From e4610483e05dfdec01010d5ac94e9c38d11ac135 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 24 Oct 2021 22:06:13 -0400 Subject: [PATCH] Fixes for 5.14 Signed-off-by: Sasha Levin --- ...codec-wcd938x-add-irq-config-support.patch | 38 +++ ...mb-enable-alpha-blended-second-plane.patch | 272 ++++++++++++++++++ ...rm-kmb-limit-supported-mode-to-1080p.patch | 106 +++++++ ...nr_thps-in-file-s-mapping-on-thp-spl.patch | 64 +++++ ...for-miscalculation-of-rx-unused-desc.patch | 99 +++++++ ...nge-multipath-and-bonding-to-be-mutu.patch | 142 +++++++++ ...-move-lag-destruction-to-a-workqueue.patch | 68 +++++ ...the-shadow-stack-when-idle_task_exit.patch | 44 +++ .../scsi-iscsi-fix-set_param-handling.patch | 45 +++ ...duplicate-device-entries-when-scanni.patch | 40 +++ ...-a-memory-leak-in-an-error-path-of-q.patch | 54 ++++ ...-validation-for-unsolicited-incoming.patch | 81 ++++++ queue-5.14/series | 12 + 13 files changed, 1065 insertions(+) create mode 100644 queue-5.14/asoc-codec-wcd938x-add-irq-config-support.patch create mode 100644 queue-5.14/drm-kmb-enable-alpha-blended-second-plane.patch create mode 100644 queue-5.14/drm-kmb-limit-supported-mode-to-1080p.patch create mode 100644 queue-5.14/mm-thp-decrease-nr_thps-in-file-s-mapping-on-thp-spl.patch create mode 100644 queue-5.14/net-hns3-fix-for-miscalculation-of-rx-unused-desc.patch create mode 100644 queue-5.14/net-mlx5-lag-change-multipath-and-bonding-to-be-mutu.patch create mode 100644 queue-5.14/net-mlx5-lag-move-lag-destruction-to-a-workqueue.patch create mode 100644 queue-5.14/sched-scs-reset-the-shadow-stack-when-idle_task_exit.patch create mode 100644 queue-5.14/scsi-iscsi-fix-set_param-handling.patch create mode 100644 queue-5.14/scsi-mpi3mr-fix-duplicate-device-entries-when-scanni.patch create mode 100644 queue-5.14/scsi-qla2xxx-fix-a-memory-leak-in-an-error-path-of-q.patch create mode 100644 queue-5.14/scsi-storvsc-fix-validation-for-unsolicited-incoming.patch diff --git a/queue-5.14/asoc-codec-wcd938x-add-irq-config-support.patch b/queue-5.14/asoc-codec-wcd938x-add-irq-config-support.patch new file mode 100644 index 00000000000..b8b6994bd86 --- /dev/null +++ b/queue-5.14/asoc-codec-wcd938x-add-irq-config-support.patch @@ -0,0 +1,38 @@ +From 2bd281638040b916289f7290e6a5ce593c8145bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 19:21:15 +0530 +Subject: ASoC: codec: wcd938x: Add irq config support + +From: Srinivasa Rao Mandadapu + +[ Upstream commit 214174d9f56c7f81f4860a26b6b8b961a6b92654 ] + +This patch fixes compilation error in wcd98x codec driver. + +Fixes: 045442228868 ("ASoC: codecs: wcd938x: add audio routing and Kconfig") + +Signed-off-by: Venkata Prasad Potturu +Signed-off-by: Srinivasa Rao Mandadapu +Reviewed-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/1633614675-27122-1-git-send-email-srivasam@codeaurora.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index db16071205ba..dd1ae611fc2a 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -1564,6 +1564,7 @@ config SND_SOC_WCD938X + config SND_SOC_WCD938X_SDW + tristate "WCD9380/WCD9385 Codec - SDW" + select SND_SOC_WCD938X ++ select REGMAP_IRQ + depends on SOUNDWIRE + select REGMAP_SOUNDWIRE + help +-- +2.33.0 + diff --git a/queue-5.14/drm-kmb-enable-alpha-blended-second-plane.patch b/queue-5.14/drm-kmb-enable-alpha-blended-second-plane.patch new file mode 100644 index 00000000000..837f92b909d --- /dev/null +++ b/queue-5.14/drm-kmb-enable-alpha-blended-second-plane.patch @@ -0,0 +1,272 @@ +From 8d9c4a0ac852d5877e731c70f7a04bff6c4e992b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 14:34:29 -0800 +Subject: drm/kmb: Enable alpha blended second plane + +From: Edmund Dea + +[ Upstream commit c026565fe9be813fe826f7e5533ed763283af5f0 ] + +Enable one additional plane that is alpha blended on top +of the primary plane. + +This also fixes the below warnings when building with +-Warray-bounds: + +drivers/gpu/drm/kmb/kmb_plane.c:135:20: warning: array subscript 3 is +above array bounds of 'struct layer_status[1]' [-Warray-bounds] +drivers/gpu/drm/kmb/kmb_plane.c:132:20: warning: array subscript 2 is +above array bounds of 'struct layer_status[1]' [-Warray-bounds] +drivers/gpu/drm/kmb/kmb_plane.c:129:20: warning: array subscript 1 is +above array bounds of 'struct layer_status[1]' [-Warray-bounds] + +v2: corrected previous patch dependecies so it builds + +Signed-off-by: Edmund Dea +Signed-off-by: Anitha Chrisanthus +Acked-by: Sam Ravnborg +Link: https://patchwork.kernel.org/project/dri-devel/patch/20210728003126.1425028-13-anitha.chrisanthus@intel.com/ +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/kmb/kmb_drv.c | 8 ++-- + drivers/gpu/drm/kmb/kmb_drv.h | 5 ++ + drivers/gpu/drm/kmb/kmb_plane.c | 81 +++++++++++++++++++++++++++++---- + drivers/gpu/drm/kmb/kmb_plane.h | 5 +- + drivers/gpu/drm/kmb/kmb_regs.h | 3 ++ + 5 files changed, 87 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/kmb/kmb_drv.c