summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPaul Gortmaker <paul.gortmaker@windriver.com>2020-08-21 12:36:27 -0400
committerPaul Gortmaker <paul.gortmaker@windriver.com>2020-08-21 12:36:27 -0400
commitfde881de78484cd57887d2d9c295b47f30103e51 (patch)
treeba6e2dd5cc1609bc3a782a65351cf33f4be5ea43
parent3335ecb21c502b7b01b9fe94ba579956dbfe0669 (diff)
downloadlongterm-queue-5.2-fde881de78484cd57887d2d9c295b47f30103e51.tar.gz
drop all previously applied commits
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r--queue/ALSA-hda-realtek-enable-headset-mic-of-ASUS-ROG-Zeph.patch56
-rw-r--r--queue/ALSA-hda-realtek-typo_fix-enable-headset-mic-of-ASUS.patch50
-rw-r--r--queue/PCI-ASPM-Disable-ASPM-on-ASMedia-ASM1083-1085-PCIe-t.patch67
-rw-r--r--queue/Revert-i2c-cadence-Fix-the-hold-bit-setting.patch68
-rw-r--r--queue/arm64-alternatives-move-length-validation-inside-the.patch40
-rw-r--r--queue/crypto-ccp-Release-all-allocated-memory-if-sha-type-.patch36
-rw-r--r--queue/drm-amd-display-Clear-dm_state-for-fast-updates.patch99
-rw-r--r--queue/media-rc-prevent-memory-leak-in-cx23888_ir_probe.patch34
-rw-r--r--queue/series9
-rw-r--r--queue/xfrm-policy-match-with-both-mark-and-mask-on-user-in.patch255
10 files changed, 0 insertions, 714 deletions
diff --git a/queue/ALSA-hda-realtek-enable-headset-mic-of-ASUS-ROG-Zeph.patch b/queue/ALSA-hda-realtek-enable-headset-mic-of-ASUS-ROG-Zeph.patch
deleted file mode 100644
index 3d1833fb..00000000
--- a/queue/ALSA-hda-realtek-enable-headset-mic-of-ASUS-ROG-Zeph.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b Mon Sep 17 00:00:00 2001
-From: Armas Spann <zappel@retarded.farm>
-Date: Fri, 24 Jul 2020 16:06:16 +0200
-Subject: [PATCH] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus
- G15(GA502) series with ALC289
-
-commit 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b upstream.
-
-This patch adds support for headset mic to the ASUS ROG Zephyrus
-G15(GA502) notebook series by adding the corresponding
-vendor/pci_device id, as well as adding a new fixup for the used
-realtek ALC289. The fixup stets the correct pin to get the headset mic
-correctly recognized on audio-jack.
-
-Signed-off-by: Armas Spann <zappel@retarded.farm>
-Cc: <stable@vger.kernel.org>
-Link: https://lore.kernel.org/r/20200724140616.298892-1-zappel@retarded.farm
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 1b2d8e56390a..a2c48a7f4594 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -6153,6 +6153,7 @@ enum {
- ALC269VC_FIXUP_ACER_HEADSET_MIC,
- ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
- ALC289_FIXUP_ASUS_G401,
-+ ALC289_FIXUP_ASUS_GA502,
- ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
- };
-
-@@ -7370,6 +7371,13 @@ static const struct hda_fixup alc269_fixups[] = {
- { }
- },
- },
-+ [ALC289_FIXUP_ASUS_GA502] = {
-+ .type = HDA_FIXUP_PINS,
-+ .v.pins = (const struct hda_pintbl[]) {
-+ { 0x19, 0x03a11020 }, /* headset mic with jack detect */
-+ { }
-+ },
-+ },
- [ALC256_FIXUP_ACER_MIC_NO_PRESENCE] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = (const struct hda_pintbl[]) {
-@@ -7561,6 +7569,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
- SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
- SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
-+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
- SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
- SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
- SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
---
-2.27.0
-
diff --git a/queue/ALSA-hda-realtek-typo_fix-enable-headset-mic-of-ASUS.patch b/queue/ALSA-hda-realtek-typo_fix-enable-headset-mic-of-ASUS.patch
deleted file mode 100644
index defa27d3..00000000
--- a/queue/ALSA-hda-realtek-typo_fix-enable-headset-mic-of-ASUS.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 293a92c1d9913248b9987b68f3a5d6d2f0aae62b Mon Sep 17 00:00:00 2001
-From: Armas Spann <zappel@retarded.farm>
-Date: Fri, 24 Jul 2020 16:08:37 +0200
-Subject: [PATCH] ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG
- Zephyrus G14(GA401) series with ALC289
-
-commit 293a92c1d9913248b9987b68f3a5d6d2f0aae62b upstream.
