2021-06-16 21:40:08

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 00/38] 5.10.45-rc1 review

This is the start of the stable review cycle for the 5.10.45 release.
There are 38 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Fri, 18 Jun 2021 15:28:19 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.45-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 5.10.45-rc1

Zheng Yongjun <[email protected]>
fib: Return the correct errno code

Zheng Yongjun <[email protected]>
net: Return the correct errno code

Zheng Yongjun <[email protected]>
net/x25: Return the correct errno code

Jiapeng Chong <[email protected]>
rtnetlink: Fix missing error code in rtnl_bridge_notify()

Victor Zhao <[email protected]>
drm/amd/amdgpu:save psp ring wptr to avoid attack

Roman Li <[email protected]>
drm/amd/display: Fix potential memory leak in DMUB hw_init

Rodrigo Siqueira <[email protected]>
drm/amd/display: Fix overlay validation by considering cursors

Jiansong Chen <[email protected]>
drm/amdgpu: refine amdgpu_fru_get_product_info

Bindu Ramamurthy <[email protected]>
drm/amd/display: Allow bandwidth validation for 0 streams.

Josh Triplett <[email protected]>
net: ipconfig: Don't override command-line hostnames or domains

Hannes Reinecke <[email protected]>
nvme-loop: do not warn for deleted controllers during reset

Hannes Reinecke <[email protected]>
nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue()

Hannes Reinecke <[email protected]>
nvme-loop: clear NVME_LOOP_Q_LIVE when nvme_loop_configure_admin_queue() fails

Hannes Reinecke <[email protected]>
nvme-loop: reset queue count to 1 in nvme_loop_destroy_io_queues()

Ewan D. Milne <[email protected]>
scsi: scsi_devinfo: Add blacklist entry for HPE OPEN-V

Larry Finger <[email protected]>
Bluetooth: Add a new USB ID for RTL8822CE

Daniel Wagner <[email protected]>
scsi: qedf: Do not put host in qedf_vport_create() unconditionally

Jiapeng Chong <[email protected]>
ethernet: myri10ge: Fix missing error code in myri10ge_probe()

Maurizio Lombardi <[email protected]>
scsi: target: core: Fix warning on realtime kernels

Hillf Danton <[email protected]>
gfs2: Fix use-after-free in gfs2_glock_shrink_scan

Khem Raj <[email protected]>
riscv: Use -mno-relax when using lld linker

Bixuan Cui <[email protected]>
HID: gt683r: add missing MODULE_DEVICE_TABLE

Bob Peterson <[email protected]>
gfs2: fix a deadlock on withdraw-during-mount

Andreas Gruenbacher <[email protected]>
gfs2: Prevent direct-I/O write fallback errors from getting lost

Yongqiang Liu <[email protected]>
ARM: OMAP2+: Fix build warning when mmc_omap is not built

Maciej Falkowski <[email protected]>
ARM: OMAP1: Fix use of possibly uninitialized irq variable

Thierry Reding <[email protected]>
drm/tegra: sor: Fully initialize SOR before registration

Thierry Reding <[email protected]>
gpu: host1x: Split up client initalization and registration

Pavel Machek (CIP) <[email protected]>
drm/tegra: sor: Do not leak runtime PM reference

Anirudh Rayabharam <[email protected]>
HID: usbhid: fix info leak in hid_submit_ctrl

Mark Bolhuis <[email protected]>
HID: Add BUS_VIRTUAL to hid_connect logging

Ahelenia Ziemiańska <[email protected]>
HID: multitouch: set Stylus suffix for Stylus-application devices, too

Saeed Mirzamohammadi <[email protected]>
HID: quirks: Add quirk for Lenovo optical mouse

Srinivas Pandruvada <[email protected]>
HID: hid-sensor-hub: Return error for hid_set_field() failure

Dmitry Torokhov <[email protected]>
HID: hid-input: add mapping for emoji picker key

Mateusz Jończyk <[email protected]>
HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95

Nirenjan Krishnan <[email protected]>
HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65

Dan Robertson <[email protected]>
net: ieee802154: fix null deref in parse dev addr


-------------

Diffstat:

Makefile | 4 +--
arch/arm/mach-omap1/pm.c | 10 ++++--
arch/arm/mach-omap2/board-n8x0.c | 2 +-
arch/riscv/Makefile | 9 +++++
drivers/bluetooth/btusb.c | 2 ++
drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c | 42 ++++++++++++----------
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 1 +
drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 +-
drivers/gpu/drm/amd/amdgpu/psp_v3_1.c | 3 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 ++++++--
.../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +-
drivers/gpu/drm/tegra/sor.c | 41 +++++++++++----------
drivers/gpu/host1x/bus.c | 30 ++++++++++++----
drivers/hid/Kconfig | 4 +--
drivers/hid/hid-a4tech.c | 2 ++
drivers/hid/hid-core.c | 3 ++
drivers/hid/hid-debug.c | 1 +
drivers/hid/hid-gt683r.c | 1 +
drivers/hid/hid-ids.h | 3 ++
drivers/hid/hid-input.c | 3 ++
drivers/hid/hid-multitouch.c | 8 ++---
drivers/hid/hid-quirks.c | 3 ++
drivers/hid/hid-sensor-hub.c | 13 ++++---
drivers/hid/usbhid/hid-core.c | 2 +-
drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 1 +
drivers/nvme/target/loop.c | 11 ++++--
drivers/scsi/qedf/qedf_main.c | 20 +++++------
drivers/scsi/scsi_devinfo.c | 1 +
drivers/target/target_core_transport.c | 4 +--
fs/gfs2/file.c | 5 ++-
fs/gfs2/glock.c | 26 +++++++++++---
include/linux/hid.h | 3 +-
include/linux/host1x.h | 30 ++++++++++++----
include/uapi/linux/input-event-codes.h | 1 +
net/compat.c | 2 +-
net/core/fib_rules.c | 2 +-
net/core/rtnetlink.c | 4 ++-
net/ieee802154/nl802154.c | 9 ++---
net/ipv4/ipconfig.c | 13 ++++---
net/x25/af_x25.c | 2 +-
40 files changed, 231 insertions(+), 109 deletions(-)



2021-06-16 21:42:23

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 15/38] gfs2: Prevent direct-I/O write fallback errors from getting lost

From: Andreas Gruenbacher <[email protected]>

[ Upstream commit 43a511c44e58e357a687d61a20cf5ef1dc9e5a7c ]

When a direct I/O write falls entirely and falls back to buffered I/O and the
buffered I/O fails, the write failed with return value 0 instead of the error
number reported by the buffered I/O. Fix that.

