloc.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Xiongwei Song +Date: Tue, 2 Jan 2018 21:24:55 +0800 +Subject: drm/ttm: check the return value of kzalloc + +From: Xiongwei Song + + +[ Upstream commit 19d859a7205bc59ffc38303eb25ae394f61d21dc ] + +In the function ttm_page_alloc_init, kzalloc call is made for variable +_manager, we need to check its return value, it may return NULL. + +Signed-off-by: Xiongwei Song +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ttm/ttm_page_alloc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c +@@ -821,6 +821,8 @@ int ttm_page_alloc_init(struct ttm_mem_g + pr_info("Initializing pool allocator\n"); + + _manager = kzalloc(sizeof(*_manager), GFP_KERNEL); ++ if (!_manager) ++ return -ENOMEM; + + ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc"); + diff --git a/queue-4.14/e1000-fix-disabling-already-disabled-warning.patch b/queue-4.14/e1000-fix-disabling-already-disabled-warning.patch new file mode 100644 index 00000000000..0f9b6a7db8d --- /dev/null +++ b/queue-4.14/e1000-fix-disabling-already-disabled-warning.patch @@ -0,0 +1,181 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Tushar Dave +Date: Wed, 6 Dec 2017 02:26:29 +0530 +Subject: e1000: fix disabling already-disabled warning + +From: Tushar Dave + + +[ Upstream commit 0b76aae741abb9d16d2c0e67f8b1e766576f897d ] + +This patch adds check so that driver does not disable already +disabled device. + +[ 44.637743] advantechwdt: Unexpected close, not stopping watchdog! +[ 44.997548] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6 +[ 45.013419] e1000 0000:00:03.0: disabling already-disabled device +[ 45.013447] ------------[ cut here ]------------ +[ 45.014868] WARNING: CPU: 1 PID: 71 at drivers/pci/pci.c:1641 pci_disable_device+0xa1/0x105: + pci_disable_device at drivers/pci/pci.c:1640 +[ 45.016171] CPU: 1 PID: 71 Comm: rcu_perf_shutdo Not tainted 4.14.0-01330-g3c07399 #1 +[ 45.017197] task: ffff88011bee9e40 task.stack: ffffc90000860000 +[ 45.017987] RIP: 0010:pci_disable_device+0xa1/0x105: + pci_disable_device at drivers/pci/pci.c:1640 +[ 45.018603] RSP: 0000:ffffc90000863e30 EFLAGS: 00010286 +[ 45.019282] RAX: 0000000000000035 RBX: ffff88013a230008 RCX: 0000000000000000 +[ 45.020182] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000203 +[ 45.021084] RBP: ffff88013a3f31e8 R08: 0000000000000001 R09: 0000000000000000 +[ 45.021986] R10: ffffffff827ec29c R11: 0000000000000002 R12: 0000000000000001 +[ 45.022946] R13: ffff88013a230008 R14: ffff880117802b20 R15: ffffc90000863e8f +[ 45.023842] FS: 0000000000000000(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000 +[ 45.024863] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 45.025583] CR2: ffffc900006d4000 CR3: 000000000220f000 CR4: 00000000000006a0 +[ 45.026478] Call Trace: +[ 45.026811] __e1000_shutdown+0x1d4/0x1e2: + __e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5162 +[ 45.027344] ? rcu_perf_cleanup+0x2a1/0x2a1: + rcu_perf_shutdown at kernel/rcu/rcuperf.c:627 +[ 45.027883] e1000_shutdown+0x14/0x3a: + e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5235 +[ 45.028351] device_shutdown+0x110/0x1aa: + device_shutdown at drivers/base/core.c:2807 +[ 45.028858] kernel_power_off+0x31/0x64: + kernel_power_off at kernel/reboot.c:260 +[ 45.029343] rcu_perf_shutdown+0x9b/0xa7: + rcu_perf_shutdown at kernel/rcu/rcuperf.c:637 +[ 45.029852] ? __wake_up_common_lock+0xa2/0xa2: + autoremove_wake_function at kernel/sched/wait.c:376 +[ 45.030414] kthread+0x126/0x12e: + kthread at kernel/kthread.c:233 +[ 45.030834] ? __kthread_bind_mask+0x8e/0x8e: + kthread at kernel/kthread.c:190 +[ 45.031399] ? ret_from_fork+0x1f/0x30: + ret_from_fork at arch/x86/entry/entry_64.S:443 +[ 45.031883] ? kernel_init+0xa/0xf5: + kernel_init at init/main.c:997 +[ 45.032325] ret_from_fork+0x1f/0x30: + ret_from_fork at arch/x86/entry/entry_64.S:443 +[ 45.032777] Code: 00 48 85 ed 75 07 48 8b ab a8 00 00 00 48 8d bb 98 00 00 00 e8 aa d1 11 00 48 89 ea 48 89 c6 48 c7 c7 d8 e4 0b 82 e8 55 7d da ff <0f> ff b9 01 00 00 00 31 d2 be 01 00 00 00 48 c7 c7 f0 b1 61 82 +[ 45.035222] ---[ end trace c257137b1b1976ef ]--- +[ 45.037838] ACPI: Preparing to enter system sleep state S5 + +Signed-off-by: Tushar Dave +Tested-by: Fengguang Wu +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000/e1000.h | 3 +- + drivers/net/ethernet/intel/e1000/e1000_main.c | 27 +++++++++++++++++++++----- + 2 files changed, 24 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000/e1000.h ++++ b/drivers/net/ethernet/intel/e1000/e1000.h +@@ -331,7 +331,8 @@ struct e1000_adapter { + enum e1000_state_t { + __E1000_TESTING, + __E1000_RESETTING, +- __E1000_DOWN ++ __E1000_DOWN, ++ __E1000_DISABLED + }; + + #undef pr_fmt +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -945,7 +945,7 @@ static int e1000_init_hw_struct(struct e + static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct net_device *netdev; +- struct e1000_adapter *adapter; ++ struct e1000_adapter *adapter = NULL; + struct e1000_hw *hw; + + static int cards_found; +@@ -955,6 +955,7 @@ static int e1000_probe(struct pci_dev *p + u16 tmp = 0; + u16 eeprom_apme_mask = E1000_EEPROM_APME; + int bars, need_ioport; ++ bool disable_dev = false; + + /* do not allocate ioport bars when not needed */ + need_ioport = e1000_is_need_ioport(pdev); +@@ -1259,11 +1260,13 @@ err_mdio_ioremap: + iounmap(hw->ce4100_gbe_mdio_base_virt); + iounmap(hw->hw_addr); + err_ioremap: ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + err_alloc_etherdev: + pci_release_selected_regions(pdev, bars); + err_pci_reg: +- pci_disable_device(pdev); ++ if (!adapter || disable_dev) ++ pci_disable_device(pdev); + return err; + } + +@@ -1281,6 +1284,7 @@ static void e1000_remove(struct pci_dev + struct net_device *netdev = pci_get_drvdata(pdev); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; ++ bool disable_dev; + + e1000_down_and_stop(adapter); + e1000_release_manageability(adapter); +@@ -1299,9 +1303,11 @@ static void e1000_remove(struct pci_dev + iounmap(hw->flash_address); + pci_release_selected_regions(pdev, adapter->bars); + ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + +- pci_disable_device(pdev); ++ if (disable_dev) ++ pci_disable_device(pdev); + } + + /** +@@ -5156,7 +5162,8 @@ static int __e1000_shutdown(struct pci_d + if (netif_running(netdev)) + e1000_free_irq(adapter); + +- pci_disable_device(pdev); ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + return 0; + } +@@ -5200,6 +5207,10 @@ static int e1000_resume(struct pci_dev * + pr_err("Cannot enable PCI device from suspend\n"); + return err; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); +@@ -5274,7 +5285,9 @@ static pci_ers_result_t e1000_io_error_d + + if (netif_running(netdev)) + e1000_down(adapter); +- pci_disable_device(pdev); ++ ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + /* Request a slot slot reset. */ + return PCI_ERS_RESULT_NEED_RESET; +@@ -5302,6 +5315,10 @@ static pci_ers_result_t e1000_io_slot_re + pr_err("Cannot re-enable PCI device after reset.\n"); + return PCI_ERS_RESULT_DISCONNECT; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); diff --git a/queue-4.14/exec-avoid-gcc-8-warning-for-get_task_comm.patch b/queue-4.14/exec-avoid-gcc-8-warning-for-get_task_comm.patch new file mode 100644 index 00000000000..4ad9ac7b375 --- /dev/null +++ b/queue-4.14/exec-avoid-gcc-8-warning-for-get_task_comm.patch @@ -0,0 +1,85 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Arnd Bergmann +Date: Thu, 14 Dec 2017 15:32:41 -0800 +Subject: exec: avoid gcc-8 warning for get_task_comm + +From: Arnd Bergmann + + +[ Upstream commit 3756f6401c302617c5e091081ca4d26ab604bec5 ] + +gcc-8 warns about using strncpy() with the source size as the limit: + + fs/exec.c:1223:32: error: argument to 'sizeof' in 'strncpy' call is the same expression as the source; did you mean to use the size of the destination? [-Werror=sizeof-pointer-memaccess] + +This is indeed slightly suspicious, as it protects us from source +arguments without NUL-termination, but does not guarantee that the +destination is terminated. + +This keeps the strncpy() to ensure we have properly padded target +buffer, but ensures that we use the correct length, by passing the +actual length of the destination buffer as well as adding a build-time +check to ensure it is exactly TASK_COMM_LEN. + +There are only 23 callsites which I all reviewed to ensure this is +currently the case. We could get away with doing only the check or +passing the right length, but it doesn't hurt to do both. + +Link: http://lkml.kernel.org/r/20171205151724.1764896-1-arnd@arndb.de +Signed-off-by: Arnd Bergmann +Suggested-by: Kees Cook +Acked-by: Kees Cook +Acked-by: Ingo Molnar +Cc: Alexander Viro +Cc: Peter Zijlstra +Cc: Serge Hallyn +Cc: James Morris +Cc: Aleksa Sarai +Cc: "Eric W. Biederman" +Cc: Frederic Weisbecker +Cc: Thomas Gleixner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/exec.c | 7 +++---- + include/linux/sched.h | 6 +++++- + 2 files changed, 8 insertions(+), 5 deletions(-) + +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1216,15 +1216,14 @@ killed: + return -EAGAIN; + } + +-char *get_task_comm(char *buf, struct task_struct *tsk) ++char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk) + { +- /* buf must be at least sizeof(tsk->comm) in size */ + task_lock(tsk); +- strncpy(buf, tsk->comm, sizeof(tsk->comm)); ++ strncpy(buf, tsk->comm, buf_size); + task_unlock(tsk); + return buf; + } +-EXPORT_SYMBOL_GPL(get_task_comm); ++EXPORT_SYMBOL_GPL(__get_task_comm); + + /* + * These functions flushes out all traces of the currently running executable +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1502,7 +1502,11 @@ static inline void set_task_comm(struct + __set_task_comm(tsk, from, false); + } + +-extern char *get_task_comm(char *to, struct task_struct *tsk); ++extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk); ++#define get_task_comm(buf, tsk) ({ \ ++ BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN); \ ++ __get_task_comm(buf, sizeof(buf), tsk); \ ++}) + + #ifdef CONFIG_SMP + void scheduler_ipi(void); diff --git a/queue-4.14/genirq-guard-handle_bad_irq-log-messages.patch b/queue-4.14/genirq-guard-handle_bad_irq-log-messages.patch new file mode 100644 index 00000000000..d135bd93d55 --- /dev/null +++ b/queue-4.14/genirq-guard-handle_bad_irq-log-messages.patch @@ -0,0 +1,60 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Guenter Roeck +Date: Sat, 2 Dec 2017 09:13:04 -0800 +Subject: genirq: Guard handle_bad_irq log messages + +From: Guenter Roeck + + +[ Upstream commit 11bca0a83f83f6093d816295668e74ef24595944 ] + +An interrupt storm on a bad interrupt will cause the kernel +log to be clogged. + +[ 60.089234] ->handle_irq(): ffffffffbe2f803f, +[ 60.090455] 0xffffffffbf2af380 +[ 60.090510] handle_bad_irq+0x0/0x2e5 +[ 60.090522] ->irq_data.chip(): ffffffffbf2af380, +[ 60.090553] IRQ_NOPROBE set +[ 60.090584] ->handle_irq(): ffffffffbe2f803f, +[ 60.090590] handle_bad_irq+0x0/0x2e5 +[ 60.090596] ->irq_data.chip(): ffffffffbf2af380, +[ 60.090602] 0xffffffffbf2af380 +[ 60.090608] ->action(): (null) +[ 60.090779] handle_bad_irq+0x0/0x2e5 + +This was seen when running an upstream kernel on Acer Chromebook R11. The +system was unstable as result. + +Guard the log message with __printk_ratelimit to reduce the impact. This +won't prevent the interrupt storm from happening, but at least the system +remains stable. + +Signed-off-by: Guenter Roeck +Signed-off-by: Thomas Gleixner +Cc: Dmitry Torokhov +Cc: Joe Perches +Cc: Andy Shevchenko +Cc: Mika Westerberg +Link: https://bugzilla.kernel.org/show_bug.cgi?id=197953 +Link: https://lkml.kernel.org/r/1512234784-21038-1-git-send-email-linux@roeck-us.net +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/irq/debug.h | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/kernel/irq/debug.h ++++ b/kernel/irq/debug.h +@@ -12,6 +12,11 @@ + + static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc) + { ++ static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5); ++ ++ if (!__ratelimit(&ratelimit)) ++ return; ++ + printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n", + irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled); + printk("->handle_irq(): %p, ", desc->handle_irq); diff --git a/queue-4.14/i40e-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch b/queue-4.14/i40e-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch new file mode 100644 index 00000000000..9432c5a3c3b --- /dev/null +++ b/queue-4.14/i40e-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch @@ -0,0 +1,98 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Jacob Keller +Date: Wed, 20 Dec 2017 11:04:36 -0500 +Subject: i40e: don't remove netdev->dev_addr when syncing uc list + +From: Jacob Keller + + +[ Upstream commit 458867b2ca0c987445c5d9adccd1642970e1ba07 ] + +In some circumstances, such as with bridging, it is possible that the +stack will add a devices own MAC address to its unicast address list. + +If, later, the stack deletes this address, then the i40e driver will +receive a request to remove this address. + +The driver stores its current MAC address as part of the MAC/VLAN hash +array, since it is convenient and matches exactly how the hardware +expects to be told which traffic to receive. + +This causes a problem, since for more devices, the MAC address is stored +separately, and requests to delete a unicast address should not have the +ability to remove the filter for the MAC address. + +Fix this by forcing a check on every address sync to ensure we do not +remove the device address. + +There is a very narrow possibility of a race between .set_mac and +.set_rx_mode, if we don't change netdev->dev_addr before updating our +internal MAC list in .set_mac. This might be possible if .set_rx_mode is +going to remove MAC "XYZ" from the list, at the same time as .set_mac +changes our dev_addr to MAC "XYZ", we might possibly queue a delete, +then an add in .set_mac, then queue a delete in .set_rx_mode's +dev_uc_sync and then update netdev->dev_addr. We can avoid this by +moving the copy into dev_addr prior to the changes to the MAC filter +list. + +A similar race on the other side does not cause problems, as if we're +changing our MAC form A to B, and we race with .set_rx_mode, it could +queue a delete from A, we'd update our address, and allow the delete. +This seems like a race, but in reality we're about to queue a delete of +A anyways, so it would not cause any issues. + +A race in the initialization code is unlikely because the netdevice has +not yet been fully initialized and the stack should not be adding or +removing addresses yet. + +Note that we don't (yet) need similar code for the VF driver because it +does not make use of __dev_uc_sync and __dev_mc_sync, but instead roles +its own method for handling updates to the MAC/VLAN list, which already +has code to protect against removal of the hardware address. + +Signed-off-by: Jacob Keller +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1553,11 +1553,18 @@ static int i40e_set_mac(struct net_devic + else + netdev_info(netdev, "set new mac address %pM\n", addr->sa_data); + ++ /* Copy the address first, so that we avoid a possible race with ++ * .set_rx_mode(). If we copy after changing the address in the filter ++ * list, we might open ourselves to a narrow race window where ++ * .set_rx_mode could delete our dev_addr filter and prevent traffic ++ * from passing. ++ */ ++ ether_addr_copy(netdev->dev_addr, addr->sa_data); ++ + spin_lock_bh(&vsi->mac_filter_hash_lock); + i40e_del_mac_filter(vsi, netdev->dev_addr); + i40e_add_mac_filter(vsi, addr->sa_data); + spin_unlock_bh(&vsi->mac_filter_hash_lock); +- ether_addr_copy(netdev->dev_addr, addr->sa_data); + if (vsi->type == I40E_VSI_MAIN) { + i40e_status ret; + +@@ -1739,6 +1746,14 @@ static int i40e_addr_unsync(struct net_d + struct i40e_netdev_priv *np = netdev_priv(netdev); + struct i40e_vsi *vsi = np->vsi; + ++ /* Under some circumstances, we might receive a request to delete ++ * our own device address from our uc list. Because we store the ++ * device address in the VSI's MAC/VLAN filter list, we need to ignore ++ * such requests and not delete our device address from this list. ++ */ ++ if (ether_addr_equal(addr, netdev->dev_addr)) ++ return 0; ++ + i40e_del_mac_filter(vsi, addr); + + return 0; diff --git a/queue-4.14/i40e-i40evf-account-for-frags-split-over-multiple-descriptors-in-check-linearize.patch b/queue-4.14/i40e-i40evf-account-for-frags-split-over-multiple-descriptors-in-check-linearize.patch new file mode 100644 index 00000000000..d07099d2e6f --- /dev/null +++ b/queue-4.14/i40e-i40evf-account-for-frags-split-over-multiple-descriptors-in-check-linearize.patch @@ -0,0 +1,122 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Alexander Duyck +Date: Fri, 8 Dec 2017 10:55:04 -0800 +Subject: i40e/i40evf: Account for frags split over multiple descriptors in check linearize + +From: Alexander Duyck + + +[ Upstream commit 248de22e638f10bd5bfc7624a357f940f66ba137 ] + +The original code for __i40e_chk_linearize didn't take into account the +fact that if a fragment is 16K in size or larger it has to be split over 2 +descriptors and the smaller of those 2 descriptors will be on the trailing +edge of the transmit. As a result we can get into situations where we didn't +catch requests that could result in a Tx hang. + +This patch takes care of that by subtracting the length of all but the +trailing edge of the stale fragment before we test for sum. By doing this +we can guarantee that we have all cases covered, including the case of a +fragment that spans multiple descriptors. We don't need to worry about +checking the inner portions of this since 12K is the maximum aligned DMA +size and that is larger than any MSS will ever be since the MTU limit for +jumbos is something on the order of 9K. + +Signed-off-by: Alexander Duyck +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 26 +++++++++++++++++++++++--- + drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 26 +++++++++++++++++++++++--- + 2 files changed, 46 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -3048,10 +3048,30 @@ bool __i40e_chk_linearize(struct sk_buff + /* Walk through fragments adding latest fragment, testing it, and + * then removing stale fragments from the sum. + */ +- stale = &skb_shinfo(skb)->frags[0]; +- for (;;) { ++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) { ++ int stale_size = skb_frag_size(stale); ++ + sum += skb_frag_size(frag++); + ++ /* The stale fragment may present us with a smaller ++ * descriptor than the actual fragment size. To account ++ * for that we need to remove all the data on the front and ++ * figure out what the remainder would be in the last ++ * descriptor associated with the fragment. ++ */ ++ if (stale_size > I40E_MAX_DATA_PER_TXD) { ++ int align_pad = -(stale->page_offset) & ++ (I40E_MAX_READ_REQ_SIZE - 1); ++ ++ sum -= align_pad; ++ stale_size -= align_pad; ++ ++ do { ++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ } while (stale_size > I40E_MAX_DATA_PER_TXD); ++ } ++ + /* if sum is negative we failed to make sufficient progress */ + if (sum < 0) + return true; +@@ -3059,7 +3079,7 @@ bool __i40e_chk_linearize(struct sk_buff + if (!nr_frags--) + break; + +- sum -= skb_frag_size(stale++); ++ sum -= stale_size; + } + + return false; +--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c +@@ -2014,10 +2014,30 @@ bool __i40evf_chk_linearize(struct sk_bu + /* Walk through fragments adding latest fragment, testing it, and + * then removing stale fragments from the sum. + */ +- stale = &skb_shinfo(skb)->frags[0]; +- for (;;) { ++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) { ++ int stale_size = skb_frag_size(stale); ++ + sum += skb_frag_size(frag++); + ++ /* The stale fragment may present us with a smaller ++ * descriptor than the actual fragment size. To account ++ * for that we need to remove all the data on the front and ++ * figure out what the remainder would be in the last ++ * descriptor associated with the fragment. ++ */ ++ if (stale_size > I40E_MAX_DATA_PER_TXD) { ++ int align_pad = -(stale->page_offset) & ++ (I40E_MAX_READ_REQ_SIZE - 1); ++ ++ sum -= align_pad; ++ stale_size -= align_pad; ++ ++ do { ++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ } while (stale_size > I40E_MAX_DATA_PER_TXD); ++ } ++ + /* if sum is negative we failed to make sufficient progress */ + if (sum < 0) + return true; +@@ -2025,7 +2045,7 @@ bool __i40evf_chk_linearize(struct sk_bu + if (!nr_frags--) + break; + +- sum -= skb_frag_size(stale++); ++ sum -= stale_size; + } + + return false; diff --git a/queue-4.14/i915-reject-ccs-modifiers-for-pipe-c-on-geminilake.patch b/queue-4.14/i915-reject-ccs-modifiers-for-pipe-c-on-geminilake.patch new file mode 100644 index 00000000000..3766c68ead6 --- /dev/null +++ b/queue-4.14/i915-reject-ccs-modifiers-for-pipe-c-on-geminilake.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Gabriel Krisman Bertazi +Date: Tue, 19 Dec 2017 22:24:10 -0200 +Subject: i915: Reject CCS modifiers for pipe C on Geminilake + +From: Gabriel Krisman Bertazi + + +[ Upstream commit 8bc0d7ac934b6f2d0dc8f38a3104d281c9db1e98 ] + +Current code advertises (on the modifiers blob property) support for CCS +modifier for pipe C on GLK, only to reject it later when validating the +request before the atomic commit. + +This fixes the tests igt@kms_ccs@pipe-c-*, which should skip on GLK for +pipe C (see bug 104096). + +A relevant discussion is archived at: + +https://lists.freedesktop.org/archives/intel-gfx/2017-December/150646.html + +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104096 +Signed-off-by: Gabriel Krisman Bertazi +Cc: Ben Widawsky +Reviewed-by: Ben Widawsky +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20171220002410.5604-1-krisman@collabora.co.uk +(cherry picked from commit f0cbd8bd877f3d8c5b80a6b1add9ca9010d7f9d8) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/intel_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -13240,7 +13240,7 @@ intel_primary_plane_create(struct drm_i9 + primary->frontbuffer_bit = INTEL_FRONTBUFFER_PRIMARY(pipe); + primary->check_plane = intel_check_primary_plane; + +- if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) { ++ if (INTEL_GEN(dev_priv) >= 10) { + intel_primary_formats = skl_primary_formats; + num_formats = ARRAY_SIZE(skl_primary_formats); + modifiers = skl_format_modifiers_ccs; diff --git a/queue-4.14/ia64-sched-cputime-fix-build-error-if-config_virt_cpu_accounting_native-y.patch b/queue-4.14/ia64-sched-cputime-fix-build-error-if-config_virt_cpu_accounting_native-y.patch new file mode 100644 index 00000000000..0750bfa4373 --- /dev/null +++ b/queue-4.14/ia64-sched-cputime-fix-build-error-if-config_virt_cpu_accounting_native-y.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Valentin Ilie +Date: Fri, 5 Jan 2018 23:12:59 +0000 +Subject: ia64, sched/cputime: Fix build error if CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y + +From: Valentin Ilie + + +[ Upstream commit 7729bebc619307a0233c86f8585a4bf3eadc7ce4 ] + +Remove the extra parenthesis. + +This bug was introduced by: + + e2339a4caa5e: ("ia64: Convert vtime to use nsec units directly") + +Signed-off-by: Valentin Ilie +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: fenghua.yu@intel.com +Cc: linux-ia64@vger.kernel.org +Cc: tony.luck@intel.com +Link: http://lkml.kernel.org/r/1515193979-24873-1-git-send-email-valentin.ilie@gmail.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/ia64/kernel/time.