b/drivers/gpu/drm/kmb/kmb_drv.c +index bb7eca9e13ae..d3091bf38cc0 100644 +--- a/drivers/gpu/drm/kmb/kmb_drv.c ++++ b/drivers/gpu/drm/kmb/kmb_drv.c +@@ -173,10 +173,10 @@ static int kmb_setup_mode_config(struct drm_device *drm) + ret = drmm_mode_config_init(drm); + if (ret) + return ret; +- drm->mode_config.min_width = KMB_MIN_WIDTH; +- drm->mode_config.min_height = KMB_MIN_HEIGHT; +- drm->mode_config.max_width = KMB_MAX_WIDTH; +- drm->mode_config.max_height = KMB_MAX_HEIGHT; ++ drm->mode_config.min_width = KMB_FB_MIN_WIDTH; ++ drm->mode_config.min_height = KMB_FB_MIN_HEIGHT; ++ drm->mode_config.max_width = KMB_FB_MAX_WIDTH; ++ drm->mode_config.max_height = KMB_FB_MAX_HEIGHT; + drm->mode_config.funcs = &kmb_mode_config_funcs; + + ret = kmb_setup_crtc(drm); +diff --git a/drivers/gpu/drm/kmb/kmb_drv.h b/drivers/gpu/drm/kmb/kmb_drv.h +index 178aa14f2efc..5869890b8fc7 100644 +--- a/drivers/gpu/drm/kmb/kmb_drv.h ++++ b/drivers/gpu/drm/kmb/kmb_drv.h +@@ -20,6 +20,11 @@ + #define DRIVER_MAJOR 1 + #define DRIVER_MINOR 1 + ++#define KMB_FB_MAX_WIDTH 1920 ++#define KMB_FB_MAX_HEIGHT 1080 ++#define KMB_FB_MIN_WIDTH 1 ++#define KMB_FB_MIN_HEIGHT 1 ++ + #define KMB_LCD_DEFAULT_CLK 200000000 + #define KMB_SYS_CLK_MHZ 500 + +diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c +index 45cb096455b5..00404ba4126d 100644 +--- a/drivers/gpu/drm/kmb/kmb_plane.c ++++ b/drivers/gpu/drm/kmb/kmb_plane.c +@@ -113,9 +113,10 @@ static int kmb_plane_atomic_check(struct drm_plane *plane, + if (ret) + return ret; + +- if (new_plane_state->crtc_w > KMB_MAX_WIDTH || new_plane_state->crtc_h > KMB_MAX_HEIGHT) +- return -EINVAL; +- if (new_plane_state->crtc_w < KMB_MIN_WIDTH || new_plane_state->crtc_h < KMB_MIN_HEIGHT) ++ if (new_plane_state->crtc_w > KMB_FB_MAX_WIDTH || ++ new_plane_state->crtc_h > KMB_FB_MAX_HEIGHT || ++ new_plane_state->crtc_w < KMB_FB_MIN_WIDTH || ++ new_plane_state->crtc_h < KMB_FB_MIN_HEIGHT) + return -EINVAL; + + /* Due to HW limitations, changing plane height or width after +@@ -306,6 +307,44 @@ static void config_csc(struct kmb_drm_private *kmb, int plane_id) + kmb_write_lcd(kmb, LCD_LAYERn_CSC_OFF3(plane_id), csc_coef_lcd[11]); + } + ++static void kmb_plane_set_alpha(struct kmb_drm_private *kmb, ++ const struct drm_plane_state *state, ++ unsigned char plane_id, ++ unsigned int *val) ++{ ++ u16 plane_alpha = state->alpha; ++ u16 pixel_blend_mode = state->pixel_blend_mode; ++ int has_alpha = state->fb->format->has_alpha; ++ ++ if (plane_alpha != DRM_BLEND_ALPHA_OPAQUE) ++ *val |= LCD_LAYER_ALPHA_STATIC; ++ ++ if (has_alpha) { ++ switch (pixel_blend_mode) { ++ case DRM_MODE_BLEND_PIXEL_NONE: ++ break; ++ case DRM_MODE_BLEND_PREMULTI: ++ *val |= LCD_LAYER_ALPHA_EMBED | LCD_LAYER_ALPHA_PREMULT; ++ break; ++ case DRM_MODE_BLEND_COVERAGE: ++ *val |= LCD_LAYER_ALPHA_EMBED; ++ break; ++ default: ++ DRM_DEBUG("Missing pixel blend mode case (%s == %ld)\n", ++ __stringify(pixel_blend_mode), ++ (long)pixel_blend_mode); ++ break; ++ } ++ } ++ ++ if (plane_alpha == DRM_BLEND_ALPHA_OPAQUE && !has_alpha) { ++ *val &= LCD_LAYER_ALPHA_DISABLED; ++ return; ++ } ++ ++ kmb_write_lcd(kmb, LCD_LAYERn_ALPHA(plane_id), plane_alpha); ++} ++ + static void kmb_plane_atomic_update(struct drm_plane *plane, + struct drm_atomic_state *state) + { +@@ -333,11 +372,12 @@ static void kmb_plane_atomic_update(struct drm_plane *plane, + fb = new_plane_state->fb; + if (!fb) + return; ++ + num_planes = fb->format->num_planes; + kmb_plane = to_kmb_plane(plane); +- plane_id = kmb_plane->id; + + kmb = to_kmb(plane->dev); ++ plane_id = kmb_plane->id; + + spin_lock_irq(&kmb->irq_lock); + if (kmb->kmb_under_flow || kmb->kmb_flush_done) { +@@ -431,20 +471,32 @@ static void kmb_plane_atomic_update(struct drm_plane *plane, + config_csc(kmb, plane_id); + } + ++ kmb_plane_set_alpha(kmb, plane->state, plane_id, &val); ++ + kmb_write_lcd(kmb, LCD_LAYERn_CFG(plane_id), val); + ++ /* Configure LCD_CONTROL */ ++ ctrl = kmb_read_lcd(kmb, LCD_CONTROL); ++ ++ /* Set layer blending config */ ++ ctrl &= ~LCD_CTRL_ALPHA_ALL; ++ ctrl |= LCD_CTRL_ALPHA_BOTTOM_VL1 | ++ LCD_CTRL_ALPHA_BLEND_VL2; ++ ++ ctrl &= ~LCD_CTRL_ALPHA_BLEND_BKGND_DISABLE; ++ + switch (plane_id) { + case LAYER_0: +- ctrl = LCD_CTRL_VL1_ENABLE; ++ ctrl |= LCD_CTRL_VL1_ENABLE; + break; + case LAYER_1: +- ctrl = LCD_CTRL_VL2_ENABLE; ++ ctrl |= LCD_CTRL_VL2_ENABLE; + break; + case LAYER_2: +- ctrl = LCD_CTRL_GL1_ENABLE; ++ ctrl |= LCD_CTRL_GL1_ENABLE; + break; + case LAYER_3: +- ctrl = LCD_CTRL_GL2_ENABLE; ++ ctrl |= LCD_CTRL_GL2_ENABLE; + break; + } + +@@ -456,7 +508,7 @@ static void kmb_plane_atomic_update(struct drm_plane *plane, + */ + ctrl |= LCD_CTRL_VHSYNC_IDLE_LVL; + +- kmb_set_bitmask_lcd(kmb, LCD_CONTROL, ctrl); ++ kmb_write_lcd(kmb, LCD_CONTROL, ctrl); + + /* Enable pipeline AXI read transactions for the DMA + * after setting graphics layers. This must be done +@@ -531,6 +583,9 @@ struct kmb_plane *kmb_plane_init(struct drm_device *drm) + enum drm_plane_type