Signed-off-by: Andreas Gruenbacher <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
fs/gfs2/file.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
index b39b339feddc..16fb0184ce5e 100644
--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -938,8 +938,11 @@ static ssize_t gfs2_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
current->backing_dev_info = inode_to_bdi(inode);
buffered = iomap_file_buffered_write(iocb, from, &gfs2_iomap_ops);
current->backing_dev_info = NULL;
- if (unlikely(buffered <= 0))
+ if (unlikely(buffered <= 0)) {
+ if (!ret)
+ ret = buffered;
goto out_unlock;
+ }

/*
* We need to ensure that the page cache pages are written to
--
2.30.2



2021-06-16 21:43:14

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 20/38] scsi: target: core: Fix warning on realtime kernels

From: Maurizio Lombardi <[email protected]>

[ Upstream commit 515da6f4295c2c42b8c54572cce3d2dd1167c41e ]

On realtime kernels, spin_lock_irq*(spinlock_t) do not disable the
interrupts, a call to irqs_disabled() will return false thus firing a
warning in __transport_wait_for_tasks().

Remove the warning and also replace assert_spin_locked() with
lockdep_assert_held()

Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Bart Van Assche <[email protected]>
Signed-off-by: Maurizio Lombardi <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/target/target_core_transport.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 484f0ba0a65b..61b79804d462 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -3038,9 +3038,7 @@ __transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop,
__releases(&cmd->t_state_lock)
__acquires(&cmd->t_state_lock)
{
-
- assert_spin_locked(&cmd->t_state_lock);
- WARN_ON_ONCE(!irqs_disabled());
+ lockdep_assert_held(&cmd->t_state_lock);

if (fabric_stop)
cmd->transport_state |= CMD_T_FABRIC_STOP;
--
2.30.2



2021-06-16 21:43:14

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 21/38] ethernet: myri10ge: Fix missing error code in myri10ge_probe()

From: Jiapeng Chong <[email protected]>

[ Upstream commit f336d0b93ae978f12c5e27199f828da89b91e56a ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'status'.

Eliminate the follow smatch warning:

drivers/net/ethernet/myricom/myri10ge/myri10ge.c:3818 myri10ge_probe()
warn: missing error code 'status'.

Reported-by: Abaci Robot <[email protected]>
Signed-off-by: Jiapeng Chong <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
index c84c8bf2bc20..fc99ad8e4a38 100644
--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
+++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c
@@ -3815,6 +3815,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
dev_err(&pdev->dev,
"invalid sram_size %dB or board span %ldB\n",
mgp->sram_size, mgp->board_span);
+ status = -EINVAL;
goto abort_with_ioremap;
}
memcpy_fromio(mgp->eeprom_strings,
--
2.30.2



2021-06-16 22:12:55

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 29/38] net: ipconfig: Dont override command-line hostnames or domains

From: Josh Triplett <[email protected]>

[ Upstream commit b508d5fb69c2211a1b860fc058aafbefc3b3c3cd ]

If the user specifies a hostname or domain name as part of the ip=
command-line option, preserve it and don't overwrite it with one
supplied by DHCP/BOOTP.

For instance, ip=::::myhostname::dhcp will use "myhostname" rather than
ignoring and overwriting it.

Fix the comment on ic_bootp_string that suggests it only copies a string
"if not already set"; it doesn't have any such logic.

Signed-off-by: Josh Triplett <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/ipv4/ipconfig.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 3cd13e1bc6a7..213a1c91507d 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -870,7 +870,7 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d


/*
- * Copy BOOTP-supplied string if not already set.
+ * Copy BOOTP-supplied string
*/
static int __init ic_bootp_string(char *dest, char *src, int len, int max)
{
@@ -919,12 +919,15 @@ static void __init ic_do_bootp_ext(u8 *ext)
}
break;
case 12: /* Host name */
- ic_bootp_string(utsname()->nodename, ext+1, *ext,
- __NEW_UTS_LEN);
- ic_host_name_set = 1;
+ if (!ic_host_name_set) {
+ ic_bootp_string(utsname()->nodename, ext+1, *ext,
+ __NEW_UTS_LEN);
+ ic_host_name_set = 1;
+ }
break;
case 15: /* Domain name (DNS) */
- ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain));
+ if (!ic_domain[0])
+ ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain));
break;
case 17: /* Root path */
if (!root_server_path[0])
--
2.30.2



2021-06-16 22:12:55

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 32/38] drm/amd/display: Fix overlay validation by considering cursors

From: Rodrigo Siqueira <[email protected]>

[ Upstream commit 33f409e60eb0c59a4d0d06a62ab4642a988e17f7 ]

A few weeks ago, we saw a two cursor issue in a ChromeOS system. We
fixed it in the commit:

drm/amd/display: Fix two cursor duplication when using overlay
(read the commit message for more details)

After this change, we noticed that some IGT subtests related to
kms_plane and kms_plane_scaling started to fail. After investigating
this issue, we noticed that all subtests that fail have a primary plane
covering the overlay plane, which is currently rejected by amdgpu dm.
Fail those IGT tests highlight that our verification was too broad and
compromises the overlay usage in our drive. This patch fixes this issue
by ensuring that we only reject commits where the primary plane is not
fully covered by the overlay when the cursor hardware is enabled. With
this fix, all IGT tests start to pass again, which means our overlay
support works as expected.