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/ia64/kernel/time.c ++++ b/arch/ia64/kernel/time.c +@@ -88,7 +88,7 @@ void vtime_flush(struct task_struct *tsk + } + + if (ti->softirq_time) { +- delta = cycle_to_nsec(ti->softirq_time)); ++ delta = cycle_to_nsec(ti->softirq_time); + account_system_index_time(tsk, delta, CPUTIME_SOFTIRQ); + } + diff --git a/queue-4.14/ib-ipoib-fix-race-condition-in-neigh-creation.patch b/queue-4.14/ib-ipoib-fix-race-condition-in-neigh-creation.patch new file mode 100644 index 00000000000..4f57abdad1f --- /dev/null +++ b/queue-4.14/ib-ipoib-fix-race-condition-in-neigh-creation.patch @@ -0,0 +1,136 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Erez Shitrit +Date: Sun, 31 Dec 2017 15:33:15 +0200 +Subject: IB/ipoib: Fix race condition in neigh creation + +From: Erez Shitrit + + +[ Upstream commit 16ba3defb8bd01a9464ba4820a487f5b196b455b ] + +When using enhanced mode for IPoIB, two threads may execute xmit in +parallel to two different TX queues while the target is the same. +In this case, both of them will add the same neighbor to the path's +neigh link list and we might see the following message: + + list_add double add: new=ffff88024767a348, prev=ffff88024767a348... + WARNING: lib/list_debug.c:31__list_add_valid+0x4e/0x70 + ipoib_start_xmit+0x477/0x680 [ib_ipoib] + dev_hard_start_xmit+0xb9/0x3e0 + sch_direct_xmit+0xf9/0x250 + __qdisc_run+0x176/0x5d0 + __dev_queue_xmit+0x1f5/0xb10 + __dev_queue_xmit+0x55/0xb10 + +Analysis: +Two SKB are scheduled to be transmitted from two cores. +In ipoib_start_xmit, both gets NULL when calling ipoib_neigh_get. +Two calls to neigh_add_path are made. One thread takes the spin-lock +and calls ipoib_neigh_alloc which creates the neigh structure, +then (after the __path_find) the neigh is added to the path's neigh +link list. When the second thread enters the critical section it also +calls ipoib_neigh_alloc but in this case it gets the already allocated +ipoib_neigh structure, which is already linked to the path's neigh +link list and adds it again to the list. Which beside of triggering +the list, it creates a loop in the linked list. This loop leads to +endless loop inside path_rec_completion. + +Solution: +Check list_empty(&neigh->list) before adding to the list. +Add a similar fix in "ipoib_multicast.c::ipoib_mcast_send" + +Fixes: b63b70d87741 ('IPoIB: Use a private hash table for path lookup in xmit path') +Signed-off-by: Erez Shitrit +Reviewed-by: Alex Vesker +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 25 ++++++++++++++++++------- + drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 5 ++++- + 2 files changed, 22 insertions(+), 8 deletions(-) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -903,8 +903,8 @@ static int path_rec_start(struct net_dev + return 0; + } + +-static void neigh_add_path(struct sk_buff *skb, u8 *daddr, +- struct net_device *dev) ++static struct ipoib_neigh *neigh_add_path(struct sk_buff *skb, u8 *daddr, ++ struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); + struct rdma_netdev *rn = netdev_priv(dev); +@@ -918,7 +918,15 @@ static void neigh_add_path(struct sk_buf + spin_unlock_irqrestore(&priv->lock, flags); + ++dev->stats.tx_dropped; + dev_kfree_skb_any(skb); +- return; ++ return NULL; ++ } ++ ++ /* To avoid race condition, make sure that the ++ * neigh will be added only once. ++ */ ++ if (unlikely(!list_empty(&neigh->list))) { ++ spin_unlock_irqrestore(&priv->lock, flags); ++ return neigh; + } + + path = __path_find(dev, daddr + 4); +@@ -957,7 +965,7 @@ static void neigh_add_path(struct sk_buf + path->ah->last_send = rn->send(dev, skb, path->ah->ah, + IPOIB_QPN(daddr)); + ipoib_neigh_put(neigh); +- return; ++ return NULL; + } + } else { + neigh->ah = NULL; +@@ -974,7 +982,7 @@ static void neigh_add_path(struct sk_buf + + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_neigh_put(neigh); +- return; ++ return NULL; + + err_path: + ipoib_neigh_free(neigh); +@@ -984,6 +992,8 @@ err_drop: + + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_neigh_put(neigh); ++ ++ return NULL; + } + + static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev, +@@ -1092,8 +1102,9 @@ static int ipoib_start_xmit(struct sk_bu + case htons(ETH_P_TIPC): + neigh = ipoib_neigh_get(dev, phdr->hwaddr); + if (unlikely(!neigh)) { +- neigh_add_path(skb, phdr->hwaddr, dev); +- return NETDEV_TX_OK; ++ neigh = neigh_add_path(skb, phdr->hwaddr, dev); ++ if (likely(!neigh)) ++ return NETDEV_TX_OK; + } + break; + case htons(ETH_P_ARP): +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -816,7 +816,10 @@ void ipoib_mcast_send(struct net_device + spin_lock_irqsave(&priv->lock, flags); + if (!neigh) { + neigh = ipoib_neigh_alloc(daddr, dev); +- if (neigh) { ++ /* Make sure that the neigh will be added only ++ * once to mcast list. ++ */ ++ if (neigh && list_empty(&neigh->list)) { + kref_get(&mcast->ah->ref); + neigh->ah = mcast->ah; + list_add_tail(&neigh->list, &mcast->neigh_list); diff --git a/queue-4.14/ib-mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch b/queue-4.14/ib-mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch new file mode 100644 index 00000000000..1f46adecd33 --- /dev/null +++ b/queue-4.14/ib-mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Leon Romanovsky +Date: Sun, 31 Dec 2017 15:33:14 +0200 +Subject: IB/mlx4: Fix mlx4_ib_alloc_mr error flow + +From: Leon Romanovsky + + +[ Upstream commit 5a371cf87e145b86efd32007e46146e78c1eff6d ] + +ibmr.device is being set only after ib_alloc_mr() is successfully complete. +Therefore, in case imlx4_mr_enable() returns with error, the error flow +unwinder calls to mlx4_free_priv_pages(), which uses ibmr.device. + +Such usage causes to NULL dereference oops and to fix it, the IB device +should be set in the mr struct earlier stage (e.g. prior to calling +mlx4_free_priv_pages()). + +Fixes: 1b2cd0fc673c ("IB/mlx4: Support the new memory registration API") +Signed-off-by: Nitzan Carmi +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx4/mr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -406,7 +406,6 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib + goto err_free_mr; + + mr->max_pages = max_num_sg; +- + err = mlx4_mr_enable(dev->dev, &mr->mmr); + if (err) + goto err_free_pl; +@@ -417,6 +416,7 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib + return &mr->ibmr; + + err_free_pl: ++ mr->ibmr.device = pd->device; + mlx4_free_priv_pages(mr); + err_free_mr: + (void) mlx4_mr_free(dev->dev, &mr->mmr); diff --git a/queue-4.14/ib-mlx5-fix-mlx5_ib_alloc_mr-error-flow.patch b/queue-4.14/ib-mlx5-fix-mlx5_ib_alloc_mr-error-flow.patch new file mode 100644 index 00000000000..1455ed0ba54 --- /dev/null +++ b/queue-4.14/ib-mlx5-fix-mlx5_ib_alloc_mr-error-flow.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Nitzan Carmi +Date: Tue, 26 Dec 2017 11:20:20 +0200 +Subject: IB/mlx5: Fix mlx5_ib_alloc_mr error flow + +From: Nitzan Carmi + + +[ Upstream commit 45e6ae7ef21b907dacb18da62d5787d74a31d860 ] + +ibmr.device is being set only after ib_alloc_mr() is +(successfully) complete. Therefore, in case mlx5_core_create_mkey() +return with error, the error flow calls mlx5_free_priv_descs() +which uses ibmr.device (which doesn't exist yet), causing +a NULL dereference oops. + +To fix this, the IB device should be set in the mr struct earlier +stage (e.g. prior to calling mlx5_core_create_mkey()). + +Fixes: 8a187ee52b04 ("IB/mlx5: Support the new memory registration API") +Signed-off-by: Max Gurtovoy +Signed-off-by: Nitzan Carmi +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx5/mr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1637,6 +1637,7 @@ struct ib_mr *mlx5_ib_alloc_mr(struct ib + MLX5_SET(mkc, mkc, access_mode, mr->access_mode); + MLX5_SET(mkc, mkc, umr_en, 1); + ++ mr->ibmr.device = pd->device; + err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen); + if (err) + goto err_destroy_psv; diff --git a/queue-4.14/input-xen-kbdfront-do-not-advertise-multi-touch-pressure-support.patch b/queue-4.14/input-xen-kbdfront-do-not-advertise-multi-touch-pressure-support.patch new file mode 100644 index 00000000000..d5b929a5cec --- /dev/null +++ b/queue-4.14/input-xen-kbdfront-do-not-advertise-multi-touch-pressure-support.patch @@ -0,0 +1,38 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Oleksandr Andrushchenko +Date: Tue, 2 Jan 2018 09:39:25 -0800 +Subject: Input: xen-kbdfront - do not advertise multi-touch pressure support + +From: Oleksandr Andrushchenko + + +[ Upstream commit 02a0d9216d4daf6a58d88642bd2da2c78c327552 ] + +Some user-space applications expect multi-touch pressure +on contact to be reported if it is advertised in device +properties. Otherwise, such applications may treat reports +not as actual touches, but hovering. Currently this is +only advertised, but not reported. +Fix this by not advertising that ABS_MT_PRESSURE is supported. + +Signed-off-by: Oleksandr Andrushchenko +Signed-off-by: Andrii Chepurnyi +Patchwork-Id: 10140017 +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/misc/xen-kbdfront.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/input/misc/xen-kbdfront.c ++++ b/drivers/input/misc/xen-kbdfront.c +@@ -326,8 +326,6 @@ static int xenkbd_probe(struct xenbus_de + 0, width, 0, 0); + input_set_abs_params(mtouch, ABS_MT_POSITION_Y, + 0, height, 0, 0); +- input_set_abs_params(mtouch, ABS_MT_PRESSURE, +- 0, 255, 0, 0); + + ret = input_mt_init_slots(mtouch, num_cont, INPUT_MT_DIRECT); + if (ret) { diff --git a/queue-4.14/ip6_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch b/queue-4.14/ip6_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch new file mode 100644 index 00000000000..a088857212a --- /dev/null +++ b/queue-4.14/ip6_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Xin Long +Date: Mon, 18 Dec 2017 14:25:09 +0800 +Subject: ip6_gre: remove the incorrect mtu limit for ipgre tap + +From: Xin Long + + +[ Upstream commit 2c52129a7d74d017320804c6928de770815c5f4a ] + +The same fix as the patch "ip_gre: remove the incorrect mtu limit for +ipgre tap" is also needed for ip6_gre. + +Fixes: 61e84623ace3 ("net: centralize net_device min/max MTU checking") +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_gre.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1335,6 +1335,7 @@ static void ip6gre_tap_setup(struct net_ + + ether_setup(dev); + ++ dev->max_mtu = 0; + dev->netdev_ops = &ip6gre_tap_netdev_ops; + dev->needs_free_netdev = true; + dev->priv_destructor = ip6gre_dev_free; diff --git a/queue-4.14/ip6_tunnel-allow-ip6gre-dev-mtu-to-be-set-below-1280.patch b/queue-4.14/ip6_tunnel-allow-ip6gre-dev-mtu-to-be-set-below-1280.patch new file mode 100644 index 00000000000..982b0b8ed1c --- /dev/null +++ b/queue-4.14/ip6_tunnel-allow-ip6gre-dev-mtu-to-be-set-below-1280.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Xin Long +Date: Mon, 25 Dec 2017 14:45:12 +0800 +Subject: ip6_tunnel: allow ip6gre dev mtu to be set below 1280 + +From: Xin Long + + +[ Upstream commit 2fa771be953a17f8e0a9c39103464c2574444c62 ] + +Commit 582442d6d5bc ("ipv6: Allow the MTU of ipip6 tunnel to be set +below 1280") fixed a mtu setting issue. It works for ipip6 tunnel. + +But ip6gre dev updates the mtu also with ip6_tnl_change_mtu. Since +the inner packet over ip6gre can be ipv4 and it's mtu should also +be allowed to set below 1280, the same issue also exists on ip6gre. + +This patch is to fix it by simply changing to check if parms.proto +is IPPROTO_IPV6 in ip6_tnl_change_mtu instead, to make ip6gre to +go to 'else' branch. + +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_tunnel.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1684,11 +1684,11 @@ int ip6_tnl_change_mtu(struct net_device + { + struct ip6_tnl *tnl = netdev_priv(dev); + +- if (tnl->parms.proto == IPPROTO_IPIP) { +- if (new_mtu < ETH_MIN_MTU) ++ if (tnl->parms.proto == IPPROTO_IPV6) { ++ if (new_mtu < IPV6_MIN_MTU) + return -EINVAL; + } else { +- if (new_mtu < IPV6_MIN_MTU) ++ if (new_mtu < ETH_MIN_MTU) + return -EINVAL; + } + if (new_mtu > 0xFFF8 - dev->hard_header_len) diff --git a/queue-4.14/ip6_tunnel-get-the-min-mtu-properly-in-ip6_tnl_xmit.patch b/queue-4.14/ip6_tunnel-get-the-min-mtu-properly-in-ip6_tnl_xmit.patch new file mode 100644 index 00000000000..2bf89042eb4 --- /dev/null +++ b/queue-4.14/ip6_tunnel-get-the-min-mtu-properly-in-ip6_tnl_xmit.patch @@ -0,0 +1,60 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Xin Long +Date: Mon, 18 Dec 2017 14:26:21 +0800 +Subject: ip6_tunnel: get the min mtu properly in ip6_tnl_xmit + +From: Xin Long + + +[ Upstream commit c9fefa08190fc879fb2e681035d7774e0a8c5170 ] + +Now it's using IPV6_MIN_MTU as the min mtu in ip6_tnl_xmit, but +IPV6_MIN_MTU actually only works when the inner packet is ipv6. + +With IPV6_MIN_MTU for ipv4 packets, the new pmtu for inner dst +couldn't be set less than 1280. It would cause tx_err and the +packet to be dropped when the outer dst pmtu is close to 1280. + +Jianlin found it by running ipv4 traffic with the topo: + + (client) gre6 <---> eth1 (route) eth2 <---> gre6 (server) + +After changing eth2 mtu to 1300, the performance became very +low, or the connection was even broken. The issue also affects +ip4ip6 and ip6ip6 tunnels. + +So if the inner packet is ipv4, 576 should be considered as the +min mtu. + +Note that for ip4ip6 and ip6ip6 tunnels, the inner packet can +only be ipv4 or ipv6, but for gre6 tunnel, it may also be ARP. +This patch using 576 as the min mtu for non-ipv6 packet works +for all those cases. + +Reported-by: Jianlin Shi +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_tunnel.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1131,8 +1131,13 @@ route_lookup: + max_headroom += 8; + mtu -= 8; + } +- if (mtu < IPV6_MIN_MTU) +- mtu = IPV6_MIN_MTU; ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ if (mtu < IPV6_MIN_MTU) ++ mtu = IPV6_MIN_MTU; ++ } else if (mtu < 576) { ++ mtu = 576; ++ } ++ + if (skb_dst(skb) && !t->parms.collect_md) + skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { diff --git a/queue-4.14/ip_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch b/queue-4.14/ip_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch new file mode 100644 index 00000000000..2d2bebbb73b --- /dev/null +++ b/queue-4.14/ip_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Xin Long +Date: Mon, 18 Dec 2017 14:24:35 +0800 +Subject: ip_gre: remove the incorrect mtu limit for ipgre tap + +From: Xin Long + + +[ Upstream commit cfddd4c33c254954927942599d299b3865743146 ] + +ipgre tap driver calls ether_setup(), after commit 61e84623ace3 +("net: centralize net_device min/max MTU checking"), the range +of mtu is [min_mtu, max_mtu], which is [68, 1500] by default. + +It causes the dev mtu of the ipgre tap device to not be greater +than 1500, this limit value is not correct for ipgre tap device. + +Besides, it's .change_mtu already does the right check. So this +patch is just to set max_mtu as 0, and leave the check to it's +.change_mtu. + +Fixes: 61e84623ace3 ("net: centralize net_device min/max MTU checking") +Reported-by: Jianlin Shi +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_gre.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -1274,6 +1274,7 @@ static const struct net_device_ops erspa + static void ipgre_tap_setup(struct net_device *dev) + { + ether_setup(dev); ++ dev->max_mtu = 0; + dev->netdev_ops = &gre_tap_netdev_ops; + dev->priv_flags &= ~IFF_TX_SKB_SHARING; + dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; diff --git a/queue-4.14/ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch b/queue-4.14/ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch new file mode 100644 index 00000000000..2c9cdab9b9c --- /dev/null +++ b/queue-4.14/ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch @@ -0,0 +1,44 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Brendan McGrath +Date: Wed, 13 Dec 2017 22:14:57 +1100 +Subject: ipv6: icmp6: Allow icmp messages to be looped back + +From: Brendan McGrath + + +[ Upstream commit 588753f1eb18978512b1c9b85fddb457d46f9033 ] + +One example of when an ICMPv6 packet is required to be looped back is +when a host acts as both a Multicast Listener and a Multicast Router. + +A Multicast Router will listen on address ff02::16 for MLDv2 messages. + +Currently, MLDv2 messages originating from a Multicast Listener running +on the same host as the Multicast Router are not being delivered to the +Multicast Router. This is due to dst.input being assigned the default +value of dst_discard. + +This results in the packet being looped back but discarded before being +delivered to the Multicast Router. + +This patch sets dst.input to ip6_input to ensure a looped back packet +is delivered to the Multicast Router. + +Signed-off-by: Brendan McGrath +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/route.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1755,6 +1755,7 @@ struct dst_entry *icmp6_dst_alloc(struct + } + + rt->dst.flags |= DST_HOST; ++ rt->dst.input = ip6_input; + rt->dst.output = ip6_output; + rt->rt6i_gateway = fl6->daddr; + rt->rt6i_dst.addr = fl6->daddr; diff --git a/queue-4.14/led-core-fix-brightness-setting-when-setting-delay_off-0.patch b/queue-4.14/led-core-fix-brightness-setting-when-setting-delay_off-0.patch new file mode 100644 index 00000000000..45d7b6bfffa --- /dev/null +++ b/queue-4.14/led-core-fix-brightness-setting-when-setting-delay_off-0.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Matthieu CASTET +Date: Tue, 12 Dec 2017 11:10:44 +0100 +Subject: led: core: Fix brightness setting when setting delay_off=0 + +From: Matthieu CASTET + + +[ Upstream commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c ] + +With the current code, the following sequence won't work : +echo timer > trigger + +echo 0 > delay_off +* at this point we call +** led_delay_off_store +** led_blink_set +--- + drivers/leds/led-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/leds/led-core.c ++++ b/drivers/leds/led-core.c +@@ -187,7 +187,7 @@ void led_blink_set(struct led_classdev * + unsigned long *delay_on, + unsigned long *delay_off) + { +- del_timer_sync(&led_cdev->blink_timer); ++ led_stop_software_blink(led_cdev); + + clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags); + clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags); diff --git a/queue-4.14/leds-core-fix-regression-caused-by-commit-2b83ff96f51d.patch b/queue-4.14/leds-core-fix-regression-caused-by-commit-2b83ff96f51d.patch new file mode 100644 index 00000000000..bd1dbf14bee --- /dev/null +++ b/queue-4.14/leds-core-fix-regression-caused-by-commit-2b83ff96f51d.patch @@ -0,0 +1,48 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Jacek Anaszewski +Date: Wed, 3 Jan 2018 21:13:45 +0100 +Subject: leds: core: Fix regression caused by commit 2b83ff96f51d + +From: Jacek Anaszewski + + +[ Upstream commit 7b6af2c53192f1766892ef40c8f48a413509ed72 ] + +Commit 2b83ff96f51d ("led: core: Fix brightness setting when setting delay_off=0") +replaced del_timer_sync(&led_cdev->blink_timer) with led_stop_software_blink() +in led_blink_set(), which additionally clears LED_BLINK_SW flag as well as +zeroes blink_delay_on and blink_delay_off properties of the struct led_classdev. + +Cleansing of the latter ones wasn't required to fix the original issue but +wasn't considered harmful. It nonetheless turned out to be so in case when +pointer to one or both props is passed to led_blink_set() like in the +ledtrig-timer.c. In such cases zeroes are passed later in delay_on and/or +delay_off arguments to led_blink_setup(), which results either in stopping +the software blinking or setting blinking frequency always to 1Hz. + +Avoid using led_stop_software_blink() and add a single call required +to clear LED_BLINK_SW flag, which was the only needed modification to +fix the original issue. + +Fixes 2b83ff96f51d ("led: core: Fix brightness setting when setting delay_off=0") +Signed-off-by: Jacek Anaszewski + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/leds/led-core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/leds/led-core.c ++++ b/drivers/leds/led-core.c +@@ -187,8 +187,9 @@ void led_blink_set(struct led_classdev * + unsigned long *delay_on, + unsigned long *delay_off) + { +- led_stop_software_blink(led_cdev); ++ del_timer_sync(&led_cdev->blink_timer); + ++ clear_bit(LED_BLINK_SW, &led_cdev->work_flags); + clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags); + clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags); + diff --git a/queue-4.14/lib-mpi-fix-umul_ppmm-for-mips64r6.patch b/queue-4.14/lib-mpi-fix-umul_ppmm-for-mips64r6.patch new file mode 100644 index 00000000000..085d1cc5fae --- /dev/null +++ b/queue-4.14/lib-mpi-fix-umul_ppmm-for-mips64r6.patch @@ -0,0 +1,78 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: James Hogan +Date: Tue, 5 Dec 2017 23:31:35 +0000 +Subject: lib/mpi: Fix umul_ppmm() for MIPS64r6 + +From: James Hogan + + +[ Upstream commit bbc25bee37d2b32cf3a1fab9195b6da3a185614a ] + +Current MIPS64r6 toolchains aren't able to generate efficient +DMULU/DMUHU based code for the C implementation of umul_ppmm(), which +performs an unsigned 64 x 64 bit multiply and returns the upper and +lower 64-bit halves of the 128-bit result. Instead it widens the 64-bit +inputs to 128-bits and emits a __multi3 intrinsic call to perform a 128 +x 128 multiply. This is both inefficient, and it results in a link error +since we don't include __multi3 in MIPS linux. + +For example commit 90a53e4432b1 ("cfg80211: implement regdb signature +checking") merged in v4.15-rc1 recently broke the 64r6_defconfig and +64r6el_defconfig builds by indirectly selecting MPILIB. The same build +errors can be reproduced on older kernels by enabling e.g. CRYPTO_RSA: + +lib/mpi/generic_mpih-mul1.o: In function `mpihelp_mul_1': +lib/mpi/generic_mpih-mul1.c:50: undefined reference to `__multi3' +lib/mpi/generic_mpih-mul2.o: In function `mpihelp_addmul_1': +lib/mpi/generic_mpih-mul2.c:49: undefined reference to `__multi3' +lib/mpi/generic_mpih-mul3.o: In function `mpihelp_submul_1': +lib/mpi/generic_mpih-mul3.c:49: undefined reference to `__multi3' +lib/mpi/mpih-div.o In function `mpihelp_divrem': +lib/mpi/mpih-div.c:205: undefined reference to `__multi3' +lib/mpi/mpih-div.c:142: undefined reference to `__multi3' + +Therefore add an efficient MIPS64r6 implementation of umul_ppmm() using +inline assembly and the DMULU/DMUHU instructions, to prevent __multi3 +calls being emitted. + +Fixes: 7fd08ca58ae6 ("MIPS: Add build support for the MIPS R6 ISA") +Signed-off-by: James Hogan +Cc: Ralf Baechle +Cc: Herbert Xu +Cc: "David S. Miller" +Cc: linux-mips@linux-mips.org +Cc: linux-crypto@vger.kernel.org +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + lib/mpi/longlong.h | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +--- a/lib/mpi/longlong.h ++++ b/lib/mpi/longlong.h +@@ -671,7 +671,23 @@ do { \ + ************** MIPS/64 ************** + ***************************************/ + #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64 +-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4) ++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6 ++/* ++ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C ++ * code below, so we special case MIPS64r6 until the compiler can do better. ++ */ ++#define umul_ppmm(w1, w0, u, v) \ ++do { \ ++ __asm__ ("dmulu %0,%1,%2" \ ++ : "=d" ((UDItype)(w0)) \ ++ : "d" ((UDItype)(u)), \ ++ "d" ((UDItype)(v))); \ ++ __asm__ ("dmuhu %0,%1,%2" \ ++ : "=d" ((UDItype)(w1)) \ ++ : "d" ((UDItype)(u)), \ ++ "d" ((UDItype)(v))); \ ++} while (0) ++#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4) + #define umul_ppmm(w1, w0, u, v) \ + do { \ + typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \ diff --git a/queue-4.14/mac80211-mesh-drop-frames-appearing-to-be-from-us.patch b/queue-4.14/mac80211-mesh-drop-frames-appearing-to-be-from-us.patch new file mode 100644 index 00000000000..b3cdc43333f --- /dev/null +++ b/queue-4.14/mac80211-mesh-drop-frames-appearing-to-be-from-us.patch @@ -0,0 +1,35 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Johannes Berg +Date: Thu, 4 Jan 2018 15:51:53 +0100 +Subject: mac80211: mesh: drop frames appearing to be from us + +From: Johannes Berg + + +[ Upstream commit 736a80bbfda709fb3631f5f62056f250a38e5804 ] + +If there are multiple mesh stations with the same MAC address, +they will both get confused and start throwing warnings. + +Obviously in this case nothing can actually work anyway, so just +drop frames that look like they're from ourselves early on. + +Reported-by: Gui Iribarren +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/rx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struc + } + return true; + case NL80211_IFTYPE_MESH_POINT: ++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2)) ++ return false; + if (multicast) + return true; + return ether_addr_equal(sdata->vif.addr, hdr->addr1); diff --git a/queue-4.14/mac80211_hwsim-fix-a-possible-sleep-in-atomic-bug-in-hwsim_get_radio_nl.patch b/queue-4.14/mac80211_hwsim-fix-a-possible-sleep-in-atomic-bug-in-hwsim_get_radio_nl.patch new file mode 100644 index 00000000000..22603d49681 --- /dev/null +++ b/queue-4.14/mac80211_hwsim-fix-a-possible-sleep-in-atomic-bug-in-hwsim_get_radio_nl.patch @@ -0,0 +1,38 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Jia-Ju Bai +Date: Tue, 12 Dec 2017 17:26:36 +0800 +Subject: mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl + +From: Jia-Ju Bai + + +[ Upstream commit 162bd5e5fd921785077b5862d8f2ffabe2fe11e5 ] + +The driver may sleep under a spinlock. +The function call path is: +hwsim_get_radio_nl (acquire the spinlock) + nlmsg_new(GFP_KERNEL) --> may sleep + +To fix it, GFP_KERNEL is replaced with GFP_ATOMIC. + +This bug is found by my static analysis tool(DSAC) and checked by my code review. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3220,7 +3220,7 @@ static int hwsim_get_radio_nl(struct sk_ + if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info))) + continue; + +- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); ++ skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); + if (!skb) { + res = -ENOMEM; + goto out_err; diff --git a/queue-4.14/macvlan-fix-one-possible-double-free.patch b/queue-4.14/macvlan-fix-one-possible-double-free.patch new file mode 100644 index 00000000000..77655b182f3 --- /dev/null +++ b/queue-4.14/macvlan-fix-one-possible-double-free.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Gao Feng +Date: Tue, 26 Dec 2017 21:44:32 +0800 +Subject: macvlan: Fix one possible double free + +From: Gao Feng + + +[ Upstream commit d02fd6e7d2933ede6478a15f9e4ce8a93845824e ] + +Because the macvlan_uninit would free the macvlan port, so there is one +double free case in macvlan_common_newlink. When the macvlan port is just +created, then register_netdevice or netdev_upper_dev_link failed and they +would invoke macvlan_uninit. Then it would reach the macvlan_port_destroy +which triggers the double free. + +Signed-off-by: Gao Feng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/macvlan.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1441,9 +1441,14 @@ int macvlan_common_newlink(struct net *s + return 0; + + unregister_netdev: ++ /* macvlan_uninit would free the macvlan port */ + unregister_netdevice(dev); ++ return err; + destroy_macvlan_port: +- if (create) ++ /* the macvlan port may be freed by macvlan_uninit when fail to register. ++ * so we destroy the macvlan port only when it's valid. ++ */ ++ if (create && macvlan_port_get_rtnl(dev)) + macvlan_port_destroy(port->dev); + return err; + } diff --git a/queue-4.14/mdio-sun4i-fix-a-memory-leak.patch b/queue-4.14/mdio-sun4i-fix-a-memory-leak.patch new file mode 100644 index 00000000000..9968aecf0a8 --- /dev/null +++ b/queue-4.14/mdio-sun4i-fix-a-memory-leak.