plane_type; + const u32 *plane_formats; + int num_plane_formats; ++ unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) | ++ BIT(DRM_MODE_BLEND_PREMULTI) | ++ BIT(DRM_MODE_BLEND_COVERAGE); + + for (i = 0; i < KMB_MAX_PLANES; i++) { + plane = drmm_kzalloc(drm, sizeof(*plane), GFP_KERNEL); +@@ -562,8 +617,16 @@ struct kmb_plane *kmb_plane_init(struct drm_device *drm) + drm_dbg(drm, "%s : %d i=%d type=%d", + __func__, __LINE__, + i, plane_type); ++ drm_plane_create_alpha_property(&plane->base_plane); ++ ++ drm_plane_create_blend_mode_property(&plane->base_plane, ++ blend_caps); ++ ++ drm_plane_create_zpos_immutable_property(&plane->base_plane, i); ++ + drm_plane_helper_add(&plane->base_plane, + &kmb_plane_helper_funcs); ++ + if (plane_type == DRM_PLANE_TYPE_PRIMARY) { + primary = plane; + kmb->plane = plane; +diff --git a/drivers/gpu/drm/kmb/kmb_plane.h b/drivers/gpu/drm/kmb/kmb_plane.h +index 99207b35365c..b51144044fe8 100644 +--- a/drivers/gpu/drm/kmb/kmb_plane.h ++++ b/drivers/gpu/drm/kmb/kmb_plane.h +@@ -35,6 +35,9 @@ + #define POSSIBLE_CRTCS 1 + #define to_kmb_plane(x) container_of(x, struct kmb_plane, base_plane) + ++#define POSSIBLE_CRTCS 1 ++#define KMB_MAX_PLANES 2 ++ + enum layer_id { + LAYER_0, + LAYER_1, +@@ -43,8 +46,6 @@ enum layer_id { + /* KMB_MAX_PLANES */ + }; + +-#define KMB_MAX_PLANES 1 +- + enum sub_plane_id { + Y_PLANE, + U_PLANE, +diff --git a/drivers/gpu/drm/kmb/kmb_regs.h b/drivers/gpu/drm/kmb/kmb_regs.h +index 48150569f702..9756101b0d32 100644 +--- a/drivers/gpu/drm/kmb/kmb_regs.h ++++ b/drivers/gpu/drm/kmb/kmb_regs.h +@@ -43,8 +43,10 @@ + #define LCD_CTRL_OUTPUT_ENABLED BIT(19) + #define LCD_CTRL_BPORCH_ENABLE BIT(21) + #define LCD_CTRL_FPORCH_ENABLE BIT(22) ++#define LCD_CTRL_ALPHA_BLEND_BKGND_DISABLE BIT(23) + #define LCD_CTRL_PIPELINE_DMA BIT(28) + #define LCD_CTRL_VHSYNC_IDLE_LVL BIT(31) ++#define LCD_CTRL_ALPHA_ALL (0xff << 6) + + /* interrupts */ + #define LCD_INT_STATUS (0x4 * 0x001) +@@ -115,6 +117,7 @@ + #define LCD_LAYER_ALPHA_EMBED BIT(5) + #define LCD_LAYER_ALPHA_COMBI (LCD_LAYER_ALPHA_STATIC | \ + LCD_LAYER_ALPHA_EMBED) ++#define LCD_LAYER_ALPHA_DISABLED ~(LCD_LAYER_ALPHA_COMBI) + /* RGB multiplied with alpha */ + #define LCD_LAYER_ALPHA_PREMULT BIT(6) + #define LCD_LAYER_INVERT_COL BIT(7) +-- +2.33.0 + diff --git a/queue-5.14/drm-kmb-limit-supported-mode-to-1080p.patch b/queue-5.14/drm-kmb-limit-supported-mode-to-1080p.patch new file mode 100644 index 00000000000..44f3b0f890d --- /dev/null +++ b/queue-5.14/drm-kmb-limit-supported-mode-to-1080p.patch @@ -0,0 +1,106 @@ +From 3e97c116e7722c7f2598b5f7bdc16043a334fc0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jan 2021 14:34:13 -0800 +Subject: drm/kmb: Limit supported mode to 1080p + +From: Anitha Chrisanthus + +[ Upstream commit a79f40cccd4644c32f6d5ae1ccf091a262e1dc57 ] + +KMB only supports single resolution(1080p), this commit checks for +1920x1080x60 or 1920x1080x59 in crtc_mode_valid. +Also, modes with vfp < 4 are not supported in KMB display. This change +prunes display modes with vfp < 4. + +v2: added vfp check + +Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display") +Co-developed-by: Edmund Dea +Signed-off-by: Edmund Dea +Signed-off-by: Anitha Chrisanthus +Acked-by: Sam Ravnborg +Link:https://patchwork.freedesktop.org/patch/msgid/20211013233632.471892-2-anitha.chrisanthus@intel.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/kmb/kmb_crtc.c | 34 ++++++++++++++++++++++++++++++++++ + drivers/gpu/drm/kmb/kmb_drv.h | 9 ++++++++- + 2 files changed, 42 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/kmb/kmb_crtc.c b/drivers/gpu/drm/kmb/kmb_crtc.c +index 4f240466cf63..06613ffeaaf8 100644 +--- a/drivers/gpu/drm/kmb/kmb_crtc.c ++++ b/drivers/gpu/drm/kmb/kmb_crtc.c +@@ -186,11 +186,45 @@ static void kmb_crtc_atomic_flush(struct drm_crtc *crtc, + spin_unlock_irq(&crtc->dev->event_lock); + } + ++static enum drm_mode_status ++ kmb_crtc_mode_valid(struct drm_crtc *crtc, ++ const struct drm_display_mode *mode) ++{ ++ int refresh; ++ struct drm_device *dev = crtc->dev; ++ int vfp = mode->vsync_start - mode->vdisplay; ++ ++ if (mode->vdisplay < KMB_CRTC_MAX_HEIGHT) { ++ drm_dbg(dev, "height = %d less than %d", ++ mode->vdisplay, KMB_CRTC_MAX_HEIGHT); ++ return MODE_BAD_VVALUE; ++ } ++ if (mode->hdisplay < KMB_CRTC_MAX_WIDTH) { ++ drm_dbg(dev, "width = %d less than %d", ++ mode->hdisplay, KMB_CRTC_MAX_WIDTH); ++ return MODE_BAD_HVALUE; ++ } ++ refresh = drm_mode_vrefresh(mode); ++ if (refresh < KMB_MIN_VREFRESH || refresh > KMB_MAX_VREFRESH) { ++ drm_dbg(dev, "refresh = %d less than %d or greater than %d", ++ refresh, KMB_MIN_VREFRESH, KMB_MAX_VREFRESH); ++ return MODE_BAD; ++ } ++ ++ if (vfp < KMB_CRTC_MIN_VFP) { ++ drm_dbg(dev, "vfp = %d less than %d", vfp, KMB_CRTC_MIN_VFP); ++ return MODE_BAD; ++ } ++ ++ return MODE_OK; ++} ++ + static const struct drm_crtc_helper_funcs kmb_crtc_helper_funcs = { + .atomic_begin = kmb_crtc_atomic_begin, + .atomic_enable = kmb_crtc_atomic_enable, + .atomic_disable = kmb_crtc_atomic_disable, + .atomic_flush = kmb_crtc_atomic_flush, ++ .mode_valid = kmb_crtc_mode_valid, + }; + + int kmb_setup_crtc(struct drm_device *drm) +diff --git a/drivers/gpu/drm/kmb/kmb_drv.h b/drivers/gpu/drm/kmb/kmb_drv.h +index 5869890b8fc7..bf085e95b28f 100644 +--- a/drivers/gpu/drm/kmb/kmb_drv.h ++++ b/drivers/gpu/drm/kmb/kmb_drv.h +@@ -20,11 +20,18 @@ + #define DRIVER_MAJOR 1 + #define DRIVER_MINOR 1 + ++/* Platform definitions */ ++#define KMB_CRTC_MIN_VFP 4 ++#define KMB_CRTC_MAX_WIDTH 1920 /* max width in pixels */ ++#define KMB_CRTC_MAX_HEIGHT 1080 /* max height in pixels */ ++#define KMB_CRTC_MIN_WIDTH 1920 ++#define KMB_CRTC_MIN_HEIGHT 1080 + #define KMB_FB_MAX_WIDTH 1920 + #define KMB_FB_MAX_HEIGHT 1080 + #define KMB_FB_MIN_WIDTH 1 + #define KMB_FB_MIN_HEIGHT 1 +- ++#define KMB_MIN_VREFRESH 59 /*vertical refresh in Hz */ ++#define KMB_MAX_VREFRESH 60 /*vertical refresh in Hz */ + #define KMB_LCD_DEFAULT_CLK 200000000 + #define KMB_SYS_CLK_MHZ 500 + +-- +2.33.0 + diff --git a/queue-5.14/mm-thp-decrease-nr_thps-in-file-s-mapping-on-thp-spl.patch b/queue-5.14/mm-thp-decrease-nr_thps-in-file-s-mapping-on-thp-spl.patch new file mode 100644 index 00000000000..1623bd30be1 --- /dev/null +++ b/queue-5.14/mm-thp-decrease-nr_thps-in-file-s-mapping-on-thp-spl.patch @@ -0,0 +1,64 @@ +From e6f839944d0e2345e93b0afeeb2e51a847f362f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 15:16:19 -0700 +Subject: mm/thp: decrease nr_thps in file's mapping on THP split + +From: Marek Szyprowski + +[ Upstream commit 1ca7554d05ac038c98271f8968ed821266ecaa9c ] + +Decrease nr_thps counter in file's mapping to ensure that the page cache +won't be dropped excessively on file write access if page has been +already split. + +I've tried a test scenario running a big binary, kernel remaps it with +THPs, then force a THP split with /sys/kernel/debug/split_huge_pages. +During any further open of that binary with O_RDWR or O_WRITEONLY kernel +drops page cache for it, because of non-zero thps counter. + +Link: https://lkml.kernel.org/r/20211012120237.2600-1-m.szyprowski@samsung.com +Signed-off-by: Marek Szyprowski +Fixes: 09d91cda0e82 ("mm,thp: avoid writes to file with THP in pagecache") +Fixes: 06d3eff62d9d ("mm/thp: fix node page state in split_huge_page_to_list()") +Acked-by: Matthew Wilcox (Oracle) +Reviewed-by: Yang Shi +Cc: +Cc: Song Liu +Cc: Rik van Riel +Cc: "Kirill A . Shutemov" +Cc: Johannes Weiner +Cc: Hillf Danton +Cc: Hugh Dickins +Cc: William Kucharski +Cc: Oleg Nesterov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/huge_memory.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index afff3ac87067..163c2da2a654 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2724,12 +2724,14 @@ int split_huge_page_to_list(struct page *page, struct list_head *list) + if (mapping) { + int nr = thp_nr_pages(head); + +- if (PageSwapBacked(head)) ++ if (PageSwapBacked(head)) { + __mod_lruvec_page_state(head, NR_SHMEM_THPS, + -nr); +- else ++ } else { + __mod_lruvec_page_state(head, NR_FILE_THPS, + -nr); ++ filemap_nr_thps_dec(mapping); ++ } + } + + __split_huge_page(page, list, end); +-- +2.33.0 + diff --git a/queue-5.14/net-hns3-fix-for-miscalculation-of-rx-unused-desc.patch b/queue-5.14/net-hns3-fix-for-miscalculation-of-rx-unused-desc.patch new file mode 100644 index 00000000000..8f159854a18 --- /dev/null +++ b/queue-5.14/net-hns3-fix-for-miscalculation-of-rx-unused-desc.patch @@ -0,0 +1,99 @@ +From de39f43f38f95e3c9dc99f8b86aaeb6574c041c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Oct 2021 22:16:32 +0800 +Subject: net: hns3: fix for miscalculation of rx unused desc + +From: Yunsheng Lin + +[ Upstream commit 9f9f0f19994b42b3e5e8735d41b9c5136828a76c ] + +rx unused desc is the desc that need attatching new buffer +before refilling to hw to receive new packet, the number of +desc need attatching new buffer is calculated using next_to_use +and next_to_clean. when next_to_use == next_to_clean, currently +hns3 driver assumes that all the desc has the buffer attatched, +but 'next_to_use == next_to_clean' also means all the desc need +attatching new buffer if hw has comsumed all the desc and the +driver has not attatched any buffer to the desc yet. + +This patch adds 'refill' in desc_cb to indicate whether a new +buffer has been refilled to a desc. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Yunsheng Lin +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++++ + drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 1 + + 2 files changed, 9 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 02495ea34332..5aad7951308d 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3263,6 +3263,7 @@ static void hns3_buffer_detach(struct hns3_enet_ring *ring, int i) + { + hns3_unmap_buffer(ring, &ring->desc_cb[i]); + ring->desc[i].addr = 0; ++ ring->desc_cb[i].refill = 0; + } + + static void hns3_free_buffer_detach(struct hns3_enet_ring *ring, int i, +@@ -3340,6 +3341,7 @@ static int hns3_alloc_and_attach_buffer(struct hns3_enet_ring *ring, int i) + return ret; + + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma); ++ ring->desc_cb[i].refill = 1; + + return 0; + } +@@ -3370,12 +3372,14 @@ static void hns3_replace_buffer(struct hns3_enet_ring *ring, int i, + hns3_unmap_buffer(ring, &ring->desc_cb[i]); + ring->desc_cb[i] = *res_cb; + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma); ++ ring->desc_cb[i].refill = 1; + ring->desc[i].rx.bd_base_info = 0; + } + + static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i) + { + ring->desc_cb[i].reuse_flag = 0; ++ ring->desc_cb[i].refill = 1; + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma + + ring->desc_cb[i].page_offset); + ring->desc[i].rx.bd_base_info = 0; +@@ -3482,6 +3486,9 @@ static int hns3_desc_unused(struct hns3_enet_ring *ring) + int ntc = ring->next_to_clean; + int ntu = ring->next_to_use; + ++ if (unlikely(ntc == ntu && !ring->desc_cb[ntc].refill)) ++ return ring->desc_num; ++ + return ((ntc >= ntu) ? 0 : ring->desc_num) + ntc - ntu; + } + +@@ -3826,6 +3833,7 @@ static void hns3_rx_ring_move_fw(struct hns3_enet_ring *ring) + { + ring->desc[ring->next_to_clean].rx.bd_base_info &= + cpu_to_le32(~BIT(HNS3_RXD_VLD_B)); ++ ring->desc_cb[ring->next_to_clean].refill = 0; + ring->next_to_clean += 1; + + if (unlikely(ring->next_to_clean == ring->desc_num)) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +index 399ebeed6e7e..d146f44bfaca 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +@@ -322,6 +322,7 @@ struct hns3_desc_cb { + u32 length; /* length of the buffer */ + + u16 reuse_flag; ++ u16 refill; + + /* desc type, used by the ring user to mark the type of the priv data */ + u16 type; +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5-lag-change-multipath-and-bonding-to-be-mutu.patch b/queue-5.14/net-mlx5-lag-change-multipath-and-bonding-to-be-mutu.patch new file mode 100644 index 00000000000..82eff8e3d0d --- /dev/null +++ b/queue-5.14/net-mlx5-lag-change-multipath-and-bonding-to-be-mutu.patch @@ -0,0 +1,142 @@ +From 2c21e7c47a74ecf2a292a93becb33466cc648bbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 16:05:38 +0300 +Subject: net/mlx5: Lag, change multipath and bonding to be mutually exclusive + +From: Maor Dickman + +[ Upstream commit 14fe2471c62816ba82546fb68369d957c3a58b59 ] + +Both multipath and bonding events are changing the HW LAG state +independently. +Handling one of the features events while the other is already +enabled can cause unwanted behavior, for example handling +bonding event while multipath enabled will disable the lag and +cause multipath to stop working. + +Fix it by ignoring bonding event while in multipath and ignoring FIB +events while in bonding mode. + +Fixes: 544fe7c2e654 ("net/mlx5e: Activate HW multipath and handle port affinity based on FIB events") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 2 ++ + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 ++ + drivers/net/ethernet/mellanox/mlx5/core/lag.c | 4 ++++ + drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 13 ++++++++----- + drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h | 2 ++ + include/linux/mlx5/driver.h | 1 - + 6 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +index 1e2d117082d4..603d9884b6bd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +@@ -10,6 +10,8 @@ + #include "en_tc.h" + #include "rep/tc.h" + #include "rep/neigh.h" ++#include "lag.h" ++#include "lag_mp.h" + + struct mlx5e_tc_tun_route_attr { + struct net_device *out_dev; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 6eba574c5a36..c757209b47ee 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -72,6 +72,8 @@ + #include "lib/fs_chains.h" + #include "diag/en_tc_tracepoint.h" + #include ++#include "lag.h" ++#include "lag_mp.h" + + #define nic_chains(priv) ((priv)->fs.tc.chains) + #define MLX5_MH_ACT_SZ MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +index 814440aae1ae..be6e7e10b252 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +@@ -375,6 +375,10 @@ static void mlx5_do_bond(struct mlx5_lag *ldev) + if (!mlx5_lag_is_ready(ldev)) { + do_bond = false; + } else { ++ /* VF LAG is in multipath mode, ignore bond change requests */ ++ if (mlx5_lag_is_multipath(dev0)) ++ return; ++ + tracker = ldev->tracker; + + do_bond = tracker.is_bonded && mlx5_lag_check_prereq(ldev); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +index 516bfc2bd797..577e5d02bfdd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +@@ -9,20 +9,23 @@ + #include "eswitch.h" + #include "lib/mlx5.h" + ++static bool __mlx5_lag_is_multipath(struct mlx5_lag *ldev) ++{ ++ return !!(ldev->flags & MLX5_LAG_FLAG_MULTIPATH); ++} ++ + static bool mlx5_lag_multipath_check_prereq(struct mlx5_lag *ldev) + { + if (!mlx5_lag_is_ready(ldev)) + return false; + ++ if (__mlx5_lag_is_active(ldev) && !