From a6660012249193ca272766f5298c0df42007b11f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 18 May 2020 16:40:28 +0200 Subject: [PATCH] 5.6-stable patches added patches: arm-dts-r8a73a4-add-missing-cmt1-interrupts.patch arm-dts-r8a7740-add-missing-extal2-to-cpg-node.patch arm64-dts-imx8mn-change-sdma1-ahb-clock-for-imx8mn.patch arm64-dts-meson-g12-common-fix-dwc2-clock-names.patch arm64-dts-meson-g12b-khadas-vim3-add-missing-frddr_a-status-property.patch arm64-dts-meson-g12b-ugoos-am6-fix-usb-vbus-supply.patch arm64-dts-qcom-msm8996-reduce-vdd_apc-voltage.patch arm64-dts-renesas-r8a77980-fix-ipmmu-vip-nodes.patch arm64-dts-rockchip-rename-dwc3-device-nodes-on-rk3399-to-make-dtc-happy.patch arm64-dts-rockchip-replace-rk805-pmic-node-name-with-pmic-on-rk3328-boards.patch bpf-enforce-returning-0-for-fentry-fexit-progs.patch bpf-fix-sk_psock-refcnt-leak-when-receiving-message.patch bpf-restrict-bpf_trace_printk-s-s-usage-and-add-pks-pus-specifier.patch clk-ti-clkctrl-fix-bad-of_node_put-within-clkctrl_get_name.patch clk-unlink-clock-if-failed-to-prepare-or-enable.patch dt-bindings-dma-fsl-edma-fix-ls1028a-edma-compatible.patch fanotify-fix-merging-marks-masks-with-fan_ondir.patch kvm-x86-fix-off-by-one-error-in-kvm_vcpu_ioctl_x86_setup_mce.patch makefile-disallow-data-races-on-gcc-10-as-well.patch powerpc-ima-fix-secure-boot-rules-in-ima-arch-policy.patch powerpc-uaccess-evaluate-macro-arguments-once-before-user-access-is-allowed.patch rdma-uverbs-do-not-discard-the-ib_event_device_fatal-event.patch rdma-uverbs-move-ib_event_device_fatal-to-destroy_uobj.patch revert-alsa-hda-realtek-fix-pop-noise-on-alc225.patch riscv-perf-riscv_base_pmu-should-be-independent.patch selftests-bpf-enforce-returning-0-for-fentry-fexit-programs.patch sunrpc-revert-241b1f419f0e-sunrpc-remove-xdr_buf_trim.patch usb-gadget-audio-fix-a-missing-error-return-value-in-audio_bind.patch usb-gadget-legacy-fix-error-return-code-in-cdc_bind.patch usb-gadget-legacy-fix-error-return-code-in-gncm_bind.patch usb-gadget-net2272-fix-a-memory-leak-in-an-error-handling-path-in-net2272_plat_probe.patch usb-gadget-tegra-xudc-fix-idle-suspend-resume.patch --- ...-r8a73a4-add-missing-cmt1-interrupts.patch | 40 ++++ ...a7740-add-missing-extal2-to-cpg-node.patch | 38 +++ ...mn-change-sdma1-ahb-clock-for-imx8mn.patch | 34 +++ ...eson-g12-common-fix-dwc2-clock-names.patch | 33 +++ ...-add-missing-frddr_a-status-property.patch | 40 ++++ ...n-g12b-ugoos-am6-fix-usb-vbus-supply.patch | 34 +++ ...-qcom-msm8996-reduce-vdd_apc-voltage.patch | 38 +++ ...renesas-r8a77980-fix-ipmmu-vip-nodes.patch | 39 +++ ...ce-nodes-on-rk3399-to-make-dtc-happy.patch | 46 ++++ ...node-name-with-pmic-on-rk3328-boards.patch | 49 ++++ ...e-returning-0-for-fentry-fexit-progs.patch | 63 +++++ ...k-refcnt-leak-when-receiving-message.patch | 58 +++++ ...-s-s-usage-and-add-pks-pus-specifier.patch | 226 ++++++++++++++++++ ...-of_node_put-within-clkctrl_get_name.patch | 39 +++ ...clock-if-failed-to-prepare-or-enable.patch | 42 ++++ ...fsl-edma-fix-ls1028a-edma-compatible.patch | 36 +++ ...x-merging-marks-masks-with-fan_ondir.patch | 67 ++++++ ...rror-in-kvm_vcpu_ioctl_x86_setup_mce.patch | 37 +++ ...isallow-data-races-on-gcc-10-as-well.patch | 34 +++ ...secure-boot-rules-in-ima-arch-policy.patch | 60 +++++ ...s-once-before-user-access-is-allowed.patch | 150 ++++++++++++ ...card-the-ib_event_device_fatal-event.patch | 106 ++++++++ ...b_event_device_fatal-to-destroy_uobj.patch | 83 +++++++ ...-hda-realtek-fix-pop-noise-on-alc225.patch | 36 +++ ...riscv_base_pmu-should-be-independent.patch | 65 +++++ ...eturning-0-for-fentry-fexit-programs.patch | 42 ++++ queue-5.6/series | 32 +++ ...b1f419f0e-sunrpc-remove-xdr_buf_trim.patch | 136 +++++++++++ ...ing-error-return-value-in-audio_bind.patch | 35 +++ ...cy-fix-error-return-code-in-cdc_bind.patch | 36 +++ ...y-fix-error-return-code-in-gncm_bind.patch | 36 +++ ...-handling-path-in-net2272_plat_probe.patch | 33 +++ ...t-tegra-xudc-fix-idle-suspend-resume.patch | 45 ++++ 33 files changed, 1888 insertions(+) create mode 100644 queue-5.6/arm-dts-r8a73a4-add-missing-cmt1-interrupts.patch create mode 100644 queue-5.6/arm-dts-r8a7740-add-missing-extal2-to-cpg-node.patch create mode 100644 queue-5.6/arm64-dts-imx8mn-change-sdma1-ahb-clock-for-imx8mn.patch create mode 100644 queue-5.6/arm64-dts-meson-g12-common-fix-dwc2-clock-names.patch create mode 100644 queue-5.6/arm64-dts-meson-g12b-khadas-vim3-add-missing-frddr_a-status-property.patch create mode 100644 queue-5.6/arm64-dts-meson-g12b-ugoos-am6-fix-usb-vbus-supply.patch create mode 100644 queue-5.6/arm64-dts-qcom-msm8996-reduce-vdd_apc-voltage.patch create mode 100644 queue-5.6/arm64-dts-renesas-r8a77980-fix-ipmmu-vip-nodes.patch create mode 100644 queue-5.6/arm64-dts-rockchip-rename-dwc3-device-nodes-on-rk3399-to-make-dtc-happy.patch create mode 100644 queue-5.6/arm64-dts-rockchip-replace-rk805-pmic-node-name-with-pmic-on-rk3328-boards.patch create mode 100644 queue-5.6/bpf-enforce-returning-0-for-fentry-fexit-progs.patch create mode 100644 queue-5.6/bpf-fix-sk_psock-refcnt-leak-when-receiving-message.patch create mode 100644 queue-5.6/bpf-restrict-bpf_trace_printk-s-s-usage-and-add-pks-pus-specifier.patch create mode 100644 queue-5.6/clk-ti-clkctrl-fix-bad-of_node_put-within-clkctrl_get_name.patch create mode 100644 queue-5.6/clk-unlink-clock-if-failed-to-prepare-or-enable.patch create mode 100644 queue-5.6/dt-bindings-dma-fsl-edma-fix-ls1028a-edma-compatible.patch create mode 100644 queue-5.6/fanotify-fix-merging-marks-masks-with-fan_ondir.patch create mode 100644 queue-5.6/kvm-x86-fix-off-by-one-error-in-kvm_vcpu_ioctl_x86_setup_mce.patch create mode 100644 queue-5.6/makefile-disallow-data-races-on-gcc-10-as-well.patch create mode 100644 queue-5.6/powerpc-ima-fix-secure-boot-rules-in-ima-arch-policy.patch create mode 100644 queue-5.6/powerpc-uaccess-evaluate-macro-arguments-once-before-user-access-is-allowed.patch create mode 100644 queue-5.6/rdma-uverbs-do-not-discard-the-ib_event_device_fatal-event.patch create mode 100644 queue-5.6/rdma-uverbs-move-ib_event_device_fatal-to-destroy_uobj.patch create mode 100644 queue-5.6/revert-alsa-hda-realtek-fix-pop-noise-on-alc225.patch create mode 100644 queue-5.6/riscv-perf-riscv_base_pmu-should-be-independent.patch create mode 100644 queue-5.6/selftests-bpf-enforce-returning-0-for-fentry-fexit-programs.patch create mode 100644 queue-5.6/sunrpc-revert-241b1f419f0e-sunrpc-remove-xdr_buf_trim.patch create mode 100644 queue-5.6/usb-gadget-audio-fix-a-missing-error-return-value-in-audio_bind.patch create mode 100644 queue-5.6/usb-gadget-legacy-fix-error-return-code-in-cdc_bind.patch create mode 100644 queue-5.6/usb-gadget-legacy-fix-error-return-code-in-gncm_bind.patch create mode 100644 queue-5.6/usb-gadget-net2272-fix-a-memory-leak-in-an-error-handling-path-in-net2272_plat_probe.patch create mode 100644 queue-5.6/usb-gadget-tegra-xudc-fix-idle-suspend-resume.patch diff --git a/queue-5.6/arm-dts-r8a73a4-add-missing-cmt1-interrupts.patch b/queue-5.6/arm-dts-r8a73a4-add-missing-cmt1-interrupts.patch new file mode 100644 index 00000000000..e51b3c2cd0f --- /dev/null +++ b/queue-5.6/arm-dts-r8a73a4-add-missing-cmt1-interrupts.patch @@ -0,0 +1,40 @@ +From 0f739fdfe9e5ce668bd6d3210f310df282321837 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 8 Apr 2020 11:09:26 +0200 +Subject: ARM: dts: r8a73a4: Add missing CMT1 interrupts + +From: Geert Uytterhoeven + +commit 0f739fdfe9e5ce668bd6d3210f310df282321837 upstream. + +The R-Mobile APE6 Compare Match Timer 1 generates 8 interrupts, one for +each channel, but currently only 1 is described. +Fix this by adding the missing interrupts. + +Fixes: f7b65230019b9dac ("ARM: shmobile: r8a73a4: Add CMT1 node") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20200408090926.25201-1-geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/r8a73a4.dtsi | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/r8a73a4.dtsi ++++ b/arch/arm/boot/dts/r8a73a4.dtsi +@@ -131,7 +131,14 @@ + cmt1: timer@e6130000 { + compatible = "renesas,r8a73a4-cmt1", "renesas,rcar-gen2-cmt1"; + reg = <0 0xe6130000 0 0x1004>; +- interrupts = ; ++ interrupts = , ++ , ++ , ++ , ++ , ++ , ++ , ++ ; + clocks = <&mstp3_clks R8A73A4_CLK_CMT1>; + clock-names = "fck"; + power-domains = <&pd_c5>; diff --git a/queue-5.6/arm-dts-r8a7740-add-missing-extal2-to-cpg-node.patch b/queue-5.6/arm-dts-r8a7740-add-missing-extal2-to-cpg-node.patch new file mode 100644 index 00000000000..1bccdb27197 --- /dev/null +++ b/queue-5.6/arm-dts-r8a7740-add-missing-extal2-to-cpg-node.patch @@ -0,0 +1,38 @@ +From e47cb97f153193d4b41ca8d48127da14513d54c7 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 8 May 2020 11:59:18 +0200 +Subject: ARM: dts: r8a7740: Add missing extal2 to CPG node + +From: Geert Uytterhoeven + +commit e47cb97f153193d4b41ca8d48127da14513d54c7 upstream. + +The Clock Pulse Generator (CPG) device node lacks the extal2 clock. +This may lead to a failure registering the "r" clock, or to a wrong +parent for the "usb24s" clock, depending on MD_CK2 pin configuration and +boot loader CPG_USBCKCR register configuration. + +This went unnoticed, as this does not affect the single upstream board +configuration, which relies on the first clock input only. + +Fixes: d9ffd583bf345e2e ("ARM: shmobile: r8a7740: add SoC clocks to DTS") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Ulrich Hecht +Link: https://lore.kernel.org/r/20200508095918.6061-1-geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/r8a7740.