-
-This patch fixes a small typo I accidently submitted with the initial patch. The board should be named GA401 not G401.
-
-Fixes: ff53664daff2 ("ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289")
-Signed-off-by: Armas Spann <zappel@retarded.farm>
-Cc: <stable@vger.kernel.org>
-Link: https://lore.kernel.org/r/20200724140837.302763-1-zappel@retarded.farm
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index a2c48a7f4594..3f2512942daf 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -6152,7 +6152,7 @@ enum {
- ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS,
- ALC269VC_FIXUP_ACER_HEADSET_MIC,
- ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
-- ALC289_FIXUP_ASUS_G401,
-+ ALC289_FIXUP_ASUS_GA401,
- ALC289_FIXUP_ASUS_GA502,
- ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
- };
-@@ -7364,7 +7364,7 @@ static const struct hda_fixup alc269_fixups[] = {
- .chained = true,
- .chain_id = ALC269_FIXUP_HEADSET_MIC
- },
-- [ALC289_FIXUP_ASUS_G401] = {
-+ [ALC289_FIXUP_ASUS_GA401] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = (const struct hda_pintbl[]) {
- { 0x19, 0x03a11020 }, /* headset mic with jack detect */
-@@ -7570,7 +7570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
- SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
- SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
-- SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
-+ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
- SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
- SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
- SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
---
-2.27.0
-
diff --git a/queue/PCI-ASPM-Disable-ASPM-on-ASMedia-ASM1083-1085-PCIe-t.patch b/queue/PCI-ASPM-Disable-ASPM-on-ASMedia-ASM1083-1085-PCIe-t.patch
deleted file mode 100644
index b37e0c7a..00000000
--- a/queue/PCI-ASPM-Disable-ASPM-on-ASMedia-ASM1083-1085-PCIe-t.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From b361663c5a40c8bc758b7f7f2239f7a192180e7c Mon Sep 17 00:00:00 2001
-From: Robert Hancock <hancockrwd@gmail.com>
-Date: Tue, 21 Jul 2020 20:18:03 -0600
-Subject: [PATCH] PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI
- bridge
-
-commit b361663c5a40c8bc758b7f7f2239f7a192180e7c upstream.
-
-Recently ASPM handling was changed to allow ASPM on PCIe-to-PCI/PCI-X
-bridges. Unfortunately the ASMedia ASM1083/1085 PCIe to PCI bridge device
-doesn't seem to function properly with ASPM enabled. On an Asus PRIME
-H270-PRO motherboard, it causes errors like these:
-
- pcieport 0000:00:1c.0: AER: PCIe Bus Error: severity=Corrected, type=Data Link Layer, (Transmitter ID)
- pcieport 0000:00:1c.0: AER: device [8086:a292] error status/mask=00003000/00002000
- pcieport 0000:00:1c.0: AER: [12] Timeout
- pcieport 0000:00:1c.0: AER: Corrected error received: 0000:00:1c.0
- pcieport 0000:00:1c.0: AER: can't find device of ID00e0
-
-In addition to flooding the kernel log, this also causes the machine to
-wake up immediately after suspend is initiated.
-
-The device advertises ASPM L0s and L1 support in the Link Capabilities
-register, but the ASMedia web page for ASM1083 [1] claims "No PCIe ASPM
-support".
