From a4bae697dd20c55d716ca05f6931a82568ead5c4 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 17 Jul 2020 12:16:18 -0400 Subject: [PATCH] Fixes for 5.7 Signed-off-by: Sasha Levin --- ...-missing-sentinel-to-erratum_1463225.patch | 39 +++++++++ ...eta-add-back-interface-mode-validati.patch | 81 +++++++++++++++++++ ...eta-do-not-error-out-in-non-serdes-m.patch | 44 ++++++++++ ...x-make-1-bit-bit-fields-unsigned-int.patch | 42 ++++++++++ queue-5.7/series | 6 ++ ...-fix-lockup-if-device-is-shutdown-du.patch | 60 ++++++++++++++ ...-a-double-free-in-xenbus_map_ring_pv.patch | 41 ++++++++++ 7 files changed, 313 insertions(+) create mode 100644 queue-5.7/arm64-add-missing-sentinel-to-erratum_1463225.patch create mode 100644 queue-5.7/net-ethernet-mvneta-add-back-interface-mode-validati.patch create mode 100644 queue-5.7/net-ethernet-mvneta-do-not-error-out-in-non-serdes-m.patch create mode 100644 queue-5.7/scsi-qla2xxx-make-1-bit-bit-fields-unsigned-int.patch create mode 100644 queue-5.7/spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch create mode 100644 queue-5.7/xen-xenbus-fix-a-double-free-in-xenbus_map_ring_pv.patch diff --git a/queue-5.7/arm64-add-missing-sentinel-to-erratum_1463225.patch b/queue-5.7/arm64-add-missing-sentinel-to-erratum_1463225.patch new file mode 100644 index 00000000000..a9f9cea2602 --- /dev/null +++ b/queue-5.7/arm64-add-missing-sentinel-to-erratum_1463225.patch @@ -0,0 +1,39 @@ +From 9517949d20001f246cd52f5c4ad20ce6925132a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 22:13:40 -0700 +Subject: arm64: Add missing sentinel to erratum_1463225 + +From: Florian Fainelli + +[ Upstream commit 09c717c92b52df54918e12cbfe6a4658233fda69 ] + +When the erratum_1463225 array was introduced a sentinel at the end was +missing thus causing a KASAN: global-out-of-bounds in +is_affected_midr_range_list on arm64 error. + +Fixes: a9e821b89daa ("arm64: Add KRYO4XX gold CPU cores to erratum list 1463225 and 1418040") +Signed-off-by: Florian Fainelli +Reviewed-by: Sai Prakash Ranjan +Link: https://lore.kernel.org/linux-arm-kernel/CA+G9fYs3EavpU89-rTQfqQ9GgxAMgMAk7jiiVrfP0yxj5s+Q6g@mail.gmail.com/ +Link: https://lore.kernel.org/r/20200709051345.14544-1-f.fainelli@gmail.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpu_errata.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index dbf266212808e..f9387c1252325 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -778,6 +778,7 @@ static const struct midr_range erratum_1463225[] = { + MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 1), + /* Kryo4xx Gold (rcpe to rfpf) => (r0p0 to r3p1) */ + MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xf), ++ {}, + }; + #endif + +-- +2.25.1 + diff --git a/queue-5.7/net-ethernet-mvneta-add-back-interface-mode-validati.patch b/queue-5.7/net-ethernet-mvneta-add-back-interface-mode-validati.patch new file mode 100644 index 00000000000..17f7a5907dc --- /dev/null +++ b/queue-5.7/net-ethernet-mvneta-add-back-interface-mode-validati.patch @@ -0,0 +1,81 @@ +From e6c21a6d57983db1c775968b2e1de2b5bea7bbdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 09:00:45 +0200 +Subject: net: ethernet: mvneta: Add back interface mode validation + +From: Sascha Hauer + +[ Upstream commit 41c2b6b4f0f807803bb49f65835d136941a70f85 ] + +When writing the serdes configuration register was moved to +mvneta_config_interface() the whole code block was removed from +mvneta_port_power_up() in the assumption that its only purpose was to +write the serdes configuration register. As mentioned by Russell King +its purpose was also to check for valid interface modes early so that +later in the driver we do not have to care for unexpected interface +modes. +Add back the test to let the driver bail out early on unhandled +interface modes. + +Fixes: b4748553f53f ("net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy") +Signed-off-by: Sascha Hauer +Reviewed-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 7faeb4bfc282e..b2da295e2fc01 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -5003,10 +5003,18 @@ static void mvneta_conf_mbus_windows(struct mvneta_port *pp, + } + + /* Power up the port */ +-static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode) ++static int