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/r8a7740.dtsi ++++ b/arch/arm/boot/dts/r8a7740.dtsi +@@ -479,7 +479,7 @@ + cpg_clocks: cpg_clocks@e6150000 { + compatible = "renesas,r8a7740-cpg-clocks"; + reg = <0xe6150000 0x10000>; +- clocks = <&extal1_clk>, <&extalr_clk>; ++ clocks = <&extal1_clk>, <&extal2_clk>, <&extalr_clk>; + #clock-cells = <1>; + clock-output-names = "system", "pllc0", "pllc1", + "pllc2", "r", diff --git a/queue-5.6/arm64-dts-imx8mn-change-sdma1-ahb-clock-for-imx8mn.patch b/queue-5.6/arm64-dts-imx8mn-change-sdma1-ahb-clock-for-imx8mn.patch new file mode 100644 index 00000000000..6869e83b2d3 --- /dev/null +++ b/queue-5.6/arm64-dts-imx8mn-change-sdma1-ahb-clock-for-imx8mn.patch @@ -0,0 +1,34 @@ +From 15ddc3e17aec0de4c69d595b873e184432b9791d Mon Sep 17 00:00:00 2001 +From: Adam Ford +Date: Fri, 27 Mar 2020 21:33:53 -0500 +Subject: arm64: dts: imx8mn: Change SDMA1 ahb clock for imx8mn + +From: Adam Ford + +commit 15ddc3e17aec0de4c69d595b873e184432b9791d upstream. + +Using SDMA1 with UART1 is causing a "Timeout waiting for CH0" error. +This patch changes to ahb clock from SDMA1_ROOT to AHB which fixes the +timeout error. + +Fixes: 6c3debcbae47 ("arm64: dts: freescale: Add i.MX8MN dtsi support") + +Signed-off-by: Adam Ford +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -661,7 +661,7 @@ + reg = <0x30bd0000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SDMA1_ROOT>, +- <&clk IMX8MN_CLK_SDMA1_ROOT>; ++ <&clk IMX8MN_CLK_AHB>; + clock-names = "ipg", "ahb"; + #dma-cells = <3>; + fsl,sdma-ram-script-name = "imx/sdma/sdma-imx7d.bin"; diff --git a/queue-5.6/arm64-dts-meson-g12-common-fix-dwc2-clock-names.patch b/queue-5.6/arm64-dts-meson-g12-common-fix-dwc2-clock-names.patch new file mode 100644 index 00000000000..d56741619e1 --- /dev/null +++ b/queue-5.6/arm64-dts-meson-g12-common-fix-dwc2-clock-names.patch @@ -0,0 +1,33 @@ +From e4f634d812634067b0c661af2e3cecfd629c89b8 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Thu, 26 Mar 2020 17:08:57 +0100 +Subject: arm64: dts: meson-g12-common: fix dwc2 clock names + +From: Neil Armstrong + +commit e4f634d812634067b0c661af2e3cecfd629c89b8 upstream. + +Use the correct dwc2 clock name. + +Fixes: 9baf7d6be730 ("arm64: dts: meson: g12a: Add G12A USB nodes") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20200326160857.11929-3-narmstrong@baylibre.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +@@ -2204,7 +2204,7 @@ + reg = <0x0 0xff400000 0x0 0x40000>; + interrupts = ; + clocks = <&clkc CLKID_USB1_DDR_BRIDGE>; +- clock-names = "ddr"; ++ clock-names = "otg"; + phys = <&usb2_phy1>; + phy-names = "usb2-phy"; + dr_mode = "peripheral"; diff --git a/queue-5.6/arm64-dts-meson-g12b-khadas-vim3-add-missing-frddr_a-status-property.patch b/queue-5.6/arm64-dts-meson-g12b-khadas-vim3-add-missing-frddr_a-status-property.patch new file mode 100644 index 00000000000..ca99f5136c5 --- /dev/null +++ b/queue-5.6/arm64-dts-meson-g12b-khadas-vim3-add-missing-frddr_a-status-property.patch @@ -0,0 +1,40 @@ +From 5ac0869fb39b1c1ba84d4d75c550f82e0bf44c96 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Fri, 18 Oct 2019 14:02:16 +0000 +Subject: arm64: dts: meson-g12b-khadas-vim3: add missing frddr_a status property + +From: Neil Armstrong + +commit 5ac0869fb39b1c1ba84d4d75c550f82e0bf44c96 upstream. + +In the process of moving the VIM3 audio nodes to a G12B specific dtsi +for enabling the SM1 based VIM3L, the frddr_a status = "okay" property +got dropped. +This re-enables the frddr_a node to fix audio support. + +Fixes: 4f26cc1c96c9 ("arm64: dts: khadas-vim3: move common nodes into meson-khadas-vim3.dtsi") +Reported-by: Christian Hewitt +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Reviewed-by: Jerome Brunet +Tested-by: Jerome Brunet +Link: https://lore.kernel.org/r/20191018140216.4257-1-narmstrong@baylibre.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi +@@ -152,6 +152,10 @@ + clock-latency = <50000>; + }; + ++&frddr_a { ++ status = "okay"; ++}; ++ + &frddr_b { + status = "okay"; + }; diff --git a/queue-5.6/arm64-dts-meson-g12b-ugoos-am6-fix-usb-vbus-supply.patch b/queue-5.6/arm64-dts-meson-g12b-ugoos-am6-fix-usb-vbus-supply.patch new file mode 100644 index 00000000000..98376af1ab2 --- /dev/null +++ b/queue-5.6/arm64-dts-meson-g12b-ugoos-am6-fix-usb-vbus-supply.patch @@ -0,0 +1,34 @@ +From 4e025fd91ba32a16ed8131158aa63cd37d141cbb Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Thu, 26 Mar 2020 17:08:56 +0100 +Subject: arm64: dts: meson-g12b-ugoos-am6: fix usb vbus-supply + +From: Neil Armstrong + +commit 4e025fd91ba32a16ed8131158aa63cd37d141cbb upstream. + +The USB supply used the wrong property, fixing: +meson-g12b-ugoos-am6.dt.yaml: usb@ffe09000: 'vbus-regulator' does not match any of the regexes: '^usb@[0-9a-f]+$', 'pinctrl-[0-9]+' + +Fixes: 2cd2310fca4c ("arm64: dts: meson-g12b-ugoos-am6: add initial device-tree") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20200326160857.11929-2-narmstrong@baylibre.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts +@@ -545,7 +545,7 @@ + &usb { + status = "okay"; + dr_mode = "host"; +- vbus-regulator = <&usb_pwr_en>; ++ vbus-supply = <&usb_pwr_en>; + }; + + &usb2_phy0 { diff --git a/queue-5.6/arm64-dts-qcom-msm8996-reduce-vdd_apc-voltage.patch b/queue-5.6/arm64-dts-qcom-msm8996-reduce-vdd_apc-voltage.patch new file mode 100644 index 00000000000..421e8d57371 --- /dev/null +++ b/queue-5.6/arm64-dts-qcom-msm8996-reduce-vdd_apc-voltage.patch @@ -0,0 +1,38 @@ +From 28810eecae08f9458a44831978e36f14ed182c80 Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Tue, 17 Mar 2020 22:44:42 -0700 +Subject: arm64: dts: qcom: msm8996: Reduce vdd_apc voltage + +From: Bjorn Andersson + +commit 28810eecae08f9458a44831978e36f14ed182c80 upstream. + +Some msm8996 based devices are unstable when run with VDD_APC of 1.23V, +which is listed as the maximum voltage in "Turbo" mode. Given that the +CPU cluster is not run in "Turbo" mode, reduce this to 0.98V - the +maximum voltage for nominal operation. + +Tested-by: Loic Poulain +Fixes: 7a2a2231ef22 ("arm64: dts: apq8096-db820c: Fix VDD core voltage") +Cc: Loic Poulain +Link: https://lore.kernel.org/r/20200318054442.3066726-1-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +@@ -658,8 +658,8 @@ + s11 { + qcom,saw-leader; + regulator-always-on; +- regulator-min-microvolt = <1230000>; +- regulator-max-microvolt = <1230000>; ++ regulator-min-microvolt = <980000>; ++ regulator-max-microvolt = <980000>; + }; + }; + diff --git a/queue-5.6/arm64-dts-renesas-r8a77980-fix-ipmmu-vip-nodes.patch b/queue-5.6/arm64-dts-renesas-r8a77980-fix-ipmmu-vip-nodes.patch new file mode 100644 index 00000000000..208902fdf5d --- /dev/null +++ b/queue-5.6/arm64-dts-renesas-r8a77980-fix-ipmmu-vip-nodes.patch @@ -0,0 +1,39 @@ +From f4d71c6ea9e58c07dd4d02d09c5dd9bb780ec4b1 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Fri, 17 Apr 2020 16:29:03 +0900 +Subject: arm64: dts: renesas: r8a77980: Fix IPMMU VIP[01] nodes + +From: Yoshihiro Shimoda + +commit f4d71c6ea9e58c07dd4d02d09c5dd9bb780ec4b1 upstream. + +Missing the renesas,ipmmu-main property on ipmmu_vip[01] nodes. + +Fixes: 55697cbb44e4 ("arm64: dts: renesas: r8a779{65,80,90}: Add IPMMU devices nodes) +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/1587108543-23786-1-git-send-email-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/renesas/r8a77980.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/renesas/r8a77980.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a77980.dtsi +@@ -1318,6 +1318,7 @@ + ipmmu_vip0: mmu@e7b00000 { + compatible = "renesas,ipmmu-r8a77980"; + reg = <0 0xe7b00000 0 0x1000>; ++ renesas,ipmmu-main = <&ipmmu_mm 4>; + power-domains = <&sysc R8A77980_PD_ALWAYS_ON>; + #iommu-cells = <1>; + }; +@@ -1325,6 +1326,7 @@ + ipmmu_vip1: mmu@e7960000 { + compatible = "renesas,ipmmu-r8a77980"; + reg = <0 0xe7960000 0 0x1000>; ++ renesas,ipmmu-main = <&ipmmu_mm 11>; + power-domains = <&sysc R8A77980_PD_ALWAYS_ON>; + #iommu-cells = <1>; + }; diff --git a/queue-5.6/arm64-dts-rockchip-rename-dwc3-device-nodes-on-rk3399-to-make-dtc-happy.patch b/queue-5.6/arm64-dts-rockchip-rename-dwc3-device-nodes-on-rk3399-to-make-dtc-happy.patch new file mode 100644 index 00000000000..636e26c1958 --- /dev/null +++ b/queue-5.6/arm64-dts-rockchip-rename-dwc3-device-nodes-on-rk3399-to-make-dtc-happy.patch @@ -0,0 +1,46 @@ +From 190c7f6fd43a776d4a6da1dac44408104649e9b7 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Fri, 27 Mar 2020 11:04:14 +0800 +Subject: arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy + +From: Chen-Yu Tsai + +commit 190c7f6fd43a776d4a6da1dac44408104649e9b7 upstream. + +The device tree compiler complains that the dwc3 nodes have regs +properties but no matching unit addresses. + +Add the unit addresses to the device node name. While at it, also rename +the nodes from "dwc3" to "usb", as guidelines require device nodes have +generic names. + +Fixes: 7144224f2c2b ("arm64: dts: rockchip: support dwc3 USB for rk3399") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20200327030414.5903-7-wens@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -410,7 +410,7 @@ + reset-names = "usb3-otg"; + status = "disabled"; + +- usbdrd_dwc3_0: dwc3 { ++ usbdrd_dwc3_0: usb@fe800000 { + compatible = "snps,dwc3"; + reg = <0x0 0xfe800000 0x0 0x100000>; + interrupts = ; +@@ -446,7 +446,7 @@ + reset-names = "usb3-otg"; + status = "disabled"; + +- usbdrd_dwc3_1: dwc3 { ++ usbdrd_dwc3_1: usb@fe900000 { + compatible = "snps,dwc3"; + reg = <0x0 0xfe900000 0x0 0x100000>; + interrupts = ; diff --git a/queue-5.6/arm64-dts-rockchip-replace-rk805-pmic-node-name-with-pmic-on-rk3328-boards.patch b/queue-5.6/arm64-dts-rockchip-replace-rk805-pmic-node-name-with-pmic-on-rk3328-boards.patch new file mode 100644 index 00000000000..073f20c2a6a --- /dev/null +++ b/queue-5.6/arm64-dts-rockchip-replace-rk805-pmic-node-name-with-pmic-on-rk3328-boards.patch @@ -0,0 +1,49 @@ +From 83b994129fb4c18a8460fd395864a28740e5e7fb Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Fri, 27 Mar 2020 11:04:10 +0800 +Subject: arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards + +From: Chen-Yu Tsai + +commit 83b994129fb4c18a8460fd395864a28740e5e7fb upstream. + +In some board device tree files, "rk805" was used for the RK805 PMIC's +node name. However the policy for device trees is that generic names +should be used. + +Replace the "rk805" node name with the generic "pmic" name. + +Fixes: 1e28037ec88e ("arm64: dts: rockchip: add rk805 node for rk3328-evb") +Fixes: 955bebde057e ("arm64: dts: rockchip: add rk3328-rock64 board") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20200327030414.5903-3-wens@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/rockchip/rk3328-evb.dts | 2 +- + arch/arm64/boot/dts/rockchip/rk3328-rock64.