-
-Windows 10 (build 2004) enables L0s, but it also logs correctable PCIe
-errors.
-
-Add a quirk to disable ASPM for this device.
-
-[1] https://www.asmedia.com.tw/eng/e_show_products.php?cate_index=169&item=114
-
-[bhelgaas: commit log]
-Fixes: 66ff14e59e8a ("PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges")
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208667
-Link: https://lore.kernel.org/r/20200722021803.17958-1-hancockrwd@gmail.com
-Signed-off-by: Robert Hancock <hancockrwd@gmail.com>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
-
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 812bfc32ecb8..2ea61abd5830 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -2330,6 +2330,19 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s);
- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
-
-+static void quirk_disable_aspm_l0s_l1(struct pci_dev *dev)
-+{
-+ pci_info(dev, "Disabling ASPM L0s/L1\n");
-+ pci_disable_link_state(dev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
-+}
-+
-+/*
-+ * ASM1083/1085 PCIe-PCI bridge devices cause AER timeout errors on the
-+ * upstream PCIe root port when ASPM is enabled. At least L0s mode is affected;
-+ * disable both L0s and L1 for now to be safe.
-+ */
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x1080, quirk_disable_aspm_l0s_l1);
-+
- /*
- * Some Pericom PCIe-to-PCI bridges in reverse mode need the PCIe Retrain
- * Link bit cleared after starting the link retrain process to allow this
---
-2.27.0
-
diff --git a/queue/Revert-i2c-cadence-Fix-the-hold-bit-setting.patch b/queue/Revert-i2c-cadence-Fix-the-hold-bit-setting.patch
deleted file mode 100644
index 33dcbaa9..00000000
--- a/queue/Revert-i2c-cadence-Fix-the-hold-bit-setting.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 0db9254d6b896b587759e2c844c277fb1a6da5b9 Mon Sep 17 00:00:00 2001
-From: Raviteja Narayanam <raviteja.narayanam@xilinx.com>
-Date: Fri, 3 Jul 2020 19:25:49 +0530
-Subject: [PATCH] Revert "i2c: cadence: Fix the hold bit setting"
-
-commit 0db9254d6b896b587759e2c844c277fb1a6da5b9 upstream.
-
-This reverts commit d358def706880defa4c9e87381c5bf086a97d5f9.
-
-There are two issues with "i2c: cadence: Fix the hold bit setting" commit.
-
-1. In case of combined message request from user space, when the HOLD
-bit is cleared in cdns_i2c_mrecv function, a STOP condition is sent
-on the bus even before the last message is started. This is because when
-the HOLD bit is cleared, the FIFOS are empty and there is no pending
-transfer. The STOP condition should occur only after the last message
-is completed.
-
-2. The code added by the commit is redundant. Driver is handling the
-setting/clearing of HOLD bit in right way before the commit.
-
-The setting of HOLD bit based on 'bus_hold_flag' is taken care in
-cdns_i2c_master_xfer function even before cdns_i2c_msend/cdns_i2c_recv
-functions.
-
-The clearing of HOLD bit is taken care at the end of cdns_i2c_msend and
-cdns_i2c_recv functions based on bus_hold_flag and byte count.
-Since clearing of HOLD bit is done after the slave address is written to
-the register (writing to address register triggers the message transfer),
-it is ensured that STOP condition occurs at the right time after
-completion of the pending transfer (last message).
-
-Signed-off-by: Raviteja Narayanam <raviteja.narayanam@xilinx.com>
-Acked-by: Michal Simek <michal.simek@xilinx.com>
-Signed-off-by: Wolfram Sang <wsa@kernel.org>
-
-diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
-index 4b72398af505..e06960207ada 100644
---- a/drivers/i2c/busses/i2c-cadence.c
-+++ b/drivers/i2c/busses/i2c-cadence.c
-@@ -594,10 +594,8 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
- * Check for the message size against FIFO depth and set the
- * 'hold bus' bit if it is greater than FIFO depth.