Cc: Tianci.Yin <[email protected]>
Cc: Harry Wentland <[email protected]>
Cc: Nicholas Choi <[email protected]>
Cc: Bhawanpreet Lakha <[email protected]>
Cc: Nicholas Kazlauskas <[email protected]>
Cc: Mark Yacoub <[email protected]>
Cc: Daniel Wheeler <[email protected]>

Tested-by: Daniel Wheeler <[email protected]>
Signed-off-by: Rodrigo Siqueira <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index fbbb1bde6b06..4792228ed481 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8616,7 +8616,7 @@ static int validate_overlay(struct drm_atomic_state *state)
int i;
struct drm_plane *plane;
struct drm_plane_state *old_plane_state, *new_plane_state;
- struct drm_plane_state *primary_state, *overlay_state = NULL;
+ struct drm_plane_state *primary_state, *cursor_state, *overlay_state = NULL;

/* Check if primary plane is contained inside overlay */
for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) {
@@ -8646,6 +8646,14 @@ static int validate_overlay(struct drm_atomic_state *state)
if (!primary_state->crtc)
return 0;

+ /* check if cursor plane is enabled */
+ cursor_state = drm_atomic_get_plane_state(state, overlay_state->crtc->cursor);
+ if (IS_ERR(cursor_state))
+ return PTR_ERR(cursor_state);
+
+ if (drm_atomic_plane_disabling(plane->state, cursor_state))
+ return 0;
+
/* Perform the bounds check to ensure the overlay plane covers the primary */
if (primary_state->crtc_x < overlay_state->crtc_x ||
primary_state->crtc_y < overlay_state->crtc_y ||
--
2.30.2



2021-06-16 22:14:10

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 35/38] rtnetlink: Fix missing error code in rtnl_bridge_notify()

From: Jiapeng Chong <[email protected]>

[ Upstream commit a8db57c1d285c758adc7fb43d6e2bad2554106e1 ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'err'.

Eliminate the follow smatch warning:

net/core/rtnetlink.c:4834 rtnl_bridge_notify() warn: missing error code
'err'.

Reported-by: Abaci Robot <[email protected]>
Signed-off-by: Jiapeng Chong <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/core/rtnetlink.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index eae8e87930cd..83894723ebee 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -4842,8 +4842,10 @@ static int rtnl_bridge_notify(struct net_device *dev)
if (err < 0)
goto errout;

- if (!skb->len)
+ if (!skb->len) {
+ err = -EINVAL;
goto errout;
+ }

rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
return 0;
--
2.30.2



2021-06-16 22:14:15

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 36/38] net/x25: Return the correct errno code

From: Zheng Yongjun <[email protected]>

[ Upstream commit d7736958668c4facc15f421e622ffd718f5be80a ]

When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.

Signed-off-by: Zheng Yongjun <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/x25/af_x25.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index e65a50192432..03ed170b8125 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -546,7 +546,7 @@ static int x25_create(struct net *net, struct socket *sock, int protocol,
if (protocol)
goto out;

- rc = -ENOBUFS;
+ rc = -ENOMEM;
if ((sk = x25_alloc_socket(net, kern)) == NULL)
goto out;

--
2.30.2



2021-06-16 22:15:00

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 37/38] net: Return the correct errno code

From: Zheng Yongjun <[email protected]>

[ Upstream commit 49251cd00228a3c983651f6bb2f33f6a0b8f152e ]

When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.

Signed-off-by: Zheng Yongjun <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/compat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/compat.c b/net/compat.c
index ddd15af3a283..210fc3b4d0d8 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -177,7 +177,7 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk,
if (kcmlen > stackbuf_size)
kcmsg_base = kcmsg = sock_kmalloc(sk, kcmlen, GFP_KERNEL);
if (kcmsg == NULL)
- return -ENOBUFS;
+ return -ENOMEM;

/* Now copy them over neatly. */
memset(kcmsg, 0, kcmlen);
--
2.30.2



2021-06-16 22:26:43

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 10/38] drm/tegra: sor: Do not leak runtime PM reference

From: Pavel Machek (CIP) <[email protected]>

[ Upstream commit 73a395c46704304b96bc5e2ee19be31124025c0c ]

It's theoretically possible for the runtime PM reference to leak if the
code fails anywhere between the pm_runtime_resume_and_get() and
pm_runtime_put() calls, so make sure to release the runtime PM reference
in that case.

Practically this will never happen because none of the functions will
fail on Tegra, but it's better for the code to be pedantic in case these
assumptions will ever become wrong.

Signed-off-by: Pavel Machek (CIP) <[email protected]>
[[email protected]: add commit message]
Signed-off-by: Thierry Reding <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/tegra/sor.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
index 7b88261f57bb..67a80dae1c00 100644
--- a/drivers/gpu/drm/tegra/sor.c
+++ b/drivers/gpu/drm/tegra/sor.c
@@ -3125,21 +3125,21 @@ static int tegra_sor_init(struct host1x_client *client)
if (err < 0) {
dev_err(sor->dev, "failed to acquire SOR reset: %d\n",
err);
- return err;
+ goto rpm_put;
}

err = reset_control_assert(sor->rst);
if (err < 0) {
dev_err(sor->dev, "failed to assert SOR reset: %d\n",
err);
- return err;
+ goto rpm_put;
}
}

err = clk_prepare_enable(sor->clk);
if (err < 0) {
dev_err(sor->dev, "failed to enable clock: %d\n", err);
- return err;
+ goto rpm_put;
}

usleep_range(1000, 3000);
@@ -3150,7 +3150,7 @@ static int tegra_sor_init(struct host1x_client *client)
dev_err(sor->dev, "failed to deassert SOR reset: %d\n",
err);
clk_disable_unprepare(sor->clk);
- return err;
+ goto rpm_put;
}

reset_control_release(sor->rst);
@@ -3171,6 +3171,12 @@ static int tegra_sor_init(struct host1x_client *client)
}

return 0;
+
+rpm_put:
+ if (sor->rst)
+ pm_runtime_put(sor->dev);
+
+ return err;
}

static int tegra_sor_exit(struct host1x_client *client)
--
2.30.2



2021-06-16 22:26:43

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 11/38] gpu: host1x: Split up client initalization and registration

From: Thierry Reding <[email protected]>

[ Upstream commit 0cfe5a6e758fb20be8ad3e8f10cb087cc8033eeb ]

In some cases we may need to initialize the host1x client first before
registering it. This commit adds a new helper that will do nothing but
the initialization of the data structure.