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts +@@ -92,7 +92,7 @@ + &i2c1 { + status = "okay"; + +- rk805: rk805@18 { ++ rk805: pmic@18 { + compatible = "rockchip,rk805"; + reg = <0x18>; + interrupt-parent = <&gpio2>; +--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts +@@ -169,7 +169,7 @@ + &i2c1 { + status = "okay"; + +- rk805: rk805@18 { ++ rk805: pmic@18 { + compatible = "rockchip,rk805"; + reg = <0x18>; + interrupt-parent = <&gpio2>; diff --git a/queue-5.6/bpf-enforce-returning-0-for-fentry-fexit-progs.patch b/queue-5.6/bpf-enforce-returning-0-for-fentry-fexit-progs.patch new file mode 100644 index 00000000000..d7a4f86c2ca --- /dev/null +++ b/queue-5.6/bpf-enforce-returning-0-for-fentry-fexit-progs.patch @@ -0,0 +1,63 @@ +From e92888c72fbdc6f9d07b3b0604c012e81d7c0da7 Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Wed, 13 May 2020 22:32:05 -0700 +Subject: bpf: Enforce returning 0 for fentry/fexit progs + +From: Yonghong Song + +commit e92888c72fbdc6f9d07b3b0604c012e81d7c0da7 upstream. + +Currently, tracing/fentry and tracing/fexit prog +return values are not enforced. In trampoline codes, +the fentry/fexit prog return values are ignored. +Let us enforce it to be 0 to avoid confusion and +allows potential future extension. + +This patch also explicitly added return value +checking for tracing/raw_tp, tracing/fmod_ret, +and freplace programs such that these program +return values can be anything. The purpose are +two folds: + 1. to make it explicit about return value expectations + for these programs in verifier. + 2. for tracing prog_type, if a future attach type + is added, the default is -ENOTSUPP which will + enforce to specify return value ranges explicitly. + +Fixes: fec56f5890d9 ("bpf: Introduce BPF trampoline") +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200514053206.1298415-1-yhs@fb.com +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/bpf/verifier.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6498,6 +6498,23 @@ static int check_return_code(struct bpf_ + return 0; + range = tnum_const(0); + break; ++ case BPF_PROG_TYPE_TRACING: ++ switch (env->prog->expected_attach_type) { ++ case BPF_TRACE_FENTRY: ++ case BPF_TRACE_FEXIT: ++ range = tnum_const(0); ++ break; ++ case BPF_TRACE_RAW_TP: ++ case BPF_MODIFY_RETURN: ++ return 0; ++ default: ++ return -ENOTSUPP; ++ } ++ break; ++ case BPF_PROG_TYPE_EXT: ++ /* freplace program can return anything as its return value ++ * depends on the to-be-replaced kernel func or bpf program. ++ */ + default: + return 0; + } diff --git a/queue-5.6/bpf-fix-sk_psock-refcnt-leak-when-receiving-message.patch b/queue-5.6/bpf-fix-sk_psock-refcnt-leak-when-receiving-message.patch new file mode 100644 index 00000000000..91c4e4bbee2 --- /dev/null +++ b/queue-5.6/bpf-fix-sk_psock-refcnt-leak-when-receiving-message.patch @@ -0,0 +1,58 @@ +From 18f02ad19e2c2a1d9e1d55a4e1c0cbf51419151c Mon Sep 17 00:00:00 2001 +From: Xiyu Yang +Date: Sun, 26 Apr 2020 11:35:15 +0800 +Subject: bpf: Fix sk_psock refcnt leak when receiving message + +From: Xiyu Yang + +commit 18f02ad19e2c2a1d9e1d55a4e1c0cbf51419151c upstream. + +tcp_bpf_recvmsg() invokes sk_psock_get(), which returns a reference of +the specified sk_psock object to "psock" with increased refcnt. + +When tcp_bpf_recvmsg() returns, local variable "psock" becomes invalid, +so the refcount should be decreased to keep refcount balanced. + +The reference counting issue happens in several exception handling paths +of tcp_bpf_recvmsg(). When those error scenarios occur such as "flags" +includes MSG_ERRQUEUE, the function forgets to decrease the refcnt +increased by sk_psock_get(), causing a refcnt leak. + +Fix this issue by calling sk_psock_put() or pulling up the error queue +read handling when those error scenarios occur. + +Fixes: e7a5f1f1cd000 ("bpf/sockmap: Read psock ingress_msg before sk_receive_queue") +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/1587872115-42805-1-git-send-email-xiyuyang19@fudan.edu.cn +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_bpf.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -121,14 +121,17 @@ int tcp_bpf_recvmsg(struct sock *sk, str + struct sk_psock *psock; + int copied, ret; + ++ if (unlikely(flags & MSG_ERRQUEUE)) ++ return inet_recv_error(sk, msg, len, addr_len); ++ + psock = sk_psock_get(sk); + if (unlikely(!psock)) + return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); +- if (unlikely(flags & MSG_ERRQUEUE)) +- return inet_recv_error(sk, msg, len, addr_len); + if (!skb_queue_empty(&sk->sk_receive_queue) && +- sk_psock_queue_empty(psock)) ++ sk_psock_queue_empty(psock)) { ++ sk_psock_put(sk, psock); + return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); ++ } + lock_sock(sk); + msg_bytes_ready: + copied = __tcp_bpf_recvmsg(sk, psock, msg, len, flags); diff --git a/queue-5.6/bpf-restrict-bpf_trace_printk-s-s-usage-and-add-pks-pus-specifier.patch b/queue-5.6/bpf-restrict-bpf_trace_printk-s-s-usage-and-add-pks-pus-specifier.patch new file mode 100644 index 00000000000..d0007cd0138 --- /dev/null +++ b/queue-5.6/bpf-restrict-bpf_trace_printk-s-s-usage-and-add-pks-pus-specifier.patch @@ -0,0 +1,226 @@ +From b2a5212fb634561bb734c6356904e37f6665b955 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 15 May 2020 12:11:18 +0200 +Subject: bpf: Restrict bpf_trace_printk()'s %s usage and add %pks, %pus specifier + +From: Daniel Borkmann + +commit b2a5212fb634561bb734c6356904e37f6665b955 upstream. + +Usage of plain %s conversion specifier in bpf_trace_printk() suffers from the +very same issue as bpf_probe_read{,str}() helpers, that is, it is broken on +archs with overlapping address ranges. + +While the helpers have been addressed through work in 6ae08ae3dea2 ("bpf: Add +probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers"), we need +an option for bpf_trace_printk() as well to fix it. + +Similarly as with the helpers, force users to make an explicit choice by adding +%pks and %pus specifier to bpf_trace_printk() which will then pick the corresponding +strncpy_from_unsafe*() variant to perform the access under KERNEL_DS or USER_DS. +The %pk* (kernel specifier) and %pu* (user specifier) can later also be extended +for other objects aside strings that are probed and printed under tracing, and +reused out of other facilities like bpf_seq_printf() or BTF based type printing. + +Existing behavior of %s for current users is still kept working for archs where it +is not broken and therefore gated through CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE. +For archs not having this property we fall-back to pick probing under KERNEL_DS as +a sensible default. + +Fixes: 8d3b7dce8622 ("bpf: add support for %s specifier to bpf_trace_printk()") +Reported-by: Linus Torvalds +Reported-by: Christoph Hellwig +Signed-off-by: Daniel Borkmann +Signed-off-by: Alexei Starovoitov +Cc: Masami Hiramatsu +Cc: Brendan Gregg +Link: https://lore.kernel.org/bpf/20200515101118.6508-4-daniel@iogearbox.net +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/core-api/printk-formats.rst | 14 ++++ + kernel/trace/bpf_trace.c | 94 +++++++++++++++++++----------- + lib/vsprintf.c | 12 +++ + 3 files changed, 88 insertions(+), 32 deletions(-) + +--- a/Documentation/core-api/printk-formats.rst ++++ b/Documentation/core-api/printk-formats.rst +@@ -112,6 +112,20 @@ used when printing stack backtraces. The + consideration the effect of compiler optimisations which may occur + when tail-calls are used and marked with the noreturn GCC attribute. + ++Probed Pointers from BPF / tracing ++---------------------------------- ++ ++:: ++ ++ %pks kernel string ++ %pus user string ++ ++The ``k`` and ``u`` specifiers are used for printing prior probed memory from ++either kernel memory (k) or user memory (u). The subsequent ``s`` specifier ++results in printing a string. For direct use in regular vsnprintf() the (k) ++and (u) annotation is ignored, however, when used out of BPF's bpf_trace_printk(), ++for example, it reads the memory it is pointing to without faulting. ++ + Kernel Pointers + --------------- + +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -325,17 +325,15 @@ static const struct bpf_func_proto *bpf_ + + /* + * Only limited trace_printk() conversion specifiers allowed: +- * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %s ++ * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %pks %pus %s + */ + BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1, + u64, arg2, u64, arg3) + { ++ int i, mod[3] = {}, fmt_cnt = 0; ++ char buf[64], fmt_ptype; ++ void *unsafe_ptr = NULL; + bool str_seen = false; +- int mod[3] = {}; +- int fmt_cnt = 0; +- u64 unsafe_addr; +- char buf[64]; +- int i; + + /* + * bpf_check()->check_func_arg()->check_stack_boundary() +@@ -361,40 +359,71 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt + if (fmt[i] == 'l') { + mod[fmt_cnt]++; + i++; +- } else if (fmt[i] == 'p' || fmt[i] == 's') { ++ } else if (fmt[i] == 'p') { + mod[fmt_cnt]++; ++ if ((fmt[i + 1] == 'k' || ++ fmt[i + 1] == 'u') && ++ fmt[i + 2] == 's') { ++ fmt_ptype = fmt[i + 1]; ++ i += 2; ++ goto fmt_str; ++ } ++ + /* disallow any further format extensions */ + if (fmt[i + 1] != 0 && + !isspace(fmt[i + 1]) && + !ispunct(fmt[i + 1])) + return -EINVAL; +- fmt_cnt++; +- if (fmt[i] == 's') { +- if (str_seen) +- /* allow only one '%s' per fmt string */ +- return -EINVAL; +- str_seen = true; +- +- switch (fmt_cnt) { +- case 1: +- unsafe_addr = arg1; +- arg1 = (long) buf; +- break; +- case 2: +- unsafe_addr = arg2; +- arg2 = (long) buf; +- break; +- case 3: +- unsafe_addr = arg3; +- arg3 = (long) buf; +- break; +- } +- buf[0] = 0; +- strncpy_from_unsafe(buf, +- (void *) (long) unsafe_addr, ++ ++ goto fmt_next; ++ } else if (fmt[i] == 's') { ++ mod[fmt_cnt]++; ++ fmt_ptype = fmt[i]; ++fmt_str: ++ if (str_seen) ++ /* allow only one '%s' per fmt string */ ++ return -EINVAL; ++ str_seen = true; ++ ++ if (fmt[i + 1] != 0 && ++ !isspace(fmt[i + 1]) && ++ !ispunct(fmt[i + 1])) ++ return -EINVAL; ++ ++ switch (fmt_cnt) { ++ case 0: ++ unsafe_ptr = (void *)(long)arg1; ++ arg1 = (long)buf; ++ break; ++ case 1: ++ unsafe_ptr = (void *)(long)arg2; ++ arg2 = (long)buf; ++ break; ++ case 2: ++ unsafe_ptr = (void *)(long)arg3; ++ arg3 = (long)buf; ++ break; ++ } ++ ++ buf[0] = 0; ++ switch (fmt_ptype) { ++ case 's': ++#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE ++ strncpy_from_unsafe(buf, unsafe_ptr, + sizeof(buf)); ++ break; ++#endif ++ case 'k': ++ strncpy_from_unsafe_strict(buf, unsafe_ptr, ++ sizeof(buf)); ++ break; ++ case 'u': ++ strncpy_from_unsafe_user(buf, ++ (__force void __user *)unsafe_ptr, ++ sizeof(buf)); ++ break; + } +- continue; ++ goto fmt_next; + } + + if (fmt[i] == 'l') { +@@ -405,6 +434,7 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt + if (fmt[i] != 'i' && fmt[i] != 'd' && + fmt[i] != 'u' && fmt[i] != 'x') + return -EINVAL; ++fmt_next: + fmt_cnt++; + } + +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -2168,6 +2168,10 @@ char *fwnode_string(char *buf, char *end + * f full name + * P node name, including a possible unit address + * - 'x' For printing the address. Equivalent to "%lx". ++ * - '[ku]s' For a BPF/tracing related format specifier, e.g. used out of ++ * bpf_trace_printk() where [ku] prefix specifies either kernel (k) ++ * or user (u) memory to probe, and: ++ * s a string, equivalent to "%s" on direct vsnprintf() use + * + * ** When making changes please also update: + * Documentation/core-api/printk-formats.rst +@@ -2251,6 +2255,14 @@ char *pointer(const char *fmt, char *buf + if (!IS_ERR(ptr)) + break; + return err_ptr(buf, end, ptr, spec); ++ case 'u': ++ case 'k': ++ switch (fmt[1]) { ++ case 's': ++ return string(buf, end, ptr, spec); ++ default: ++ return error_string(buf, end, "(einval)", spec); ++ } + } + + /* default is to _not_ leak addresses, hash before printing */ diff --git a/queue-5.6/clk-ti-clkctrl-fix-bad-of_node_put-within-clkctrl_get_name.patch b/queue-5.6/clk-ti-clkctrl-fix-bad-of_node_put-within-clkctrl_get_name.patch new file mode 100644 index 00000000000..2aa506cc879 --- /dev/null +++ b/queue-5.6/clk-ti-clkctrl-fix-bad-of_node_put-within-clkctrl_get_name.patch @@ -0,0 +1,39 @@ +From e1f9e0d28ff025564dfdb1001a7839b4af5db2e2 Mon Sep 17 00:00:00 2001 +From: Tero Kristo +Date: Fri, 24 Apr 2020 15:47:25 +0300 +Subject: clk: ti: clkctrl: Fix Bad of_node_put within clkctrl_get_name + +From: Tero Kristo + +commit e1f9e0d28ff025564dfdb1001a7839b4af5db2e2 upstream. + +clkctrl_get_name incorrectly calls of_node_put when it is not really +doing of_node_get. This causes a boot time warning later on: + +[ 0.000000] OF: ERROR: Bad of_node_put() on /ocp/interconnect@4a000000/segmen +t@0/target-module@5000/cm_core_aon@0/ipu-cm@500/ipu1-clkctrl@20 + +Fix by dropping the of_node_put from the function. + +Reported-by: Naresh Kamboju +Fixes: 6c3090520554 ("clk: ti: clkctrl: Fix hidden dependency to node name") +Signed-off-by: Tero Kristo +Link: https://lkml.kernel.org/r/20200424124725.9895-1-t-kristo@ti.com +Acked-by: Tony Lindgren +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/ti/clkctrl.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -461,7 +461,6 @@ static char * __init clkctrl_get_name(st + return name; + } + } +- of_node_put(np); + + return NULL; + } diff --git a/queue-5.6/clk-unlink-clock-if-failed-to-prepare-or-enable.patch b/queue-5.6/clk-unlink-clock-if-failed-to-prepare-or-enable.patch new file mode 100644 index 00000000000..917a91c6274 --- /dev/null +++ b/queue-5.6/clk-unlink-clock-if-failed-to-prepare-or-enable.patch @@ -0,0 +1,42 @@ +From 018d4671b9bbd4a5c55cf6eab3e1dbc70a50b66e Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Tue, 5 May 2020 15:09:53 +0100 +Subject: clk: Unlink clock if failed to prepare or enable + +From: Marc Zyngier + +commit 018d4671b9bbd4a5c55cf6eab3e1dbc70a50b66e upstream. + +On failing to prepare or enable a clock, remove the core structure +from the list it has been inserted as it is about to be freed. + +This otherwise leads to random crashes when subsequent clocks get +registered, during which parsing of the clock tree becomes adventurous. + +Observed with QEMU's RPi-3 emulation. + +Fixes: 12ead77432f2 ("clk: Don't try to enable critical clocks if prepare failed") +Signed-off-by: Marc Zyngier +Cc: Guenter Roeck +Cc: Stephen Boyd +Cc: Michael Turquette +Link: https://lkml.kernel.org/r/20200505140953.409430-1-maz@kernel.org +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -3512,6 +3512,9 @@ static int __clk_core_init(struct clk_co + out: + clk_pm_runtime_put(core); + unlock: ++ if (ret) ++ hlist_del_init(&core->child_node); ++ + clk_prepare_unlock(); + + if (!ret) diff --git a/queue-5.6/dt-bindings-dma-fsl-edma-fix-ls1028a-edma-compatible.patch b/queue-5.6/dt-bindings-dma-fsl-edma-fix-ls1028a-edma-compatible.patch new file mode 100644 index 00000000000..d826f250658 --- /dev/null +++ b/queue-5.6/dt-bindings-dma-fsl-edma-fix-ls1028a-edma-compatible.patch @@ -0,0 +1,36 @@ +From d94a05f87327143f94f67dd256932163ac2bcd65 Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Fri, 6 Mar 2020 21:54:02 +0100 +Subject: dt-bindings: dma: fsl-edma: fix ls1028a-edma compatible + +From: Michael Walle + +commit d94a05f87327143f94f67dd256932163ac2bcd65 upstream. + +The bootloader will fix up the IOMMU entries only on nodes with the +compatible "fsl,vf610-edma". Thus make this compatible string mandatory +for the ls1028a-edma. + +While at it, fix the "fsl,fsl," typo. + +Signed-off-by: Michael Walle +Fixes: d8c1bdb5288d ("dt-bindings: dma: fsl-edma: add new fsl,fsl,ls1028a-edma") +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/dma/fsl-edma.txt | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/dma/fsl-edma.txt ++++ b/Documentation/devicetree/bindings/dma/fsl-edma.txt +@@ -10,7 +10,8 @@ Required properties: + - compatible : + - "fsl,vf610-edma" for eDMA used similar to that on Vybrid vf610 SoC + - "fsl,imx7ulp-edma" for eDMA2 used similar to that on i.mx7ulp +- - "fsl,fsl,ls1028a-edma" for eDMA used similar to that on Vybrid vf610 SoC ++ - "fsl,ls1028a-edma" followed by "fsl,vf610-edma" for eDMA used on the ++ LS1028A SoC. + - reg : Specifies base physical address(s) and size of the eDMA registers. + The 1st region is eDMA control register's address and size. + The 2nd and the 3rd regions are programmable channel multiplexing diff --git a/queue-5.6/fanotify-fix-merging-marks-masks-with-fan_ondir.patch b/queue-5.6/fanotify-fix-merging-marks-masks-with-fan_ondir.patch new file mode 100644 index 00000000000..f2dc0435206 --- /dev/null +++ b/queue-5.6/fanotify-fix-merging-marks-masks-with-fan_ondir.patch @@ -0,0 +1,67 @@ +From 55bf882c7f13dda8bbe624040c6d5b4fbb812d16 Mon Sep 17 00:00:00 2001 +From: Amir Goldstein +Date: Thu, 19 Mar 2020 17:10:17 +0200 +Subject: fanotify: fix merging marks masks with FAN_ONDIR + +From: Amir Goldstein + +commit 55bf882c7f13dda8bbe624040c6d5b4fbb812d16 upstream. + +Change the logic of FAN_ONDIR in two ways that are similar to the logic +of FAN_EVENT_ON_CHILD, that was fixed in commit 54a307ba8d3c ("fanotify: +fix logic of events on child"): + +1. The flag is meaningless in ignore mask +2. The flag refers only to events in the mask of the mark where it is set + +This is what the fanotify_mark.2 man page says about FAN_ONDIR: +"Without this flag, only events for files are created." It doesn't +say anything about setting this flag in ignore mask to stop getting +events on directories nor can I think of any setup where this capability +would be useful. + +Currently, when marks masks are merged, the FAN_ONDIR flag set in one +mark affects the events that are set in another mark's mask and this +behavior causes unexpected results. For example, a user adds a mark on a +directory with mask FAN_ATTRIB | FAN_ONDIR and a mount mark with mask +FAN_OPEN (without FAN_ONDIR). An opendir() of that directory (which is +inside that mount) generates a FAN_OPEN event even though neither of the +marks requested to get open events on directories. + +Link: https://lore.kernel.org/r/20200319151022.31456-10-amir73il@gmail.com +Signed-off-by: Amir Goldstein +Signed-off-by: Jan Kara +Cc: Rachel Sibley +Signed-off-by: Greg Kroah-Hartman + +--- + fs/notify/fanotify/fanotify.