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Christophe JAILLET +Date: Sat, 6 Jan 2018 09:00:09 +0100 +Subject: mdio-sun4i: Fix a memory leak + +From: Christophe JAILLET + + +[ Upstream commit 56c0290202ab94a2f2780c449395d4ae8495fab4 ] + +If the probing of the regulator is deferred, the memory allocated by +'mdiobus_alloc_size()' will be leaking. +It should be freed before the next call to 'sun4i_mdio_probe()' which will +reallocate it. + +Fixes: 4bdcb1dd9feb ("net: Add MDIO bus driver for the Allwinner EMAC") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/mdio-sun4i.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/mdio-sun4i.c ++++ b/drivers/net/phy/mdio-sun4i.c +@@ -118,8 +118,10 @@ static int sun4i_mdio_probe(struct platf + + data->regulator = devm_regulator_get(&pdev->dev, "phy"); + if (IS_ERR(data->regulator)) { +- if (PTR_ERR(data->regulator) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(data->regulator) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto err_out_free_mdiobus; ++ } + + dev_info(&pdev->dev, "no regulator found\n"); + data->regulator = NULL; diff --git a/queue-4.14/mlxsw-pci-wait-after-reset-before-accessing-hw.patch b/queue-4.14/mlxsw-pci-wait-after-reset-before-accessing-hw.patch new file mode 100644 index 00000000000..907f8247f25 --- /dev/null +++ b/queue-4.14/mlxsw-pci-wait-after-reset-before-accessing-hw.patch @@ -0,0 +1,54 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Yuval Mintz +Date: Wed, 10 Jan 2018 11:42:43 +0100 +Subject: mlxsw: pci: Wait after reset before accessing HW + +From: Yuval Mintz + + +[ Upstream commit 8e033a93b37f37aa9fca71a370a895155320af60 ] + +After performing reset driver polls on HW indication until learning +that the reset is done, but immediately after reset the device becomes +unresponsive which might lead to completion timeout on the first read. + +Wait for 100ms before starting the polling. + +Fixes: 233fa44bd67a ("mlxsw: pci: Implement reset done check") +Signed-off-by: Yuval Mintz +Reviewed-by: Ido Schimmel +Signed-off-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/pci.c | 7 ++++++- + drivers/net/ethernet/mellanox/mlxsw/pci_hw.h | 1 + + 2 files changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c +@@ -1643,7 +1643,12 @@ static int mlxsw_pci_sw_reset(struct mlx + return 0; + } + +- wmb(); /* reset needs to be written before we read control register */ ++ /* Reset needs to be written before we read control register, and ++ * we must wait for the HW to become responsive once again ++ */ ++ wmb(); ++ msleep(MLXSW_PCI_SW_RESET_WAIT_MSECS); ++ + end = jiffies + msecs_to_jiffies(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS); + do { + u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY); +--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h +@@ -59,6 +59,7 @@ + #define MLXSW_PCI_SW_RESET 0xF0010 + #define MLXSW_PCI_SW_RESET_RST_BIT BIT(0) + #define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 5000 ++#define MLXSW_PCI_SW_RESET_WAIT_MSECS 100 + #define MLXSW_PCI_FW_READY 0xA1844 + #define MLXSW_PCI_FW_READY_MASK 0xFFFF + #define MLXSW_PCI_FW_READY_MAGIC 0x5E diff --git a/queue-4.14/mm-frame_vector.c-release-a-semaphore-in-get_vaddr_frames.patch b/queue-4.14/mm-frame_vector.c-release-a-semaphore-in-get_vaddr_frames.patch new file mode 100644 index 00000000000..b3e65e8b601 --- /dev/null +++ b/queue-4.14/mm-frame_vector.c-release-a-semaphore-in-get_vaddr_frames.patch @@ -0,0 +1,44 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Christophe JAILLET +Date: Thu, 14 Dec 2017 15:33:08 -0800 +Subject: mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()' + +From: Christophe JAILLET + + +[ Upstream commit 1f704fd0d14043e76e80f6b8b2251b9b2cedcca6 ] + +A semaphore is acquired before this check, so we must release it before +leaving. + +Link: http://lkml.kernel.org/r/20171211211009.4971-1-christophe.jaillet@wanadoo.fr +Fixes: b7f0554a56f2 ("mm: fail get_vaddr_frames() for filesystem-dax mappings") +Signed-off-by: Christophe JAILLET +Acked-by: Michal Hocko +Cc: Dan Williams +Cc: Christian Borntraeger +Cc: David Sterba +Cc: Greg Kroah-Hartman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/frame_vector.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/mm/frame_vector.c ++++ b/mm/frame_vector.c +@@ -62,8 +62,10 @@ int get_vaddr_frames(unsigned long start + * get_user_pages_longterm() and disallow it for filesystem-dax + * mappings. + */ +- if (vma_is_fsdax(vma)) +- return -EOPNOTSUPP; ++ if (vma_is_fsdax(vma)) { ++ ret = -EOPNOTSUPP; ++ goto out; ++ } + + if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) { + vec->got_ref = true; diff --git a/queue-4.14/mtd-nand-brcmnand-zero-bitflip-is-not-an-error.patch b/queue-4.14/mtd-nand-brcmnand-zero-bitflip-is-not-an-error.patch new file mode 100644 index 00000000000..991a8fd747e --- /dev/null +++ b/queue-4.14/mtd-nand-brcmnand-zero-bitflip-is-not-an-error.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Albert Hsieh +Date: Mon, 20 Nov 2017 11:26:26 +0800 +Subject: mtd: nand: brcmnand: Zero bitflip is not an error + +From: Albert Hsieh + + +[ Upstream commit e44b9a9c135727f3410e029910275f40681dc8bc ] + +A negative return value of brcmstb_nand_verify_erased_page() indicates a +real bitflip error of an erased page, and other return values (>= 0) show +the corrected bitflip number. Zero return value means no bitflip, but the +current driver code treats it as an error, and eventually leads to +falsely reported ECC error. + +Fixes: 02b88eea9f9c ("mtd: brcmnand: Add check for erased page bitflip") +Signed-off-by: Albert Hsieh +Acked-by: Boris Brezillon +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/brcmnand/brcmnand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/brcmnand/brcmnand.c +@@ -1763,7 +1763,7 @@ try_dmaread: + err = brcmstb_nand_verify_erased_page(mtd, chip, buf, + addr); + /* erased page bitflips corrected */ +- if (err > 0) ++ if (err >= 0) + return err; + } + diff --git a/queue-4.14/mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch b/queue-4.14/mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch new file mode 100644 index 00000000000..beeebeaf0f2 --- /dev/null +++ b/queue-4.14/mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch @@ -0,0 +1,63 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Sascha Hauer +Date: Tue, 5 Dec 2017 11:51:40 +0100 +Subject: mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM + +From: Sascha Hauer + + +[ Upstream commit fdf2e821052958a114618a95ab18a300d0b080cb ] + +When erased subpages are read then the BCH decoder returns STATUS_ERASED +if they are all empty, or STATUS_UNCORRECTABLE if there are bitflips. +When there are bitflips, we have to set these bits again to show the +upper layers a completely erased page. When a bitflip happens in the +exact byte where the bad block marker is, then this byte is swapped +with another byte in block_mark_swapping(). The correction code then +detects a bitflip in another subpage and no longer corrects the bitflip +where it really happens. + +Correct this behaviour by calling block_mark_swapping() after the +bitflips have been corrected. + +In our case UBIFS failed with this bug because it expects erased +pages to be really empty: + +UBIFS error (pid 187): ubifs_scan: corrupt empty space at LEB 36:118735 +UBIFS error (pid 187): ubifs_scanned_corruption: corruption at LEB 36:118735 +UBIFS error (pid 187): ubifs_scanned_corruption: first 8192 bytes from LEB 36:118735 +UBIFS error (pid 187): ubifs_scan: LEB 36 scanning failed +UBIFS error (pid 187): do_commit: commit failed, error -117 + +Signed-off-by: Sascha Hauer +Reviewed-by: Richard Weinberger +Acked-by: Boris Brezillon +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +@@ -1067,9 +1067,6 @@ static int gpmi_ecc_read_page(struct mtd + return ret; + } + +- /* handle the block mark swapping */ +- block_mark_swapping(this, payload_virt, auxiliary_virt); +- + /* Loop over status bytes, accumulating ECC status. */ + status = auxiliary_virt + nfc_geo->auxiliary_status_offset; + +@@ -1158,6 +1155,9 @@ static int gpmi_ecc_read_page(struct mtd + max_bitflips = max_t(unsigned int, max_bitflips, *status); + } + ++ /* handle the block mark swapping */ ++ block_mark_swapping(this, buf, auxiliary_virt); ++ + if (oob_required) { + /* + * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob() diff --git a/queue-4.14/net-aquantia-fix-actual-speed-capabilities-reporting.patch b/queue-4.14/net-aquantia-fix-actual-speed-capabilities-reporting.patch new file mode 100644 index 00000000000..723663534e7 --- /dev/null +++ b/queue-4.14/net-aquantia-fix-actual-speed-capabilities-reporting.patch @@ -0,0 +1,150 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Igor Russkikh +Date: Thu, 14 Dec 2017 12:34:40 +0300 +Subject: net: aquantia: Fix actual speed capabilities reporting + +From: Igor Russkikh + + +[ Upstream commit e4d02ca04c6d48ab2226342a1c4ed54f1dbb72bd ] + +Different hardware device Ids correspond to different maximum speed +available. Extra checks were added for devices D108 and D109 to +remove unsupported speeds from these device capabilities list. + +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/aquantia/atlantic/aq_hw.h | 4 +++- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 7 ++++--- + drivers/net/ethernet/aquantia/atlantic/aq_nic.h | 2 +- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 5 +++-- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 13 ++++++++++++- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 13 ++++++++++++- + 6 files changed, 35 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h +@@ -85,7 +85,9 @@ struct aq_hw_ops { + void (*destroy)(struct aq_hw_s *self); + + int (*get_hw_caps)(struct aq_hw_s *self, +- struct aq_hw_caps_s *aq_hw_caps); ++ struct aq_hw_caps_s *aq_hw_caps, ++ unsigned short device, ++ unsigned short subsystem_device); + + int (*hw_ring_tx_xmit)(struct aq_hw_s *self, struct aq_ring_s *aq_ring, + unsigned int frags); +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -222,7 +222,7 @@ static struct net_device *aq_nic_ndev_al + + struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops, + const struct ethtool_ops *et_ops, +- struct device *dev, ++ struct pci_dev *pdev, + struct aq_pci_func_s *aq_pci_func, + unsigned int port, + const struct aq_hw_ops *aq_hw_ops) +@@ -242,7 +242,7 @@ struct aq_nic_s *aq_nic_alloc_cold(const + ndev->netdev_ops = ndev_ops; + ndev->ethtool_ops = et_ops; + +- SET_NETDEV_DEV(ndev, dev); ++ SET_NETDEV_DEV(ndev, &pdev->dev); + + ndev->if_port = port; + self->ndev = ndev; +@@ -254,7 +254,8 @@ struct aq_nic_s *aq_nic_alloc_cold(const + + self->aq_hw = self->aq_hw_ops.create(aq_pci_func, self->port, + &self->aq_hw_ops); +- err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps); ++ err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps, ++ pdev->device, pdev->subsystem_device); + if (err < 0) + goto err_exit; + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h +@@ -71,7 +71,7 @@ struct aq_nic_cfg_s { + + struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops, + const struct ethtool_ops *et_ops, +- struct device *dev, ++ struct pci_dev *pdev, + struct aq_pci_func_s *aq_pci_func, + unsigned int port, + const struct aq_hw_ops *aq_hw_ops); +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -51,7 +51,8 @@ struct aq_pci_func_s *aq_pci_func_alloc( + pci_set_drvdata(pdev, self); + self->pdev = pdev; + +- err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps); ++ err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps, pdev->device, ++ pdev->subsystem_device); + if (err < 0) + goto err_exit; + +@@ -59,7 +60,7 @@ struct aq_pci_func_s *aq_pci_func_alloc( + + for (port = 0; port < self->ports; ++port) { + struct aq_nic_s *aq_nic = aq_nic_alloc_cold(ndev_ops, eth_ops, +- &pdev->dev, self, ++ pdev, self, + port, aq_hw_ops); + + if (!aq_nic) { +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +@@ -18,9 +18,20 @@ + #include "hw_atl_a0_internal.h" + + static int hw_atl_a0_get_hw_caps(struct aq_hw_s *self, +- struct aq_hw_caps_s *aq_hw_caps) ++ struct aq_hw_caps_s *aq_hw_caps, ++ unsigned short device, ++ unsigned short subsystem_device) + { + memcpy(aq_hw_caps, &hw_atl_a0_hw_caps_, sizeof(*aq_hw_caps)); ++ ++ if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001) ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G; ++ ++ if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) { ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G; ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_5G; ++ } ++ + return 0; + } + +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -18,9 +18,20 @@ + #include "hw_atl_b0_internal.h" + + static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self, +- struct aq_hw_caps_s *aq_hw_caps) ++ struct aq_hw_caps_s *aq_hw_caps, ++ unsigned short device, ++ unsigned short subsystem_device) + { + memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps)); ++ ++ if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001) ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G; ++ ++ if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) { ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G; ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_5G; ++ } ++ + return 0; + } + diff --git a/queue-4.14/net-aquantia-fix-hardware-dma-stream-overload-on-large-mrrs.patch b/queue-4.14/net-aquantia-fix-hardware-dma-stream-overload-on-large-mrrs.patch new file mode 100644 index 00000000000..e6f2ef2f6ce --- /dev/null +++ b/queue-4.14/net-aquantia-fix-hardware-dma-stream-overload-on-large-mrrs.patch @@ -0,0 +1,85 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Igor Russkikh +Date: Thu, 14 Dec 2017 12:34:41 +0300 +Subject: net: aquantia: Fix hardware DMA stream overload on large MRRS + +From: Igor Russkikh + + +[ Upstream commit 1e366161510f266516107a69db91f1f2edaea11c ] + +Systems with large MRRS on device (2K, 4K) with high data rates and/or +large MTU, atlantic observes DMA packet buffer overflow. On some systems +that causes PCIe transaction errors, hardware NMIs or datapath freeze. +This patch +1) Limits MRRS from device side to 2K (thats maximum our hardware supports) +2) Limit maximum size of outstanding TX DMA data read requests. This makes +hardware buffers running fine. + +Signed-off-by: Pavel Belous +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 12 ++++++++++ + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h | 6 +++++ + 2 files changed, 18 insertions(+) + +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -16,6 +16,7 @@ + #include "hw_atl_utils.h" + #include "hw_atl_llh.h" + #include "hw_atl_b0_internal.h" ++#include "hw_atl_llh_internal.h" + + static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self, + struct aq_hw_caps_s *aq_hw_caps, +@@ -368,6 +369,7 @@ static int hw_atl_b0_hw_init(struct aq_h + }; + + int err = 0; ++ u32 val; + + self->aq_nic_cfg = aq_nic_cfg; + +@@ -385,6 +387,16 @@ static int hw_atl_b0_hw_init(struct aq_h + hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss); + hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss); + ++ /* Force limit MRRS on RDM/TDM to 2K */ ++ val = aq_hw_read_reg(self, pci_reg_control6_adr); ++ aq_hw_write_reg(self, pci_reg_control6_adr, (val & ~0x707) | 0x404); ++ ++ /* TX DMA total request limit. B0 hardware is not capable to ++ * handle more than (8K-MRRS) incoming DMA data. ++ * Value 24 in 256byte units ++ */ ++ aq_hw_write_reg(self, tx_dma_total_req_limit_adr, 24); ++ + err = aq_hw_err_from_flags(self); + if (err < 0) + goto err_exit; +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +@@ -2343,6 +2343,9 @@ + #define tx_dma_desc_base_addrmsw_adr(descriptor) \ + (0x00007c04u + (descriptor) * 0x40) + ++/* tx dma total request limit */ ++#define tx_dma_total_req_limit_adr 0x00007b20u ++ + /* tx interrupt moderation control register definitions + * Preprocessor definitions for TX Interrupt Moderation Control Register + * Base Address: 0x00008980 +@@ -2369,6 +2372,9 @@ + /* default value of bitfield reg_res_dsbl */ + #define pci_reg_res_dsbl_default 0x1 + ++/* PCI core control register */ ++#define pci_reg_control6_adr 0x1014u ++ + /* global microprocessor scratch pad definitions */ + #define glb_cpu_scratch_scp_adr(scratch_scp) (0x00000300u + (scratch_scp) * 0x4) + diff --git a/queue-4.14/net-arc_emac-fix-arc_emac_rx-error-paths.patch b/queue-4.14/net-arc_emac-fix-arc_emac_rx-error-paths.patch new file mode 100644 index 00000000000..335e277f40b --- /dev/null +++ b/queue-4.14/net-arc_emac-fix-arc_emac_rx-error-paths.patch @@ -0,0 +1,100 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Alexander Kochetkov +Date: Fri, 15 Dec 2017 20:20:06 +0300 +Subject: net: arc_emac: fix arc_emac_rx() error paths + +From: Alexander Kochetkov + + +[ Upstream commit e688822d035b494071ecbadcccbd6f3325fb0f59 ] + +arc_emac_rx() has some issues found by code review. + +In case netdev_alloc_skb_ip_align() or dma_map_single() failure +rx fifo entry will not be returned to EMAC. + +In case dma_map_single() failure previously allocated skb became +lost to driver. At the same time address of newly allocated skb +will not be provided to EMAC. + +Signed-off-by: Alexander Kochetkov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/arc/emac_main.c | 53 ++++++++++++++++++++--------------- + 1 file changed, 31 insertions(+), 22 deletions(-) + +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -210,39 +210,48 @@ static int arc_emac_rx(struct net_device + continue; + } + +- pktlen = info & LEN_MASK; +- stats->rx_packets++; +- stats->rx_bytes += pktlen; +- skb = rx_buff->skb; +- skb_put(skb, pktlen); +- skb->dev = ndev; +- skb->protocol = eth_type_trans(skb, ndev); +- +- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), +- dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); +- +- /* Prepare the BD for next cycle */ +- rx_buff->skb = netdev_alloc_skb_ip_align(ndev, +- EMAC_BUFFER_SIZE); +- if (unlikely(!rx_buff->skb)) { ++ /* Prepare the BD for next cycle. netif_receive_skb() ++ * only if new skb was allocated and mapped to avoid holes ++ * in the RX fifo. ++ */ ++ skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE); ++ if (unlikely(!skb)) { ++ if (net_ratelimit()) ++ netdev_err(ndev, "cannot allocate skb\n"); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; +- /* Because receive_skb is below, increment rx_dropped */ + stats->rx_dropped++; + continue; + } + +- /* receive_skb only if new skb was allocated to avoid holes */ +- netif_receive_skb(skb); +- +- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data, ++ addr = dma_map_single(&ndev->dev, (void *)skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); + if (dma_mapping_error(&ndev->dev, addr)) { + if (net_ratelimit()) +- netdev_err(ndev, "cannot dma map\n"); +- dev_kfree_skb(rx_buff->skb); ++ netdev_err(ndev, "cannot map dma buffer\n"); ++ dev_kfree_skb(skb); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; ++ stats->rx_dropped++; + continue; + } ++ ++ /* unmap previosly mapped skb */ ++ dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), ++ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); ++ ++ pktlen = info & LEN_MASK; ++ stats->rx_packets++; ++ stats->rx_bytes += pktlen; ++ skb_put(rx_buff->skb, pktlen); ++ rx_buff->skb->dev = ndev; ++ rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev); ++ ++ netif_receive_skb(rx_buff->skb); ++ ++ rx_buff->skb = skb; + dma_unmap_addr_set(rx_buff, addr, addr); + dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE); + diff --git a/queue-4.14/net-ena-unmask-msi-x-only-after-device-initialization-is-completed.patch b/queue-4.14/net-ena-unmask-msi-x-only-after-device-initialization-is-completed.patch new file mode 100644 index 00000000000..2b4561054a7 --- /dev/null +++ b/queue-4.14/net-ena-unmask-msi-x-only-after-device-initialization-is-completed.patch @@ -0,0 +1,82 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Netanel Belgazal +Date: Wed, 3 Jan 2018 06:17:29 +0000 +Subject: net: ena: unmask MSI-X only after device initialization is completed + +From: Netanel Belgazal + + +[ Upstream commit 7853b49ce8e0ef6364d24512b287463841d71bd3 ] + +Under certain conditions MSI-X interrupt might arrive right after it +was unmasked in ena_up(). There is a chance it would be processed by +the driver before device ENA_FLAG_DEV_UP flag is set. In such a case +the interrupt is ignored. +ENA device operates in auto-masked mode, therefore ignoring +interrupt leaves it masked for good. +Moving unmask of interrupt to be the last step in ena_up(). + +Signed-off-by: Netanel Belgazal +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1565,7 +1565,7 @@ static int ena_rss_configure(struct ena_ + + static int ena_up_complete(struct ena_adapter *adapter) + { +- int rc, i; ++ int rc; + + rc = ena_rss_configure(adapter); + if (rc) +@@ -1584,17 +1584,6 @@ static int ena_up_complete(struct ena_ad + + ena_napi_enable_all(adapter); + +- /* Enable completion queues interrupt */ +- for (i = 0; i < adapter->num_queues; i++) +- ena_unmask_interrupt(&adapter->tx_ring[i], +- &adapter->rx_ring[i]); +- +- /* schedule napi in case we had pending packets +- * from the last time we disable napi +- */ +- for (i = 0; i < adapter->num_queues; i++) +- napi_schedule(&adapter->ena_napi[i].napi); +- + return 0; + } + +@@ -1731,7 +1720,7 @@ create_err: + + static int ena_up(struct ena_adapter *adapter) + { +- int rc; ++ int rc, i; + + netdev_dbg(adapter->netdev, "%s\n", __func__); + +@@ -1774,6 +1763,17 @@ static int ena_up(struct ena_adapter *ad + + set_bit(ENA_FLAG_DEV_UP, &adapter->flags); + ++ /* Enable completion queues interrupt */ ++ for (i = 0; i < adapter->num_queues; i++) ++ ena_unmask_interrupt(&adapter->tx_ring[i], ++ &adapter->rx_ring[i]); ++ ++ /* schedule napi in case we had pending packets ++ * from the last time we disable napi ++ */ ++ for (i = 0; i < adapter->num_queues; i++) ++ napi_schedule(&adapter->ena_napi[i].napi); ++ + return rc; + + err_up: diff --git a/queue-4.14/net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch b/queue-4.14/net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch new file mode 100644 index 00000000000..1e2092abe51 --- /dev/null +++ b/queue-4.14/net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Yangbo Lu +Date: Tue, 9 Jan 2018 11:02:33 +0800 +Subject: net: gianfar_ptp: move set_fipers() to spinlock protecting area + +From: Yangbo Lu + + +[ Upstream commit 11d827a993a969c3c6ec56758ff63a44ba19b466 ] + +set_fipers() calling should be protected by spinlock in +case that any interrupt breaks related registers setting +and the function we expect. This patch is to move set_fipers() +to spinlock protecting area in ptp_gianfar_adjtime(). + +Signed-off-by: Yangbo Lu +Acked-by: Richard Cochran +Reviewed-by: Fabio Estevam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/gianfar_ptp.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/ethernet/freescale/gianfar_ptp.c ++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c +@@ -319,11 +319,10 @@ static int ptp_gianfar_adjtime(struct pt + now = tmr_cnt_read(etsects); + now += delta; + tmr_cnt_write(etsects, now); ++ set_fipers(etsects); + + spin_unlock_irqrestore(&etsects->lock, flags); + +- set_fipers(etsects); +- + return 0; + } + diff --git a/queue-4.14/net-mediatek-setup-proper-state-for-disabled-gmac-on-the-default.patch b/queue-4.14/net-mediatek-setup-proper-state-for-disabled-gmac-on-the-default.patch new file mode 100644 index 00000000000..6d02f55516a --- /dev/null +++ b/queue-4.14/net-mediatek-setup-proper-state-for-disabled-gmac-on-the-default.