At the same time, the initialization is removed from the registration
function. Note, however, that for simplicity we explicitly initialize
the client when the host1x_client_register() function is called, as
opposed to the low-level __host1x_client_register() function. This
allows existing callers to remain unchanged.

Signed-off-by: Thierry Reding <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/host1x/bus.c | 30 ++++++++++++++++++++++++------
include/linux/host1x.h | 30 ++++++++++++++++++++++++------
2 files changed, 48 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
index 9e2cb6968819..6e3b49d0de66 100644
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -703,6 +703,29 @@ void host1x_driver_unregister(struct host1x_driver *driver)
}
EXPORT_SYMBOL(host1x_driver_unregister);

+/**
+ * __host1x_client_init() - initialize a host1x client
+ * @client: host1x client
+ * @key: lock class key for the client-specific mutex
+ */
+void __host1x_client_init(struct host1x_client *client, struct lock_class_key *key)
+{
+ INIT_LIST_HEAD(&client->list);
+ __mutex_init(&client->lock, "host1x client lock", key);
+ client->usecount = 0;
+}
+EXPORT_SYMBOL(__host1x_client_init);
+
+/**
+ * host1x_client_exit() - uninitialize a host1x client
+ * @client: host1x client
+ */
+void host1x_client_exit(struct host1x_client *client)
+{
+ mutex_destroy(&client->lock);
+}
+EXPORT_SYMBOL(host1x_client_exit);
+
/**
* __host1x_client_register() - register a host1x client
* @client: host1x client
@@ -715,16 +738,11 @@ EXPORT_SYMBOL(host1x_driver_unregister);
* device and call host1x_device_init(), which will in turn call each client's
* &host1x_client_ops.init implementation.
*/
-int __host1x_client_register(struct host1x_client *client,
- struct lock_class_key *key)
+int __host1x_client_register(struct host1x_client *client)
{
struct host1x *host1x;
int err;

- INIT_LIST_HEAD(&client->list);
- __mutex_init(&client->lock, "host1x client lock", key);
- client->usecount = 0;
-
mutex_lock(&devices_lock);

list_for_each_entry(host1x, &devices, list) {
diff --git a/include/linux/host1x.h b/include/linux/host1x.h
index 9eb77c87a83b..ed0005ce4285 100644
--- a/include/linux/host1x.h
+++ b/include/linux/host1x.h
@@ -320,12 +320,30 @@ static inline struct host1x_device *to_host1x_device(struct device *dev)
int host1x_device_init(struct host1x_device *device);
int host1x_device_exit(struct host1x_device *device);

-int __host1x_client_register(struct host1x_client *client,
- struct lock_class_key *key);
-#define host1x_client_register(class) \
- ({ \
- static struct lock_class_key __key; \
- __host1x_client_register(class, &__key); \
+void __host1x_client_init(struct host1x_client *client, struct lock_class_key *key);
+void host1x_client_exit(struct host1x_client *client);
+
+#define host1x_client_init(client) \
+ ({ \
+ static struct lock_class_key __key; \
+ __host1x_client_init(client, &__key); \
+ })
+
+int __host1x_client_register(struct host1x_client *client);
+
+/*
+ * Note that this wrapper calls __host1x_client_init() for compatibility
+ * with existing callers. Callers that want to separately initialize and
+ * register a host1x client must first initialize using either of the
+ * __host1x_client_init() or host1x_client_init() functions and then use
+ * the low-level __host1x_client_register() function to avoid the client
+ * getting reinitialized.
+ */
+#define host1x_client_register(client) \
+ ({ \
+ static struct lock_class_key __key; \
+ __host1x_client_init(client, &__key); \
+ __host1x_client_register(client); \
})

int host1x_client_unregister(struct host1x_client *client);
--
2.30.2



2021-06-16 23:01:20

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 33/38] drm/amd/display: Fix potential memory leak in DMUB hw_init

From: Roman Li <[email protected]>

[ Upstream commit c5699e2d863f58221044efdc3fa712dd32d55cde ]

[Why]
On resume we perform DMUB hw_init which allocates memory:
dm_resume->dm_dmub_hw_init->dc_dmub_srv_create->kzalloc
That results in memory leak in suspend/resume scenarios.

[How]
Allocate memory for the DC wrapper to DMUB only if it was not
allocated before.
No need to reallocate it on suspend/resume.

Signed-off-by: Lang Yu <[email protected]>
Signed-off-by: Roman Li <[email protected]>
Reviewed-by: Nicholas Kazlauskas <[email protected]>
Acked-by: Qingqing Zhuo <[email protected]>
Tested-by: Daniel Wheeler <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 4792228ed481..13588c46ae8e 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -870,7 +870,8 @@ static int dm_dmub_hw_init(struct amdgpu_device *adev)
abm->dmcu_is_running = dmcu->funcs->is_dmcu_initialized(dmcu);
}

- adev->dm.dc->ctx->dmub_srv = dc_dmub_srv_create(adev->dm.dc, dmub_srv);
+ if (!adev->dm.dc->ctx->dmub_srv)
+ adev->dm.dc->ctx->dmub_srv = dc_dmub_srv_create(adev->dm.dc, dmub_srv);
if (!adev->dm.dc->ctx->dmub_srv) {
DRM_ERROR("Couldn't allocate DC DMUB server!\n");
return -ENOMEM;
@@ -1755,7 +1756,6 @@ static int dm_suspend(void *handle)

amdgpu_dm_irq_suspend(adev);

-
dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D3);

return 0;
--
2.30.2



2021-06-16 23:01:37

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 34/38] drm/amd/amdgpu:save psp ring wptr to avoid attack

From: Victor Zhao <[email protected]>

[ Upstream commit 2370eba9f552eaae3d8aa1f70b8e9eec5c560f9e ]

[Why]
When some tools performing psp mailbox attack, the readback value
of register can be a random value which may break psp.