- */
-- if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
-+ if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
- ctrl_reg |= CDNS_I2C_CR_HOLD;
-- else
-- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
-
- cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
-
-@@ -654,11 +652,8 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
- * Check for the message size against FIFO depth and set the
- * 'hold bus' bit if it is greater than FIFO depth.
- */
-- if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
-+ if (id->send_count > CDNS_I2C_FIFO_DEPTH)
- ctrl_reg |= CDNS_I2C_CR_HOLD;
-- else
-- ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
--
- cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
-
- /* Clear the interrupts in interrupt status register. */
---
-2.27.0
-
diff --git a/queue/arm64-alternatives-move-length-validation-inside-the.patch b/queue/arm64-alternatives-move-length-validation-inside-the.patch
deleted file mode 100644
index 33c96522..00000000
--- a/queue/arm64-alternatives-move-length-validation-inside-the.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 966a0acce2fca776391823381dba95c40e03c339 Mon Sep 17 00:00:00 2001
-From: Sami Tolvanen <samitolvanen@google.com>
-Date: Thu, 30 Jul 2020 08:37:01 -0700
-Subject: [PATCH] arm64/alternatives: move length validation inside the
- subsection
-
-commit 966a0acce2fca776391823381dba95c40e03c339 upstream.
-
-Commit f7b93d42945c ("arm64/alternatives: use subsections for replacement
-sequences") breaks LLVM's integrated assembler, because due to its
-one-pass design, it cannot compute instruction sequence lengths before the
-layout for the subsection has been finalized. This change fixes the build
-by moving the .org directives inside the subsection, so they are processed
-after the subsection layout is known.
-
-Fixes: f7b93d42945c ("arm64/alternatives: use subsections for replacement sequences")
-Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
-Link: https://github.com/ClangBuiltLinux/linux/issues/1078
-Link: https://lore.kernel.org/r/20200730153701.3892953-1-samitolvanen@google.com
-Signed-off-by: Will Deacon <will@kernel.org>
-
-diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
-index 12f0eb56a1cc..619db9b4c9d5 100644
---- a/arch/arm64/include/asm/alternative.h
-+++ b/arch/arm64/include/asm/alternative.h
-@@ -77,9 +77,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
- "663:\n\t" \
- newinstr "\n" \
- "664:\n\t" \
-- ".previous\n\t" \
- ".org . - (664b-663b) + (662b-661b)\n\t" \
-- ".org . - (662b-661b) + (664b-663b)\n" \
-+ ".org . - (662b-661b) + (664b-663b)\n\t" \
-+ ".previous\n" \
- ".endif\n"
-
- #define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb) \
---
-2.27.0
-
diff --git a/queue/crypto-ccp-Release-all-allocated-memory-if-sha-type-.patch b/queue/crypto-ccp-Release-all-allocated-memory-if-sha-type-.patch
deleted file mode 100644
index ba68a9f4..00000000
--- a/queue/crypto-ccp-Release-all-allocated-memory-if-sha-type-.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 128c66429247add5128c03dc1e144ca56f05a4e2 Mon Sep 17 00:00:00 2001
-From: Navid Emamdoost <navid.emamdoost@gmail.com>
-Date: Thu, 19 Sep 2019 11:04:48 -0500
-Subject: [PATCH] crypto: ccp - Release all allocated memory if sha type is
- invalid
-
-commit 128c66429247add5128c03dc1e144ca56f05a4e2 upstream.
-
-Release all allocated memory if sha type is invalid:
-In ccp_run_sha_cmd, if the type of sha is invalid, the allocated
-hmac_buf should be released.
-
-v2: fix the goto.