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Sean Wang +Date: Mon, 18 Dec 2017 17:00:17 +0800 +Subject: net: mediatek: setup proper state for disabled GMAC on the default + +From: Sean Wang + + +[ Upstream commit 7352e252b5bf40d59342494a70354a2d436fd0cd ] + +The current solution would setup fixed and force link of 1Gbps to the both +GMAC on the default. However, The GMAC should always be put to link down +state when the GMAC is disabled on certain target boards. Otherwise, +the driver possibly receives unexpected data from the floating hardware +connection through the unused GMAC. Although the driver had been added +certain protection in RX path to get rid of such kind of unexpected data +sent to the upper stack. + +Signed-off-by: Sean Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -1959,11 +1959,12 @@ static int mtk_hw_init(struct mtk_eth *e + /* set GE2 TUNE */ + regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0); + +- /* GE1, Force 1000M/FD, FC ON */ +- mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0)); +- +- /* GE2, Force 1000M/FD, FC ON */ +- mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1)); ++ /* Set linkdown as the default for each GMAC. Its own MCR would be set ++ * up with the more appropriate value when mtk_phy_link_adjust call is ++ * being invoked. ++ */ ++ for (i = 0; i < MTK_MAC_COUNT; i++) ++ mtk_w32(eth, 0, MTK_MAC_MCR(i)); + + /* Indicates CDM to parse the MTK special tag from CPU + * which also is working out for untag packets. diff --git a/queue-4.14/net-mlx5-cleanup-irqs-in-case-of-unload-failure.patch b/queue-4.14/net-mlx5-cleanup-irqs-in-case-of-unload-failure.patch new file mode 100644 index 00000000000..9a56b3454e2 --- /dev/null +++ b/queue-4.14/net-mlx5-cleanup-irqs-in-case-of-unload-failure.patch @@ -0,0 +1,92 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Moshe Shemesh +Date: Tue, 21 Nov 2017 15:15:51 +0200 +Subject: net/mlx5: Cleanup IRQs in case of unload failure + +From: Moshe Shemesh + + +[ Upstream commit d6b2785cd55ee72e9608762650b3ef299f801b1b ] + +When mlx5_stop_eqs fails to destroy any of the eqs it returns with an error. +In such failure flow the function will return without +releasing all EQs irqs and then pci_free_irq_vectors will fail. +Fix by only warn on destroy EQ failure and continue to release other +EQs and their irqs. + +It fixes the following kernel trace: +kernel: kernel BUG at drivers/pci/msi.c:352! +... +... +kernel: Call Trace: +kernel: pci_disable_msix+0xd3/0x100 +kernel: pci_free_irq_vectors+0xe/0x20 +kernel: mlx5_load_one.isra.17+0x9f5/0xec0 [mlx5_core] + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Signed-off-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/eq.c | 20 +++++++++++++------- + include/linux/mlx5/driver.h | 2 +- + 2 files changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c +@@ -776,7 +776,7 @@ err1: + return err; + } + +-int mlx5_stop_eqs(struct mlx5_core_dev *dev) ++void mlx5_stop_eqs(struct mlx5_core_dev *dev) + { + struct mlx5_eq_table *table = &dev->priv.eq_table; + int err; +@@ -785,22 +785,28 @@ int mlx5_stop_eqs(struct mlx5_core_dev * + if (MLX5_CAP_GEN(dev, pg)) { + err = mlx5_destroy_unmap_eq(dev, &table->pfault_eq); + if (err) +- return err; ++ mlx5_core_err(dev, "failed to destroy page fault eq, err(%d)\n", ++ err); + } + #endif + + err = mlx5_destroy_unmap_eq(dev, &table->pages_eq); + if (err) +- return err; ++ mlx5_core_err(dev, "failed to destroy pages eq, err(%d)\n", ++ err); + +- mlx5_destroy_unmap_eq(dev, &table->async_eq); ++ err = mlx5_destroy_unmap_eq(dev, &table->async_eq); ++ if (err) ++ mlx5_core_err(dev, "failed to destroy async eq, err(%d)\n", ++ err); + mlx5_cmd_use_polling(dev); + + err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq); +- if (err) ++ if (err) { ++ mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n", ++ err); + mlx5_cmd_use_events(dev); +- +- return err; ++ } + } + + int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq, +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -1017,7 +1017,7 @@ int mlx5_create_map_eq(struct mlx5_core_ + enum mlx5_eq_type type); + int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq); + int mlx5_start_eqs(struct mlx5_core_dev *dev); +-int mlx5_stop_eqs(struct mlx5_core_dev *dev); ++void mlx5_stop_eqs(struct mlx5_core_dev *dev); + int mlx5_vector2eqn(struct mlx5_core_dev *dev, int vector, int *eqn, + unsigned int *irqn); + int mlx5_core_attach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid, u32 qpn); diff --git a/queue-4.14/net-mlx5-stay-in-polling-mode-when-command-eq-destroy-fails.patch b/queue-4.14/net-mlx5-stay-in-polling-mode-when-command-eq-destroy-fails.patch new file mode 100644 index 00000000000..bb0af96a9cf --- /dev/null +++ b/queue-4.14/net-mlx5-stay-in-polling-mode-when-command-eq-destroy-fails.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Moshe Shemesh +Date: Mon, 4 Dec 2017 15:23:51 +0200 +Subject: net/mlx5: Stay in polling mode when command EQ destroy fails + +From: Moshe Shemesh + + +[ Upstream commit a2fba188fd5eadd6061bef4f2f2577a43231ebf3 ] + +During unload, on mlx5_stop_eqs we move command interface from events +mode to polling mode, but if command interface EQ destroy fail we move +back to events mode. +That's wrong since even if we fail to destroy command interface EQ, we +do release its irq, so no interrupts will be received. + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Signed-off-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/eq.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c +@@ -802,11 +802,9 @@ void mlx5_stop_eqs(struct mlx5_core_dev + mlx5_cmd_use_polling(dev); + + err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq); +- if (err) { ++ if (err) + mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n", + err); +- mlx5_cmd_use_events(dev); +- } + } + + int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq, diff --git a/queue-4.14/net-mlx5e-fix-ets-bw-check.patch b/queue-4.14/net-mlx5e-fix-ets-bw-check.patch new file mode 100644 index 00000000000..5d442d79724 --- /dev/null +++ b/queue-4.14/net-mlx5e-fix-ets-bw-check.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Huy Nguyen +Date: Thu, 26 Oct 2017 09:56:34 -0500 +Subject: net/mlx5e: Fix ETS BW check + +From: Huy Nguyen + + +[ Upstream commit ff0891915cd7b24ab27eee9b360c0452853bf9f6 ] + +Fix bug that allows ets bw sum to be 0% when ets tc type exists. + +Fixes: 08fb1dacdd76 ('net/mlx5e: Support DCBNL IEEE ETS') +Signed-off-by: Moshe Shemesh +Reviewed-by: Huy Nguyen +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +@@ -259,6 +259,7 @@ int mlx5e_dcbnl_ieee_setets_core(struct + static int mlx5e_dbcnl_validate_ets(struct net_device *netdev, + struct ieee_ets *ets) + { ++ bool have_ets_tc = false; + int bw_sum = 0; + int i; + +@@ -273,11 +274,14 @@ static int mlx5e_dbcnl_validate_ets(stru + } + + /* Validate Bandwidth Sum */ +- for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) +- if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) ++ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) { ++ if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) { ++ have_ets_tc = true; + bw_sum += ets->tc_tx_bw[i]; ++ } ++ } + +- if (bw_sum != 0 && bw_sum != 100) { ++ if (have_ets_tc && bw_sum != 100) { + netdev_err(netdev, + "Failed to validate ETS: BW sum is illegal\n"); + return -EINVAL; diff --git a/queue-4.14/net-phy-fix-resume-handling.patch b/queue-4.14/net-phy-fix-resume-handling.patch new file mode 100644 index 00000000000..7bb7fcbd47c --- /dev/null +++ b/queue-4.14/net-phy-fix-resume-handling.patch @@ -0,0 +1,135 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Russell King +Date: Tue, 12 Dec 2017 10:45:36 +0000 +Subject: net: phy: fix resume handling + +From: Russell King + + +[ Upstream commit f5e64032a799d4f54decc7eb6aafcdffb67f9ad9 ] + +When a PHY has the BMCR_PDOWN bit set, it may decide to ignore writes +to other registers, or reset the registers to power-on defaults. +Micrel PHYs do this for their interrupt registers. + +The current structure of phylib tries to enable interrupts before +resuming (and releasing) the BMCR_PDOWN bit. This fails, causing +Micrel PHYs to stop working after a suspend/resume sequence if they +are using interrupts. + +Fix this by ensuring that the PHY driver resume methods do not take +the phydev->lock mutex themselves, but the callers of phy_resume() +take that lock. This then allows us to move the call to phy_resume() +before we enable interrupts in phy_start(). + +Signed-off-by: Russell King +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/at803x.c | 4 ---- + drivers/net/phy/phy.c | 9 +++------ + drivers/net/phy/phy_device.c | 10 ++++++---- + 3 files changed, 9 insertions(+), 14 deletions(-) + +--- a/drivers/net/phy/at803x.c ++++ b/drivers/net/phy/at803x.c +@@ -239,14 +239,10 @@ static int at803x_resume(struct phy_devi + { + int value; + +- mutex_lock(&phydev->lock); +- + value = phy_read(phydev, MII_BMCR); + value &= ~(BMCR_PDOWN | BMCR_ISOLATE); + phy_write(phydev, MII_BMCR, value); + +- mutex_unlock(&phydev->lock); +- + return 0; + } + +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -828,7 +828,6 @@ EXPORT_SYMBOL(phy_stop); + */ + void phy_start(struct phy_device *phydev) + { +- bool do_resume = false; + int err = 0; + + mutex_lock(&phydev->lock); +@@ -841,6 +840,9 @@ void phy_start(struct phy_device *phydev + phydev->state = PHY_UP; + break; + case PHY_HALTED: ++ /* if phy was suspended, bring the physical link up again */ ++ phy_resume(phydev); ++ + /* make sure interrupts are re-enabled for the PHY */ + if (phydev->irq != PHY_POLL) { + err = phy_enable_interrupts(phydev); +@@ -849,17 +851,12 @@ void phy_start(struct phy_device *phydev + } + + phydev->state = PHY_RESUMING; +- do_resume = true; + break; + default: + break; + } + mutex_unlock(&phydev->lock); + +- /* if phy was suspended, bring the physical link up again */ +- if (do_resume) +- phy_resume(phydev); +- + phy_trigger_machine(phydev, true); + } + EXPORT_SYMBOL(phy_start); +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -135,7 +135,9 @@ static int mdio_bus_phy_resume(struct de + if (!mdio_bus_phy_may_suspend(phydev)) + goto no_resume; + ++ mutex_lock(&phydev->lock); + ret = phy_resume(phydev); ++ mutex_unlock(&phydev->lock); + if (ret < 0) + return ret; + +@@ -1026,7 +1028,9 @@ int phy_attach_direct(struct net_device + if (err) + goto error; + ++ mutex_lock(&phydev->lock); + phy_resume(phydev); ++ mutex_unlock(&phydev->lock); + phy_led_triggers_register(phydev); + + return err; +@@ -1157,6 +1161,8 @@ int phy_resume(struct phy_device *phydev + struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver); + int ret = 0; + ++ WARN_ON(!mutex_is_locked(&phydev->lock)); ++ + if (phydev->drv && phydrv->resume) + ret = phydrv->resume(phydev); + +@@ -1639,13 +1645,9 @@ int genphy_resume(struct phy_device *phy + { + int value; + +- mutex_lock(&phydev->lock); +- + value = phy_read(phydev, MII_BMCR); + phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN); + +- mutex_unlock(&phydev->lock); +- + return 0; + } + EXPORT_SYMBOL(genphy_resume); diff --git a/queue-4.14/net-phy-xgene-disable-clk-on-error-paths.patch b/queue-4.14/net-phy-xgene-disable-clk-on-error-paths.patch new file mode 100644 index 00000000000..fd8d3f5da8c --- /dev/null +++ b/queue-4.14/net-phy-xgene-disable-clk-on-error-paths.patch @@ -0,0 +1,83 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Alexey Khoroshilov +Date: Sat, 16 Dec 2017 00:52:39 +0300 +Subject: net: phy: xgene: disable clk on error paths + +From: Alexey Khoroshilov + + +[ Upstream commit ab14436065c8066c265540312742390d6d07ddd2 ] + +There are several error paths in xgene_mdio_probe(), +where clk is left undisabled. The patch fixes them. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/mdio-xgene.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/drivers/net/phy/mdio-xgene.c ++++ b/drivers/net/phy/mdio-xgene.c +@@ -194,8 +194,11 @@ static int xgene_mdio_reset(struct xgene + } + + ret = xgene_enet_ecc_init(pdata); +- if (ret) ++ if (ret) { ++ if (pdata->dev->of_node) ++ clk_disable_unprepare(pdata->clk); + return ret; ++ } + xgene_gmac_reset(pdata); + + return 0; +@@ -388,8 +391,10 @@ static int xgene_mdio_probe(struct platf + return ret; + + mdio_bus = mdiobus_alloc(); +- if (!mdio_bus) +- return -ENOMEM; ++ if (!mdio_bus) { ++ ret = -ENOMEM; ++ goto out_clk; ++ } + + mdio_bus->name = "APM X-Gene MDIO bus"; + +@@ -418,7 +423,7 @@ static int xgene_mdio_probe(struct platf + mdio_bus->phy_mask = ~0; + ret = mdiobus_register(mdio_bus); + if (ret) +- goto out; ++ goto out_mdiobus; + + acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1, + acpi_register_phy, NULL, mdio_bus, NULL); +@@ -426,16 +431,20 @@ static int xgene_mdio_probe(struct platf + } + + if (ret) +- goto out; ++ goto out_mdiobus; + + pdata->mdio_bus = mdio_bus; + xgene_mdio_status = true; + + return 0; + +-out: ++out_mdiobus: + mdiobus_free(mdio_bus); + ++out_clk: ++ if (dev->of_node) ++ clk_disable_unprepare(pdata->clk); ++ + return ret; + } + diff --git a/queue-4.14/net-stmmac-fix-bad-rx-timestamp-extraction.patch b/queue-4.14/net-stmmac-fix-bad-rx-timestamp-extraction.patch new file mode 100644 index 00000000000..f5f81650a1a --- /dev/null +++ b/queue-4.14/net-stmmac-fix-bad-rx-timestamp-extraction.patch @@ -0,0 +1,93 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Fredrik Hallenberg +Date: Mon, 18 Dec 2017 23:34:00 +0100 +Subject: net: stmmac: Fix bad RX timestamp extraction + +From: Fredrik Hallenberg + + +[ Upstream commit a1762456993893795030d911106a7650481db0ef ] + +As noted in dwmac4_wrback_get_rx_timestamp_status the timestamp is found +in the context descriptor following the current descriptor. However the +current code looks for the context descriptor in the current +descriptor, which will always fail. + +Signed-off-by: Fredrik Hallenberg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/common.h | 2 +- + drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 5 +++-- + drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 3 ++- + drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 2 +- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- + 5 files changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -409,7 +409,7 @@ struct stmmac_desc_ops { + /* get timestamp value */ + u64(*get_timestamp) (void *desc, u32 ats); + /* get rx timestamp status */ +- int (*get_rx_timestamp_status) (void *desc, u32 ats); ++ int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats); + /* Display ring */ + void (*display_ring)(void *head, unsigned int size, bool rx); + /* set MSS via context descriptor */ +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +@@ -258,7 +258,8 @@ static int dwmac4_rx_check_timestamp(voi + return ret; + } + +-static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats) ++static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc, ++ u32 ats) + { + struct dma_desc *p = (struct dma_desc *)desc; + int ret = -EINVAL; +@@ -270,7 +271,7 @@ static int dwmac4_wrback_get_rx_timestam + + /* Check if timestamp is OK from context descriptor */ + do { +- ret = dwmac4_rx_check_timestamp(desc); ++ ret = dwmac4_rx_check_timestamp(next_desc); + if (ret < 0) + goto exit; + i++; +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -400,7 +400,8 @@ static u64 enh_desc_get_timestamp(void * + return ns; + } + +-static int enh_desc_get_rx_timestamp_status(void *desc, u32 ats) ++static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc, ++ u32 ats) + { + if (ats) { + struct dma_extended_desc *p = (struct dma_extended_desc *)desc; +--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +@@ -265,7 +265,7 @@ static u64 ndesc_get_timestamp(void *des + return ns; + } + +-static int ndesc_get_rx_timestamp_status(void *desc, u32 ats) ++static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats) + { + struct dma_desc *p = (struct dma_desc *)desc; + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -489,7 +489,7 @@ static void stmmac_get_rx_hwtstamp(struc + desc = np; + + /* Check if timestamp is available */ +- if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) { ++ if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) { + ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts); + netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns); + shhwtstamp = skb_hwtstamps(skb); diff --git a/queue-4.14/net-stmmac-fix-tx-timestamp-calculation.patch b/queue-4.14/net-stmmac-fix-tx-timestamp-calculation.patch new file mode 100644 index 00000000000..b53fa7d28bb --- /dev/null +++ b/queue-4.14/net-stmmac-fix-tx-timestamp-calculation.patch @@ -0,0 +1,46 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Fredrik Hallenberg +Date: Mon, 18 Dec 2017 23:33:59 +0100 +Subject: net: stmmac: Fix TX timestamp calculation + +From: Fredrik Hallenberg + + +[ Upstream commit 200922c93f008e03ddc804c6dacdf26ca1ba86d7 ] + +When using GMAC4 the value written in PTP_SSIR should be shifted however +the shifted value is also used in subsequent calculations which results +in a bad timestamp value. + +Signed-off-by: Fredrik Hallenberg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +@@ -34,6 +34,7 @@ static u32 stmmac_config_sub_second_incr + { + u32 value = readl(ioaddr + PTP_TCR); + unsigned long data; ++ u32 reg_value; + + /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second + * formula = (1/ptp_clock) * 1000000000 +@@ -50,10 +51,11 @@ static u32 stmmac_config_sub_second_incr + + data &= PTP_SSIR_SSINC_MASK; + ++ reg_value = data; + if (gmac4) +- data = data << GMAC4_PTP_SSIR_SSINC_SHIFT; ++ reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT; + +- writel(data, ioaddr + PTP_SSIR); ++ writel(reg_value, ioaddr + PTP_SSIR); + + return data; + } diff --git a/queue-4.14/net-usb-qmi_wwan-add-support-for-yuga-clm920-nc5-pid-0x9625.patch b/queue-4.14/net-usb-qmi_wwan-add-support-for-yuga-clm920-nc5-pid-0x9625.patch new file mode 100644 index 00000000000..5f59e4aa616 --- /dev/null +++ b/queue-4.14/net-usb-qmi_wwan-add-support-for-yuga-clm920-nc5-pid-0x9625.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: "SZ Lin (林上智)" +Date: Fri, 29 Dec 2017 17:02:17 +0800 +Subject: NET: usb: qmi_wwan: add support for YUGA CLM920-NC5 PID 0x9625 + +From: "SZ Lin (林上智)" + + +[ Upstream commit bd30ffc414e55194ed6149fad69a145550cb7c18 ] + +This patch adds support for PID 0x9625 of YUGA CLM920-NC5. + +YUGA CLM920-NC5 needs to enable QMI_WWAN_QUIRK_DTR before QMI operation. + +qmicli -d /dev/cdc-wdm0 -p --dms-get-revision +[/dev/cdc-wdm0] Device revision retrieved: + Revision: 'CLM920_NC5-V1 1 [Oct 23 2016 19:00:00]' + +Signed-off-by: SZ Lin (林上智) +Acked-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1100,6 +1100,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */ + {QMI_FIXED_INTF(0x0846, 0x68a2, 8)}, + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */ + {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */ diff --git a/queue-4.14/net-usb-qmi_wwan-add-telit-me910-pid-0x1101-support.patch b/queue-4.14/net-usb-qmi_wwan-add-telit-me910-pid-0x1101-support.patch new file mode 100644 index 00000000000..8ccdd2a427e --- /dev/null +++ b/queue-4.14/net-usb-qmi_wwan-add-telit-me910-pid-0x1101-support.patch @@ -0,0 +1,31 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Daniele Palmas +Date: Thu, 14 Dec 2017 16:56:14 +0100 +Subject: net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support + +From: Daniele Palmas + + +[ Upstream commit c647c0d62c82eb3ddf78a0d8b3d58819d9f552aa ] + +This patch adds support for Telit ME910 PID 0x1101. + +Signed-off-by: Daniele Palmas +Acked-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1211,6 +1211,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ ++ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */ + {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */ diff --git a/queue-4.14/netfilter-nf_tables-fix-chain-filter-in-nf_tables_dump_rules.patch b/queue-4.14/netfilter-nf_tables-fix-chain-filter-in-nf_tables_dump_rules.patch new file mode 100644 index 00000000000..cd69a2e72a3 --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-fix-chain-filter-in-nf_tables_dump_rules.patch @@ -0,0 +1,33 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Pablo Neira Ayuso +Date: Tue, 19 Dec 2017 12:01:21 +0100 +Subject: netfilter: nf_tables: fix chain filter in nf_tables_dump_rules() + +From: Pablo Neira Ayuso + + +[ Upstream commit 24c0df82ef7919e4d10cf2e4e65d368eb2e8ea21 ] + +ctx->chain may be null now that we have very large object names, +so we cannot check for ctx->chain[0] here. + +Fixes: b7263e071aba7 ("netfilter: nf_tables: Allow table names of up to 255 chars") +Signed-off-by: Pablo Neira Ayuso +Acked-by: Phil Sutter +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2072,7 +2072,7 @@ static int nf_tables_dump_rules(struct s + continue; + + list_for_each_entry_rcu(chain, &table->chains, list) { +- if (ctx && ctx->chain[0] && ++ if (ctx && ctx->chain && + strcmp(ctx->chain, chain->name) != 0) + continue; + diff --git a/queue-4.14/netfilter-nf_tables-fix-potential-null-ptr-deref-in-nf_tables_dump_obj_done.patch b/queue-4.14/netfilter-nf_tables-fix-potential-null-ptr-deref-in-nf_tables_dump_obj_done.patch new file mode 100644 index 00000000000..987d6ddd859 --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-fix-potential-null-ptr-deref-in-nf_tables_dump_obj_done.patch @@ -0,0 +1,39 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Hangbin Liu +Date: Mon, 25 Dec 2017 11:34:54 +0800 +Subject: netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done() + +From: Hangbin Liu + + +[ Upstream commit 8bea728dce8972e534e6b99fd550f7b5cc3864e8 ] + +If there is no NFTA_OBJ_TABLE and NFTA_OBJ_TYPE, the c.data will be NULL in +nf_tables_getobj(). So before free filter->table in nf_tables_dump_obj_done(), +we need to check if filter is NULL first. + +Fixes: e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 chars") +Signed-off-by: Hangbin Liu +Acked-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4596,8 +4596,10 @@ static int nf_tables_dump_obj_done(struc + { + struct nft_obj_filter *filter = cb->data; + +- kfree(filter->table); +- kfree(filter); ++ if (filter) { ++ kfree(filter->table); ++ kfree(filter); ++ } + + return 0; + } diff --git a/queue-4.14/netfilter-uapi-correct-untracked-conntrack-state-bit-number.patch b/queue-4.14/netfilter-uapi-correct-untracked-conntrack-state-bit-number.patch new file mode 100644 index 00000000000..edb4a7169af --- /dev/null +++ b/queue-4.14/netfilter-uapi-correct-untracked-conntrack-state-bit-number.patch @@ -0,0 +1,40 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Florian Westphal +Date: Wed, 20 Dec 2017 12:08:33 +0100 +Subject: netfilter: uapi: correct UNTRACKED conntrack state bit number + +From: Florian Westphal + + +[ Upstream commit 4c82fd0abb87e20d0d68ef5237e74732352806c8 ] + +nft_ct exposes this bit to userspace. This used to be + + #define NF_CT_STATE_UNTRACKED_BIT (1 << (IP_CT_NUMBER + 1)) + (IP_CT_NUMBER is 5, so this was 0x40) + +.. but this got changed to 8 (0x100) when the untracked object got removed. +Replace this with a literal 6 to prevent further incompatible changes +in case IP_CT_NUMBER ever increases. + +Fixes: cc41c84b7e7f2 ("netfilter: kill the fake untracked conntrack objects") +Reported-by: Li Shuang +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/uapi/linux/netfilter/nf_conntrack_common.h ++++ b/include/uapi/linux/netfilter/nf_conntrack_common.h +@@ -36,7 +36,7 @@ enum ip_conntrack_info { + + #define NF_CT_STATE_INVALID_BIT (1 << 0) + #define NF_CT_STATE_BIT(ctinfo) (1 << ((ctinfo) % IP_CT_IS_REPLY + 1)) +-#define NF_CT_STATE_UNTRACKED_BIT (1 << (IP_CT_UNTRACKED + 1)) ++#define NF_CT_STATE_UNTRACKED_BIT (1 << 6) + + /* Bitset representing status of connection. */ + enum ip_conntrack_status { diff --git a/queue-4.14/nfp-always-unmask-aux-interrupts-at-init.patch b/queue-4.14/nfp-always-unmask-aux-interrupts-at-init.patch new file mode 100644 index 00000000000..d82cd92df5d --- /dev/null +++ b/queue-4.14/nfp-always-unmask-aux-interrupts-at-init.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Jakub Kicinski +Date: Tue, 9 Jan 2018 18:14:28 -0800 +Subject: nfp: always unmask aux interrupts at init + +From: Jakub Kicinski + + +[ Upstream commit fc2336505fb49a8b932a0a67a9745c408b79992c ] + +The link state and exception interrupts may be masked when we probe. +The firmware should in theory prevent sending (and automasking) those +interrupts if the device is disabled, but if my reading of the FW code +is correct there are firmwares out there with race conditions in this +area. The interrupt may also be masked if previous driver which used +the device was malfunctioning and we didn't load the FW (there is no +other good way to comprehensively reset the PF). + +Note that FW unmasks the data interrupts by itself when vNIC is +enabled, such helpful operation is not performed for LSC/EXN interrupts. + +Always unmask the auxiliary interrupts after request_irq(). On the +remove path add missing PCI write flush before free_irq(). + +Fixes: 4c3523623dc0 ("net: add driver for Netronome NFP4000/NFP6000 NIC VFs") +Signed-off-by: Jakub Kicinski +Reviewed-by: Dirk van der Merwe +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +@@ -568,6 +568,7 @@ nfp_net_aux_irq_request(struct nfp_net * + return err; + } + nn_writeb(nn, ctrl_offset, entry->entry); ++ nfp_net_irq_unmask(nn, entry->entry); + + return 0; + } +@@ -582,6 +583,7 @@ static void nfp_net_aux_irq_free(struct + unsigned int vector_idx) + { + nn_writeb(nn, ctrl_offset, 0xff); ++ nn_pci_flush(nn); + free_irq(nn->irq_entries[vector_idx].vector, nn); + } + diff --git a/queue-4.14/nl80211-check-for-the-required-netlink-attribute-presence.patch b/queue-4.14/nl80211-check-for-the-required-netlink-attribute-presence.patch new file mode 100644 index 00000000000..910d91d9dc2 --- /dev/null +++ b/queue-4.14/nl80211-check-for-the-required-netlink-attribute-presence.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Hao Chen +Date: Wed, 3 Jan 2018 11:00:31 +0800 +Subject: nl80211: Check for the required netlink attribute presence + +From: Hao Chen + + +[ Upstream commit 3ea15452ee85754f70f3b9fa1f23165ef2e77ba7 ] + +nl80211_nan_add_func() does not check if the required attribute +NL80211_NAN_FUNC_FOLLOW_UP_DEST is present when processing +NL80211_CMD_ADD_NAN_FUNCTION request. This request can be issued +by users with CAP_NET_ADMIN privilege and may result in NULL dereference +and a system crash. Add a check for the required attribute presence. + +Signed-off-by: Hao Chen +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/nl80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -11301,7 +11301,8 @@ static int nl80211_nan_add_func(struct s + break; + case NL80211_NAN_FUNC_FOLLOW_UP: + if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || +- !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) { ++ !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || ++ !