__mlx5_lag_is_multipath(ldev)) ++ return false; ++ + return mlx5_esw_multipath_prereq(ldev->pf[MLX5_LAG_P1].dev, + ldev->pf[MLX5_LAG_P2].dev); + } + +-static bool __mlx5_lag_is_multipath(struct mlx5_lag *ldev) +-{ +- return !!(ldev->flags & MLX5_LAG_FLAG_MULTIPATH); +-} +- + bool mlx5_lag_is_multipath(struct mlx5_core_dev *dev) + { + struct mlx5_lag *ldev; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h +index 729c839397a8..dea199e79bed 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h +@@ -24,12 +24,14 @@ struct lag_mp { + void mlx5_lag_mp_reset(struct mlx5_lag *ldev); + int mlx5_lag_mp_init(struct mlx5_lag *ldev); + void mlx5_lag_mp_cleanup(struct mlx5_lag *ldev); ++bool mlx5_lag_is_multipath(struct mlx5_core_dev *dev); + + #else /* CONFIG_MLX5_ESWITCH */ + + static inline void mlx5_lag_mp_reset(struct mlx5_lag *ldev) {}; + static inline int mlx5_lag_mp_init(struct mlx5_lag *ldev) { return 0; } + static inline void mlx5_lag_mp_cleanup(struct mlx5_lag *ldev) {} ++bool mlx5_lag_is_multipath(struct mlx5_core_dev *dev) { return false; } + + #endif /* CONFIG_MLX5_ESWITCH */ + #endif /* __MLX5_LAG_MP_H__ */ +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 25a8be58d289..9b8add8eac0c 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -1135,7 +1135,6 @@ int mlx5_cmd_create_vport_lag(struct mlx5_core_dev *dev); + int mlx5_cmd_destroy_vport_lag(struct mlx5_core_dev *dev); + bool mlx5_lag_is_roce(struct mlx5_core_dev *dev); + bool mlx5_lag_is_sriov(struct mlx5_core_dev *dev); +-bool mlx5_lag_is_multipath(struct mlx5_core_dev *dev); + bool mlx5_lag_is_active(struct mlx5_core_dev *dev); + struct net_device *mlx5_lag_get_roce_netdev(struct mlx5_core_dev *dev); + u8 mlx5_lag_get_slave_port(struct mlx5_core_dev *dev, +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5-lag-move-lag-destruction-to-a-workqueue.patch b/queue-5.14/net-mlx5-lag-move-lag-destruction-to-a-workqueue.patch new file mode 100644 index 00000000000..5d20e90e620 --- /dev/null +++ b/queue-5.14/net-mlx5-lag-move-lag-destruction-to-a-workqueue.patch @@ -0,0 +1,68 @@ +From 502ba484f81d7d74072b819d4e921989104e33f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 16:19:57 -0700 +Subject: net/mlx5: Lag, move lag destruction to a workqueue + +From: Mark Bloch + +[ Upstream commit 63d4a9afbcee4167ffb0d126b23b8884b15e5837 ] + +If a netdev is removed from the lag the lag should be destroyed. +With downstream patches this might trigger a reconfiguration of +representors on a different eswitch and such we don't have the proper +locking to so from this path. Move the destruction to be done by the +workqueue. + +As the destruction won't affect the netdev side it okay to do so. +The RDMA side will be reconfigured and it already coded to handle such +reconfiguration. + +Signed-off-by: Mark Bloch +Reviewed-by: Mark Zhang +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lag.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +index 40ef60f562b4..814440aae1ae 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +@@ -372,12 +372,13 @@ static void mlx5_do_bond(struct mlx5_lag *ldev) + bool do_bond, roce_lag; + int err; + +- if (!mlx5_lag_is_ready(ldev)) +- return; +- +- tracker = ldev->tracker; ++ if (!mlx5_lag_is_ready(ldev)) { ++ do_bond = false; ++ } else { ++ tracker = ldev->tracker; + +- do_bond = tracker.is_bonded && mlx5_lag_check_prereq(ldev); ++ do_bond = tracker.is_bonded && mlx5_lag_check_prereq(ldev); ++ } + + if (do_bond && !__mlx5_lag_is_active(ldev)) { + roce_lag = !mlx5_sriov_is_enabled(dev0) && +@@ -691,11 +692,11 @@ void mlx5_lag_remove_netdev(struct mlx5_core_dev *dev, + if (!ldev) + return; + +- if (__mlx5_lag_is_active(ldev)) +- mlx5_disable_lag(ldev); +- + mlx5_ldev_remove_netdev(ldev, netdev); + ldev->flags &= ~MLX5_LAG_FLAG_READY; ++ ++ if (__mlx5_lag_is_active(ldev)) ++ mlx5_queue_bond_work(ldev, 0); + } + + /* Must be called with intf_mutex held */ +-- +2.33.0 + diff --git a/queue-5.14/sched-scs-reset-the-shadow-stack-when-idle_task_exit.patch b/queue-5.14/sched-scs-reset-the-shadow-stack-when-idle_task_exit.patch new file mode 100644 index 00000000000..3c4a555a9e6 --- /dev/null +++ b/queue-5.14/sched-scs-reset-the-shadow-stack-when-idle_task_exit.patch @@ -0,0 +1,44 @@ +From db4189654eebf1e8df013822135ee7e73225bdba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 16:35:21 +0800 +Subject: sched/scs: Reset the shadow stack when idle_task_exit + +From: Woody Lin + +[ Upstream commit 63acd42c0d4942f74710b11c38602fb14dea7320 ] + +Commit f1a0a376ca0c ("sched/core: Initialize the idle task with +preemption disabled") removed the init_idle() call from +idle_thread_get(). This was the sole call-path on hotplug that resets +the Shadow Call Stack (scs) Stack Pointer (sp). + +Not resetting the scs-sp leads to scs overflow after enough hotplug +cycles. Therefore add an explicit scs_task_reset() to the hotplug code +to make sure the scs-sp does get reset on hotplug. + +Fixes: f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled") +Signed-off-by: Woody Lin +[peterz: Changelog] +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Valentin Schneider +Link: https://lore.kernel.org/r/20211012083521.973587-1-woodylin@google.