mvneta_port_power_up(struct mvneta_port *pp, int phy_mode) + { + /* MAC Cause register should be cleared */ + mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0); ++ ++ if (phy_mode != PHY_INTERFACE_MODE_QSGMII && ++ phy_mode != PHY_INTERFACE_MODE_SGMII && ++ !phy_interface_mode_is_8023z(phy_mode) && ++ !phy_interface_mode_is_rgmii(phy_mode)) ++ return -EINVAL; ++ ++ return 0; + } + + /* Device initialization routine */ +@@ -5192,7 +5200,11 @@ static int mvneta_probe(struct platform_device *pdev) + if (err < 0) + goto err_netdev; + +- mvneta_port_power_up(pp, phy_mode); ++ err = mvneta_port_power_up(pp, pp->phy_interface); ++ if (err < 0) { ++ dev_err(&pdev->dev, "can't power up port\n"); ++ return err; ++ } + + /* Armada3700 network controller does not support per-cpu + * operation, so only single NAPI should be initialized. +@@ -5346,7 +5358,11 @@ static int mvneta_resume(struct device *device) + } + } + mvneta_defaults_set(pp); +- mvneta_port_power_up(pp, pp->phy_interface); ++ err = mvneta_port_power_up(pp, pp->phy_interface); ++ if (err < 0) { ++ dev_err(device, "can't power up port\n"); ++ return err; ++ } + + netif_device_attach(dev); + +-- +2.25.1 + diff --git a/queue-5.7/net-ethernet-mvneta-do-not-error-out-in-non-serdes-m.patch b/queue-5.7/net-ethernet-mvneta-do-not-error-out-in-non-serdes-m.patch new file mode 100644 index 00000000000..0d9eb9597b0 --- /dev/null +++ b/queue-5.7/net-ethernet-mvneta-do-not-error-out-in-non-serdes-m.patch @@ -0,0 +1,44 @@ +From 32915f5dfeb8f2ece6caa3b4a164b1210754008f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 09:00:44 +0200 +Subject: net: ethernet: mvneta: Do not error out in non serdes modes + +From: Sascha Hauer + +[ Upstream commit d3d239dcb8aae6d7b10642d292b404e57604f7ea ] + +In mvneta_config_interface() the RGMII modes are catched by the default +case which is an error return. The RGMII modes are valid modes for the +driver, so instead of returning an error add a break statement to return +successfully. + +This avoids this warning for non comphy SoCs which use RGMII, like +SolidRun Clearfog: + +WARNING: CPU: 0 PID: 268 at drivers/net/ethernet/marvell/mvneta.c:3512 mvneta_start_dev+0x220/0x23c + +Fixes: b4748553f53f ("net: ethernet: mvneta: Fix Serdes configuration for SoCs without comphy") +Signed-off-by: Sascha Hauer +Reviewed-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index cf26cf4e47aa8..7faeb4bfc282e 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -3565,7 +3565,7 @@ static int mvneta_config_interface(struct mvneta_port *pp, + MVNETA_HSGMII_SERDES_PROTO); + break; + default: +- return -EINVAL; ++ break; + } + } + +-- +2.25.1 + diff --git a/queue-5.7/scsi-qla2xxx-make-1-bit-bit-fields-unsigned-int.patch b/queue-5.7/scsi-qla2xxx-make-1-bit-bit-fields-unsigned-int.patch new file mode 100644 index 00000000000..953a0c19491 --- /dev/null +++ b/queue-5.7/scsi-qla2xxx-make-1-bit-bit-fields-unsigned-int.patch @@ -0,0 +1,42 @@ +From af9cba6f742a9230a97408832ef83b2b3a86d004 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Apr 2020 11:20:13 +0100 +Subject: scsi: qla2xxx: make 1-bit bit-fields unsigned int + +From: Colin Ian King + +[ Upstream commit 78b874b7cbf09fbfadfa5f18a347ebef7bbb49fe ] + +The bitfields mpi_fw_dump_reading and mpi_fw_dumped are currently signed +which is not recommended as the representation is an implementation defined +behaviour. Fix this by making the bit-fields unsigned ints. + +Link: https://lore.kernel.org/r/20200428102013.1040598-1-colin.king@canonical.com +Fixes: cbb01c2f2f63 ("scsi: qla2xxx: Fix MPI failure AEN (8200) handling") +Reviewed-by: Bart Van Assche +Reviewed-by: Himanshu Madhani +Signed-off-by: Colin Ian King +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index daa9e936887bb..172ea4e5887d9 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -4248,8 +4248,8 @@ struct qla_hw_data { + int fw_dump_reading; + void *mpi_fw_dump; + u32 mpi_fw_dump_len; +- int mpi_fw_dump_reading:1; +- int mpi_fw_dumped:1; ++ unsigned int mpi_fw_dump_reading:1; ++ unsigned int mpi_fw_dumped:1; + int prev_minidump_failed; + dma_addr_t eft_dma; + void *eft; +-- +2.25.1 + diff --git a/queue-5.7/series b/queue-5.7/series index 8d61bebc040..c3e7c738a3b 100644 --- a/queue-5.7/series +++ b/queue-5.7/series @@ -66,3 +66,9 @@ iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch iio-pressure-ms5611-fix-buffer-element-alignment.patch iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch +arm64-add-missing-sentinel-to-erratum_1463225.patch +xen-xenbus-fix-a-double-free-in-xenbus_map_ring_pv.patch +net-ethernet-mvneta-do-not-error-out-in-non-serdes-m.patch +net-ethernet-mvneta-add-back-interface-mode-validati.patch +scsi-qla2xxx-make-1-bit-bit-fields-unsigned-int.patch +spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch diff --git a/queue-5.7/spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch b/queue-5.7/spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch new file mode 100644 index 00000000000..b0badd8bbbe --- /dev/null +++ b/queue-5.7/spi-spi-fsl-dspi-fix-lockup-if-device-is-shutdown-du.patch @@ -0,0 +1,60 @@ +From 11de8c48a1271655e6b14fcd3955ffc544a08645 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jun 2020 13:05:41 +0200 +Subject: spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI + transfer + +From: Krzysztof Kozlowski + +[ Upstream commit 3c525b69e8c1a9a6944e976603c7a1a713e728f9 ] + +During shutdown, the driver should unregister the SPI controller +and stop the hardware. Otherwise the dspi_transfer_one_message() could +wait on completion infinitely. + +Additionally, calling spi_unregister_controller() first in device +shutdown reverse-matches the probe function, where SPI controller is +registered at the end. + +Fixes: dc234825997e ("spi: spi-fsl-dspi: Adding shutdown hook") +Reported-by: Vladimir Oltean +Signed-off-by: Krzysztof Kozlowski +Tested-by: Vladimir Oltean +Reviewed-by: Vladimir Oltean +Cc: +Link: https://lore.kernel.org/r/20200622110543.5035-2-krzk@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-dspi.c | 15 +-------------- + 1 file changed, 1 insertion(+), 14 deletions(-) + +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 38d337f0967db..e0b30e4b1b695 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -1461,20 +1461,7 @@ static int dspi_remove(struct platform_device *pdev) + + static void dspi_shutdown(struct platform_device *pdev) + { +- struct spi_controller *ctlr = platform_get_drvdata(pdev); +- struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr); +- +- /* Disable RX and TX */ +- regmap_update_bits(dspi->regmap, SPI_MCR, +- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF, +- SPI_MCR_DIS_TXF | SPI_MCR_DIS_RXF); +- +- /* Stop Running */ +- regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, SPI_MCR_HALT); +- +- dspi_release_dma(dspi); +- clk_disable_unprepare(dspi->clk); +- spi_unregister_controller(dspi->ctlr); ++ dspi_remove(pdev); + } + + static struct platform_driver fsl_dspi_driver = { +-- +2.25.1 + diff --git a/queue-5.7/xen-xenbus-fix-a-double-free-in-xenbus_map_ring_pv.patch b/queue-5.7/xen-xenbus-fix-a-double-free-in-xenbus_map_ring_pv.patch new file mode 100644 index 00000000000..19b1c912517 --- /dev/null +++ b/queue-5.7/xen-xenbus-fix-a-double-free-in-xenbus_map_ring_pv.patch @@ -0,0 +1,41 @@ +From bef4c9cfeda8f7a81ff11ab62053c8edbe9e52bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 14:36:10 +0300 +Subject: xen/xenbus: Fix a double free in xenbus_map_ring_pv() + +From: Dan Carpenter + +[ Upstream commit ba8c423488974f02b538e9dc1730f0334f9b85aa ] + +When there is an error the caller frees "info->node" so the free here +will result in a double free. We should just delete first kfree(). + +Fixes: 3848e4e0a32a ("xen/xenbus: avoid large structs and arrays on the stack") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200710113610.GA92345@mwanda +Reviewed-by: Juergen Gross +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + drivers/xen/xenbus/xenbus_client.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c +index 4f168b46fbca5..786fbb7d8be06 100644 +--- a/drivers/xen/xenbus/xenbus_client.c ++++ b/drivers/xen/xenbus/xenbus_client.c +@@ -693,10 +693,8 @@ static int xenbus_map_ring_pv(struct xenbus_device *dev, + bool leaked; + + area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, info->ptes); +- if (!area) { +- kfree(node); ++ if (!area) + return -ENOMEM; +- } + + for (i = 0; i < nr_grefs; i++) + info->phys_addrs[i] = +-- +2.25.1 + -- 2.47.3