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { + err = -EINVAL; + goto out; + } diff --git a/queue-4.14/nvme-check-hw-sectors-before-setting-chunk-sectors.patch b/queue-4.14/nvme-check-hw-sectors-before-setting-chunk-sectors.patch new file mode 100644 index 00000000000..131d1c01527 --- /dev/null +++ b/queue-4.14/nvme-check-hw-sectors-before-setting-chunk-sectors.patch @@ -0,0 +1,37 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Keith Busch +Date: Thu, 14 Dec 2017 11:20:14 -0700 +Subject: nvme: check hw sectors before setting chunk sectors + +From: Keith Busch + + +[ Upstream commit 249159c5f15812140fa216f9997d799ac0023a1f ] + +Some devices with IDs matching the "stripe" quirk don't actually have +this quirk, and don't have an MDTS value. When MDTS is not set, the +driver sets the max sectors to UINT_MAX, which is not a power of 2, +hitting a BUG_ON from blk_queue_chunk_sectors. This patch skips setting +chunk sectors for such devices. + +Signed-off-by: Keith Busch +Reviewed-by: Martin K. Petersen +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1515,7 +1515,8 @@ static void nvme_set_queue_limits(struct + blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors); + blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX)); + } +- if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) ++ if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) && ++ is_power_of_2(ctrl->max_hw_sectors)) + blk_queue_chunk_sectors(q, ctrl->max_hw_sectors); + blk_queue_virt_boundary(q, ctrl->page_size - 1); + if (ctrl->vwc & NVME_CTRL_VWC_PRESENT) diff --git a/queue-4.14/nvme-fabrics-initialize-default-host-id-in-nvmf_host_default.patch b/queue-4.14/nvme-fabrics-initialize-default-host-id-in-nvmf_host_default.patch new file mode 100644 index 00000000000..864cd7cfa85 --- /dev/null +++ b/queue-4.14/nvme-fabrics-initialize-default-host-id-in-nvmf_host_default.patch @@ -0,0 +1,30 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: "Ewan D. Milne" +Date: Fri, 5 Jan 2018 12:44:06 -0500 +Subject: nvme-fabrics: initialize default host->id in nvmf_host_default() + +From: "Ewan D. Milne" + + +[ Upstream commit 6b018235b4daabae96d855219fae59c3fb8be417 ] + +The field was uninitialized before use. + +Signed-off-by: Ewan D. Milne +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/fabrics.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -74,6 +74,7 @@ static struct nvmf_host *nvmf_host_defau + return NULL; + + kref_init(&host->ref); ++ uuid_gen(&host->id); + snprintf(host->nqn, NVMF_NQN_SIZE, + "nqn.2014-08.org.nvmexpress:uuid:%pUb", &host->id); + diff --git a/queue-4.14/nvme-fc-remove-double-put-reference-if-admin-connect-fails.patch b/queue-4.14/nvme-fc-remove-double-put-reference-if-admin-connect-fails.patch new file mode 100644 index 00000000000..97e02325181 --- /dev/null +++ b/queue-4.14/nvme-fc-remove-double-put-reference-if-admin-connect-fails.patch @@ -0,0 +1,34 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: James Smart +Date: Wed, 29 Nov 2017 15:11:37 -0800 +Subject: nvme-fc: remove double put reference if admin connect fails + +From: James Smart + + +[ Upstream commit 4596e752db02d47038cd7c965419789ab15d1985 ] + +There are two put references in the failure case of initial +create_association. The first put actually frees the controller, thus the +second put references freed memory. + +Remove the unnecessary 2nd put. + +Signed-off-by: James Smart +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/fc.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2876,7 +2876,6 @@ nvme_fc_init_ctrl(struct device *dev, st + + /* initiate nvme ctrl ref counting teardown */ + nvme_uninit_ctrl(&ctrl->ctrl); +- nvme_put_ctrl(&ctrl->ctrl); + + /* Remove core ctrl ref. */ + nvme_put_ctrl(&ctrl->ctrl); diff --git a/queue-4.14/of_mdio-avoid-mdio-bus-removal-when-a-phy-is-missing.patch b/queue-4.14/of_mdio-avoid-mdio-bus-removal-when-a-phy-is-missing.patch new file mode 100644 index 00000000000..6bb5769cff7 --- /dev/null +++ b/queue-4.14/of_mdio-avoid-mdio-bus-removal-when-a-phy-is-missing.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Madalin Bucur +Date: Tue, 9 Jan 2018 14:43:34 +0200 +Subject: of_mdio: avoid MDIO bus removal when a PHY is missing + +From: Madalin Bucur + + +[ Upstream commit 95f566de0269a0c59fd6a737a147731302136429 ] + +If one of the child devices is missing the of_mdiobus_register_phy() +call will return -ENODEV. When a missing device is encountered the +registration of the remaining PHYs is stopped and the MDIO bus will +fail to register. Propagate all errors except ENODEV to avoid it. + +Signed-off-by: Madalin Bucur +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/of_mdio.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/of/of_mdio.c ++++ b/drivers/of/of_mdio.c +@@ -228,7 +228,12 @@ int of_mdiobus_register(struct mii_bus * + rc = of_mdiobus_register_phy(mdio, child, addr); + else + rc = of_mdiobus_register_device(mdio, child, addr); +- if (rc) ++ ++ if (rc == -ENODEV) ++ dev_err(&mdio->dev, ++ "MDIO device at address %d is missing.\n", ++ addr); ++ else if (rc) + goto unregister; + } + +@@ -252,7 +257,7 @@ int of_mdiobus_register(struct mii_bus * + + if (of_mdiobus_child_is_phy(child)) { + rc = of_mdiobus_register_phy(mdio, child, addr); +- if (rc) ++ if (rc && rc != -ENODEV) + goto unregister; + } + } diff --git a/queue-4.14/parisc-reduce-thread-stack-to-16-kb.patch b/queue-4.14/parisc-reduce-thread-stack-to-16-kb.patch new file mode 100644 index 00000000000..52a3b455fdf --- /dev/null +++ b/queue-4.14/parisc-reduce-thread-stack-to-16-kb.patch @@ -0,0 +1,38 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: John David Anglin +Date: Mon, 13 Nov 2017 19:35:33 -0500 +Subject: parisc: Reduce thread stack to 16 kb + +From: John David Anglin + + +[ Upstream commit da57c5414f49ef9e4bcb9ae0bbafd1d650b31411 ] + +In testing, I found that the thread stack can be 16 kB when using an irq +stack. Without it, the thread stack needs to be 32 kB. Currently, the irq +stack is 32 kB. While it probably could be 16 kB, I would prefer to leave it +as is for safety. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/include/asm/thread_info.h | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/parisc/include/asm/thread_info.h ++++ b/arch/parisc/include/asm/thread_info.h +@@ -35,7 +35,12 @@ struct thread_info { + + /* thread information allocation */ + ++#ifdef CONFIG_IRQSTACKS ++#define THREAD_SIZE_ORDER 2 /* PA-RISC requires at least 16k stack */ ++#else + #define THREAD_SIZE_ORDER 3 /* PA-RISC requires at least 32k stack */ ++#endif ++ + /* Be sure to hunt all references to this down when you change the size of + * the kernel stack */ + #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER) diff --git a/queue-4.14/perf-x86-intel-plug-memory-leak-in-intel_pmu_init.patch b/queue-4.14/perf-x86-intel-plug-memory-leak-in-intel_pmu_init.patch new file mode 100644 index 00000000000..37fb82b41fe --- /dev/null +++ b/queue-4.14/perf-x86-intel-plug-memory-leak-in-intel_pmu_init.patch @@ -0,0 +1,61 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Thomas Gleixner +Date: Wed, 27 Dec 2017 19:45:31 +0100 +Subject: perf/x86/intel: Plug memory leak in intel_pmu_init() + +From: Thomas Gleixner + + +[ Upstream commit 7ad1437d6ace0e450a6c1167720608ad660b191d ] + +A recent commit introduced an extra merge_attr() call in the skylake +branch, which causes a memory leak. + +Store the pointer to the extra allocated memory and free it at the end of +the function. + +Fixes: a5df70c354c2 ("perf/x86: Only show format attributes when supported") +Reported-by: Tommi Rantala +Signed-off-by: Thomas Gleixner +Cc: Andi Kleen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3847,6 +3847,8 @@ static struct attribute *intel_pmu_attrs + + __init int intel_pmu_init(void) + { ++ struct attribute **extra_attr = NULL; ++ struct attribute **to_free = NULL; + union cpuid10_edx edx; + union cpuid10_eax eax; + union cpuid10_ebx ebx; +@@ -3854,7 +3856,6 @@ __init int intel_pmu_init(void) + unsigned int unused; + struct extra_reg *er; + int version, i; +- struct attribute **extra_attr = NULL; + char *name; + + if (!cpu_has(&boot_cpu_data, X86_FEATURE_ARCH_PERFMON)) { +@@ -4294,6 +4295,7 @@ __init int intel_pmu_init(void) + extra_attr = boot_cpu_has(X86_FEATURE_RTM) ? + hsw_format_attr : nhm_format_attr; + extra_attr = merge_attr(extra_attr, skl_format_attr); ++ to_free = extra_attr; + x86_pmu.cpu_events = get_hsw_events_attrs(); + intel_pmu_pebs_data_source_skl( + boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X); +@@ -4401,6 +4403,7 @@ __init int intel_pmu_init(void) + pr_cont("full-width counters, "); + } + ++ kfree(to_free); + return 0; + } + diff --git a/queue-4.14/phy-cpcap-usb-fix-platform_get_irq_byname-s-error-checking.patch b/queue-4.14/phy-cpcap-usb-fix-platform_get_irq_byname-s-error-checking.patch new file mode 100644 index 00000000000..5286a6fbb0a --- /dev/null +++ b/queue-4.14/phy-cpcap-usb-fix-platform_get_irq_byname-s-error-checking.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Arvind Yadav +Date: Fri, 17 Nov 2017 16:55:35 +0530 +Subject: phy: cpcap-usb: Fix platform_get_irq_byname's error checking. + +From: Arvind Yadav + + +[ Upstream commit e796cc6a3a9186c92092e2f5929cf8f65b56cf01 ] + +The platform_get_irq_byname() function returns negative if an error occurs. +zero or positive number on success. platform_get_irq_byname() error +checking for zero is not correct. + +Fixes: 6d6ce40f63af ("phy: cpcap-usb: Add CPCAP PMIC USB support") +Signed-off-by: Arvind Yadav +Reviewed-by: Sebastian Reichel +Acked-by: Tony Lindgren +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/motorola/phy-cpcap-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/motorola/phy-cpcap-usb.c ++++ b/drivers/phy/motorola/phy-cpcap-usb.c +@@ -310,7 +310,7 @@ static int cpcap_usb_init_irq(struct pla + int irq, error; + + irq = platform_get_irq_byname(pdev, name); +- if (!irq) ++ if (irq < 0) + return -ENODEV; + + error = devm_request_threaded_irq(ddata->dev, irq, NULL, diff --git a/queue-4.14/powerpc-pseries-make-ras-irq-explicitly-dependent-on-dlpar-wq.patch b/queue-4.14/powerpc-pseries-make-ras-irq-explicitly-dependent-on-dlpar-wq.patch new file mode 100644 index 00000000000..cd9da8ce9af --- /dev/null +++ b/queue-4.14/powerpc-pseries-make-ras-irq-explicitly-dependent-on-dlpar-wq.patch @@ -0,0 +1,108 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Michael Ellerman +Date: Mon, 8 Jan 2018 14:54:32 +1100 +Subject: powerpc/pseries: Make RAS IRQ explicitly dependent on DLPAR WQ + +From: Michael Ellerman + + +[ Upstream commit e2d5915293ffdff977ddcfc12b817b08c53ffa7a ] + +The hotplug code uses its own workqueue to handle IRQ requests +(pseries_hp_wq), however that workqueue is initialized after +init_ras_IRQ(). That can lead to a kernel panic if any hotplug +interrupts fire after init_ras_IRQ() but before pseries_hp_wq is +initialised. eg: + + UDP-Lite hash table entries: 2048 (order: 0, 65536 bytes) + NET: Registered protocol family 1 + Unpacking initramfs... + (qemu) object_add memory-backend-ram,id=mem1,size=10G + (qemu) device_add pc-dimm,id=dimm1,memdev=mem1 + Unable to handle kernel paging request for data at address 0xf94d03007c421378 + Faulting instruction address: 0xc00000000012d744 + Oops: Kernel access of bad area, sig: 11 [#1] + LE SMP NR_CPUS=2048 NUMA pSeries + Modules linked in: + CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2-ziviani+ #26 + task: (ptrval) task.stack: (ptrval) + NIP: c00000000012d744 LR: c00000000012d744 CTR: 0000000000000000 + REGS: (ptrval) TRAP: 0380 Not tainted (4.15.0-rc2-ziviani+) + MSR: 8000000000009033 CR: 28088042 XER: 20040000 + CFAR: c00000000012d3c4 SOFTE: 0 + ... + NIP [c00000000012d744] __queue_work+0xd4/0x5c0 + LR [c00000000012d744] __queue_work+0xd4/0x5c0 + Call Trace: + [c0000000fffefb90] [c00000000012d744] __queue_work+0xd4/0x5c0 (unreliable) + [c0000000fffefc70] [c00000000012dce4] queue_work_on+0xb4/0xf0 + +This commit makes the RAS IRQ registration explicitly dependent on the +creation of the pseries_hp_wq. + +Reported-by: Min Deng +Reported-by: Daniel Henrique Barboza +Tested-by: Jose Ricardo Ziviani +Signed-off-by: Michael Ellerman +Reviewed-by: David Gibson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/pseries/dlpar.c | 21 ++++++++++++++++++--- + arch/powerpc/platforms/pseries/pseries.h | 2 ++ + arch/powerpc/platforms/pseries/ras.c | 3 ++- + 3 files changed, 22 insertions(+), 4 deletions(-) + +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -586,11 +586,26 @@ static ssize_t dlpar_show(struct class * + + static CLASS_ATTR_RW(dlpar); + +-static int __init pseries_dlpar_init(void) ++int __init dlpar_workqueue_init(void) + { ++ if (pseries_hp_wq) ++ return 0; ++ + pseries_hp_wq = alloc_workqueue("pseries hotplug workqueue", +- WQ_UNBOUND, 1); ++ WQ_UNBOUND, 1); ++ ++ return pseries_hp_wq ? 0 : -ENOMEM; ++} ++ ++static int __init dlpar_sysfs_init(void) ++{ ++ int rc; ++ ++ rc = dlpar_workqueue_init(); ++ if (rc) ++ return rc; ++ + return sysfs_create_file(kernel_kobj, &class_attr_dlpar.attr); + } +-machine_device_initcall(pseries, pseries_dlpar_init); ++machine_device_initcall(pseries, dlpar_sysfs_init); + +--- a/arch/powerpc/platforms/pseries/pseries.h ++++ b/arch/powerpc/platforms/pseries/pseries.h +@@ -98,4 +98,6 @@ static inline unsigned long cmo_get_page + return CMO_PageSize; + } + ++int dlpar_workqueue_init(void); ++ + #endif /* _PSERIES_PSERIES_H */ +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -69,7 +69,8 @@ static int __init init_ras_IRQ(void) + /* Hotplug Events */ + np = of_find_node_by_path("/event-sources/hot-plug-events"); + if (np != NULL) { +- request_event_sources_irqs(np, ras_hotplug_interrupt, ++ if (dlpar_workqueue_init() == 0) ++ request_event_sources_irqs(np, ras_hotplug_interrupt, + "RAS_HOTPLUG"); + of_node_put(np); + } diff --git a/queue-4.14/rdma-netlink-fix-locking-around-__ib_get_device_by_index.patch b/queue-4.14/rdma-netlink-fix-locking-around-__ib_get_device_by_index.patch new file mode 100644 index 00000000000..955f13d9dfa --- /dev/null +++ b/queue-4.14/rdma-netlink-fix-locking-around-__ib_get_device_by_index.patch @@ -0,0 +1,192 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Leon Romanovsky +Date: Mon, 1 Jan 2018 13:07:15 +0200 +Subject: RDMA/netlink: Fix locking around __ib_get_device_by_index + +From: Leon Romanovsky + + +[ Upstream commit f8978bd95cf92f869f3d9b34c1b699f49253b8c6 ] + +Holding locks is mandatory when calling __ib_device_get_by_index, +otherwise there are races during the list iteration with device removal. + +Since the locks are static to device.c, __ib_device_get_by_index can +never be called correctly by any user out side the file. + +Make the function static and provide a safe function that gets the +correct locks and returns a kref'd pointer. Fix all callers. + +Fixes: e5c9469efcb1 ("RDMA/netlink: Add nldev device doit implementation") +Fixes: c3f66f7b0052 ("RDMA/netlink: Implement nldev port doit callback") +Fixes: 7d02f605f0dc ("RDMA/netlink: Add nldev port dumpit implementation") +Reviewed-by: Mark Bloch +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/core_priv.h | 2 - + drivers/infiniband/core/device.c | 18 +++++++++++- + drivers/infiniband/core/nldev.c | 54 ++++++++++++++++++++++++------------ + 3 files changed, 54 insertions(+), 20 deletions(-) + +--- a/drivers/infiniband/core/core_priv.h ++++ b/drivers/infiniband/core/core_priv.h +@@ -314,7 +314,7 @@ static inline int ib_mad_enforce_securit + } + #endif + +-struct ib_device *__ib_device_get_by_index(u32 ifindex); ++struct ib_device *ib_device_get_by_index(u32 ifindex); + /* RDMA device netlink */ + void nldev_init(void); + void nldev_exit(void); +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -134,7 +134,7 @@ static int ib_device_check_mandatory(str + return 0; + } + +-struct ib_device *__ib_device_get_by_index(u32 index) ++static struct ib_device *__ib_device_get_by_index(u32 index) + { + struct ib_device *device; + +@@ -145,6 +145,22 @@ struct ib_device *__ib_device_get_by_ind + return NULL; + } + ++/* ++ * Caller is responsible to return refrerence count by calling put_device() ++ */ ++struct ib_device *ib_device_get_by_index(u32 index) ++{ ++ struct ib_device *device; ++ ++ down_read(&lists_rwsem); ++ device = __ib_device_get_by_index(index); ++ if (device) ++ get_device(&device->dev); ++ ++ up_read(&lists_rwsem); ++ return device; ++} ++ + static struct ib_device *__ib_device_get_by_name(const char *name) + { + struct ib_device *device; +--- a/drivers/infiniband/core/nldev.c ++++ b/drivers/infiniband/core/nldev.c +@@ -142,27 +142,34 @@ static int nldev_get_doit(struct sk_buff + + index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]); + +- device = __ib_device_get_by_index(index); ++ device = ib_device_get_by_index(index); + if (!device) + return -EINVAL; + + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); +- if (!msg) +- return -ENOMEM; ++ if (!msg) { ++ err = -ENOMEM; ++ goto err; ++ } + + nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, + RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET), + 0, 0); + + err = fill_dev_info(msg, device); +- if (err) { +- nlmsg_free(msg); +- return err; +- } ++ if (err) ++ goto err_free; + + nlmsg_end(msg, nlh); + ++ put_device(&device->dev); + return rdma_nl_unicast(msg, NETLINK_CB(skb).portid); ++ ++err_free: ++ nlmsg_free(msg); ++err: ++ put_device(&device->dev); ++ return err; + } + + static int _nldev_get_dumpit(struct ib_device *device, +@@ -220,31 +227,40 @@ static int nldev_port_get_doit(struct sk + return -EINVAL; + + index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]); +- device = __ib_device_get_by_index(index); ++ device = ib_device_get_by_index(index); + if (!device) + return -EINVAL; + + port = nla_get_u32(tb[RDMA_NLDEV_ATTR_PORT_INDEX]); +- if (!rdma_is_port_valid(device, port)) +- return -EINVAL; ++ if (!rdma_is_port_valid(device, port)) { ++ err = -EINVAL; ++ goto err; ++ } + + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); +- if (!msg) +- return -ENOMEM; ++ if (!msg) { ++ err = -ENOMEM; ++ goto err; ++ } + + nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, + RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET), + 0, 0); + + err = fill_port_info(msg, device, port); +- if (err) { +- nlmsg_free(msg); +- return err; +- } ++ if (err) ++ goto err_free; + + nlmsg_end(msg, nlh); ++ put_device(&device->dev); + + return rdma_nl_unicast(msg, NETLINK_CB(skb).portid); ++ ++err_free: ++ nlmsg_free(msg); ++err: ++ put_device(&device->dev); ++ return err; + } + + static int nldev_port_get_dumpit(struct sk_buff *skb, +@@ -265,7 +281,7 @@ static int nldev_port_get_dumpit(struct + return -EINVAL; + + ifindex = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]); +- device = __ib_device_get_by_index(ifindex); ++ device = ib_device_get_by_index(ifindex); + if (!device) + return -EINVAL; + +@@ -299,7 +315,9 @@ static int nldev_port_get_dumpit(struct + nlmsg_end(skb, nlh); + } + +-out: cb->args[0] = idx; ++out: ++ put_device(&device->dev); ++ cb->args[0] = idx; + return skb->len; + } + diff --git a/queue-4.14/rdma-vmw_pvrdma-call-ib_umem_release-on-destroy-qp-path.patch b/queue-4.14/rdma-vmw_pvrdma-call-ib_umem_release-on-destroy-qp-path.patch new file mode 100644 index 00000000000..f4b6b376906 --- /dev/null +++ b/queue-4.14/rdma-vmw_pvrdma-call-ib_umem_release-on-destroy-qp-path.patch @@ -0,0 +1,41 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Bryan Tan +Date: Wed, 20 Dec 2017 09:49:03 -0800 +Subject: RDMA/vmw_pvrdma: Call ib_umem_release on destroy QP path + +From: Bryan Tan + + +[ Upstream commit 17748056ce123ee37fb7382bc698fc721e3c4a09 ] + +The QP cleanup did not previously call ib_umem_release, +resulting in a user-triggerable kernel resource leak. + +Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") +Reviewed-by: Adit Ranadive +Reviewed-by: Aditya Sarwade +Reviewed-by: Jorgen Hansen +Signed-off-by: Bryan Tan +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c +@@ -406,6 +406,13 @@ static void pvrdma_free_qp(struct pvrdma + atomic_dec(&qp->refcnt); + wait_event(qp->wait, !atomic_read(&qp->refcnt)); + ++ if (!qp->is_kernel) { ++ if (qp->rumem) ++ ib_umem_release(qp->rumem); ++ if (qp->sumem) ++ ib_umem_release(qp->sumem); ++ } ++ + pvrdma_page_dir_cleanup(dev, &qp->pdir); + + kfree(qp); diff --git a/queue-4.14/s390-dasd-fix-wrongly-assigned-configuration-data.patch b/queue-4.14/s390-dasd-fix-wrongly-assigned-configuration-data.patch new file mode 100644 index 00000000000..a8ceb239700 --- /dev/null +++ b/queue-4.14/s390-dasd-fix-wrongly-assigned-configuration-data.patch @@ -0,0 +1,49 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Stefan Haberland +Date: Wed, 6 Dec 2017 10:30:39 +0100 +Subject: s390/dasd: fix wrongly assigned configuration data + +From: Stefan Haberland + + +[ Upstream commit 8a9bd4f8ebc6800bfc0596e28631ff6809a2f615 ] + +We store per path and per device configuration data to identify the +path or device correctly. The per path configuration data might get +mixed up if the original request gets into error recovery and is +started with a random path mask. + +This would lead to a wrong identification of a path in case of a CUIR +event for example. + +Fix by copying the path mask from the original request to the error +recovery request in case it is a path verification request. + +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd_3990_erp.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/s390/block/dasd_3990_erp.c ++++ b/drivers/s390/block/dasd_3990_erp.c +@@ -2803,6 +2803,16 @@ dasd_3990_erp_action(struct dasd_ccw_req + erp = dasd_3990_erp_handle_match_erp(cqr, erp); + } + ++ ++ /* ++ * For path verification work we need to stick with the path that was ++ * originally chosen so that the per path configuration data is ++ * assigned correctly. ++ */ ++ if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) { ++ erp->lpm = cqr->lpm; ++ } ++ + if (device->features & DASD_FEATURE_ERPLOG) { + /* print current erp_chain */ + dev_err(&device->cdev->dev, diff --git a/queue-4.14/scsi-aacraid-fix-i-o-drop-during-reset.patch b/queue-4.14/scsi-aacraid-fix-i-o-drop-during-reset.patch new file mode 100644 index 00000000000..998d3cbe1a5 --- /dev/null +++ b/queue-4.14/scsi-aacraid-fix-i-o-drop-during-reset.patch @@ -0,0 +1,50 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Prasad B Munirathnam +Date: Tue, 12 Dec 2017 11:40:10 -0800 +Subject: scsi: aacraid: Fix I/O drop during reset + +From: Prasad B Munirathnam + + +[ Upstream commit 5771cfffdffe709ae9b403b6f80438ca40bf850e ] + +"FIB_CONTEXT_FLAG_TIMEDOUT" flag is set in aac_eh_abort to indicate +command timeout. Using the same flag in reset handler causes the command +to time out and the I/Os were dropped. + +Define a new flag "FIB_CONTEXT_FLAG_EH_RESET" to make sure I/O is +properly handled in eh_reset handler. + +[mkp: tweaked commit message] + +Signed-off-by: Prasad B Munirathnam +Reviewed-by: Raghava Aditya Renukunta +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/aacraid/aacraid.h | 1 + + drivers/scsi/aacraid/linit.