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 399c37c95392..e165d28cf73b 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8495,6 +8495,7 @@ void idle_task_exit(void) + finish_arch_post_lock_switch(); + } + ++ scs_task_reset(current); + /* finish_cpu(), as ran on the BP, will clean up the active_mm state */ + } + +-- +2.33.0 + diff --git a/queue-5.14/scsi-iscsi-fix-set_param-handling.patch b/queue-5.14/scsi-iscsi-fix-set_param-handling.patch new file mode 100644 index 00000000000..58fbae38395 --- /dev/null +++ b/queue-5.14/scsi-iscsi-fix-set_param-handling.patch @@ -0,0 +1,45 @@ +From a61d3e8d4c6473900c88699ce4f6bb33c5e7e9db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Oct 2021 11:19:04 -0500 +Subject: scsi: iscsi: Fix set_param() handling + +From: Mike Christie + +[ Upstream commit 187a580c9e7895978dcd1e627b9c9e7e3d13ca96 ] + +In commit 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and +sync thread") we meant to add a check where before we call ->set_param() we +make sure the iscsi_cls_connection is bound. The problem is that between +versions 4 and 5 of the patch the deletion of the unchecked set_param() +call was dropped so we ended up with 2 calls. As a result we can still hit +a crash where we access the unbound connection on the first call. + +This patch removes that first call. + +Fixes: 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and sync thread") +Link: https://lore.kernel.org/r/20211010161904.60471-1-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Reviewed-by: Li Feng +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 922e4c7bd88e..78343d3f9385 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2930,8 +2930,6 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev) + session->recovery_tmo = value; + break; + default: +- err = transport->set_param(conn, ev->u.set_param.param, +- data, ev->u.set_param.len); + if ((conn->state == ISCSI_CONN_BOUND) || + (conn->state == ISCSI_CONN_UP)) { + err = transport->set_param(conn, ev->u.set_param.param, +-- +2.33.0 + diff --git a/queue-5.14/scsi-mpi3mr-fix-duplicate-device-entries-when-scanni.patch b/queue-5.14/scsi-mpi3mr-fix-duplicate-device-entries-when-scanni.patch new file mode 100644 index 00000000000..44589a9ce3d --- /dev/null +++ b/queue-5.14/scsi-mpi3mr-fix-duplicate-device-entries-when-scanni.patch @@ -0,0 +1,40 @@ +From 050e0bb31d8373dec256ee7c1290bbad1c2944d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 11:24:25 +0530 +Subject: scsi: mpi3mr: Fix duplicate device entries when scanning through + sysfs + +From: Sreekanth Reddy + +[ Upstream commit 97e6ea6d78064e7f1e9e19c45dc690aabbb71297 ] + +When scanning devices through the 'scan' attribute in sysfs, the user will +observe duplicate device entries in lsscsi command output. + +Set the shost's max_channel to zero to avoid this. + +Link: https://lore.kernel.org/r/20211014055425.30719-1-sreekanth.reddy@broadcom.com +Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpi3mr/mpi3mr_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c +index 24ac7ddec749..206c2598ade3 100644 +--- a/drivers/scsi/mpi3mr/mpi3mr_os.c ++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c +@@ -3755,7 +3755,7 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id) + shost->max_lun = -1; + shost->unique_id = mrioc->id; + +- shost->max_channel = 1; ++ shost->max_channel = 0; + shost->max_id = 0xFFFFFFFF; + + if (prot_mask >= 0) +-- +2.33.0 + diff --git a/queue-5.14/scsi-qla2xxx-fix-a-memory-leak-in-an-error-path-of-q.patch b/queue-5.14/scsi-qla2xxx-fix-a-memory-leak-in-an-error-path-of-q.patch new file mode 100644 index 00000000000..0761b432d4c --- /dev/null +++ b/queue-5.14/scsi-qla2xxx-fix-a-memory-leak-in-an-error-path-of-q.patch @@ -0,0 +1,54 @@ +From 94d9a3428d891a75d6abdc4e6049b469829957a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 12:18:33 -0700 +Subject: scsi: qla2xxx: Fix a memory leak in an error path of + qla2x00_process_els() + +From: Joy Gu + +[ Upstream commit 7fb223d0ad801f633c78cbe42b1d1b55f5d163ad ] + +Commit 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of +qla2x00_process_els()"), intended to change: + + bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN + +to: + + bsg_job->request->msgcode != FC_BSG_RPT_ELS + +but changed it to: + + bsg_job->request->msgcode == FC_BSG_RPT_ELS + +instead. + +Change the == to a != to avoid leaking the fcport structure or freeing +unallocated memory. + +Link: https://lore.kernel.org/r/20211012191834.90306-2-jgu@purestorage.com +Fixes: 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()") +Reviewed-by: Bart Van Assche +Signed-off-by: Joy