[How]
Use a psp wptr cache machanism to aovid the change made by attack.

v2: unify change and add detailed reason

Signed-off-by: Victor Zhao <[email protected]>
Signed-off-by: Jingwen Chen <[email protected]>
Reviewed-by: Monk Liu <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 1 +
drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 3 ++-
drivers/gpu/drm/amd/amdgpu/psp_v3_1.c | 3 ++-
3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
index 919d2fb7427b..60b7563f4c05 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h
@@ -73,6 +73,7 @@ struct psp_ring
uint64_t ring_mem_mc_addr;
void *ring_mem_handle;
uint32_t ring_size;
+ uint32_t ring_wptr;
};

/* More registers may will be supported */
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
index 6c5d9612abcb..cb764b554552 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v11_0.c
@@ -732,7 +732,7 @@ static uint32_t psp_v11_0_ring_get_wptr(struct psp_context *psp)
struct amdgpu_device *adev = psp->adev;

if (amdgpu_sriov_vf(adev))
- data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102);
+ data = psp->km_ring.ring_wptr;
else
data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67);

@@ -746,6 +746,7 @@ static void psp_v11_0_ring_set_wptr(struct psp_context *psp, uint32_t value)
if (amdgpu_sriov_vf(adev)) {
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102, value);
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101, GFX_CTRL_CMD_ID_CONSUME_CMD);
+ psp->km_ring.ring_wptr = value;
} else
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67, value);
}
diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c b/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
index f2e725f72d2f..908664a5774b 100644
--- a/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/psp_v3_1.c
@@ -379,7 +379,7 @@ static uint32_t psp_v3_1_ring_get_wptr(struct psp_context *psp)
struct amdgpu_device *adev = psp->adev;

if (amdgpu_sriov_vf(adev))
- data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_102);
+ data = psp->km_ring.ring_wptr;
else
data = RREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67);
return data;
@@ -394,6 +394,7 @@ static void psp_v3_1_ring_set_wptr(struct psp_context *psp, uint32_t value)
/* send interrupt to PSP for SRIOV ring write pointer update */
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_101,
GFX_CTRL_CMD_ID_CONSUME_CMD);
+ psp->km_ring.ring_wptr = value;
} else
WREG32_SOC15(MP0, 0, mmMP0_SMN_C2PMSG_67, value);
}
--
2.30.2



2021-06-16 23:01:53

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 09/38] HID: usbhid: fix info leak in hid_submit_ctrl

From: Anirudh Rayabharam <[email protected]>

[ Upstream commit 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f ]

In hid_submit_ctrl(), the way of calculating the report length doesn't
take into account that report->size can be zero. When running the
syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
calculate transfer_buffer_length as 16384. When this urb is passed to
the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero
report size case by using DIV_ROUND_UP for the division. Then, call it
from hid_submit_ctrl().

Reported-by: [email protected]
Signed-off-by: Anirudh Rayabharam <[email protected]>
Acked-by: Benjamin Tissoires <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/hid/usbhid/hid-core.c | 2 +-
include/linux/hid.h | 3 +--
2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 17a29ee0ac6c..8d4ac4b9fb9d 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -374,7 +374,7 @@ static int hid_submit_ctrl(struct hid_device *hid)
raw_report = usbhid->ctrl[usbhid->ctrltail].raw_report;
dir = usbhid->ctrl[usbhid->ctrltail].dir;

- len = ((report->size - 1) >> 3) + 1 + (report->id > 0);
+ len = hid_report_len(report);
if (dir == USB_DIR_OUT) {
usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0);
usbhid->urbctrl->transfer_buffer_length = len;
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 8578db50ad73..6ed2a97eb55f 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1156,8 +1156,7 @@ static inline void hid_hw_wait(struct hid_device *hdev)
*/
static inline u32 hid_report_len(struct hid_report *report)
{
- /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */
- return ((report->size - 1) >> 3) + 1 + (report->id > 0);
+ return DIV_ROUND_UP(report->size, 8) + (report->id > 0);
}

int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
--
2.30.2



2021-06-16 23:01:56

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 08/38] HID: Add BUS_VIRTUAL to hid_connect logging

From: Mark Bolhuis <[email protected]>

[ Upstream commit 48e33befe61a7d407753c53d1a06fc8d6b5dab80 ]

Add BUS_VIRTUAL to hid_connect logging since it's a valid hid bus type and it
should not print <UNKNOWN>

Signed-off-by: Mark Bolhuis <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/hid/hid-core.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 097cb1ee3126..0f69f35f2957 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2005,6 +2005,9 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
case BUS_I2C:
bus = "I2C";
break;
+ case BUS_VIRTUAL:
+ bus = "VIRTUAL";
+ break;
default:
bus = "<UNKNOWN>";
}
--
2.30.2



2021-06-16 23:08:29

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 07/38] HID: multitouch: set Stylus suffix for Stylus-application devices, too

From: Ahelenia Ziemiańska <[email protected]>

[ Upstream commit bc8b796f618c3ccb0a2a8ed1e96c00a1a7849415 ]

This re-adds the suffix to Win8 stylus-on-touchscreen devices,
now that they aren't erroneously marked as MT