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/aacraid/aacraid.h ++++ b/drivers/scsi/aacraid/aacraid.h +@@ -1724,6 +1724,7 @@ struct aac_dev + #define FIB_CONTEXT_FLAG_NATIVE_HBA (0x00000010) + #define FIB_CONTEXT_FLAG_NATIVE_HBA_TMF (0x00000020) + #define FIB_CONTEXT_FLAG_SCSI_CMD (0x00000040) ++#define FIB_CONTEXT_FLAG_EH_RESET (0x00000080) + + /* + * Define the command values +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -1037,7 +1037,7 @@ static int aac_eh_bus_reset(struct scsi_ + info = &aac->hba_map[bus][cid]; + if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS || + info->devtype != AAC_DEVTYPE_NATIVE_RAW) { +- fib->flags |= FIB_CONTEXT_FLAG_TIMED_OUT; ++ fib->flags |= FIB_CONTEXT_FLAG_EH_RESET; + cmd->SCp.phase = AAC_OWNER_ERROR_HANDLER; + } + } diff --git a/queue-4.14/scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch b/queue-4.14/scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch new file mode 100644 index 00000000000..9dbf8056863 --- /dev/null +++ b/queue-4.14/scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Cathy Avery +Date: Tue, 19 Dec 2017 13:32:48 -0500 +Subject: scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error + +From: Cathy Avery + + +[ Upstream commit d1b8b2391c24751e44f618fcf86fb55d9a9247fd ] + +When an I/O is returned with an srb_status of SRB_STATUS_INVALID_LUN +which has zero good_bytes it must be assigned an error. Otherwise the +I/O will be continuously requeued and will cause a deadlock in the case +where disks are being hot added and removed. sd_probe_async will wait +forever for its I/O to complete while holding scsi_sd_probe_domain. + +Also returning the default error of DID_TARGET_FAILURE causes multipath +to not retry the I/O resulting in applications receiving I/O errors +before a failover can occur. + +Signed-off-by: Cathy Avery +Signed-off-by: Long Li +Reviewed-by: Stephen Hemminger +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/storvsc_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -952,10 +952,11 @@ static void storvsc_handle_error(struct + case TEST_UNIT_READY: + break; + default: +- set_host_byte(scmnd, DID_TARGET_FAILURE); ++ set_host_byte(scmnd, DID_ERROR); + } + break; + case SRB_STATUS_INVALID_LUN: ++ set_host_byte(scmnd, DID_NO_CONNECT); + do_work = true; + process_err_fn = storvsc_remove_lun; + break; diff --git a/queue-4.14/sctp-add-a-ceiling-to-optlen-in-some-sockopts.patch b/queue-4.14/sctp-add-a-ceiling-to-optlen-in-some-sockopts.patch new file mode 100644 index 00000000000..b1119ddd0af --- /dev/null +++ b/queue-4.14/sctp-add-a-ceiling-to-optlen-in-some-sockopts.patch @@ -0,0 +1,60 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Marcelo Ricardo Leitner +Date: Mon, 8 Jan 2018 19:02:28 -0200 +Subject: sctp: add a ceiling to optlen in some sockopts + +From: Marcelo Ricardo Leitner + + +[ Upstream commit 5960cefab9df76600a1a7d4ff592c59e14616e88 ] + +Hangbin Liu reported that some sockopt calls could cause the kernel to log +a warning on memory allocation failure if the user supplied a large optlen +value. That is because some of them called memdup_user() without a ceiling +on optlen, allowing it to try to allocate really large buffers. + +This patch adds a ceiling by limiting optlen to the maximum allowed that +would still make sense for these sockopt. + +Reported-by: Hangbin Liu +Signed-off-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -3494,6 +3494,8 @@ static int sctp_setsockopt_hmac_ident(st + + if (optlen < sizeof(struct sctp_hmacalgo)) + return -EINVAL; ++ optlen = min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) + ++ SCTP_AUTH_NUM_HMACS * sizeof(u16)); + + hmacs = memdup_user(optval, optlen); + if (IS_ERR(hmacs)) +@@ -3532,6 +3534,11 @@ static int sctp_setsockopt_auth_key(stru + + if (optlen <= sizeof(struct sctp_authkey)) + return -EINVAL; ++ /* authkey->sca_keylength is u16, so optlen can't be bigger than ++ * this. ++ */ ++ optlen = min_t(unsigned int, optlen, USHRT_MAX + ++ sizeof(struct sctp_authkey)); + + authkey = memdup_user(optval, optlen); + if (IS_ERR(authkey)) +@@ -3889,6 +3896,9 @@ static int sctp_setsockopt_reset_streams + + if (optlen < sizeof(*params)) + return -EINVAL; ++ /* srs_number_streams is u16, so optlen can't be bigger than this. */ ++ optlen = min_t(unsigned int, optlen, USHRT_MAX + ++ sizeof(__u16) * sizeof(*params)); + + params = memdup_user(optval, optlen); + if (IS_ERR(params)) diff --git a/queue-4.14/sctp-fix-the-issue-that-a-__u16-variable-may-overflow-in-sctp_ulpq_renege.patch b/queue-4.14/sctp-fix-the-issue-that-a-__u16-variable-may-overflow-in-sctp_ulpq_renege.patch new file mode 100644 index 00000000000..f16079f8af2 --- /dev/null +++ b/queue-4.14/sctp-fix-the-issue-that-a-__u16-variable-may-overflow-in-sctp_ulpq_renege.patch @@ -0,0 +1,68 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Xin Long +Date: Mon, 18 Dec 2017 14:07:25 +0800 +Subject: sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege + +From: Xin Long + + +[ Upstream commit 5c468674d17056148da06218d4da5d04baf22eac ] + +Now when reneging events in sctp_ulpq_renege(), the variable freed +could be increased by a __u16 value twice while freed is of __u16 +type. It means freed may overflow at the second addition. + +This patch is to fix it by using __u32 type for 'freed', while at +it, also to remove 'if (chunk)' check, as all renege commands are +generated in sctp_eat_data and it can't be NULL. + +Reported-by: Marcelo Ricardo Leitner +Signed-off-by: Xin Long +Acked-by: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/ulpqueue.c | 24 ++++++++---------------- + 1 file changed, 8 insertions(+), 16 deletions(-) + +--- a/net/sctp/ulpqueue.c ++++ b/net/sctp/ulpqueue.c +@@ -1084,29 +1084,21 @@ void sctp_ulpq_partial_delivery(struct s + void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk, + gfp_t gfp) + { +- struct sctp_association *asoc; +- __u16 needed, freed; ++ struct sctp_association *asoc = ulpq->asoc; ++ __u32 freed = 0; ++ __u16 needed; + +- asoc = ulpq->asoc; +- +- if (chunk) { +- needed = ntohs(chunk->chunk_hdr->length); +- needed -= sizeof(struct sctp_data_chunk); +- } else +- needed = SCTP_DEFAULT_MAXWINDOW; +- +- freed = 0; ++ needed = ntohs(chunk->chunk_hdr->length) - ++ sizeof(struct sctp_data_chunk); + + if (skb_queue_empty(&asoc->base.sk->sk_receive_queue)) { + freed = sctp_ulpq_renege_order(ulpq, needed); +- if (freed < needed) { ++ if (freed < needed) + freed += sctp_ulpq_renege_frags(ulpq, needed - freed); +- } + } + /* If able to free enough room, accept this chunk. */ +- if (chunk && (freed >= needed)) { +- int retval; +- retval = sctp_ulpq_tail_data(ulpq, chunk, gfp); ++ if (freed >= needed) { ++ int retval = sctp_ulpq_tail_data(ulpq, chunk, gfp); + /* + * Enter partial delivery if chunk has not been + * delivered; otherwise, drain the reassembly queue. diff --git a/queue-4.14/sctp-make-use-of-pre-calculated-len.patch b/queue-4.14/sctp-make-use-of-pre-calculated-len.patch new file mode 100644 index 00000000000..7a8b62a9125 --- /dev/null +++ b/queue-4.14/sctp-make-use-of-pre-calculated-len.patch @@ -0,0 +1,94 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Marcelo Ricardo Leitner +Date: Mon, 8 Jan 2018 19:02:29 -0200 +Subject: sctp: make use of pre-calculated len + +From: Marcelo Ricardo Leitner + + +[ Upstream commit c76f97c99ae6d26d14c7f0e50e074382bfbc9f98 ] + +Some sockopt handling functions were calculating the length of the +buffer to be written to userspace and then calculating it again when +actually writing the buffer, which could lead to some write not using +an up-to-date length. + +This patch updates such places to just make use of the len variable. + +Also, replace some sizeof(type) to sizeof(var). + +Signed-off-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4957,7 +4957,7 @@ static int sctp_getsockopt_autoclose(str + len = sizeof(int); + if (put_user(len, optlen)) + return -EFAULT; +- if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int))) ++ if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len)) + return -EFAULT; + return 0; + } +@@ -5588,6 +5588,9 @@ copy_getaddrs: + err = -EFAULT; + goto out; + } ++ /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too, ++ * but we can't change it anymore. ++ */ + if (put_user(bytes_copied, optlen)) + err = -EFAULT; + out: +@@ -6024,7 +6027,7 @@ static int sctp_getsockopt_maxseg(struct + params.assoc_id = 0; + } else if (len >= sizeof(struct sctp_assoc_value)) { + len = sizeof(struct sctp_assoc_value); +- if (copy_from_user(¶ms, optval, sizeof(params))) ++ if (copy_from_user(¶ms, optval, len)) + return -EFAULT; + } else + return -EINVAL; +@@ -6194,7 +6197,9 @@ static int sctp_getsockopt_active_key(st + + if (len < sizeof(struct sctp_authkeyid)) + return -EINVAL; +- if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) ++ ++ len = sizeof(struct sctp_authkeyid); ++ if (copy_from_user(&val, optval, len)) + return -EFAULT; + + asoc = sctp_id2assoc(sk, val.scact_assoc_id); +@@ -6206,7 +6211,6 @@ static int sctp_getsockopt_active_key(st + else + val.scact_keynumber = ep->active_key_id; + +- len = sizeof(struct sctp_authkeyid); + if (put_user(len, optlen)) + return -EFAULT; + if (copy_to_user(optval, &val, len)) +@@ -6232,7 +6236,7 @@ static int sctp_getsockopt_peer_auth_chu + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; +@@ -6277,7 +6281,7 @@ static int sctp_getsockopt_local_auth_ch + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; diff --git a/queue-4.14/series b/queue-4.14/series index abaef70c6f0..086f461e256 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -1 +1,108 @@ hrtimer-ensure-posix-compliance-relative-clock_realtime-hrtimers.patch +net-phy-fix-resume-handling.patch +exec-avoid-gcc-8-warning-for-get_task_comm.patch +mm-frame_vector.c-release-a-semaphore-in-get_vaddr_frames.patch +scsi-aacraid-fix-i-o-drop-during-reset.patch +dmaengine-fsl-edma-disable-clks-on-all-error-paths.patch +phy-cpcap-usb-fix-platform_get_irq_byname-s-error-checking.patch +nvme-fc-remove-double-put-reference-if-admin-connect-fails.patch +nvme-check-hw-sectors-before-setting-chunk-sectors.patch +net-aquantia-fix-actual-speed-capabilities-reporting.patch +net-aquantia-fix-hardware-dma-stream-overload-on-large-mrrs.patch +net-usb-qmi_wwan-add-telit-me910-pid-0x1101-support.patch +mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch +mtd-nand-brcmnand-zero-bitflip-is-not-an-error.patch +ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch +parisc-reduce-thread-stack-to-16-kb.patch +arm-8731-1-fix-csum_partial_copy_from_user-stack-mismatch.patch +x86-asm-allow-again-using-asm.h-when-building-for-the-bpf-clang-target.patch +sctp-fix-the-issue-that-a-__u16-variable-may-overflow-in-sctp_ulpq_renege.patch +sget-handle-failures-of-register_shrinker.patch +net-phy-xgene-disable-clk-on-error-paths.patch +drm-nouveau-pci-do-a-msi-rearm-on-init.patch +xfrm-reinject-transport-mode-packets-through-tasklet.patch +x86-stacktrace-make-zombie-stack-traces-reliable.patch +mac80211_hwsim-fix-a-possible-sleep-in-atomic-bug-in-hwsim_get_radio_nl.patch +spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch +asoc-nau8825-fix-issue-that-pop-noise-when-start-capture.patch +cgroup-fix-deadlock-in-cpu-hotplug-path.patch +staging-ion-fix-ion_cma_heap-allocations.patch +x86-64-xen-eliminate-w-x-mappings.patch +net-mediatek-setup-proper-state-for-disabled-gmac-on-the-default.patch +net-arc_emac-fix-arc_emac_rx-error-paths.patch +vxlan-update-skb-dst-pmtu-on-tx-path.patch +ip_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch +ip6_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch +ip6_tunnel-get-the-min-mtu-properly-in-ip6_tnl_xmit.patch +net-stmmac-fix-tx-timestamp-calculation.patch +net-stmmac-fix-bad-rx-timestamp-extraction.patch +net-mlx5e-fix-ets-bw-check.patch +net-mlx5-cleanup-irqs-in-case-of-unload-failure.patch +net-mlx5-stay-in-polling-mode-when-command-eq-destroy-fails.patch +asoc-rsnd-fixup-adg-register-mask.patch +xen-balloon-mark-unallocated-host-memory-as-unusable.patch +netfilter-nf_tables-fix-chain-filter-in-nf_tables_dump_rules.patch +scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch +netfilter-uapi-correct-untracked-conntrack-state-bit-number.patch +i915-reject-ccs-modifiers-for-pipe-c-on-geminilake.patch +rdma-vmw_pvrdma-call-ib_umem_release-on-destroy-qp-path.patch +arm-dts-ls1021a-fix-incorrect-clock-references.patch +crypto-af_alg-fix-race-around-ctx-rcvused-by-making-it-atomic_t.patch +lib-mpi-fix-umul_ppmm-for-mips64r6.patch +arm64-dts-renesas-ulcb-remove-renesas-no-ether-link-property.patch +crypto-inside-secure-per-request-invalidation.patch +crypto-inside-secure-free-requests-even-if-their-handling-failed.patch +crypto-inside-secure-fix-request-allocations-in-invalidation-path.patch +netfilter-nf_tables-fix-potential-null-ptr-deref-in-nf_tables_dump_obj_done.patch +tipc-error-path-leak-fixes-in-tipc_enable_bearer.patch +tipc-fix-tipc_mon_delete-oops-in-tipc_enable_bearer-error-path.patch +tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch +tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch +bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch +perf-x86-intel-plug-memory-leak-in-intel_pmu_init.patch +led-core-fix-brightness-setting-when-setting-delay_off-0.patch +ib-mlx5-fix-mlx5_ib_alloc_mr-error-flow.patch +genirq-guard-handle_bad_irq-log-messages.patch +afs-fix-missing-error-handling-in-afs_write_end.patch +s390-dasd-fix-wrongly-assigned-configuration-data.patch +btrfs-fix-flush-bio-leak.patch +ip6_tunnel-allow-ip6gre-dev-mtu-to-be-set-below-1280.patch +input-xen-kbdfront-do-not-advertise-multi-touch-pressure-support.patch +ib-mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch +ib-ipoib-fix-race-condition-in-neigh-creation.patch +xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch +xfs-quota-check-result-of-register_shrinker.patch +macvlan-fix-one-possible-double-free.patch +e1000-fix-disabling-already-disabled-warning.patch +net-usb-qmi_wwan-add-support-for-yuga-clm920-nc5-pid-0x9625.patch +drm-ttm-check-the-return-value-of-kzalloc.patch +rdma-netlink-fix-locking-around-__ib_get_device_by_index.patch +x86-efi-fix-kernel-param-add_efi_memmap-regression.patch +uapi-libc-compat-add-fallback-for-unsupported-libcs.patch +i40e-i40evf-account-for-frags-split-over-multiple-descriptors-in-check-linearize.patch +i40e-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch +net-ena-unmask-msi-x-only-after-device-initialization-is-completed.patch +nl80211-check-for-the-required-netlink-attribute-presence.patch +mac80211-mesh-drop-frames-appearing-to-be-from-us.patch +can-flex_can-correct-the-checking-for-frame-length-in-flexcan_start_xmit.patch +wcn36xx-fix-dynamic-power-saving.patch +block-drain-queue-before-waiting-for-q_usage_counter-becoming-zero.patch +ia64-sched-cputime-fix-build-error-if-config_virt_cpu_accounting_native-y.patch +bpf-sockmap-missing-null-psock-check.patch +leds-core-fix-regression-caused-by-commit-2b83ff96f51d.patch +powerpc-pseries-make-ras-irq-explicitly-dependent-on-dlpar-wq.patch +nvme-fabrics-initialize-default-host-id-in-nvmf_host_default.patch +x86-platform-intel-mid-revert-make-bt_sfi_data-const.patch +bnxt_en-fix-population-of-flow_type-in-bnxt_hwrm_cfa_flow_alloc.patch +bnxt_en-fix-the-invalid-vf-id-check-in-bnxt_vf_ndo_prep-routine.patch +xen-netfront-enable-device-after-manual-module-load.patch +mdio-sun4i-fix-a-memory-leak.patch +solutionengine771x-fix-ether-platform-data.patch +xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch +xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch +sctp-add-a-ceiling-to-optlen-in-some-sockopts.patch +sctp-make-use-of-pre-calculated-len.patch +net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch +of_mdio-avoid-mdio-bus-removal-when-a-phy-is-missing.patch +nfp-always-unmask-aux-interrupts-at-init.patch +mlxsw-pci-wait-after-reset-before-accessing-hw.patch diff --git a/queue-4.14/sget-handle-failures-of-register_shrinker.patch b/queue-4.14/sget-handle-failures-of-register_shrinker.patch new file mode 100644 index 00000000000..540775e08f0 --- /dev/null +++ b/queue-4.14/sget-handle-failures-of-register_shrinker.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Al Viro +Date: Mon, 18 Dec 2017 15:05:07 -0500 +Subject: sget(): handle failures of register_shrinker() + +From: Al Viro + + +[ Upstream commit 9ee332d99e4d5a97548943b81c54668450ce641b ] + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/super.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/super.c ++++ b/fs/super.c +@@ -522,7 +522,11 @@ retry: + hlist_add_head(&s->s_instances, &type->fs_supers); + spin_unlock(&sb_lock); + get_filesystem(type); +- register_shrinker(&s->s_shrink); ++ err = register_shrinker(&s->s_shrink); ++ if (err) { ++ deactivate_locked_super(s); ++ s = ERR_PTR(err); ++ } + return s; + } + diff --git a/queue-4.14/solutionengine771x-fix-ether-platform-data.patch b/queue-4.14/solutionengine771x-fix-ether-platform-data.patch new file mode 100644 index 00000000000..cacfdd01a42 --- /dev/null +++ b/queue-4.14/solutionengine771x-fix-ether-platform-data.patch @@ -0,0 +1,65 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Sergei Shtylyov +Date: Sat, 6 Jan 2018 21:53:26 +0300 +Subject: SolutionEngine771x: fix Ether platform data + +From: Sergei Shtylyov + + +[ Upstream commit 195e2addbce09e5afbc766efc1e6567c9ce840d3 ] + +The 'sh_eth' driver's probe() method would fail on the SolutionEngine7710 +board and crash on SolutionEngine7712 board as the platform code is +hopelessly behind the driver's platform data -- it passes the PHY address +instead of 'struct sh_eth_plat_data *'; pass the latter to the driver in +order to fix the bug... + +Fixes: 71557a37adb5 ("[netdrvr] sh_eth: Add SH7619 support") +Signed-off-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/sh/boards/mach-se/770x/setup.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/arch/sh/boards/mach-se/770x/setup.c ++++ b/arch/sh/boards/mach-se/770x/setup.c +@@ -9,6 +9,7 @@ + */ + #include + #include ++#include + #include + #include + #include +@@ -115,6 +116,11 @@ static struct platform_device heartbeat_ + #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\ + defined(CONFIG_CPU_SUBTYPE_SH7712) + /* SH771X Ethernet driver */ ++static struct sh_eth_plat_data sh_eth_plat = { ++ .phy = PHY_ID, ++ .phy_interface = PHY_INTERFACE_MODE_MII, ++}; ++ + static struct resource sh_eth0_resources[] = { + [0] = { + .start = SH_ETH0_BASE, +@@ -132,7 +138,7 @@ static struct platform_device sh_eth0_de + .name = "sh771x-ether", + .id = 0, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth0_resources), + .resource = sh_eth0_resources, +@@ -155,7 +161,7 @@ static struct platform_device sh_eth1_de + .name = "sh771x-ether", + .id = 1, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth1_resources), + .resource = sh_eth1_resources, diff --git a/queue-4.14/spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch b/queue-4.14/spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch new file mode 100644 index 00000000000..2504ac8ff0e --- /dev/null +++ b/queue-4.14/spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Radu Pirea +Date: Fri, 15 Dec 2017 17:40:17 +0200 +Subject: spi: atmel: fixed spin_lock usage inside atmel_spi_remove + +From: Radu Pirea + + +[ Upstream commit 66e900a3d225575c8b48b59ae1fe74bb6e5a65cc ] + +The only part of atmel_spi_remove which needs to be atomic is hardware +reset. + +atmel_spi_stop_dma calls dma_terminate_all and this needs interrupts +enabled. +atmel_spi_release_dma calls dma_release_channel and dma_release_channel +locks a mutex inside of spin_lock. + +So the call of these functions can't be inside a spin_lock. + +Reported-by: Jia-Ju Bai +Signed-off-by: Radu Pirea +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-atmel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1661,12 +1661,12 @@ static int atmel_spi_remove(struct platf + pm_runtime_get_sync(&pdev->dev); + + /* reset the hardware and block queue progress */ +- spin_lock_irq(&as->lock); + if (as->use_dma) { + atmel_spi_stop_dma(master); + atmel_spi_release_dma(master); + } + ++ spin_lock_irq(&as->lock); + spi_writel(as, CR, SPI_BIT(SWRST)); + spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */ + spi_readl(as, SR); diff --git a/queue-4.14/staging-ion-fix-ion_cma_heap-allocations.patch b/queue-4.14/staging-ion-fix-ion_cma_heap-allocations.patch new file mode 100644 index 00000000000..1f469d6d3b7 --- /dev/null +++ b/queue-4.14/staging-ion-fix-ion_cma_heap-allocations.patch @@ -0,0 +1,108 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: John Stultz +Date: Fri, 15 Dec 2017 19:59:47 -0800 +Subject: staging: ion: Fix ion_cma_heap allocations + +From: John Stultz + + +[ Upstream commit f292b9b28097d8fe870336108e91bd95a14294bf ] + +In trying to add support for drm_hwcomposer to HiKey, +I've needed to utilize the ION CMA heap, and I've noticed +problems with allocations on newer kernels failing. + +It seems back with 204f672255c2 ("ion: Use CMA APIs directly"), +the ion_cma_heap code was modified to use the CMA API, but +kept the arguments as buffer lengths rather then number of pages. + +This results in errors as we don't have enough pages in CMA to +satisfy the exaggerated requests. + +This patch converts the ion_cma_heap CMA API usage to properly +request pages. + +It also fixes a minor issue in the allocation where in the error +path, the cma_release is called with the buffer->size value which +hasn't yet been set. + +Cc: Laura Abbott +Cc: Sumit Semwal +Cc: Benjamin Gaignard +Cc: Archit Taneja +Cc: Greg KH +Cc: Daniel Vetter +Cc: Dmitry Shmidt +Cc: Todd Kjos +Cc: Amit Pundir +Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly") +Acked-by: Laura Abbott +Signed-off-by: John Stultz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/android/ion/Kconfig | 2 +- + drivers/staging/android/ion/ion_cma_heap.c | 15 +++++++++++---- + 2 files changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/staging/android/ion/Kconfig ++++ b/drivers/staging/android/ion/Kconfig +@@ -37,7 +37,7 @@ config ION_CHUNK_HEAP + + config ION_CMA_HEAP + bool "Ion CMA heap support" +- depends on ION && CMA ++ depends on ION && DMA_CMA + help + Choose this option to enable CMA heaps with Ion. This heap is backed + by the Contiguous Memory Allocator (CMA). If your system has these +--- a/drivers/staging/android/ion/ion_cma_heap.c ++++ b/drivers/staging/android/ion/ion_cma_heap.c +@@ -39,9 +39,15 @@ static int ion_cma_allocate(struct ion_h + struct ion_cma_heap *cma_heap = to_cma_heap(heap); + struct sg_table *table; + struct page *pages; ++ unsigned long size = PAGE_ALIGN(len); ++ unsigned long nr_pages = size >> PAGE_SHIFT; ++ unsigned long align = get_order(size); + int ret; + +- pages = cma_alloc(cma_heap->cma, len, 0, GFP_KERNEL); ++ if (align > CONFIG_CMA_ALIGNMENT) ++ align = CONFIG_CMA_ALIGNMENT; ++ ++ pages = cma_alloc(cma_heap->cma, nr_pages, align, GFP_KERNEL); + if (!pages) + return -ENOMEM; + +@@ -53,7 +59,7 @@ static int ion_cma_allocate(struct ion_h + if (ret) + goto free_mem; + +- sg_set_page(table->sgl, pages, len, 0); ++ sg_set_page(table->sgl, pages, size, 0); + + buffer->priv_virt = pages; + buffer->sg_table = table; +@@ -62,7 +68,7 @@ static int ion_cma_allocate(struct ion_h + free_mem: + kfree(table); + err: +- cma_release(cma_heap->cma, pages, buffer->size); ++ cma_release(cma_heap->cma, pages, nr_pages); + return -ENOMEM; + } + +@@ -70,9 +76,10 @@ static void ion_cma_free(struct ion_buff + { + struct ion_cma_heap *cma_heap = to_cma_heap(buffer->heap); + struct page *pages = buffer->priv_virt; ++ unsigned long nr_pages = PAGE_ALIGN(buffer->size) >> PAGE_SHIFT; + + /* release memory */ +- cma_release(cma_heap->cma, pages, buffer->size); ++ cma_release(cma_heap->cma, pages, nr_pages); + /* release sg table */ + sg_free_table(buffer->sg_table); + kfree(buffer->sg_table); diff --git a/queue-4.14/tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch b/queue-4.14/tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch new file mode 100644 index 00000000000..98b7aa3a407 --- /dev/null +++ b/queue-4.14/tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch @@ -0,0 +1,64 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Siva Reddy Kallam +Date: Fri, 22 Dec 2017 16:05:28 +0530 +Subject: tg3: Add workaround to restrict 5762 MRRS to 2048 + +From: Siva Reddy Kallam + + +[ Upstream commit 4419bb1cedcda0272e1dc410345c5a1d1da0e367 ] + +One of AMD based server with 5762 hangs with jumbo frame traffic. +This AMD platform has southbridge limitation which is restricting MRRS +to 4000. As a work around, driver to restricts the MRRS to 2048 for +this particular 5762 NX1 card. + +Signed-off-by: Siva Reddy Kallam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/tg3.c | 10 ++++++++++ + drivers/net/ethernet/broadcom/tg3.h | 4 ++++ + 2 files changed, 14 insertions(+) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -10052,6 +10052,16 @@ static int tg3_reset_hw(struct tg3 *tp, + + tw32(GRC_MODE, tp->grc_mode | val); + ++ /* On one of the AMD platform, MRRS is restricted to 4000 because of ++ * south bridge limitation. As a workaround, Driver is setting MRRS ++ * to 2048 instead of default 4096. ++ */ ++ if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL && ++ tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) { ++ val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK; ++ tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048); ++ } ++ + /* Setup the timer prescalar register. Clock is always 66Mhz. */ + val = tr32(GRC_MISC_CFG); + val &= ~0xff; +--- a/drivers/net/ethernet/broadcom/tg3.h ++++ b/drivers/net/ethernet/broadcom/tg3.h +@@ -96,6 +96,7 @@ + #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR 0x0106 + #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT 0x0109 + #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT 0x010a ++#define TG3PCI_SUBDEVICE_ID_DELL_5762 0x07f0 + #define TG3PCI_SUBVENDOR_ID_COMPAQ PCI_VENDOR_ID_COMPAQ + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE 0x007c + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2 0x009a +@@ -281,6 +282,9 @@ + #define TG3PCI_STD_RING_PROD_IDX 0x00000098 /* 64-bit */ + #define TG3PCI_RCV_RET_RING_CON_IDX 0x000000a0 /* 64-bit */ + /* 0xa8 --> 0xb8 unused */ ++#define TG3PCI_DEV_STATUS_CTRL 0x000000b4 ++#define MAX_READ_REQ_SIZE_2048 0x00004000 ++#define MAX_READ_REQ_MASK 0x00007000 + #define TG3PCI_DUAL_MAC_CTRL 0x000000b8 + #define DUAL_MAC_CTRL_CH_MASK 0x00000003 + #define DUAL_MAC_CTRL_ID 0x00000004 diff --git a/queue-4.14/tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch b/queue-4.14/tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch new file mode 100644 index 00000000000..c4421b30158 --- /dev/null +++ b/queue-4.14/tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Siva Reddy Kallam +Date: Fri, 22 Dec 2017 16:05:29 +0530 +Subject: tg3: Enable PHY reset in MTU change path for 5720 + +From: Siva Reddy Kallam + + +[ Upstream commit e60ee41aaf898584205a6af5c996860d0fe6a836 ] + +A customer noticed RX path hang when MTU is changed on the fly while +running heavy traffic with NCSI enabled for 5717 and 5719. Since 5720 +belongs to same ASIC family, we observed same issue and same fix +could solve this problem for 5720. + +Signed-off-by: Siva Reddy Kallam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/tg3.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -14239,7 +14239,8 @@ static int tg3_change_mtu(struct net_dev + */ + if (tg3_asic_rev(tp) == ASIC_REV_57766 || + tg3_asic_rev(tp) == ASIC_REV_5717 || +- tg3_asic_rev(tp) == ASIC_REV_5719) ++ tg3_asic_rev(tp) == ASIC_REV_5719 || ++ tg3_asic_rev(tp) == ASIC_REV_5720) + reset_phy = true; + + err = tg3_restart_hw(tp, reset_phy); diff --git a/queue-4.14/tipc-error-path-leak-fixes-in-tipc_enable_bearer.patch b/queue-4.14/tipc-error-path-leak-fixes-in-tipc_enable_bearer.patch new file mode 100644 index 00000000000..a8a449e958b --- /dev/null +++ b/queue-4.14/tipc-error-path-leak-fixes-in-tipc_enable_bearer.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Tommi Rantala +Date: Fri, 22 Dec 2017 09:35:16 +0200 +Subject: tipc: error path leak fixes in tipc_enable_bearer() + +From: Tommi Rantala + + +[ Upstream commit 19142551b2be4a9e13838099fde1351386e5e007 ] + +Fix memory leak in tipc_enable_bearer() if enable_media() fails, and +cleanup with bearer_disable() if tipc_mon_create() fails. + +Acked-by: Ying Xue +Acked-by: Jon Maloy +Signed-off-by: Tommi Rantala +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/bearer.