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/fs/notify/fanotify/fanotify.c ++++ b/fs/notify/fanotify/fanotify.c +@@ -172,6 +172,13 @@ static u32 fanotify_group_event_mask(str + continue; + mark = iter_info->marks[type]; + /* ++ * If the event is on dir and this mark doesn't care about ++ * events on dir, don't send it! ++ */ ++ if (event_mask & FS_ISDIR && !(mark->mask & FS_ISDIR)) ++ continue; ++ ++ /* + * If the event is for a child and this mark doesn't care about + * events on a child, don't send it! + */ +@@ -203,10 +210,6 @@ static u32 fanotify_group_event_mask(str + user_mask &= ~FAN_ONDIR; + } + +- if (event_mask & FS_ISDIR && +- !(marks_mask & FS_ISDIR & ~marks_ignored_mask)) +- return 0; +- + return test_mask & user_mask; + } + diff --git a/queue-5.6/kvm-x86-fix-off-by-one-error-in-kvm_vcpu_ioctl_x86_setup_mce.patch b/queue-5.6/kvm-x86-fix-off-by-one-error-in-kvm_vcpu_ioctl_x86_setup_mce.patch new file mode 100644 index 00000000000..3bd9607e0ef --- /dev/null +++ b/queue-5.6/kvm-x86-fix-off-by-one-error-in-kvm_vcpu_ioctl_x86_setup_mce.patch @@ -0,0 +1,37 @@ +From c4e0e4ab4cf3ec2b3f0b628ead108d677644ebd9 Mon Sep 17 00:00:00 2001 +From: Jim Mattson +Date: Mon, 11 May 2020 15:56:16 -0700 +Subject: KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce + +From: Jim Mattson + +commit c4e0e4ab4cf3ec2b3f0b628ead108d677644ebd9 upstream. + +Bank_num is a one-based count of banks, not a zero-based index. It +overflows the allocated space only when strictly greater than +KVM_MAX_MCE_BANKS. + +Fixes: a9e38c3e01ad ("KVM: x86: Catch potential overrun in MCE setup") +Signed-off-by: Jue Wang +Signed-off-by: Jim Mattson +Reviewed-by: Peter Shier +Message-Id: <20200511225616.19557-1-jmattson@google.com> +Reviewed-by: Vitaly Kuznetsov +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3739,7 +3739,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce( + unsigned bank_num = mcg_cap & 0xff, bank; + + r = -EINVAL; +- if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS) ++ if (!bank_num || bank_num > KVM_MAX_MCE_BANKS) + goto out; + if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000)) + goto out; diff --git a/queue-5.6/makefile-disallow-data-races-on-gcc-10-as-well.patch b/queue-5.6/makefile-disallow-data-races-on-gcc-10-as-well.patch new file mode 100644 index 00000000000..06dd077f295 --- /dev/null +++ b/queue-5.6/makefile-disallow-data-races-on-gcc-10-as-well.patch @@ -0,0 +1,34 @@ +From b1112139a103b4b1101d0d2d72931f2d33d8c978 Mon Sep 17 00:00:00 2001 +From: Sergei Trofimovich +Date: Tue, 17 Mar 2020 00:07:18 +0000 +Subject: Makefile: disallow data races on gcc-10 as well + +From: Sergei Trofimovich + +commit b1112139a103b4b1101d0d2d72931f2d33d8c978 upstream. + +gcc-10 will rename --param=allow-store-data-races=0 +to -fno-allow-store-data-races. + +The flag change happened at https://gcc.gnu.org/PR92046. + +Signed-off-by: Sergei Trofimovich +Acked-by: Jiri Kosina +Signed-off-by: Masahiro Yamada +Cc: Thomas Backlund +Signed-off-by: Greg Kroah-Hartman + +--- + Makefile | 1 + + 1 file changed, 1 insertion(+) + +--- a/Makefile ++++ b/Makefile +@@ -710,6 +710,7 @@ endif + + # Tell gcc to never replace conditional load with a non-conditional one + KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0) ++KBUILD_CFLAGS += $(call cc-option,-fno-allow-store-data-races) + + include scripts/Makefile.kcov + include scripts/Makefile.gcc-plugins diff --git a/queue-5.6/powerpc-ima-fix-secure-boot-rules-in-ima-arch-policy.patch b/queue-5.6/powerpc-ima-fix-secure-boot-rules-in-ima-arch-policy.patch new file mode 100644 index 00000000000..2a4f894893e --- /dev/null +++ b/queue-5.6/powerpc-ima-fix-secure-boot-rules-in-ima-arch-policy.patch @@ -0,0 +1,60 @@ +From fa4f3f56ccd28ac031ab275e673ed4098855fed4 Mon Sep 17 00:00:00 2001 +From: Nayna Jain +Date: Fri, 1 May 2020 10:16:52 -0400 +Subject: powerpc/ima: Fix secure boot rules in ima arch policy + +From: Nayna Jain + +commit fa4f3f56ccd28ac031ab275e673ed4098855fed4 upstream. + +To prevent verifying the kernel module appended signature +twice (finit_module), once by the module_sig_check() and again by IMA, +powerpc secure boot rules define an IMA architecture specific policy +rule only if CONFIG_MODULE_SIG_FORCE is not enabled. This, +unfortunately, does not take into account the ability of enabling +"sig_enforce" on the boot command line (module.sig_enforce=1). + +Including the IMA module appraise rule results in failing the +finit_module syscall, unless the module signing public key is loaded +onto the IMA keyring. + +This patch fixes secure boot policy rules to be based on +CONFIG_MODULE_SIG instead. + +Fixes: 4238fad366a6 ("powerpc/ima: Add support to initialize ima policy rules") +Signed-off-by: Nayna Jain +Signed-off-by: Michael Ellerman +Signed-off-by: Mimi Zohar +Link: https://lore.kernel.org/r/1588342612-14532-1-git-send-email-nayna@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/ima_arch.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/kernel/ima_arch.c ++++ b/arch/powerpc/kernel/ima_arch.c +@@ -19,12 +19,12 @@ bool arch_ima_get_secureboot(void) + * to be stored as an xattr or as an appended signature. + * + * To avoid duplicate signature verification as much as possible, the IMA +- * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE ++ * policy rule for module appraisal is added only if CONFIG_MODULE_SIG + * is not enabled. + */ + static const char *const secure_rules[] = { + "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", +-#ifndef CONFIG_MODULE_SIG_FORCE ++#ifndef CONFIG_MODULE_SIG + "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", + #endif + NULL +@@ -50,7 +50,7 @@ static const char *const secure_and_trus + "measure func=KEXEC_KERNEL_CHECK template=ima-modsig", + "measure func=MODULE_CHECK template=ima-modsig", + "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", +-#ifndef CONFIG_MODULE_SIG_FORCE ++#ifndef CONFIG_MODULE_SIG + "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig", + #endif + NULL diff --git a/queue-5.6/powerpc-uaccess-evaluate-macro-arguments-once-before-user-access-is-allowed.patch b/queue-5.6/powerpc-uaccess-evaluate-macro-arguments-once-before-user-access-is-allowed.patch new file mode 100644 index 00000000000..9dbc5a4c634 --- /dev/null +++ b/queue-5.6/powerpc-uaccess-evaluate-macro-arguments-once-before-user-access-is-allowed.patch @@ -0,0 +1,150 @@ +From d02f6b7dab8228487268298ea1f21081c0b4b3eb Mon Sep 17 00:00:00 2001 +From: Nicholas Piggin +Date: Tue, 7 Apr 2020 14:12:45 +1000 +Subject: powerpc/uaccess: Evaluate macro arguments once, before user access is allowed + +From: Nicholas Piggin + +commit d02f6b7dab8228487268298ea1f21081c0b4b3eb upstream. + +get/put_user() can be called with nontrivial arguments. fs/proc/page.c +has a good example: + + if (put_user(stable_page_flags(ppage), out)) { + +stable_page_flags() is quite a lot of code, including spin locks in +the page allocator. + +Ensure these arguments are evaluated before user access is allowed. + +This improves security by reducing code with access to userspace, but +it also fixes a PREEMPT bug with KUAP on powerpc/64s: +stable_page_flags() is currently called with AMR set to allow writes, +it ends up calling spin_unlock(), which can call preempt_schedule. But +the task switch code can not be called with AMR set (it relies on +interrupts saving the register), so this blows up. + +It's fine if the code inside allow_user_access() is preemptible, +because a timer or IPI will save the AMR, but it's not okay to +explicitly cause a reschedule. + +Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200407041245.600651-1-npiggin@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/uaccess.h | 49 ++++++++++++++++++++++++++----------- + 1 file changed, 35 insertions(+), 14 deletions(-) + +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -166,13 +166,17 @@ do { \ + ({ \ + long __pu_err; \ + __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ ++ __typeof__(*(ptr)) __pu_val = (x); \ ++ __typeof__(size) __pu_size = (size); \ ++ \ + if (!is_kernel_addr((unsigned long)__pu_addr)) \ + might_fault(); \ +- __chk_user_ptr(ptr); \ ++ __chk_user_ptr(__pu_addr); \ + if (do_allow) \ +- __put_user_size((x), __pu_addr, (size), __pu_err); \ ++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ + else \ +- __put_user_size_allowed((x), __pu_addr, (size), __pu_err); \ ++ __put_user_size_allowed(__pu_val, __pu_addr, __pu_size, __pu_err); \ ++ \ + __pu_err; \ + }) + +@@ -180,9 +184,13 @@ do { \ + ({ \ + long __pu_err = -EFAULT; \ + __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ ++ __typeof__(*(ptr)) __pu_val = (x); \ ++ __typeof__(size) __pu_size = (size); \ ++ \ + might_fault(); \ +- if (access_ok(__pu_addr, size)) \ +- __put_user_size((x), __pu_addr, (size), __pu_err); \ ++ if (access_ok(__pu_addr, __pu_size)) \ ++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ ++ \ + __pu_err; \ + }) + +@@ -190,8 +198,12 @@ do { \ + ({ \ + long __pu_err; \ + __typeof__(*(ptr)) __user *__pu_addr = (ptr); \ +- __chk_user_ptr(ptr); \ +- __put_user_size((x), __pu_addr, (size), __pu_err); \ ++ __typeof__(*(ptr)) __pu_val = (x); \ ++ __typeof__(size) __pu_size = (size); \ ++ \ ++ __chk_user_ptr(__pu_addr); \ ++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \ ++ \ + __pu_err; \ + }) + +@@ -283,15 +295,18 @@ do { \ + long __gu_err; \ + __long_type(*(ptr)) __gu_val; \ + __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ +- __chk_user_ptr(ptr); \ ++ __typeof__(size) __gu_size = (size); \ ++ \ ++ __chk_user_ptr(__gu_addr); \ + if (!is_kernel_addr((unsigned long)__gu_addr)) \ + might_fault(); \ + barrier_nospec(); \ + if (do_allow) \ +- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ ++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ + else \ +- __get_user_size_allowed(__gu_val, __gu_addr, (size), __gu_err); \ ++ __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \ + (x) = (__typeof__(*(ptr)))__gu_val; \ ++ \ + __gu_err; \ + }) + +@@ -300,12 +315,15 @@ do { \ + long __gu_err = -EFAULT; \ + __long_type(*(ptr)) __gu_val = 0; \ + __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ ++ __typeof__(size) __gu_size = (size); \ ++ \ + might_fault(); \ +- if (access_ok(__gu_addr, (size))) { \ ++ if (access_ok(__gu_addr, __gu_size)) { \ + barrier_nospec(); \ +- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ ++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ + } \ + (x) = (__force __typeof__(*(ptr)))__gu_val; \ ++ \ + __gu_err; \ + }) + +@@ -314,10 +332,13 @@ do { \ + long __gu_err; \ + __long_type(*(ptr)) __gu_val; \ + __typeof__(*(ptr)) __user *__gu_addr = (ptr); \ +- __chk_user_ptr(ptr); \ ++ __typeof__(size) __gu_size = (size); \ ++ \ ++ __chk_user_ptr(__gu_addr); \ + barrier_nospec(); \ +- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \ ++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \ + (x) = (__force __typeof__(*(ptr)))__gu_val; \ ++ \ + __gu_err; \ + }) + diff --git a/queue-5.6/rdma-uverbs-do-not-discard-the-ib_event_device_fatal-event.patch b/queue-5.6/rdma-uverbs-do-not-discard-the-ib_event_device_fatal-event.patch new file mode 100644 index 00000000000..b2a02b34fee --- /dev/null +++ b/queue-5.6/rdma-uverbs-do-not-discard-the-ib_event_device_fatal-event.patch @@ -0,0 +1,106 @@ +From c485b19d52c4ba269dfd027945dee81755fdd530 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Thu, 7 May 2020 09:33:47 +0300 +Subject: RDMA/uverbs: Do not discard the IB_EVENT_DEVICE_FATAL event + +From: Jason Gunthorpe + +commit c485b19d52c4ba269dfd027945dee81755fdd530 upstream. + +The commit below moved all of the destruction to the disassociate step and +cleaned up the event channel during destroy_uobj. + +However, when ib_uverbs_free_hw_resources() pushes IB_EVENT_DEVICE_FATAL +and then immediately goes to destroy all uobjects this causes +ib_uverbs_free_event_queue() to discard the queued event if userspace +hasn't already read() it. + +Unlike all other event queues async FD needs to defer the +ib_uverbs_free_event_queue() until FD release. This still unregisters the +handler from the IB device during disassociation. + +Fixes: 3e032c0e92aa ("RDMA/core: Make ib_uverbs_async_event_file into a uobject") +Link: https://lore.kernel.org/r/20200507063348.98713-2-leon@kernel.org +Signed-off-by: Yishai Hadas +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/rdma_core.c | 3 +- + drivers/infiniband/core/uverbs.h | 1 + drivers/infiniband/core/uverbs_main.c | 2 - + drivers/infiniband/core/uverbs_std_types_async_fd.c | 26 +++++++++++++++++++- + 4 files changed, 29 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -459,7 +459,8 @@ alloc_begin_fd_uobject(const struct uver + struct ib_uobject *uobj; + struct file *filp; + +- if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release)) ++ if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release && ++ fd_type->fops->release != &uverbs_async_event_release)) + return ERR_PTR(-EINVAL); + + new_fd = get_unused_fd_flags(O_CLOEXEC); +--- a/drivers/infiniband/core/uverbs.h ++++ b/drivers/infiniband/core/uverbs.h +@@ -219,6 +219,7 @@ void ib_uverbs_init_event_queue(struct i + void ib_uverbs_init_async_event_file(struct ib_uverbs_async_event_file *ev_file); + void ib_uverbs_free_event_queue(struct ib_uverbs_event_queue *event_queue); + void ib_uverbs_flow_resources_free(struct ib_uflow_resources *uflow_res); ++int uverbs_async_event_release(struct inode *inode, struct file *filp); + + int ib_alloc_ucontext(struct uverbs_attr_bundle *attrs); + int ib_init_ucontext(struct uverbs_attr_bundle *attrs); +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -346,7 +346,7 @@ const struct file_operations uverbs_asyn + .owner = THIS_MODULE, + .read = ib_uverbs_async_event_read, + .poll = ib_uverbs_async_event_poll, +- .release = uverbs_uobject_fd_release, ++ .release = uverbs_async_event_release, + .fasync = ib_uverbs_async_event_fasync, + .llseek = no_llseek, + }; +--- a/drivers/infiniband/core/uverbs_std_types_async_fd.c ++++ b/drivers/infiniband/core/uverbs_std_types_async_fd.c +@@ -26,10 +26,34 @@ static int uverbs_async_event_destroy_uo + container_of(uobj, struct ib_uverbs_async_event_file, uobj); + + ib_unregister_event_handler(&event_file->event_handler); +- ib_uverbs_free_event_queue(&event_file->ev_queue); + return 0; + } + ++int uverbs_async_event_release(struct inode *inode, struct file *filp) ++{ ++ struct ib_uverbs_async_event_file *event_file; ++ struct ib_uobject *uobj = filp->private_data; ++ int ret; ++ ++ if (!uobj) ++ return uverbs_uobject_fd_release(inode, filp); ++ ++ event_file = ++ container_of(uobj, struct ib_uverbs_async_event_file, uobj); ++ ++ /* ++ * The async event FD has to deliver IB_EVENT_DEVICE_FATAL even after ++ * disassociation, so cleaning the event list must only happen after ++ * release. The user knows it has reached the end of the event stream ++ * when it sees IB_EVENT_DEVICE_FATAL. ++ */ ++ uverbs_uobject_get(uobj); ++ ret = uverbs_uobject_fd_release(inode, filp); ++ ib_uverbs_free_event_queue(&event_file->ev_queue); ++ uverbs_uobject_put(uobj); ++ return ret; ++} ++ + DECLARE_UVERBS_NAMED_METHOD( + UVERBS_METHOD_ASYNC_EVENT_ALLOC, + UVERBS_ATTR_FD(UVERBS_ATTR_ASYNC_EVENT_ALLOC_FD_HANDLE, diff --git a/queue-5.6/rdma-uverbs-move-ib_event_device_fatal-to-destroy_uobj.patch b/queue-5.6/rdma-uverbs-move-ib_event_device_fatal-to-destroy_uobj.patch new file mode 100644 index 00000000000..4492ab6aa11 --- /dev/null +++ b/queue-5.6/rdma-uverbs-move-ib_event_device_fatal-to-destroy_uobj.patch @@ -0,0 +1,83 @@ +From ccfdbaa5cf4601b9b71601893029dcc9245c002b Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Thu, 7 May 2020 09:33:48 +0300 +Subject: RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj + +From: Jason Gunthorpe + +commit ccfdbaa5cf4601b9b71601893029dcc9245c002b upstream. + +When multiple async FDs were allowed to exist the idea was for all +broadcast events to be delivered to all async FDs, however +IB_EVENT_DEVICE_FATAL was missed. + +Instead of having ib_uverbs_free_hw_resources() special case the global +async_fd, have it cause the event during the uobject destruction. Every +async fd is now a uobject so simply generate the IB_EVENT_DEVICE_FATAL +while destroying the async fd uobject. This ensures every async FD gets a +copy of the event. + +Fixes: d680e88e2013 ("RDMA/core: Add UVERBS_METHOD_ASYNC_EVENT_ALLOC") +Link: https://lore.kernel.org/r/20200507063348.98713-3-leon@kernel.org +Signed-off-by: Yishai Hadas +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/uverbs.h | 3 +++ + drivers/infiniband/core/uverbs_main.c | 10 +++------- + drivers/infiniband/core/uverbs_std_types_async_fd.c | 4 ++++ + 3 files changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/infiniband/core/uverbs.h ++++ b/drivers/infiniband/core/uverbs.h +@@ -228,6 +228,9 @@ void ib_uverbs_release_ucq(struct ib_uve + struct ib_ucq_object *uobj); + void ib_uverbs_release_uevent(struct ib_uevent_object *uobj); + void ib_uverbs_release_file(struct kref *ref); ++void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, ++ __u64 element, __u64 event, ++ struct list_head *obj_list, u32 *counter); + + void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context); + void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr); +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -386,10 +386,9 @@ void ib_uverbs_comp_handler(struct ib_cq + kill_fasync(&ev_queue->async_queue, SIGIO, POLL_IN); + } + +-static void +-ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, +- __u64 element, __u64 event, struct list_head *obj_list, +- u32 *counter) ++void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, ++ __u64 element, __u64 event, ++ struct list_head *obj_list, u32 *counter) + { + struct ib_uverbs_event *entry; + unsigned long flags; +@@ -1187,9 +1186,6 @@ static void ib_uverbs_free_hw_resources( + */ + mutex_unlock(&uverbs_dev->lists_mutex); + +- ib_uverbs_async_handler(READ_ONCE(file->async_file), 0, +- IB_EVENT_DEVICE_FATAL, NULL, NULL); +- + uverbs_destroy_ufile_hw(file, RDMA_REMOVE_DRIVER_REMOVE); + kref_put(&file->ref, ib_uverbs_release_file); + +--- a/drivers/infiniband/core/uverbs_std_types_async_fd.c ++++ b/drivers/infiniband/core/uverbs_std_types_async_fd.c +@@ -26,6 +26,10 @@ static int uverbs_async_event_destroy_uo + container_of(uobj, struct ib_uverbs_async_event_file, uobj); + + ib_unregister_event_handler(&event_file->event_handler); ++ ++ if (why == RDMA_REMOVE_DRIVER_REMOVE) ++ ib_uverbs_async_handler(event_file, 0, IB_EVENT_DEVICE_FATAL, ++ NULL, NULL); + return 0; + } + diff --git a/queue-5.6/revert-alsa-hda-realtek-fix-pop-noise-on-alc225.patch b/queue-5.6/revert-alsa-hda-realtek-fix-pop-noise-on-alc225.patch new file mode 100644 index 00000000000..fd4916adec8 --- /dev/null +++ b/queue-5.6/revert-alsa-hda-realtek-fix-pop-noise-on-alc225.patch @@ -0,0 +1,36 @@ +From f41224efcf8aafe80ea47ac870c5e32f3209ffc8 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Sun, 3 May 2020 23:24:46 +0800 +Subject: Revert "ALSA: hda/realtek: Fix pop noise on ALC225" + +From: Kai-Heng Feng + +commit f41224efcf8aafe80ea47ac870c5e32f3209ffc8 upstream. + +This reverts commit 3b36b13d5e69d6f51ff1c55d1b404a74646c9757. + +Enable power save node breaks some systems with ACL225. Revert the patch +and use a platform specific quirk for the original issue isntead. + +Fixes: 3b36b13d5e69 ("ALSA: hda/realtek: Fix pop noise on ALC225") +BugLink: https://bugs.launchpad.net/bugs/1875916 +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20200503152449.22761-1-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8121,8 +8121,6 @@ static int patch_alc269(struct hda_codec + spec->gen.mixer_nid = 0; + break; + case 0x10ec0225: +- codec->power_save_node = 1; +- /* fall through */ + case 0x10ec0295: + case 0x10ec0299: + spec->codec_variant = ALC269_TYPE_ALC225; diff --git a/queue-5.6/riscv-perf-riscv_base_pmu-should-be-independent.patch b/queue-5.6/riscv-perf-riscv_base_pmu-should-be-independent.patch new file mode 100644 index 00000000000..aaf2f4c768b --- /dev/null +++ b/queue-5.6/riscv-perf-riscv_base_pmu-should-be-independent.patch @@ -0,0 +1,65 @@ +From 48084c3595cb7429f6ba734cfea1313573b9a7fa Mon Sep 17 00:00:00 2001 +From: Kefeng Wang +Date: Thu, 7 May 2020 23:04:45 +0800 +Subject: riscv: perf: RISCV_BASE_PMU should be independent + +From: Kefeng Wang + +commit 48084c3595cb7429f6ba734cfea1313573b9a7fa upstream. + +Selecting PERF_EVENTS without selecting RISCV_BASE_PMU results in a build +error. + +Signed-off-by: Kefeng Wang +[Palmer: commit text] +Fixes: 178e9fc47aae("perf: riscv: preliminary RISC-V support") +Signed-off-by: Palmer Dabbelt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/riscv/include/asm/perf_event.h | 8 ++------ + arch/riscv/kernel/Makefile | 2 +- + 2 files changed, 3 insertions(+), 7 deletions(-) + +--- a/arch/riscv/include/asm/perf_event.h ++++ b/arch/riscv/include/asm/perf_event.h +@@ -12,19 +12,14 @@ + #include + #include + ++#ifdef CONFIG_RISCV_BASE_PMU + #define RISCV_BASE_COUNTERS 2 + + /* + * The RISCV_MAX_COUNTERS parameter should be specified. + */ + +-#ifdef CONFIG_RISCV_BASE_PMU + #define RISCV_MAX_COUNTERS 2 +-#endif +- +-#ifndef RISCV_MAX_COUNTERS +-#error "Please provide a valid RISCV_MAX_COUNTERS for the PMU." +-#endif + + /* + * These are the indexes of bits in counteren register *minus* 1, +@@ -82,6 +77,7 @@ struct riscv_pmu { + int irq; + }; + ++#endif + #ifdef CONFIG_PERF_EVENTS + #define perf_arch_bpf_user_pt_regs(regs) (struct user_regs_struct *)regs + #endif +--- a/arch/riscv/kernel/Makefile ++++ b/arch/riscv/kernel/Makefile +@@ -38,7 +38,7 @@ obj-$(CONFIG_MODULE_SECTIONS) += module- + obj-$(CONFIG_FUNCTION_TRACER) += mcount.o ftrace.o + obj-$(CONFIG_DYNAMIC_FTRACE) += mcount-dyn.o + +-obj-$(CONFIG_PERF_EVENTS) += perf_event.o ++obj-$(CONFIG_RISCV_BASE_PMU) += perf_event.o + obj-$(CONFIG_PERF_EVENTS) += perf_callchain.o + obj-$(CONFIG_HAVE_PERF_REGS) += perf_regs.o + obj-$(CONFIG_RISCV_SBI) += sbi.o diff --git a/queue-5.6/selftests-bpf-enforce-returning-0-for-fentry-fexit-programs.patch b/queue-5.6/selftests-bpf-enforce-returning-0-for-fentry-fexit-programs.patch new file mode 100644 index 00000000000..52655eb79c9 --- /dev/null +++ b/queue-5.6/selftests-bpf-enforce-returning-0-for-fentry-fexit-programs.patch @@ -0,0 +1,42 @@ +From 6d74f64b922b8394dccc52576659cb0dc0a1da7b Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Wed, 13 May 2020 22:32:07 -0700 +Subject: selftests/bpf: Enforce returning 0 for fentry/fexit programs + +From: Yonghong Song + +commit 6d74f64b922b8394dccc52576659cb0dc0a1da7b upstream. + +There are a few fentry/fexit programs returning non-0. +The tests with these programs will break with the previous +patch which enfoced return-0 rules. Fix them properly. + +Fixes: ac065870d928 ("selftests/bpf: Add BPF_PROG, BPF_KPROBE, and BPF_KRETPROBE macros") +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200514053207.1298479-1-yhs@fb.com +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/bpf/progs/test_overhead.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/bpf/progs/test_overhead.c ++++ b/tools/testing/selftests/bpf/progs/test_overhead.c +@@ -33,13 +33,13 @@ int prog3(struct bpf_raw_tracepoint_args + SEC("fentry/__set_task_comm") + int BPF_PROG(prog4, struct task_struct *tsk, const char *buf, bool exec) + { +- return !tsk; ++ return 0; + } + + SEC("fexit/__set_task_comm") + int BPF_PROG(prog5, struct task_struct *tsk, const char *buf, bool exec) + { +- return !tsk; ++ return 0; + } + + char _license[] SEC("license") = "GPL"; diff --git a/queue-5.6/series b/queue-5.6/series index ab9f9d39799..94f5e365b25 100644 --- a/queue-5.6/series +++ b/queue-5.6/series @@ -160,3 +160,35 @@ x86-unwind-orc-fix-error-handling-in-__unwind_start.patch exec-move-would_dump-into-flush_old_exec.patch clk-rockchip-fix-incorrect-configuration-of-rk3228-aclk_gpu-clocks.patch dwc3-remove-check-for-hwo-flag-in-dwc3_gadget_ep_reclaim_trb_sg.patch +fanotify-fix-merging-marks-masks-with-fan_ondir.patch +arm64-dts-meson-g12b-ugoos-am6-fix-usb-vbus-supply.patch +usb-gadget-tegra-xudc-fix-idle-suspend-resume.patch +usb-gadget-net2272-fix-a-memory-leak-in-an-error-handling-path-in-net2272_plat_probe.patch +usb-gadget-audio-fix-a-missing-error-return-value-in-audio_bind.patch +usb-gadget-legacy-fix-error-return-code-in-gncm_bind.patch +usb-gadget-legacy-fix-error-return-code-in-cdc_bind.patch +revert-alsa-hda-realtek-fix-pop-noise-on-alc225.patch +clk-ti-clkctrl-fix-bad-of_node_put-within-clkctrl_get_name.patch +clk-unlink-clock-if-failed-to-prepare-or-enable.patch +arm64-dts-meson-g12b-khadas-vim3-add-missing-frddr_a-status-property.patch +arm64-dts-qcom-msm8996-reduce-vdd_apc-voltage.patch +arm64-dts-meson-g12-common-fix-dwc2-clock-names.patch +arm64-dts-rockchip-replace-rk805-pmic-node-name-with-pmic-on-rk3328-boards.patch +arm64-dts-rockchip-rename-dwc3-device-nodes-on-rk3399-to-make-dtc-happy.patch +arm64-dts-imx8mn-change-sdma1-ahb-clock-for-imx8mn.patch +arm-dts-r8a73a4-add-missing-cmt1-interrupts.patch +arm64-dts-renesas-r8a77980-fix-ipmmu-vip-nodes.patch +arm-dts-r8a7740-add-missing-extal2-to-cpg-node.patch +dt-bindings-dma-fsl-edma-fix-ls1028a-edma-compatible.patch +sunrpc-revert-241b1f419f0e-sunrpc-remove-xdr_buf_trim.patch +bpf-fix-sk_psock-refcnt-leak-when-receiving-message.patch +powerpc-uaccess-evaluate-macro-arguments-once-before-user-access-is-allowed.patch +powerpc-ima-fix-secure-boot-rules-in-ima-arch-policy.patch +rdma-uverbs-do-not-discard-the-ib_event_device_fatal-event.patch +rdma-uverbs-move-ib_event_device_fatal-to-destroy_uobj.patch +riscv-perf-riscv_base_pmu-should-be-independent.patch +kvm-x86-fix-off-by-one-error-in-kvm_vcpu_ioctl_x86_setup_mce.patch +bpf-enforce-returning-0-for-fentry-fexit-progs.patch +selftests-bpf-enforce-returning-0-for-fentry-fexit-programs.patch +bpf-restrict-bpf_trace_printk-s-s-usage-and-add-pks-pus-specifier.patch +makefile-disallow-data-races-on-gcc-10-as-well.patch diff --git a/queue-5.6/sunrpc-revert-241b1f419f0e-sunrpc-remove-xdr_buf_trim.patch b/queue-5.6/sunrpc-revert-241b1f419f0e-sunrpc-remove-xdr_buf_trim.patch new file mode 100644 index 00000000000..acdb3c23423 --- /dev/null +++ b/queue-5.6/sunrpc-revert-241b1f419f0e-sunrpc-remove-xdr_buf_trim.patch @@ -0,0 +1,136 @@ +From 0a8e7b7d08466b5fc52f8e96070acc116d82a8bb Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 15 Apr 2020 17:36:22 -0400 +Subject: SUNRPC: Revert 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()") + +From: Chuck Lever + +commit 0a8e7b7d08466b5fc52f8e96070acc116d82a8bb upstream. + +I've noticed that when krb5i or krb5p security is in use, +retransmitted requests are missing the server's duplicate reply +cache. The computed checksum on the retransmitted request does not +match the cached checksum, resulting in the server performing the +retransmitted request again instead of returning the cached reply. + +The assumptions made when removing xdr_buf_trim() were not correct. +In the send paths, the upper layer has already set the segment +lengths correctly, and shorting the buffer's content is simply a +matter of reducing buf->len. + +xdr_buf_trim() is the right answer in the receive/unwrap path on +both the client and the server. The buffer segment lengths have to +be shortened one-by-one. + +On the server side in particular, head.iov_len needs to be updated +correctly to enable nfsd_cache_csum() to work correctly. The simple +buf->len computation doesn't do that, and that results in +checksumming stale data in the buffer. + +The problem isn't noticed until there's significant instability of +the RPC transport. At that point, the reliability of retransmit +detection on the server becomes crucial. + +Fixes: 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()") +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/sunrpc/xdr.h | 1 + net/sunrpc/auth_gss/gss_krb5_wrap.c | 7 ++---- + net/sunrpc/auth_gss/svcauth_gss.c | 2 - + net/sunrpc/xdr.c | 41 ++++++++++++++++++++++++++++++++++++ + 4 files changed, 46 insertions(+), 5 deletions(-) + +--- a/include/linux/sunrpc/xdr.h ++++ b/include/linux/sunrpc/xdr.h +@@ -184,6 +184,7 @@ xdr_adjust_iovec(struct kvec *iov, __be3 + extern void xdr_shift_buf(struct xdr_buf *, size_t); + extern void xdr_buf_from_iov(struct kvec *, struct xdr_buf *); + extern int xdr_buf_subsegment(struct xdr_buf *, struct