Gu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_bsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c +index d42b2ad84049..2304f54fdc93 100644 +--- a/drivers/scsi/qla2xxx/qla_bsg.c ++++ b/drivers/scsi/qla2xxx/qla_bsg.c +@@ -415,7 +415,7 @@ done_unmap_sg: + goto done_free_fcport; + + done_free_fcport: +- if (bsg_request->msgcode == FC_BSG_RPT_ELS) ++ if (bsg_request->msgcode != FC_BSG_RPT_ELS) + qla2x00_free_fcport(fcport); + done: + return rval; +-- +2.33.0 + diff --git a/queue-5.14/scsi-storvsc-fix-validation-for-unsolicited-incoming.patch b/queue-5.14/scsi-storvsc-fix-validation-for-unsolicited-incoming.patch new file mode 100644 index 00000000000..3751b85c76c --- /dev/null +++ b/queue-5.14/scsi-storvsc-fix-validation-for-unsolicited-incoming.patch @@ -0,0 +1,81 @@ +From 5443c3b99f89b42d7344a605a06a419162869b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 14:28:28 +0200 +Subject: scsi: storvsc: Fix validation for unsolicited incoming packets + +From: Andrea Parri (Microsoft) + +[ Upstream commit 6fd13d699d24beaa28310848fe65fd898fbb9043 ] + +The validation on the length of incoming packets performed in +storvsc_on_channel_callback() does not apply to unsolicited packets with ID +of 0 sent by Hyper-V. Adjust the validation for such unsolicited packets. + +Link: https://lore.kernel.org/r/20211007122828.469289-1-parri.andrea@gmail.com +Fixes: 91b1b640b834b2 ("scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback()") +Reported-by: Dexuan Cui +Reviewed-by: Michael Kelley +Reviewed-by: Haiyang Zhang +Signed-off-by: Andrea Parri (Microsoft) +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/storvsc_drv.c | 32 +++++++++++++++++++++++--------- + 1 file changed, 23 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 37506b3fe5a9..5fa1120a87f7 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1285,11 +1285,15 @@ static void storvsc_on_channel_callback(void *context) + foreach_vmbus_pkt(desc, channel) { + struct vstor_packet *packet = hv_pkt_data(desc); + struct storvsc_cmd_request *request = NULL; ++ u32 pktlen = hv_pkt_datalen(desc); + u64 rqst_id = desc->trans_id; ++ u32 minlen = rqst_id ? sizeof(struct vstor_packet) - ++ stor_device->vmscsi_size_delta : sizeof(enum vstor_packet_operation); + +- if (hv_pkt_datalen(desc) < sizeof(struct vstor_packet) - +- stor_device->vmscsi_size_delta) { +- dev_err(&device->device, "Invalid packet len\n"); ++ if (pktlen < minlen) { ++ dev_err(&device->device, ++ "Invalid pkt: id=%llu, len=%u, minlen=%u\n", ++ rqst_id, pktlen, minlen); + continue; + } + +@@ -1302,13 +1306,23 @@ static void storvsc_on_channel_callback(void *context) + if (rqst_id == 0) { + /* + * storvsc_on_receive() looks at the vstor_packet in the message +- * from the ring buffer. If the operation in the vstor_packet is +- * COMPLETE_IO, then we call storvsc_on_io_completion(), and +- * dereference the guest memory address. Make sure we don't call +- * storvsc_on_io_completion() with a guest memory address that is +- * zero if Hyper-V were to construct and send such a bogus packet. ++ * from the ring buffer. ++ * ++ * - If the operation in the vstor_packet is COMPLETE_IO, then ++ * we call storvsc_on_io_completion(), and dereference the ++ * guest memory address. Make sure we don't call ++ * storvsc_on_io_completion() with a guest memory address ++ * that is zero if Hyper-V were to construct and send such ++ * a bogus packet. ++ * ++ * - If the operation in the vstor_packet is FCHBA_DATA, then ++ * we call cache_wwn(), and access the data payload area of ++ * the packet (wwn_packet); however, there is no guarantee ++ * that the packet is big enough to contain such area. ++ * Future-proof the code by rejecting such a bogus packet. + */ +- if (packet->operation == VSTOR_OPERATION_COMPLETE_IO) { ++ if (packet->operation == VSTOR_OPERATION_COMPLETE_IO || ++ packet->operation == VSTOR_OPERATION_FCHBA_DATA) { + dev_err(&device->device, "Invalid packet with ID of 0\n"); + continue; + } +-- +2.33.0 + diff --git a/queue-5.14/series b/queue-5.14/series index 15fa597ebde..44d7576382f 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -145,3 +145,15 @@ libperf-test-evsel-fix-build-error-on-x86-architectu.patch libperf-tests-fix-test_stat_cpu.patch perf-x86-msr-add-sapphire-rapids-cpu-support.patch input-snvs_pwrkey-add-clk-handling.patch +asoc-codec-wcd938x-add-irq-config-support.patch +scsi-iscsi-fix-set_param-handling.patch +scsi-storvsc-fix-validation-for-unsolicited-incoming.patch +scsi-mpi3mr-fix-duplicate-device-entries-when-scanni.patch +scsi-qla2xxx-fix-a-memory-leak-in-an-error-path-of-q.patch +mm-thp-decrease-nr_thps-in-file-s-mapping-on-thp-spl.patch +sched-scs-reset-the-shadow-stack-when-idle_task_exit.patch +net-hns3-fix-for-miscalculation-of-rx-unused-desc.patch +net-mlx5-lag-move-lag-destruction-to-a-workqueue.patch +net-mlx5-lag-change-multipath-and-bonding-to-be-mutu.patch +drm-kmb-enable-alpha-blended-second-plane.patch +drm-kmb-limit-supported-mode-to-1080p.patch -- 2.47.3