Signed-off-by: Ahelenia Ziemiańska <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/hid/hid-multitouch.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 8580ace596c2..e5a3704b9fe8 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1580,13 +1580,13 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
/* we do not set suffix = "Touchscreen" */
hi->input->name = hdev->name;
break;
- case HID_DG_STYLUS:
- /* force BTN_STYLUS to allow tablet matching in udev */
- __set_bit(BTN_STYLUS, hi->input->keybit);
- break;
case HID_VD_ASUS_CUSTOM_MEDIA_KEYS:
suffix = "Custom Media Keys";
break;
+ case HID_DG_STYLUS:
+ /* force BTN_STYLUS to allow tablet matching in udev */
+ __set_bit(BTN_STYLUS, hi->input->keybit);
+ fallthrough;
case HID_DG_PEN:
suffix = "Stylus";
break;
--
2.30.2



2021-06-16 23:08:29

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 02/38] HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for Saitek X65

From: Nirenjan Krishnan <[email protected]>

[ Upstream commit 25bdbfbb2d8331a67824dd03d0087e9c98835f3a ]

The Saitek X65 joystick has a pair of axes that were used as mouse
pointer controls by the Windows driver. The corresponding usage page is
the Game Controls page, which is not recognized by the generic HID
driver, and therefore, both axes get mapped to ABS_MISC. The quirk makes
the second axis get mapped to ABS_MISC+1, and therefore made available
separately.

Signed-off-by: Nirenjan Krishnan <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index e220a05a05b4..c2e0c65b111b 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1034,6 +1034,7 @@
#define USB_DEVICE_ID_SAITEK_X52 0x075c
#define USB_DEVICE_ID_SAITEK_X52_2 0x0255
#define USB_DEVICE_ID_SAITEK_X52_PRO 0x0762
+#define USB_DEVICE_ID_SAITEK_X65 0x0b6a

#define USB_VENDOR_ID_SAMSUNG 0x0419
#define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 2e38340e19df..2bda94199aaf 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -158,6 +158,7 @@ static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_PRO), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X65), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
{ HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
{ HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
--
2.30.2



2021-06-16 23:08:29

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 06/38] HID: quirks: Add quirk for Lenovo optical mouse

From: Saeed Mirzamohammadi <[email protected]>

[ Upstream commit 3b2520076822f15621509a6da3bc4a8636cd33b4 ]

The Lenovo optical mouse with vendor id of 0x17ef and product id of
0x600e experiences disconnecting issues every 55 seconds:

[38565.706242] usb 1-1.4: Product: Lenovo Optical Mouse
[38565.728603] input: Lenovo Optical Mouse as /devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-1/1-1.4/1-1.4:1.0/0003:17EF:600E.029A/input/input665
[38565.755949] hid-generic 0003:17EF:600E.029A: input,hidraw1: USB HID v1.11 Mouse [Lenovo Optical Mouse] on usb-0000:01:00.0-1.4/input0
[38619.360692] usb 1-1.4: USB disconnect, device number 48
[38620.864990] usb 1-1.4: new low-speed USB device number 49 using xhci_hcd
[38620.984011] usb 1-1.4: New USB device found, idVendor=17ef,idProduct=600e, bcdDevice= 1.00
[38620.998117] usb 1-1.4: New USB device strings: Mfr=0, Product=2,SerialNumber=0

This adds HID_QUIRK_ALWAYS_POLL for this device in order to work properly.

Signed-off-by: Saeed Mirzamohammadi <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)

diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 951d0637cfb9..136b58a91c04 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -742,6 +742,7 @@
#define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085
#define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3
#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5
+#define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e
#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d
#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019
#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E 0x602e
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 9acfa075d4f3..be53c723c729 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -110,6 +110,7 @@ static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912), HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M406XE), HID_QUIRK_MULTI_INPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2), HID_QUIRK_ALWAYS_POLL },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E), HID_QUIRK_ALWAYS_POLL },
--
2.30.2



2021-06-16 23:09:00

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 5.10 38/38] fib: Return the correct errno code

From: Zheng Yongjun <[email protected]>

[ Upstream commit 59607863c54e9eb3f69afc5257dfe71c38bb751e ]

When kalloc or kmemdup failed, should return ENOMEM rather than ENOBUF.

Signed-off-by: Zheng Yongjun <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
net/core/fib_rules.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 7bcfb16854cb..9258ffc4ebff 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -1168,7 +1168,7 @@ static void notify_rule_change(int event, struct fib_rule *rule,
{
struct net *net;
struct sk_buff *skb;
- int err = -ENOBUFS;
+ int err = -ENOMEM;

net = ops->fro_net;
skb = nlmsg_new(fib_rule_nlmsg_size(ops, rule), GFP_KERNEL);
--
2.30.2



2021-06-16 23:43:16

by Harry Wentland

[permalink] [raw]
Subject: Re: [PATCH 5.10 32/38] drm/amd/display: Fix overlay validation by considering cursors

Hi Greg

Please drop this from 5.4, 5.10, or 5.12 stable kernels as it's apt to break any userspace that is using the legacy cursor IOCTL, which is most userspace.

We are in the process of reverting this on amd-staging-drm-next. Siqueira will send a patch.