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/tipc/bearer.c ++++ b/net/tipc/bearer.c +@@ -324,6 +324,7 @@ restart: + if (res) { + pr_warn("Bearer <%s> rejected, enable failure (%d)\n", + name, -res); ++ kfree(b); + return -EINVAL; + } + +@@ -347,8 +348,10 @@ restart: + if (skb) + tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr); + +- if (tipc_mon_create(net, bearer_id)) ++ if (tipc_mon_create(net, bearer_id)) { ++ bearer_disable(net, b); + return -ENOMEM; ++ } + + pr_info("Enabled bearer <%s>, discovery domain %s, priority %u\n", + name, diff --git a/queue-4.14/tipc-fix-tipc_mon_delete-oops-in-tipc_enable_bearer-error-path.patch b/queue-4.14/tipc-fix-tipc_mon_delete-oops-in-tipc_enable_bearer-error-path.patch new file mode 100644 index 00000000000..6ed98fb9c03 --- /dev/null +++ b/queue-4.14/tipc-fix-tipc_mon_delete-oops-in-tipc_enable_bearer-error-path.patch @@ -0,0 +1,82 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Tommi Rantala +Date: Fri, 22 Dec 2017 09:35:17 +0200 +Subject: tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path + +From: Tommi Rantala + + +[ Upstream commit 642a8439ddd8423b92f2e71960afe21ee1f66bb6 ] + +Calling tipc_mon_delete() before the monitor has been created will oops. +This can happen in tipc_enable_bearer() error path if tipc_disc_create() +fails. + +[ 48.589074] BUG: unable to handle kernel paging request at 0000000000001008 +[ 48.590266] IP: tipc_mon_delete+0xea/0x270 [tipc] +[ 48.591223] PGD 1e60c5067 P4D 1e60c5067 PUD 1eb0cf067 PMD 0 +[ 48.592230] Oops: 0000 [#1] SMP KASAN +[ 48.595610] CPU: 5 PID: 1199 Comm: tipc Tainted: G B 4.15.0-rc4-pc64-dirty #5 +[ 48.597176] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 +[ 48.598489] RIP: 0010:tipc_mon_delete+0xea/0x270 [tipc] +[ 48.599347] RSP: 0018:ffff8801d827f668 EFLAGS: 00010282 +[ 48.600705] RAX: ffff8801ee813f00 RBX: 0000000000000204 RCX: 0000000000000000 +[ 48.602183] RDX: 1ffffffff1de6a75 RSI: 0000000000000297 RDI: 0000000000000297 +[ 48.604373] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff1dd1533 +[ 48.605607] R10: ffffffff8eafbb05 R11: fffffbfff1dd1534 R12: 0000000000000050 +[ 48.607082] R13: dead000000000200 R14: ffffffff8e73f310 R15: 0000000000001020 +[ 48.608228] FS: 00007fc686484800(0000) GS:ffff8801f5540000(0000) knlGS:0000000000000000 +[ 48.610189] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 48.611459] CR2: 0000000000001008 CR3: 00000001dda70002 CR4: 00000000003606e0 +[ 48.612759] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 48.613831] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 48.615038] Call Trace: +[ 48.615635] tipc_enable_bearer+0x415/0x5e0 [tipc] +[ 48.620623] tipc_nl_bearer_enable+0x1ab/0x200 [tipc] +[ 48.625118] genl_family_rcv_msg+0x36b/0x570 +[ 48.631233] genl_rcv_msg+0x5a/0xa0 +[ 48.631867] netlink_rcv_skb+0x1cc/0x220 +[ 48.636373] genl_rcv+0x24/0x40 +[ 48.637306] netlink_unicast+0x29c/0x350 +[ 48.639664] netlink_sendmsg+0x439/0x590 +[ 48.642014] SYSC_sendto+0x199/0x250 +[ 48.649912] do_syscall_64+0xfd/0x2c0 +[ 48.650651] entry_SYSCALL64_slow_path+0x25/0x25 +[ 48.651843] RIP: 0033:0x7fc6859848e3 +[ 48.652539] RSP: 002b:00007ffd25dff938 EFLAGS: 00000246 ORIG_RAX: 000000000000002c +[ 48.654003] RAX: ffffffffffffffda RBX: 00007ffd25dff990 RCX: 00007fc6859848e3 +[ 48.655303] RDX: 0000000000000054 RSI: 00007ffd25dff990 RDI: 0000000000000003 +[ 48.656512] RBP: 00007ffd25dff980 R08: 00007fc685c35fc0 R09: 000000000000000c +[ 48.657697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000d13010 +[ 48.658840] R13: 00007ffd25e009c0 R14: 0000000000000000 R15: 0000000000000000 +[ 48.662972] RIP: tipc_mon_delete+0xea/0x270 [tipc] RSP: ffff8801d827f668 +[ 48.664073] CR2: 0000000000001008 +[ 48.664576] ---[ end trace e811818d54d5ce88 ]--- + +Acked-by: Ying Xue +Acked-by: Jon Maloy +Signed-off-by: Tommi Rantala +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/monitor.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/tipc/monitor.c ++++ b/net/tipc/monitor.c +@@ -633,9 +633,13 @@ void tipc_mon_delete(struct net *net, in + { + struct tipc_net *tn = tipc_net(net); + struct tipc_monitor *mon = tipc_monitor(net, bearer_id); +- struct tipc_peer *self = get_self(net, bearer_id); ++ struct tipc_peer *self; + struct tipc_peer *peer, *tmp; + ++ if (!mon) ++ return; ++ ++ self = get_self(net, bearer_id); + write_lock_bh(&mon->lock); + tn->monitors[bearer_id] = NULL; + list_for_each_entry_safe(peer, tmp, &self->list, list) { diff --git a/queue-4.14/uapi-libc-compat-add-fallback-for-unsupported-libcs.patch b/queue-4.14/uapi-libc-compat-add-fallback-for-unsupported-libcs.patch new file mode 100644 index 00000000000..41ebf476854 --- /dev/null +++ b/queue-4.14/uapi-libc-compat-add-fallback-for-unsupported-libcs.patch @@ -0,0 +1,155 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Felix Janda +Date: Mon, 1 Jan 2018 19:33:20 +0100 +Subject: uapi libc compat: add fallback for unsupported libcs + +From: Felix Janda + + +[ Upstream commit c0bace798436bca0fdc221ff61143f1376a9c3de ] + +libc-compat.h aims to prevent symbol collisions between uapi and libc +headers for each supported libc. This requires continuous coordination +between them. + +The goal of this commit is to improve the situation for libcs (such as +musl) which are not yet supported and/or do not wish to be explicitly +supported, while not affecting supported libcs. More precisely, with +this commit, unsupported libcs can request the suppression of any +specific uapi definition by defining the correspondings _UAPI_DEF_* +macro as 0. This can fix symbol collisions for them, as long as the +libc headers are included before the uapi headers. Inclusion in the +other order is outside the scope of this commit. + +All infrastructure in order to enable this fallback for unsupported +libcs is already in place, except that libc-compat.h unconditionally +defines all _UAPI_DEF_* macros to 1 for all unsupported libcs so that +any previous definitions are ignored. In order to fix this, this commit +merely makes these definitions conditional. + +This commit together with the musl libc commit + +http://git.musl-libc.org/cgit/musl/commit/?id=04983f2272382af92eb8f8838964ff944fbb8258 + +fixes for example the following compiler errors when is +included after musl's : + +./linux/in6.h:32:8: error: redefinition of 'struct in6_addr' +./linux/in6.h:49:8: error: redefinition of 'struct sockaddr_in6' +./linux/in6.h:59:8: error: redefinition of 'struct ipv6_mreq' + +The comments referencing glibc are still correct, but this file is not +only used for glibc any more. + +Signed-off-by: Felix Janda +Reviewed-by: Hauke Mehrtens +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/libc-compat.h | 55 ++++++++++++++++++++++++++++++++++++++- + 1 file changed, 54 insertions(+), 1 deletion(-) + +--- a/include/uapi/linux/libc-compat.h ++++ b/include/uapi/linux/libc-compat.h +@@ -168,46 +168,99 @@ + + /* If we did not see any headers from any supported C libraries, + * or we are being included in the kernel, then define everything +- * that we need. */ ++ * that we need. Check for previous __UAPI_* definitions to give ++ * unsupported C libraries a way to opt out of any kernel definition. */ + #else /* !defined(__GLIBC__) */ + + /* Definitions for if.h */ ++#ifndef __UAPI_DEF_IF_IFCONF + #define __UAPI_DEF_IF_IFCONF 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFMAP + #define __UAPI_DEF_IF_IFMAP 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFNAMSIZ + #define __UAPI_DEF_IF_IFNAMSIZ 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFREQ + #define __UAPI_DEF_IF_IFREQ 1 ++#endif + /* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */ ++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS + #define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1 ++#endif + /* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */ ++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO + #define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1 ++#endif + + /* Definitions for in.h */ ++#ifndef __UAPI_DEF_IN_ADDR + #define __UAPI_DEF_IN_ADDR 1 ++#endif ++#ifndef __UAPI_DEF_IN_IPPROTO + #define __UAPI_DEF_IN_IPPROTO 1 ++#endif ++#ifndef __UAPI_DEF_IN_PKTINFO + #define __UAPI_DEF_IN_PKTINFO 1 ++#endif ++#ifndef __UAPI_DEF_IP_MREQ + #define __UAPI_DEF_IP_MREQ 1 ++#endif ++#ifndef __UAPI_DEF_SOCKADDR_IN + #define __UAPI_DEF_SOCKADDR_IN 1 ++#endif ++#ifndef __UAPI_DEF_IN_CLASS + #define __UAPI_DEF_IN_CLASS 1 ++#endif + + /* Definitions for in6.h */ ++#ifndef __UAPI_DEF_IN6_ADDR + #define __UAPI_DEF_IN6_ADDR 1 ++#endif ++#ifndef __UAPI_DEF_IN6_ADDR_ALT + #define __UAPI_DEF_IN6_ADDR_ALT 1 ++#endif ++#ifndef __UAPI_DEF_SOCKADDR_IN6 + #define __UAPI_DEF_SOCKADDR_IN6 1 ++#endif ++#ifndef __UAPI_DEF_IPV6_MREQ + #define __UAPI_DEF_IPV6_MREQ 1 ++#endif ++#ifndef __UAPI_DEF_IPPROTO_V6 + #define __UAPI_DEF_IPPROTO_V6 1 ++#endif ++#ifndef __UAPI_DEF_IPV6_OPTIONS + #define __UAPI_DEF_IPV6_OPTIONS 1 ++#endif ++#ifndef __UAPI_DEF_IN6_PKTINFO + #define __UAPI_DEF_IN6_PKTINFO 1 ++#endif ++#ifndef __UAPI_DEF_IP6_MTUINFO + #define __UAPI_DEF_IP6_MTUINFO 1 ++#endif + + /* Definitions for ipx.h */ ++#ifndef __UAPI_DEF_SOCKADDR_IPX + #define __UAPI_DEF_SOCKADDR_IPX 1 ++#endif ++#ifndef __UAPI_DEF_IPX_ROUTE_DEFINITION + #define __UAPI_DEF_IPX_ROUTE_DEFINITION 1 ++#endif ++#ifndef __UAPI_DEF_IPX_INTERFACE_DEFINITION + #define __UAPI_DEF_IPX_INTERFACE_DEFINITION 1 ++#endif ++#ifndef __UAPI_DEF_IPX_CONFIG_DATA + #define __UAPI_DEF_IPX_CONFIG_DATA 1 ++#endif ++#ifndef __UAPI_DEF_IPX_ROUTE_DEF + #define __UAPI_DEF_IPX_ROUTE_DEF 1 ++#endif + + /* Definitions for xattr.h */ ++#ifndef __UAPI_DEF_XATTR + #define __UAPI_DEF_XATTR 1 ++#endif + + #endif /* __GLIBC__ */ + diff --git a/queue-4.14/vxlan-update-skb-dst-pmtu-on-tx-path.patch b/queue-4.14/vxlan-update-skb-dst-pmtu-on-tx-path.patch new file mode 100644 index 00000000000..2376060ef8b --- /dev/null +++ b/queue-4.14/vxlan-update-skb-dst-pmtu-on-tx-path.patch @@ -0,0 +1,68 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Xin Long +Date: Mon, 18 Dec 2017 14:20:56 +0800 +Subject: vxlan: update skb dst pmtu on tx path + +From: Xin Long + + +[ Upstream commit a93bf0ff449064e6b7f44e58522e940f88c0d966 ] + +Unlike ip tunnels, now vxlan doesn't do any pmtu update for +upper dst pmtu, even if it doesn't match the lower dst pmtu +any more. + +The problem can be reproduced when reducing the vxlan lower +dev's pmtu when running netperf. In jianlin's testing, the +performance went to 1/7 of the previous. + +This patch is to update the upper dst pmtu to match the lower +dst pmtu on tx path so that packets can be sent out even when +lower dev's pmtu has been changed. + +It also works for metadata dst. + +Note that this patch doesn't process any pmtu icmp packet. +But even in the future, the support for pmtu icmp packets +process of udp tunnels will also needs this. + +The same thing will be done for geneve in another patch. + +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2155,6 +2155,13 @@ static void vxlan_xmit_one(struct sk_buf + } + + ndst = &rt->dst; ++ if (skb_dst(skb)) { ++ int mtu = dst_mtu(ndst) - VXLAN_HEADROOM; ++ ++ skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, ++ skb, mtu); ++ } ++ + tos = ip_tunnel_ecn_encap(tos, old_iph, skb); + ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); + err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr), +@@ -2190,6 +2197,13 @@ static void vxlan_xmit_one(struct sk_buf + goto out_unlock; + } + ++ if (skb_dst(skb)) { ++ int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM; ++ ++ skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, ++ skb, mtu); ++ } ++ + tos = ip_tunnel_ecn_encap(tos, old_iph, skb); + ttl = ttl ? : ip6_dst_hoplimit(ndst); + skb_scrub_packet(skb, xnet); diff --git a/queue-4.14/wcn36xx-fix-dynamic-power-saving.patch b/queue-4.14/wcn36xx-fix-dynamic-power-saving.patch new file mode 100644 index 00000000000..4cf08169c2b --- /dev/null +++ b/queue-4.14/wcn36xx-fix-dynamic-power-saving.patch @@ -0,0 +1,84 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Loic Poulain +Date: Mon, 11 Dec 2017 09:52:22 +0100 +Subject: wcn36xx: Fix dynamic power saving + +From: Loic Poulain + + +[ Upstream commit 0856655a25476d4431005e39d606e349050066b0 ] + +Since driver does not report hardware dynamic power saving cap, +this is up to the mac80211 to manage power saving timeout and +state machine, using the ieee80211 config callback to report +PS changes. This patch enables/disables PS mode according to +the new configuration. + +Remove old behaviour enabling PS mode in a static way, this make +the device unusable when power save is enabled since device is +forced to PS regardless RX/TX traffic. + +Acked-by: Bjorn Andersson +Signed-off-by: Loic Poulain +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wcn36xx/main.c | 23 ++++++++++++----------- + drivers/net/wireless/ath/wcn36xx/pmc.c | 6 ++++-- + 2 files changed, 16 insertions(+), 13 deletions(-) + +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -384,6 +384,18 @@ static int wcn36xx_config(struct ieee802 + } + } + ++ if (changed & IEEE80211_CONF_CHANGE_PS) { ++ list_for_each_entry(tmp, &wcn->vif_list, list) { ++ vif = wcn36xx_priv_to_vif(tmp); ++ if (hw->conf.flags & IEEE80211_CONF_PS) { ++ if (vif->bss_conf.ps) /* ps allowed ? */ ++ wcn36xx_pmc_enter_bmps_state(wcn, vif); ++ } else { ++ wcn36xx_pmc_exit_bmps_state(wcn, vif); ++ } ++ } ++ } ++ + mutex_unlock(&wcn->conf_mutex); + + return 0; +@@ -747,17 +759,6 @@ static void wcn36xx_bss_info_changed(str + vif_priv->dtim_period = bss_conf->dtim_period; + } + +- if (changed & BSS_CHANGED_PS) { +- wcn36xx_dbg(WCN36XX_DBG_MAC, +- "mac bss PS set %d\n", +- bss_conf->ps); +- if (bss_conf->ps) { +- wcn36xx_pmc_enter_bmps_state(wcn, vif); +- } else { +- wcn36xx_pmc_exit_bmps_state(wcn, vif); +- } +- } +- + if (changed & BSS_CHANGED_BSSID) { + wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed_bssid %pM\n", + bss_conf->bssid); +--- a/drivers/net/wireless/ath/wcn36xx/pmc.c ++++ b/drivers/net/wireless/ath/wcn36xx/pmc.c +@@ -45,8 +45,10 @@ int wcn36xx_pmc_exit_bmps_state(struct w + struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif); + + if (WCN36XX_BMPS != vif_priv->pw_state) { +- wcn36xx_err("Not in BMPS mode, no need to exit from BMPS mode!\n"); +- return -EINVAL; ++ /* Unbalanced call or last BMPS enter failed */ ++ wcn36xx_dbg(WCN36XX_DBG_PMC, ++ "Not in BMPS mode, no need to exit\n"); ++ return -EALREADY; + } + wcn36xx_smd_exit_bmps(wcn, vif); + vif_priv->pw_state = WCN36XX_FULL_POWER; diff --git a/queue-4.14/x86-64-xen-eliminate-w-x-mappings.patch b/queue-4.14/x86-64-xen-eliminate-w-x-mappings.patch new file mode 100644 index 00000000000..341a29b347d --- /dev/null +++ b/queue-4.14/x86-64-xen-eliminate-w-x-mappings.patch @@ -0,0 +1,70 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Jan Beulich +Date: Mon, 18 Dec 2017 09:37:45 -0700 +Subject: x86-64/Xen: eliminate W+X mappings + +From: Jan Beulich + + +[ Upstream commit 2cc42bac1c795f75fcc062b95c6ca7ac1b84d5d8 ] + +A few thousand such pages are usually left around due to the re-use of +L1 tables having been provided by the hypervisor (Dom0) or tool stack +(DomU). Set NX in the direct map variant, which needs to be done in L2 +due to the dual use of the re-used L1s. + +For x86_configure_nx() to actually do what it is supposed to do, call +get_cpu_cap() first. This was broken by commit 4763ed4d45 ("x86, mm: +Clean up and simplify NX enablement") when switching away from the +direct EFER read. + +Signed-off-by: Jan Beulich +Reviewed-by: Juergen Gross +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/xen/enlighten_pv.c | 3 +++ + arch/x86/xen/mmu_pv.c | 12 ++++++++++++ + 2 files changed, 15 insertions(+) + +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -88,6 +88,8 @@ + #include "multicalls.h" + #include "pmu.h" + ++#include "../kernel/cpu/cpu.h" /* get_cpu_cap() */ ++ + void *xen_initial_gdt; + + static int xen_cpu_up_prepare_pv(unsigned int cpu); +@@ -1257,6 +1259,7 @@ asmlinkage __visible void __init xen_sta + __userpte_alloc_gfp &= ~__GFP_HIGHMEM; + + /* Work out if we support NX */ ++ get_cpu_cap(&boot_cpu_data); + x86_configure_nx(); + + /* Get mfn list */ +--- a/arch/x86/xen/mmu_pv.c ++++ b/arch/x86/xen/mmu_pv.c +@@ -1902,6 +1902,18 @@ void __init xen_setup_kernel_pagetable(p + /* Graft it onto L4[511][510] */ + copy_page(level2_kernel_pgt, l2); + ++ /* ++ * Zap execute permission from the ident map. Due to the sharing of ++ * L1 entries we need to do this in the L2. ++ */ ++ if (__supported_pte_mask & _PAGE_NX) { ++ for (i = 0; i < PTRS_PER_PMD; ++i) { ++ if (pmd_none(level2_ident_pgt[i])) ++ continue; ++ level2_ident_pgt[i] = pmd_set_flags(level2_ident_pgt[i], _PAGE_NX); ++ } ++ } ++ + /* Copy the initial P->M table mappings if necessary. */ + i = pgd_index(xen_start_info->mfn_list); + if (i && i < pgd_index(__START_KERNEL_map)) diff --git a/queue-4.14/x86-asm-allow-again-using-asm.h-when-building-for-the-bpf-clang-target.patch b/queue-4.14/x86-asm-allow-again-using-asm.h-when-building-for-the-bpf-clang-target.patch new file mode 100644 index 00000000000..26bc319c506 --- /dev/null +++ b/queue-4.14/x86-asm-allow-again-using-asm.h-when-building-for-the-bpf-clang-target.patch @@ -0,0 +1,202 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Arnaldo Carvalho de Melo +Date: Mon, 4 Dec 2017 13:08:47 -0300 +Subject: x86/asm: Allow again using asm.h when building for the 'bpf' clang target + +From: Arnaldo Carvalho de Melo + + +[ Upstream commit ca26cffa4e4aaeb09bb9e308f95c7835cb149248 ] + +Up to f5caf621ee35 ("x86/asm: Fix inline asm call constraints for Clang") +we were able to use x86 headers to build to the 'bpf' clang target, as +done by the BPF code in tools/perf/. + +With that commit, we ended up with following failure for 'perf test LLVM', this +is because "clang ... -target bpf ..." fails since 4.0 does not have bpf inline +asm support and 6.0 does not recognize the register 'esp', fix it by guarding +that part with an #ifndef __BPF__, that is defined by clang when building to +the "bpf" target. + + # perf test -v LLVM + 37: LLVM search and compile : + 37.1: Basic BPF llvm compile : + --- start --- + test child forked, pid 25526 + Kernel build dir is set to /lib/modules/4.14.0+/build + set env: KBUILD_DIR=/lib/modules/4.14.0+/build + unset env: KBUILD_OPTS + include option is set to -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h + set env: NR_CPUS=4 + set env: LINUX_VERSION_CODE=0x40e00 + set env: CLANG_EXEC=/usr/local/bin/clang + set env: CLANG_OPTIONS=-xc + set env: KERNEL_INC_OPTIONS= -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h + set env: WORKING_DIR=/lib/modules/4.14.0+/build + set env: CLANG_SOURCE=- + llvm compiling command template: echo '/* + * bpf-script-example.c + * Test basic LLVM building + */ + #ifndef LINUX_VERSION_CODE + # error Need LINUX_VERSION_CODE + # error Example: for 4.2 kernel, put 'clang-opt="-DLINUX_VERSION_CODE=0x40200" into llvm section of ~/.perfconfig' + #endif + #define BPF_ANY 0 + #define BPF_MAP_TYPE_ARRAY 2 + #define BPF_FUNC_map_lookup_elem 1 + #define BPF_FUNC_map_update_elem 2 + + static void *(*bpf_map_lookup_elem)(void *map, void *key) = + (void *) BPF_FUNC_map_lookup_elem; + static void *(*bpf_map_update_elem)(void *map, void *key, void *value, int flags) = + (void *) BPF_FUNC_map_update_elem; + + struct bpf_map_def { + unsigned int type; + unsigned int key_size; + unsigned int value_size; + unsigned int max_entries; + }; + + #define SEC(NAME) __attribute__((section(NAME), used)) + struct bpf_map_def SEC("maps") flip_table = { + .type = BPF_MAP_TYPE_ARRAY, + .key_size = sizeof(int), + .value_size = sizeof(int), + .max_entries = 1, + }; + + SEC("func=SyS_epoll_wait") + int bpf_func__SyS_epoll_wait(void *ctx) + { + int ind =0; + int *flag = bpf_map_lookup_elem(&flip_table, &ind); + int new_flag; + if (!flag) + return 0; + /* flip flag and store back */ + new_flag = !*flag; + bpf_map_update_elem(&flip_table, &ind, &new_flag, BPF_ANY); + return new_flag; + } + char _license[] SEC("license") = "GPL"; + int _version SEC("version") = LINUX_VERSION_CODE; + ' | $CLANG_EXEC -D__KERNEL__ -D__NR_CPUS__=$NR_CPUS -DLINUX_VERSION_CODE=$LINUX_VERSION_CODE $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c "$CLANG_SOURCE" -target bpf -O2 -o - + test child finished with 0 + ---- end ---- + LLVM search and compile subtest 0: Ok + 37.2: kbuild searching : + --- start --- + test child forked, pid 25950 + Kernel build dir is set to /lib/modules/4.14.0+/build + set env: KBUILD_DIR=/lib/modules/4.14.0+/build + unset env: KBUILD_OPTS + include option is set to -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h + set env: NR_CPUS=4 + set env: LINUX_VERSION_CODE=0x40e00 + set env: CLANG_EXEC=/usr/local/bin/clang + set env: CLANG_OPTIONS=-xc + set env: KERNEL_INC_OPTIONS= -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h + set env: WORKING_DIR=/lib/modules/4.14.0+/build + set env: CLANG_SOURCE=- + llvm compiling command template: echo '/* + * bpf-script-test-kbuild.c + * Test include from kernel header + */ + #ifndef LINUX_VERSION_CODE + # error Need LINUX_VERSION_CODE + # error Example: for 4.2 kernel, put 'clang-opt="-DLINUX_VERSION_CODE=0x40200" into llvm section of ~/.perfconfig' + #endif + #define SEC(NAME) __attribute__((section(NAME), used)) + + #include + #include + + SEC("func=vfs_llseek") + int bpf_func__vfs_llseek(void *ctx) + { + return 0; + } + + char _license[] SEC("license") = "GPL"; + int _version SEC("version") = LINUX_VERSION_CODE; + ' | $CLANG_EXEC -D__KERNEL__ -D__NR_CPUS__=$NR_CPUS -DLINUX_VERSION_CODE=$LINUX_VERSION_CODE $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c "$CLANG_SOURCE" -target bpf -O2 -o - + In file included from :12: + In file included from /home/acme/git/linux/arch/x86/include/uapi/asm/ptrace.h:5: + In file included from /home/acme/git/linux/include/linux/compiler.h:242: + In file included from /home/acme/git/linux/arch/x86/include/asm/barrier.h:5: + In file included from /home/acme/git/linux/arch/x86/include/asm/alternative.h:10: + /home/acme/git/linux/arch/x86/include/asm/asm.h:145:50: error: unknown register name 'esp' in asm + register unsigned long current_stack_pointer asm(_ASM_SP); + ^ + /home/acme/git/linux/arch/x86/include/asm/asm.h:44:18: note: expanded from macro '_ASM_SP' + #define _ASM_SP __ASM_REG(sp) + ^ + /home/acme/git/linux/arch/x86/include/asm/asm.h:27:32: note: expanded from macro '__ASM_REG' + #define __ASM_REG(reg) __ASM_SEL_RAW(e##reg, r##reg) + ^ + /home/acme/git/linux/arch/x86/include/asm/asm.h:18:29: note: expanded from macro '__ASM_SEL_RAW' + # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(a) + ^ + /home/acme/git/linux/arch/x86/include/asm/asm.h:11:32: note: expanded from macro '__ASM_FORM_RAW' + # define __ASM_FORM_RAW(x) #x + ^ + :4:1: note: expanded from here + "esp" + ^ + 1 error generated. + ERROR: unable to compile - + Hint: Check error message shown above. + Hint: You can also pre-compile it into .o using: + clang -target bpf -O2 -c - + with proper -I and -D options. + Failed to compile test case: 'kbuild searching' + test child finished with -1 + ---- end ---- + LLVM search and compile subtest 1: FAILED! + +Cc: Adrian Hunter +Cc: Alexander Potapenko +Cc: Alexei Starovoitov +Cc: Andrey Ryabinin +Cc: Andy Lutomirski +Cc: Arnd Bergmann +Cc: Daniel Borkmann +Cc: David Ahern +Cc: Dmitriy Vyukov +Cc: Jiri Olsa +Cc: Josh Poimboeuf +Cc: Linus Torvalds +Cc: Matthias Kaehlcke +Cc: Miguel Bernal Marin +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Wang Nan +Cc: Yonghong Song +Link: https://lkml.kernel.org/r/20171128175948.GL3298@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/asm.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/include/asm/asm.h ++++ b/arch/x86/include/asm/asm.h +@@ -136,6 +136,7 @@ + #endif + + #ifndef __ASSEMBLY__ ++#ifndef __BPF__ + /* + * This output constraint should be used for any inline asm which has a "call" + * instruction. Otherwise the asm may be inserted before the frame pointer +@@ -145,5 +146,6 @@ + register unsigned long current_stack_pointer asm(_ASM_SP); + #define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer) + #endif ++#endif + + #endif /* _ASM_X86_ASM_H */ diff --git a/queue-4.14/x86-efi-fix-kernel-param-add_efi_memmap-regression.patch b/queue-4.14/x86-efi-fix-kernel-param-add_efi_memmap-regression.patch new file mode 100644 index 00000000000..741a39ca278 --- /dev/null +++ b/queue-4.14/x86-efi-fix-kernel-param-add_efi_memmap-regression.patch @@ -0,0 +1,56 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Dave Young +Date: Tue, 2 Jan 2018 17:21:09 +0000 +Subject: x86/efi: Fix kernel param add_efi_memmap regression + +From: Dave Young + + +[ Upstream commit 835bcec5fdf3f9e880111b482177e7e70e3596da ] + +'add_efi_memmap' is an early param, but do_add_efi_memmap() has no +chance to run because the code path is before parse_early_param(). +I believe it worked when the param was introduced but probably later +some other changes caused the wrong order and nobody noticed it. + +Move efi_memblock_x86_reserve_range() after parse_early_param() +to fix it. + +Signed-off-by: Dave Young +Signed-off-by: Matt Fleming +Signed-off-by: Ard Biesheuvel +Cc: Bryan O'Donoghue +Cc: Ge Song +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-efi@vger.kernel.org +Link: http://lkml.kernel.org/r/20180102172110.17018-2-ard.biesheuvel@linaro.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/setup.