xdr_buf *, unsigned int, unsigned int); ++extern void xdr_buf_trim(struct xdr_buf *, unsigned int); + extern int xdr_buf_read_mic(struct xdr_buf *, struct xdr_netobj *, unsigned int); + extern int read_bytes_from_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int); + extern int write_bytes_to_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int); +--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c ++++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c +@@ -580,15 +580,14 @@ gss_unwrap_kerberos_v2(struct krb5_ctx * + */ + movelen = min_t(unsigned int, buf->head[0].iov_len, len); + movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip; +- if (offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > +- buf->head[0].iov_len) +- return GSS_S_FAILURE; ++ BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > ++ buf->head[0].iov_len); + memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen); + buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; + buf->len = len - GSS_KRB5_TOK_HDR_LEN + headskip; + + /* Trim off the trailing "extra count" and checksum blob */ +- buf->len -= ec + GSS_KRB5_TOK_HDR_LEN + tailskip; ++ xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); + + *align = XDR_QUADLEN(GSS_KRB5_TOK_HDR_LEN + headskip); + *slack = *align + XDR_QUADLEN(ec + GSS_KRB5_TOK_HDR_LEN + tailskip); +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -900,7 +900,7 @@ unwrap_integ_data(struct svc_rqst *rqstp + if (svc_getnl(&buf->head[0]) != seq) + goto out; + /* trim off the mic and padding at the end before returning */ +- buf->len -= 4 + round_up_to_quad(mic.len); ++ xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4); + stat = 0; + out: + kfree(mic.data); +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -1150,6 +1150,47 @@ xdr_buf_subsegment(struct xdr_buf *buf, + } + EXPORT_SYMBOL_GPL(xdr_buf_subsegment); + ++/** ++ * xdr_buf_trim - lop at most "len" bytes off the end of "buf" ++ * @buf: buf to be trimmed ++ * @len: number of bytes to reduce "buf" by ++ * ++ * Trim an xdr_buf by the given number of bytes by fixing up the lengths. Note ++ * that it's possible that we'll trim less than that amount if the xdr_buf is ++ * too small, or if (for instance) it's all in the head and the parser has ++ * already read too far into it. ++ */ ++void xdr_buf_trim(struct xdr_buf *buf, unsigned int len) ++{ ++ size_t cur; ++ unsigned int trim = len; ++ ++ if (buf->tail[0].iov_len) { ++ cur = min_t(size_t, buf->tail[0].iov_len, trim); ++ buf->tail[0].iov_len -= cur; ++ trim -= cur; ++ if (!trim) ++ goto fix_len; ++ } ++ ++ if (buf->page_len) { ++ cur = min_t(unsigned int, buf->page_len, trim); ++ buf->page_len -= cur; ++ trim -= cur; ++ if (!trim) ++ goto fix_len; ++ } ++ ++ if (buf->head[0].iov_len) { ++ cur = min_t(size_t, buf->head[0].iov_len, trim); ++ buf->head[0].iov_len -= cur; ++ trim -= cur; ++ } ++fix_len: ++ buf->len -= (len - trim); ++} ++EXPORT_SYMBOL_GPL(xdr_buf_trim); ++ + static void __read_bytes_from_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len) + { + unsigned int this_len; diff --git a/queue-5.6/usb-gadget-audio-fix-a-missing-error-return-value-in-audio_bind.patch b/queue-5.6/usb-gadget-audio-fix-a-missing-error-return-value-in-audio_bind.patch new file mode 100644 index 00000000000..a97380be6b1 --- /dev/null +++ b/queue-5.6/usb-gadget-audio-fix-a-missing-error-return-value-in-audio_bind.patch @@ -0,0 +1,35 @@ +From 19b94c1f9c9a16d41a8de3ccbdb8536cf1aecdbf Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 3 May 2020 12:47:07 +0200 +Subject: usb: gadget: audio: Fix a missing error return value in audio_bind() + +From: Christophe JAILLET + +commit 19b94c1f9c9a16d41a8de3ccbdb8536cf1aecdbf upstream. + +If 'usb_otg_descriptor_alloc()' fails, we must return an error code, not 0. + +Fixes: 56023ce0fd70 ("usb: gadget: audio: allocate and init otg descriptor by otg capabilities") +Reviewed-by: Peter Chen +Signed-off-by: Christophe JAILLET +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/legacy/audio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/legacy/audio.c ++++ b/drivers/usb/gadget/legacy/audio.c +@@ -300,8 +300,10 @@ static int audio_bind(struct usb_composi + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(cdev->gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto fail; ++ } + usb_otg_descriptor_init(cdev->gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; diff --git a/queue-5.6/usb-gadget-legacy-fix-error-return-code-in-cdc_bind.patch b/queue-5.6/usb-gadget-legacy-fix-error-return-code-in-cdc_bind.patch new file mode 100644 index 00000000000..36a70b6e2d7 --- /dev/null +++ b/queue-5.6/usb-gadget-legacy-fix-error-return-code-in-cdc_bind.patch @@ -0,0 +1,36 @@ +From e8f7f9e3499a6d96f7f63a4818dc7d0f45a7783b Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Thu, 7 May 2020 05:13:32 +0000 +Subject: usb: gadget: legacy: fix error return code in cdc_bind() + +From: Wei Yongjun + +commit e8f7f9e3499a6d96f7f63a4818dc7d0f45a7783b upstream. + +If 'usb_otg_descriptor_alloc()' fails, we must return a +negative error code -ENOMEM, not 0. + +Fixes: ab6796ae9833 ("usb: gadget: cdc2: allocate and init otg descriptor by otg capabilities") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/legacy/cdc2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/legacy/cdc2.c ++++ b/drivers/usb/gadget/legacy/cdc2.c +@@ -179,8 +179,10 @@ static int cdc_bind(struct usb_composite + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto fail1; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; diff --git a/queue-5.6/usb-gadget-legacy-fix-error-return-code-in-gncm_bind.patch b/queue-5.6/usb-gadget-legacy-fix-error-return-code-in-gncm_bind.patch new file mode 100644 index 00000000000..d8e99bd3328 --- /dev/null +++ b/queue-5.6/usb-gadget-legacy-fix-error-return-code-in-gncm_bind.patch @@ -0,0 +1,36 @@ +From e27d4b30b71c66986196d8a1eb93cba9f602904a Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Thu, 7 May 2020 05:13:23 +0000 +Subject: usb: gadget: legacy: fix error return code in gncm_bind() + +From: Wei Yongjun + +commit e27d4b30b71c66986196d8a1eb93cba9f602904a upstream. + +If 'usb_otg_descriptor_alloc()' fails, we must return a +negative error code -ENOMEM, not 0. + +Fixes: 1156e91dd7cc ("usb: gadget: ncm: allocate and init otg descriptor by otg capabilities") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/legacy/ncm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/legacy/ncm.c ++++ b/drivers/usb/gadget/legacy/ncm.c +@@ -156,8 +156,10 @@ static int gncm_bind(struct usb_composit + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto fail; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; diff --git a/queue-5.6/usb-gadget-net2272-fix-a-memory-leak-in-an-error-handling-path-in-net2272_plat_probe.patch b/queue-5.6/usb-gadget-net2272-fix-a-memory-leak-in-an-error-handling-path-in-net2272_plat_probe.patch new file mode 100644 index 00000000000..4045f95eefe --- /dev/null +++ b/queue-5.6/usb-gadget-net2272-fix-a-memory-leak-in-an-error-handling-path-in-net2272_plat_probe.patch @@ -0,0 +1,33 @@ +From ccaef7e6e354fb65758eaddd3eae8065a8b3e295 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Mon, 27 Apr 2020 20:04:23 +0200 +Subject: usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()' + +From: Christophe JAILLET + +commit ccaef7e6e354fb65758eaddd3eae8065a8b3e295 upstream. + +'dev' is allocated in 'net2272_probe_init()'. It must be freed in the error +handling path, as already done in the remove function (i.e. +'net2272_plat_remove()') + +Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers") +Signed-off-by: Christophe JAILLET +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/net2272.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/udc/net2272.c ++++ b/drivers/usb/gadget/udc/net2272.c +@@ -2647,6 +2647,8 @@ net2272_plat_probe(struct platform_devic + err_req: + release_mem_region(base, len); + err: ++ kfree(dev); ++ + return ret; + } + diff --git a/queue-5.6/usb-gadget-tegra-xudc-fix-idle-suspend-resume.patch b/queue-5.6/usb-gadget-tegra-xudc-fix-idle-suspend-resume.patch new file mode 100644 index 00000000000..65604d405ba --- /dev/null +++ b/queue-5.6/usb-gadget-tegra-xudc-fix-idle-suspend-resume.patch @@ -0,0 +1,45 @@ +From 0534d40160cb9505073b0ecf5e7210daee319a66 Mon Sep 17 00:00:00 2001 +From: Thierry Reding +Date: Fri, 17 Apr 2020 19:05:37 +0200 +Subject: usb: gadget: tegra-xudc: Fix idle suspend/resume + +From: Thierry Reding + +commit 0534d40160cb9505073b0ecf5e7210daee319a66 upstream. + +When the XUDC device is idle (i.e. powergated), care must be taken not +to access any registers because that would lead to a crash. + +Move the call to tegra_xudc_device_mode_off() into the same conditional +as the tegra_xudc_powergate() call to make sure we only force device +mode off if the XUDC is actually powered up. + +Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller") +Acked-by: Jon Hunter +Tested-by: Jon Hunter +Signed-off-by: Thierry Reding +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/udc/tegra-xudc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -3740,11 +3740,11 @@ static int __maybe_unused tegra_xudc_sus + + flush_work(&xudc->usb_role_sw_work); + +- /* Forcibly disconnect before powergating. */ +- tegra_xudc_device_mode_off(xudc); +- +- if (!pm_runtime_status_suspended(dev)) ++ if (!pm_runtime_status_suspended(dev)) { ++ /* Forcibly disconnect before powergating. */ ++ tegra_xudc_device_mode_off(xudc); + tegra_xudc_powergate(xudc); ++ } + + pm_runtime_disable(dev); + -- 2.47.3