Thanks,
Harry

On 2021-06-16 11:33 a.m., Greg Kroah-Hartman wrote:
> From: Rodrigo Siqueira <[email protected]>
>
> [ Upstream commit 33f409e60eb0c59a4d0d06a62ab4642a988e17f7 ]
>
> A few weeks ago, we saw a two cursor issue in a ChromeOS system. We
> fixed it in the commit:
>
> drm/amd/display: Fix two cursor duplication when using overlay
> (read the commit message for more details)
>
> After this change, we noticed that some IGT subtests related to
> kms_plane and kms_plane_scaling started to fail. After investigating
> this issue, we noticed that all subtests that fail have a primary plane
> covering the overlay plane, which is currently rejected by amdgpu dm.
> Fail those IGT tests highlight that our verification was too broad and
> compromises the overlay usage in our drive. This patch fixes this issue
> by ensuring that we only reject commits where the primary plane is not
> fully covered by the overlay when the cursor hardware is enabled. With
> this fix, all IGT tests start to pass again, which means our overlay
> support works as expected.
>
> Cc: Tianci.Yin <[email protected]>
> Cc: Harry Wentland <[email protected]>
> Cc: Nicholas Choi <[email protected]>
> Cc: Bhawanpreet Lakha <[email protected]>
> Cc: Nicholas Kazlauskas <[email protected]>
> Cc: Mark Yacoub <[email protected]>
> Cc: Daniel Wheeler <[email protected]>
>
> Tested-by: Daniel Wheeler <[email protected]>
> Signed-off-by: Rodrigo Siqueira <[email protected]>
> Signed-off-by: Alex Deucher <[email protected]>
> Signed-off-by: Sasha Levin <[email protected]>
> ---
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> index fbbb1bde6b06..4792228ed481 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
> @@ -8616,7 +8616,7 @@ static int validate_overlay(struct drm_atomic_state *state)
> int i;
> struct drm_plane *plane;
> struct drm_plane_state *old_plane_state, *new_plane_state;
> - struct drm_plane_state *primary_state, *overlay_state = NULL;
> + struct drm_plane_state *primary_state, *cursor_state, *overlay_state = NULL;
>
> /* Check if primary plane is contained inside overlay */
> for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) {
> @@ -8646,6 +8646,14 @@ static int validate_overlay(struct drm_atomic_state *state)
> if (!primary_state->crtc)
> return 0;
>
> + /* check if cursor plane is enabled */
> + cursor_state = drm_atomic_get_plane_state(state, overlay_state->crtc->cursor);
> + if (IS_ERR(cursor_state))
> + return PTR_ERR(cursor_state);
> +
> + if (drm_atomic_plane_disabling(plane->state, cursor_state))
> + return 0;
> +
> /* Perform the bounds check to ensure the overlay plane covers the primary */
> if (primary_state->crtc_x < overlay_state->crtc_x ||
> primary_state->crtc_y < overlay_state->crtc_y ||
>

2021-06-17 02:24:19

by Fox Chen

[permalink] [raw]
Subject: RE: [PATCH 5.10 00/38] 5.10.45-rc1 review

On Wed, 16 Jun 2021 17:33:09 +0200, Greg Kroah-Hartman <[email protected]> wrote:
> This is the start of the stable review cycle for the 5.10.45 release.
> There are 38 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 18 Jun 2021 15:28:19 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.45-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

5.10.45-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)

Tested-by: Fox Chen <[email protected]>

2021-06-17 02:29:31

by Florian Fainelli

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/38] 5.10.45-rc1 review



On 6/16/2021 8:33 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.45 release.
> There are 38 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 18 Jun 2021 15:28:19 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.45-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:

Tested-by: Florian Fainelli <[email protected]>
--
Florian

2021-06-17 06:52:34

by Pavel Machek

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/38] 5.10.45-rc1 review

Hi!

> This is the start of the stable review cycle for the 5.10.45 release.
> There are 38 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.

CIP testing did not find any problems here:

https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y

Tested-by: Pavel Machek (CIP) <[email protected]>

Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany


Attachments:
(No filename) (660.00 B)
signature.asc (188.00 B)
Digital signature
Download all attachments

2021-06-17 09:58:08

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/38] 5.10.45-rc1 review

On Wed, 16 Jun 2021 at 21:05, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 5.10.45 release.
> There are 38 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 18 Jun 2021 15:28:19 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.45-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Tested-by: Linux Kernel Functional Testing <[email protected]>

## Build
* kernel: 5.10.45-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.10.y
* git commit: aba9bf2d6e4093d75b06b37d11ebebd7f637636d
* git describe: v5.10.44-39-gaba9bf2d6e40
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.44-39-gaba9bf2d6e40

## No regressions (compared to v5.10.43-131-g3f05ff8b3370)

## No fixes (compared to v5.10.43-131-g3f05ff8b3370)

## Test result summary
total: 80674, pass: 65924, fail: 2590, skip: 11497, xfail: 663,

## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 193 total, 193 passed, 0 failed
* arm64: 27 total, 27 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 26 total, 26 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 45 total, 45 passed, 0 failed
* parisc: 9 total, 9 passed, 0 failed
* powerpc: 27 total, 27 passed, 0 failed
* riscv: 21 total, 21 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 18 total, 18 passed, 0 failed
* sparc: 9 total, 9 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 27 total, 27 passed, 0 failed

## Test suites summary
* fwts
* install-android-platform-tools-r2600
* kselftest-
* kselftest-android
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-vsyscall-mode-native-
* kselftest-vsyscall-mode-none-
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance

--
Linaro LKFT
https://lkft.linaro.org

2021-06-17 10:31:56

by Zou Wei

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/38] 5.10.45-rc1 review



On 2021/6/16 23:33, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.45 release.
> There are 38 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 18 Jun 2021 15:28:19 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.45-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Tested on arm64 and x86 for 5.10.45-rc1,

Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.45-rc1
Commit: aba9bf2d6e4093d75b06b37d11ebebd7f637636d
Compiler: gcc version 7.3.0 (GCC)

arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8906
passed: 8906
failed: 0
timeout: 0
--------------------------------------------------------------------

x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8906
passed: 8906
failed: 0
timeout: 0
--------------------------------------------------------------------

Tested-by: Hulk Robot <[email protected]>

2021-06-17 11:25:31

by Sudip Mukherjee

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/38] 5.10.45-rc1 review

Hi Greg,

On Wed, Jun 16, 2021 at 05:33:09PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.45 release.
> There are 38 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 18 Jun 2021 15:28:19 +0000.
> Anything received after that time might be too late.