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -928,9 +928,6 @@ void __init setup_arch(char **cmdline_p) + set_bit(EFI_BOOT, &efi.flags); + set_bit(EFI_64BIT, &efi.flags); + } +- +- if (efi_enabled(EFI_BOOT)) +- efi_memblock_x86_reserve_range(); + #endif + + x86_init.oem.arch_setup(); +@@ -984,6 +981,8 @@ void __init setup_arch(char **cmdline_p) + + parse_early_param(); + ++ if (efi_enabled(EFI_BOOT)) ++ efi_memblock_x86_reserve_range(); + #ifdef CONFIG_MEMORY_HOTPLUG + /* + * Memory used by the kernel cannot be hot-removed because Linux diff --git a/queue-4.14/x86-platform-intel-mid-revert-make-bt_sfi_data-const.patch b/queue-4.14/x86-platform-intel-mid-revert-make-bt_sfi_data-const.patch new file mode 100644 index 00000000000..81f40242782 --- /dev/null +++ b/queue-4.14/x86-platform-intel-mid-revert-make-bt_sfi_data-const.patch @@ -0,0 +1,52 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Andy Shevchenko +Date: Thu, 28 Dec 2017 14:25:23 +0200 +Subject: x86/platform/intel-mid: Revert "Make 'bt_sfi_data' const" + +From: Andy Shevchenko + + +[ Upstream commit 9d0513d82f1a8fe17b41f113ac5922fa57dbaf5c ] + +So one of the constification patches unearthed a type casting fragility +of the underlying code: + + 276c87054751 ("x86/platform/intel-mid: Make 'bt_sfi_data' const") + +converted the struct to be const while it is also used as a temporary +container for important data that is used to fill 'parent' and 'name' +fields in struct platform_device_info. + +The compiler doesn't notice this due to an explicit type cast that loses +the const - which fragility will be fixed separately. + +This type cast turned a seemingly trivial const propagation patch into a +hard to debug data corruptor and crasher bug. + +Signed-off-by: Andy Shevchenko +Cc: Bhumika Goyal +Cc: Darren Hart +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: julia.lawall@lip6.fr +Cc: platform-driver-x86@vger.kernel.org +Link: http://lkml.kernel.org/r/20171228122523.21802-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/platform/intel-mid/device_libs/platform_bt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/platform/intel-mid/device_libs/platform_bt.c ++++ b/arch/x86/platform/intel-mid/device_libs/platform_bt.c +@@ -60,7 +60,7 @@ static int __init tng_bt_sfi_setup(struc + return 0; + } + +-static const struct bt_sfi_data tng_bt_sfi_data __initdata = { ++static struct bt_sfi_data tng_bt_sfi_data __initdata = { + .setup = tng_bt_sfi_setup, + }; + diff --git a/queue-4.14/x86-stacktrace-make-zombie-stack-traces-reliable.patch b/queue-4.14/x86-stacktrace-make-zombie-stack-traces-reliable.patch new file mode 100644 index 00000000000..cc0d29a299d --- /dev/null +++ b/queue-4.14/x86-stacktrace-make-zombie-stack-traces-reliable.patch @@ -0,0 +1,69 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Josh Poimboeuf +Date: Mon, 18 Dec 2017 15:13:44 -0600 +Subject: x86/stacktrace: Make zombie stack traces reliable + +From: Josh Poimboeuf + + +[ Upstream commit 6454b3bdd138dfc640deb5e7b9a0668fca2d55dd ] + +Commit: + + 1959a60182f4 ("x86/dumpstack: Pin the target stack when dumping it") + +changed the behavior of stack traces for zombies. Before that commit, +/proc//stack reported the last execution path of the zombie before +it died: + + [] do_exit+0x6f7/0xa80 + [] do_group_exit+0x39/0xa0 + [] __wake_up_parent+0x0/0x30 + [] system_call_fastpath+0x16/0x1b + [<00007fd128f9c4f9>] 0x7fd128f9c4f9 + [] 0xffffffffffffffff + +After the commit, it just reports an empty stack trace. + +The new behavior is actually probably more correct. If the stack +refcount has gone down to zero, then the task has already gone through +do_exit() and isn't going to run anymore. The stack could be freed at +any time and is basically gone, so reporting an empty stack makes sense. + +However, save_stack_trace_tsk_reliable() treats such a missing stack +condition as an error. That can cause livepatch transition stalls if +there are any unreaped zombies. Instead, just treat it as a reliable, +empty stack. + +Reported-and-tested-by: Miroslav Benes +Signed-off-by: Josh Poimboeuf +Cc: Andy Lutomirski +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: live-patching@vger.kernel.org +Fixes: af085d9084b4 ("stacktrace/x86: add function for detecting reliable stack traces") +Link: http://lkml.kernel.org/r/e4b09e630e99d0c1080528f0821fc9d9dbaeea82.1513631620.git.jpoimboe@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/stacktrace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/stacktrace.c ++++ b/arch/x86/kernel/stacktrace.c +@@ -160,8 +160,12 @@ int save_stack_trace_tsk_reliable(struct + { + int ret; + ++ /* ++ * If the task doesn't have a stack (e.g., a zombie), the stack is ++ * "reliably" empty. ++ */ + if (!try_get_task_stack(tsk)) +- return -EINVAL; ++ return 0; + + ret = __save_stack_trace_reliable(trace, tsk); + diff --git a/queue-4.14/xen-balloon-mark-unallocated-host-memory-as-unusable.patch b/queue-4.14/xen-balloon-mark-unallocated-host-memory-as-unusable.patch new file mode 100644 index 00000000000..07a1165ca5c --- /dev/null +++ b/queue-4.14/xen-balloon-mark-unallocated-host-memory-as-unusable.patch @@ -0,0 +1,262 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Boris Ostrovsky +Date: Tue, 12 Dec 2017 15:08:21 -0500 +Subject: xen/balloon: Mark unallocated host memory as UNUSABLE + +From: Boris Ostrovsky + + +[ Upstream commit b3cf8528bb21febb650a7ecbf080d0647be40b9f ] + +Commit f5775e0b6116 ("x86/xen: discard RAM regions above the maximum +reservation") left host memory not assigned to dom0 as available for +memory hotplug. + +Unfortunately this also meant that those regions could be used by +others. Specifically, commit fa564ad96366 ("x86/PCI: Enable a 64bit BAR +on AMD Family 15h (Models 00-1f, 30-3f, 60-7f)") may try to map those +addresses as MMIO. + +To prevent this mark unallocated host memory as E820_TYPE_UNUSABLE (thus +effectively reverting f5775e0b6116) and keep track of that region as +a hostmem resource that can be used for the hotplug. + +Signed-off-by: Boris Ostrovsky +Reviewed-by: Juergen Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/xen/enlighten.c | 81 +++++++++++++++++++++++++++++++++++++++++++++++ + arch/x86/xen/setup.c | 6 +-- + drivers/xen/balloon.c | 65 ++++++++++++++++++++++++++++++++----- + include/xen/balloon.h | 5 ++ + 4 files changed, 144 insertions(+), 13 deletions(-) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1,8 +1,12 @@ ++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG ++#include ++#endif + #include + #include + + #include + #include ++#include + + #include + #include +@@ -331,3 +335,80 @@ void xen_arch_unregister_cpu(int num) + } + EXPORT_SYMBOL(xen_arch_unregister_cpu); + #endif ++ ++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG ++void __init arch_xen_balloon_init(struct resource *hostmem_resource) ++{ ++ struct xen_memory_map memmap; ++ int rc; ++ unsigned int i, last_guest_ram; ++ phys_addr_t max_addr = PFN_PHYS(max_pfn); ++ struct e820_table *xen_e820_table; ++ const struct e820_entry *entry; ++ struct resource *res; ++ ++ if (!xen_initial_domain()) ++ return; ++ ++ xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL); ++ if (!xen_e820_table) ++ return; ++ ++ memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries); ++ set_xen_guest_handle(memmap.buffer, xen_e820_table->entries); ++ rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap); ++ if (rc) { ++ pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc); ++ goto out; ++ } ++ ++ last_guest_ram = 0; ++ for (i = 0; i < memmap.nr_entries; i++) { ++ if (xen_e820_table->entries[i].addr >= max_addr) ++ break; ++ if (xen_e820_table->entries[i].type == E820_TYPE_RAM) ++ last_guest_ram = i; ++ } ++ ++ entry = &xen_e820_table->entries[last_guest_ram]; ++ if (max_addr >= entry->addr + entry->size) ++ goto out; /* No unallocated host RAM. */ ++ ++ hostmem_resource->start = max_addr; ++ hostmem_resource->end = entry->addr + entry->size; ++ ++ /* ++ * Mark non-RAM regions between the end of dom0 RAM and end of host RAM ++ * as unavailable. The rest of that region can be used for hotplug-based ++ * ballooning. ++ */ ++ for (; i < memmap.nr_entries; i++) { ++ entry = &xen_e820_table->entries[i]; ++ ++ if (entry->type == E820_TYPE_RAM) ++ continue; ++ ++ if (entry->addr >= hostmem_resource->end) ++ break; ++ ++ res = kzalloc(sizeof(*res), GFP_KERNEL); ++ if (!res) ++ goto out; ++ ++ res->name = "Unavailable host RAM"; ++ res->start = entry->addr; ++ res->end = (entry->addr + entry->size < hostmem_resource->end) ? ++ entry->addr + entry->size : hostmem_resource->end; ++ rc = insert_resource(hostmem_resource, res); ++ if (rc) { ++ pr_warn("%s: Can't insert [%llx - %llx) (%d)\n", ++ __func__, res->start, res->end, rc); ++ kfree(res); ++ goto out; ++ } ++ } ++ ++ out: ++ kfree(xen_e820_table); ++} ++#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */ +--- a/arch/x86/xen/setup.c ++++ b/arch/x86/xen/setup.c +@@ -808,7 +808,6 @@ char * __init xen_memory_setup(void) + addr = xen_e820_table.entries[0].addr; + size = xen_e820_table.entries[0].size; + while (i < xen_e820_table.nr_entries) { +- bool discard = false; + + chunk_size = size; + type = xen_e820_table.entries[i].type; +@@ -824,11 +823,10 @@ char * __init xen_memory_setup(void) + xen_add_extra_mem(pfn_s, n_pfns); + xen_max_p2m_pfn = pfn_s + n_pfns; + } else +- discard = true; ++ type = E820_TYPE_UNUSABLE; + } + +- if (!discard) +- xen_align_and_add_e820_region(addr, chunk_size, type); ++ xen_align_and_add_e820_region(addr, chunk_size, type); + + addr += chunk_size; + size -= chunk_size; +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -257,10 +257,25 @@ static void release_memory_resource(stru + kfree(resource); + } + ++/* ++ * Host memory not allocated to dom0. We can use this range for hotplug-based ++ * ballooning. ++ * ++ * It's a type-less resource. Setting IORESOURCE_MEM will make resource ++ * management algorithms (arch_remove_reservations()) look into guest e820, ++ * which we don't want. ++ */ ++static struct resource hostmem_resource = { ++ .name = "Host RAM", ++}; ++ ++void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res) ++{} ++ + static struct resource *additional_memory_resource(phys_addr_t size) + { +- struct resource *res; +- int ret; ++ struct resource *res, *res_hostmem; ++ int ret = -ENOMEM; + + res = kzalloc(sizeof(*res), GFP_KERNEL); + if (!res) +@@ -269,13 +284,42 @@ static struct resource *additional_memor + res->name = "System RAM"; + res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY; + +- ret = allocate_resource(&iomem_resource, res, +- size, 0, -1, +- PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL); +- if (ret < 0) { +- pr_err("Cannot allocate new System RAM resource\n"); +- kfree(res); +- return NULL; ++ res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL); ++ if (res_hostmem) { ++ /* Try to grab a range from hostmem */ ++ res_hostmem->name = "Host memory"; ++ ret = allocate_resource(&hostmem_resource, res_hostmem, ++ size, 0, -1, ++ PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL); ++ } ++ ++ if (!ret) { ++ /* ++ * Insert this resource into iomem. Because hostmem_resource ++ * tracks portion of guest e820 marked as UNUSABLE noone else ++ * should try to use it. ++ */ ++ res->start = res_hostmem->start; ++ res->end = res_hostmem->end; ++ ret = insert_resource(&iomem_resource, res); ++ if (ret < 0) { ++ pr_err("Can't insert iomem_resource [%llx - %llx]\n", ++ res->start, res->end); ++ release_memory_resource(res_hostmem); ++ res_hostmem = NULL; ++ res->start = res->end = 0; ++ } ++ } ++ ++ if (ret) { ++ ret = allocate_resource(&iomem_resource, res, ++ size, 0, -1, ++ PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL); ++ if (ret < 0) { ++ pr_err("Cannot allocate new System RAM resource\n"); ++ kfree(res); ++ return NULL; ++ } + } + + #ifdef CONFIG_SPARSEMEM +@@ -287,6 +331,7 @@ static struct resource *additional_memor + pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n", + pfn, limit); + release_memory_resource(res); ++ release_memory_resource(res_hostmem); + return NULL; + } + } +@@ -765,6 +810,8 @@ static int __init balloon_init(void) + set_online_page_callback(&xen_online_page); + register_memory_notifier(&xen_memory_nb); + register_sysctl_table(xen_root); ++ ++ arch_xen_balloon_init(&hostmem_resource); + #endif + + #ifdef CONFIG_XEN_PV +--- a/include/xen/balloon.h ++++ b/include/xen/balloon.h +@@ -44,3 +44,8 @@ static inline void xen_balloon_init(void + { + } + #endif ++ ++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG ++struct resource; ++void arch_xen_balloon_init(struct resource *hostmem_resource); ++#endif diff --git a/queue-4.14/xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch b/queue-4.14/xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch new file mode 100644 index 00000000000..d07a705cd4e --- /dev/null +++ b/queue-4.14/xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch @@ -0,0 +1,36 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Ross Lagerwall +Date: Tue, 9 Jan 2018 12:10:21 +0000 +Subject: xen/gntdev: Fix off-by-one error when unmapping with holes + +From: Ross Lagerwall + + +[ Upstream commit 951a010233625b77cde3430b4b8785a9a22968d1 ] + +If the requested range has a hole, the calculation of the number of +pages to unmap is off by one. Fix it. + +Signed-off-by: Ross Lagerwall +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/gntdev.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -380,10 +380,8 @@ static int unmap_grant_pages(struct gran + } + range = 0; + while (range < pages) { +- if (map->unmap_ops[offset+range].handle == -1) { +- range--; ++ if (map->unmap_ops[offset+range].handle == -1) + break; +- } + range++; + } + err = __unmap_grant_pages(map, offset, range); diff --git a/queue-4.14/xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch b/queue-4.14/xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch new file mode 100644 index 00000000000..8e04a90eac4 --- /dev/null +++ b/queue-4.14/xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch @@ -0,0 +1,42 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Ross Lagerwall +Date: Tue, 9 Jan 2018 12:10:22 +0000 +Subject: xen/gntdev: Fix partial gntdev_mmap() cleanup + +From: Ross Lagerwall + + +[ Upstream commit cf2acf66ad43abb39735568f55e1f85f9844e990 ] + +When cleaning up after a partially successful gntdev_mmap(), unmap the +successfully mapped grant pages otherwise Xen will kill the domain if +in debug mode (Attempt to implicitly unmap a granted PTE) or Linux will +kill the process and emit "BUG: Bad page map in process" if Xen is in +release mode. + +This is only needed when use_ptemod is true because gntdev_put_map() +will unmap grant pages itself when use_ptemod is false. + +Signed-off-by: Ross Lagerwall +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/gntdev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -1071,8 +1071,10 @@ unlock_out: + out_unlock_put: + mutex_unlock(&priv->lock); + out_put_map: +- if (use_ptemod) ++ if (use_ptemod) { + map->vma = NULL; ++ unmap_grant_pages(map, 0, map->count); ++ } + gntdev_put_map(priv, map); + return err; + } diff --git a/queue-4.14/xen-netfront-enable-device-after-manual-module-load.patch b/queue-4.14/xen-netfront-enable-device-after-manual-module-load.patch new file mode 100644 index 00000000000..9544fdcccdc --- /dev/null +++ b/queue-4.14/xen-netfront-enable-device-after-manual-module-load.patch @@ -0,0 +1,45 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Eduardo Otubo +Date: Fri, 5 Jan 2018 09:42:16 +0100 +Subject: xen-netfront: enable device after manual module load + +From: Eduardo Otubo + + +[ Upstream commit b707fda2df4070785d0fa8a278aa13944c5f51f8 ] + +When loading the module after unloading it, the network interface would +not be enabled and thus wouldn't have a backend counterpart and unable +to be used by the guest. + +The guest would face errors like: + + [root@guest ~]# ethtool -i eth0 + Cannot get driver information: No such device + + [root@guest ~]# ifconfig eth0 + eth0: error fetching interface information: Device not found + +This patch initializes the state of the netfront device whenever it is +loaded manually, this state would communicate the netback to create its +device and establish the connection between them. + +Signed-off-by: Eduardo Otubo +Reviewed-by: Boris Ostrovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netfront.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1326,6 +1326,7 @@ static struct net_device *xennet_create_ + + netif_carrier_off(netdev); + ++ xenbus_switch_state(dev, XenbusStateInitialising); + return netdev; + + exit: diff --git a/queue-4.14/xfrm-reinject-transport-mode-packets-through-tasklet.patch b/queue-4.14/xfrm-reinject-transport-mode-packets-through-tasklet.patch new file mode 100644 index 00000000000..00a1f30083c --- /dev/null +++ b/queue-4.14/xfrm-reinject-transport-mode-packets-through-tasklet.patch @@ -0,0 +1,200 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Herbert Xu +Date: Fri, 15 Dec 2017 16:40:44 +1100 +Subject: xfrm: Reinject transport-mode packets through tasklet + +From: Herbert Xu + + +[ Upstream commit acf568ee859f098279eadf551612f103afdacb4e ] + +This is an old bugbear of mine: + +https://www.mail-archive.com/netdev@vger.kernel.org/msg03894.html + +By crafting special packets, it is possible to cause recursion +in our kernel when processing transport-mode packets at levels +that are only limited by packet size. + +The easiest one is with DNAT, but an even worse one is where +UDP encapsulation is used in which case you just have to insert +an UDP encapsulation header in between each level of recursion. + +This patch avoids this problem by reinjecting tranport-mode packets +through a tasklet. + +Fixes: b05e106698d9 ("[IPV4/6]: Netfilter IPsec input hooks") +Signed-off-by: Herbert Xu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/xfrm.h | 3 ++ + net/ipv4/xfrm4_input.c | 12 +++++++++- + net/ipv6/xfrm6_input.c | 10 +++++++- + net/xfrm/xfrm_input.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 80 insertions(+), 2 deletions(-) + +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1570,6 +1570,9 @@ int xfrm_init_state(struct xfrm_state *x + int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); + int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); + int xfrm_input_resume(struct sk_buff *skb, int nexthdr); ++int xfrm_trans_queue(struct sk_buff *skb, ++ int (*finish)(struct net *, struct sock *, ++ struct sk_buff *)); + int xfrm_output_resume(struct sk_buff *skb, int err); + int xfrm_output(struct sock *sk, struct sk_buff *skb); + int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); +--- a/net/ipv4/xfrm4_input.c ++++ b/net/ipv4/xfrm4_input.c +@@ -23,6 +23,12 @@ int xfrm4_extract_input(struct xfrm_stat + return xfrm4_extract_header(skb); + } + ++static int xfrm4_rcv_encap_finish2(struct net *net, struct sock *sk, ++ struct sk_buff *skb) ++{ ++ return dst_input(skb); ++} ++ + static inline int xfrm4_rcv_encap_finish(struct net *net, struct sock *sk, + struct sk_buff *skb) + { +@@ -33,7 +39,11 @@ static inline int xfrm4_rcv_encap_finish + iph->tos, skb->dev)) + goto drop; + } +- return dst_input(skb); ++ ++ if (xfrm_trans_queue(skb, xfrm4_rcv_encap_finish2)) ++ goto drop; ++ ++ return 0; + drop: + kfree_skb(skb); + return NET_RX_DROP; +--- a/net/ipv6/xfrm6_input.c ++++ b/net/ipv6/xfrm6_input.c +@@ -32,6 +32,14 @@ int xfrm6_rcv_spi(struct sk_buff *skb, i + } + EXPORT_SYMBOL(xfrm6_rcv_spi); + ++static int xfrm6_transport_finish2(struct net *net, struct sock *sk, ++ struct sk_buff *skb) ++{ ++ if (xfrm_trans_queue(skb, ip6_rcv_finish)) ++ __kfree_skb(skb); ++ return -1; ++} ++ + int xfrm6_transport_finish(struct sk_buff *skb, int async) + { + struct xfrm_offload *xo = xfrm_offload(skb); +@@ -56,7 +64,7 @@ int xfrm6_transport_finish(struct sk_buf + + NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, + dev_net(skb->dev), NULL, skb, skb->dev, NULL, +- ip6_rcv_finish); ++ xfrm6_transport_finish2); + return -1; + } + +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -8,15 +8,29 @@ + * + */ + ++#include ++#include + #include + #include + #include ++#include + #include + #include + #include + #include + #include + ++struct xfrm_trans_tasklet { ++ struct tasklet_struct tasklet; ++ struct sk_buff_head queue; ++}; ++ ++struct xfrm_trans_cb { ++ int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb); ++}; ++ ++#define XFRM_TRANS_SKB_CB(__skb) ((struct xfrm_trans_cb *)&((__skb)->cb[0])) ++ + static struct kmem_cache *secpath_cachep __read_mostly; + + static DEFINE_SPINLOCK(xfrm_input_afinfo_lock); +@@ -25,6 +39,8 @@ static struct xfrm_input_afinfo const __ + static struct gro_cells gro_cells; + static struct net_device xfrm_napi_dev; + ++static DEFINE_PER_CPU(struct xfrm_trans_tasklet, xfrm_trans_tasklet); ++ + int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo) + { + int err = 0; +@@ -477,9 +493,41 @@ int xfrm_input_resume(struct sk_buff *sk + } + EXPORT_SYMBOL(xfrm_input_resume); + ++static void xfrm_trans_reinject(unsigned long data) ++{ ++ struct xfrm_trans_tasklet *trans = (void *)data; ++ struct sk_buff_head queue; ++ struct sk_buff *skb; ++ ++ __skb_queue_head_init(&queue); ++ skb_queue_splice_init(&trans->queue, &queue); ++ ++ while ((skb = __skb_dequeue(&queue))) ++ XFRM_TRANS_SKB_CB(skb)->finish(dev_net(skb->dev), NULL, skb); ++} ++ ++int xfrm_trans_queue(struct sk_buff *skb, ++ int (*finish)(struct net *, struct sock *, ++ struct sk_buff *)) ++{ ++ struct xfrm_trans_tasklet *trans; ++ ++ trans = this_cpu_ptr(&xfrm_trans_tasklet); ++ ++ if (skb_queue_len(&trans->queue) >= netdev_max_backlog) ++ return -ENOBUFS; ++ ++ XFRM_TRANS_SKB_CB(skb)->finish = finish; ++ skb_queue_tail(&trans->queue, skb); ++ tasklet_schedule(&trans->tasklet); ++ return 0; ++} ++EXPORT_SYMBOL(xfrm_trans_queue); ++ + void __init xfrm_input_init(void) + { + int err; ++ int i; + + init_dummy_netdev(&xfrm_napi_dev); + err = gro_cells_init(&gro_cells, &xfrm_napi_dev); +@@ -490,4 +538,13 @@ void __init xfrm_input_init(void) + sizeof(struct sec_path), + 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, + NULL); ++ ++ for_each_possible_cpu(i) { ++ struct xfrm_trans_tasklet *trans; ++ ++ trans = &per_cpu(xfrm_trans_tasklet, i); ++ __skb_queue_head_init(&trans->queue); ++ tasklet_init(&trans->tasklet, xfrm_trans_reinject, ++ (unsigned long)trans); ++ } + } diff --git a/queue-4.14/xfs-quota-check-result-of-register_shrinker.patch b/queue-4.14/xfs-quota-check-result-of-register_shrinker.patch new file mode 100644 index 00000000000..abfe2d47cff --- /dev/null +++ b/queue-4.14/xfs-quota-check-result-of-register_shrinker.patch @@ -0,0 +1,108 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Aliaksei Karaliou +Date: Thu, 21 Dec 2017 13:18:26 -0800 +Subject: xfs: quota: check result of register_shrinker() + +From: Aliaksei Karaliou + + +[ Upstream commit 3a3882ff26fbdbaf5f7e13f6a0bccfbf7121041d ] + +xfs_qm_init_quotainfo() does not check result of register_shrinker() +which was tagged as __must_check recently, reported by sparse. + +Signed-off-by: Aliaksei Karaliou +[darrick: move xfs_qm_destroy_quotainos nearer xfs_qm_init_quotainos] +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/xfs/xfs_qm.c | 45 +++++++++++++++++++++++++++++---------------- + 1 file changed, 29 insertions(+), 16 deletions(-) + +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -48,7 +48,7 @@ + STATIC int xfs_qm_init_quotainos(xfs_mount_t *); + STATIC int xfs_qm_init_quotainfo(xfs_mount_t *); + +- ++STATIC void xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi); + STATIC void xfs_qm_dqfree_one(struct xfs_dquot *dqp); + /* + * We use the batch lookup interface to iterate over the dquots as it +@@ -695,9 +695,17 @@ xfs_qm_init_quotainfo( + qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan; + qinf->qi_shrinker.seeks = DEFAULT_SEEKS; + qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE; +- register_shrinker(&qinf->qi_shrinker); ++ ++ error = register_shrinker(&qinf->qi_shrinker); ++ if (error) ++ goto out_free_inos; ++ + return 0; + ++out_free_inos: ++ mutex_destroy(&qinf->qi_quotaofflock); ++ mutex_destroy(&qinf->qi_tree_lock); ++ xfs_qm_destroy_quotainos(qinf); + out_free_lru: + list_lru_destroy(&qinf->qi_lru); + out_free_qinf: +@@ -706,7 +714,6 @@ out_free_qinf: + return error; + } + +- + /* + * Gets called when unmounting a filesystem or when all quotas get + * turned off. +@@ -723,19 +730,7 @@ xfs_qm_destroy_quotainfo( + + unregister_shrinker(&qi->qi_shrinker); + list_lru_destroy(&qi->qi_lru); +- +- if (qi->qi_uquotaip) { +- IRELE(qi->qi_uquotaip); +- qi->qi_uquotaip = NULL; /* paranoia */ +- } +- if (qi->qi_gquotaip) { +- IRELE(qi->qi_gquotaip); +- qi->qi_gquotaip = NULL; +- } +- if (qi->qi_pquotaip) { +- IRELE(qi->qi_pquotaip); +- qi->qi_pquotaip = NULL; +- } ++ xfs_qm_destroy_quotainos(qi); + mutex_destroy(&qi->qi_tree_lock); + mutex_destroy(&qi->qi_quotaofflock); + kmem_free(qi); +@@ -1601,6 +1596,24 @@ error_rele: + } + + STATIC void ++xfs_qm_destroy_quotainos( ++ xfs_quotainfo_t *qi) ++{ ++ if (qi->qi_uquotaip) { ++ IRELE(qi->qi_uquotaip); ++ qi->qi_uquotaip = NULL; /* paranoia */ ++ } ++ if (qi->qi_gquotaip) { ++ IRELE(qi->qi_gquotaip); ++ qi->qi_gquotaip = NULL; ++ } ++ if (qi->qi_pquotaip) { ++ IRELE(qi->qi_pquotaip); ++ qi->qi_pquotaip = NULL; ++ } ++} ++ ++STATIC void + xfs_qm_dqfree_one( + struct xfs_dquot *dqp) + { diff --git a/queue-4.14/xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch b/queue-4.14/xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch new file mode 100644 index 00000000000..33b6e30a203 --- /dev/null +++ b/queue-4.14/xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch @@ -0,0 +1,32 @@ +From foo@baz Wed Feb 28 16:23:28 CET 2018 +From: Aliaksei Karaliou +Date: Thu, 21 Dec 2017 13:18:26 -0800 +Subject: xfs: quota: fix missed destroy of qi_tree_lock + +From: Aliaksei Karaliou + + +[ Upstream commit 2196881566225f3c3428d1a5f847a992944daa5b ] + +xfs_qm_destroy_quotainfo() does not destroy quotainfo->qi_tree_lock +while destroys quotainfo->qi_quotaofflock. + +Signed-off-by: Aliaksei Karaliou +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/xfs/xfs_qm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -736,6 +736,7 @@ xfs_qm_destroy_quotainfo( + IRELE(qi->qi_pquotaip); + qi->qi_pquotaip = NULL; + } ++ mutex_destroy(&qi->qi_tree_lock); + mutex_destroy(&qi->qi_quotaofflock); + kmem_free(qi); + mp->m_quotainfo = NULL; -- 2.47.3