Build test:
mips (gcc version 11.1.1 20210615): 63 configs -> no failure
arm (gcc version 11.1.1 20210615): 105 configs -> no new failure
arm64 (gcc version 11.1.1 20210615): 2 configs -> no failure
x86_64 (gcc version 10.2.1 20210110): 2 configs -> no failure

Boot test:
x86_64: Booted on my test laptop. No regression.
x86_64: Booted on qemu. No regression.
arm64: Booted on rpi4b (4GB model). No regression.

Tested-by: Sudip Mukherjee <[email protected]>

2021-06-17 21:43:29

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 5.10 00/38] 5.10.45-rc1 review

On Wed, Jun 16, 2021 at 05:33:09PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.45 release.
> There are 38 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 18 Jun 2021 15:28:19 +0000.
> Anything received after that time might be too late.
>

Build results:
total: 156 pass: 156 fail: 0
Qemu test results:
total: 455 pass: 455 fail: 0

Tested-by: Guenter Roeck <[email protected]>

Guenter

2021-06-19 08:46:32

by Alexander Tsoy

[permalink] [raw]
Subject: Re: [PATCH 5.10 35/38] rtnetlink: Fix missing error code in rtnl_bridge_notify()

В Ср, 16/06/2021 в 17:33 +0200, Greg Kroah-Hartman пишет:
> From: Jiapeng Chong <[email protected]>
>
> [ Upstream commit a8db57c1d285c758adc7fb43d6e2bad2554106e1 ]
>
> The error code is missing in this code scenario, add the error code
> '-EINVAL' to the return value 'err'.
>
> Eliminate the follow smatch warning:
>
> net/core/rtnetlink.c:4834 rtnl_bridge_notify() warn: missing error code
> 'err'.

This patch breaks systemd-resolved. It is 100% reproducible on two of
my systems, but there are also systems where I cannot reproduce it. The
problem manifests itself as SERVFAIL on every DNS query.

Just reverting this patch from 5.10.45 fixes the problem for me.

>
> Reported-by: Abaci Robot <[email protected]>
> Signed-off-by: Jiapeng Chong <[email protected]>
> Signed-off-by: David S. Miller <[email protected]>
> Signed-off-by: Sasha Levin <[email protected]>
> ---
>  net/core/rtnetlink.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index eae8e87930cd..83894723ebee 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -4842,8 +4842,10 @@ static int rtnl_bridge_notify(struct net_device
> *dev)
>         if (err < 0)
>                 goto errout;
>  
> -       if (!skb->len)
> +       if (!skb->len) {
> +               err = -EINVAL;
>                 goto errout;
> +       }
>  
>         rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
>         return 0;


2021-06-19 10:00:42

by Greg Kroah-Hartman

[permalink] [raw]
Subject: Re: [PATCH 5.10 35/38] rtnetlink: Fix missing error code in rtnl_bridge_notify()

On Sat, Jun 19, 2021 at 02:58:28AM +0300, Alexander Tsoy wrote:
> В Ср, 16/06/2021 в 17:33 +0200, Greg Kroah-Hartman пишет:
> > From: Jiapeng Chong <[email protected]>
> >
> > [ Upstream commit a8db57c1d285c758adc7fb43d6e2bad2554106e1 ]
> >
> > The error code is missing in this code scenario, add the error code
> > '-EINVAL' to the return value 'err'.
> >
> > Eliminate the follow smatch warning:
> >
> > net/core/rtnetlink.c:4834 rtnl_bridge_notify() warn: missing error code
> > 'err'.
>
> This patch breaks systemd-resolved. It is 100% reproducible on two of
> my systems, but there are also systems where I cannot reproduce it. The
> problem manifests itself as SERVFAIL on every DNS query.
>
> Just reverting this patch from 5.10.45 fixes the problem for me.

Is Linus's tree also broken for you? It should be reverted there first.

thanks,

greg k-h

2021-06-19 20:38:33

by Alexander Tsoy

[permalink] [raw]
Subject: Re: [PATCH 5.10 35/38] rtnetlink: Fix missing error code in rtnl_bridge_notify()

В Сб, 19/06/2021 в 08:45 +0200, Greg Kroah-Hartman пишет:
> On Sat, Jun 19, 2021 at 02:58:28AM +0300, Alexander Tsoy wrote:
> > В Ср, 16/06/2021 в 17:33 +0200, Greg Kroah-Hartman пишет:
> > > From: Jiapeng Chong <[email protected]>
> > >
> > > [ Upstream commit a8db57c1d285c758adc7fb43d6e2bad2554106e1 ]
> > >
> > > The error code is missing in this code scenario, add the error code
> > > '-EINVAL' to the return value 'err'.
> > >
> > > Eliminate the follow smatch warning:
> > >
> > > net/core/rtnetlink.c:4834 rtnl_bridge_notify() warn: missing error
> > > code
> > > 'err'.
> >
> > This patch breaks systemd-resolved. It is 100% reproducible on two of
> > my systems, but there are also systems where I cannot reproduce it.
> > The
> > problem manifests itself as SERVFAIL on every DNS query.
> >
> > Just reverting this patch from 5.10.45 fixes the problem for me.
>
> Is Linus's tree also broken for you?  It should be reverted there
> first.

Looks like this patch was reverted in Linus's tree:
d2e381c4963663bca6f30c3b996fa4dbafe8fcb5 (rtnetlink: Fix regression in
bridge VLAN configuration)


Also after some investigation I think my problem was actually with
NetworkManager as systemd-networkd + systemd-resolved works fine.

$ grep ^dns /etc/NetworkManager/NetworkManager.conf
dns=systemd-resolved

with this patch:

$ resolvectl
...
Link 4 (eno1)
Current Scopes: none
Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS
DNSSEC=no/unsupported
DNS Servers: 192.168.1.1 fd9f:5696:250c::1
DNS Domain: lan

with this patch reverted:

$ resolvectl
...
Link 4 (eno1)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS
DNSSEC=no/unsupported
Current DNS Server: 192.168.1.1
DNS Servers: 192.168.1.1 fd9f:5696:250c::1
DNS Domain: lan