-
-Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
-Acked-by: Gary R Hook <gary.hook@amd.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-
-diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
-index c8da8eb160da..422193690fd4 100644
---- a/drivers/crypto/ccp/ccp-ops.c
-+++ b/drivers/crypto/ccp/ccp-ops.c
-@@ -1777,8 +1777,9 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
- LSB_ITEM_SIZE);
- break;
- default:
-+ kfree(hmac_buf);
- ret = -EINVAL;
-- goto e_ctx;
-+ goto e_data;
- }
-
- memset(&hmac_cmd, 0, sizeof(hmac_cmd));
---
-2.27.0
-
diff --git a/queue/drm-amd-display-Clear-dm_state-for-fast-updates.patch b/queue/drm-amd-display-Clear-dm_state-for-fast-updates.patch
deleted file mode 100644
index a54b6565..00000000
--- a/queue/drm-amd-display-Clear-dm_state-for-fast-updates.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From fde9f39ac7f1ffd799a96ffa1e06b2051f0898f1 Mon Sep 17 00:00:00 2001
-From: Mazin Rezk <mnrzk@protonmail.com>
-Date: Mon, 27 Jul 2020 05:40:46 +0000
-Subject: [PATCH] drm/amd/display: Clear dm_state for fast updates
-
-commit fde9f39ac7f1ffd799a96ffa1e06b2051f0898f1 upstream.
-
-This patch fixes a race condition that causes a use-after-free during
-amdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking commits
-are requested and the second one finishes before the first. Essentially,
-this bug occurs when the following sequence of events happens:
-
-1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is
-deferred to the workqueue.
-
-2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is
-deferred to the workqueue.
-
-3. Commit #2 starts before commit #1, dm_state #1 is used in the
-commit_tail and commit #2 completes, freeing dm_state #1.
-
-4. Commit #1 starts after commit #2 completes, uses the freed dm_state
-1 and dereferences a freelist pointer while setting the context.
-
-Since this bug has only been spotted with fast commits, this patch fixes
-the bug by clearing the dm_state instead of using the old dc_state for
-fast updates. In addition, since dm_state is only used for its dc_state
-and amdgpu_dm_atomic_commit_tail will retain the dc_state if none is found,
-removing the dm_state should not have any consequences in fast updates.
-
-This use-after-free bug has existed for a while now, but only caused a
-noticeable issue starting from 5.7-rc1 due to 3202fa62f ("slub: relocate
-freelist pointer to middle of object") moving the freelist pointer from
-dm_state->base (which was unused) to dm_state->context (which is
-dereferenced).
-
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207383
-Fixes: bd200d190f45 ("drm/amd/display: Don't replace the dc_state for fast updates")
-Reported-by: Duncan <1i5t5.duncan@cox.net>
-Signed-off-by: Mazin Rezk <mnrzk@protonmail.com>
-Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Cc: stable@vger.kernel.org
-
-diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-index 86ffa0c2880f..710edc70e37e 100644
---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
-@@ -8717,20 +8717,38 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
- * the same resource. If we have a new DC context as part of
- * the DM atomic state from validation we need to free it and
- * retain the existing one instead.
-+ *
-+ * Furthermore, since the DM atomic state only contains the DC
-+ * context and can safely be annulled, we can free the state
-+ * and clear the associated private object now to free
-+ * some memory and avoid a possible use-after-free later.
- */
-- struct dm_atomic_state *new_dm_state, *old_dm_state;
-
-- new_dm_state = dm_atomic_get_new_state(state);
-- old_dm_state = dm_atomic_get_old_state(state);
-+ for (i = 0; i < state->num_private_objs; i++) {
-+ struct drm_private_obj *obj = state->private_objs[i].ptr;
-
-- if (new_dm_state && old_dm_state) {
-- if (new_dm_state->context)
-- dc_release_state(new_dm_state->context);
-+ if (obj->funcs == adev->dm.atomic_obj.funcs) {
-+ int j = state->num_private_objs-1;
-
-- new_dm_state->context = old_dm_state->context;
-+ dm_atomic_destroy_state(obj,
-+ state->private_objs[i].state);
-+
-+ /* If i is not at the end of the array then the
-+ * last element needs to be moved to where i was
-+ * before the array can safely be truncated.
-+ */
-+ if (i != j)
-+ state->private_objs[i] =
-+ state->private_objs[j];
-
-- if (old_dm_state->context)
-- dc_retain_state(old_dm_state->context);
-+ state->private_objs[j].ptr = NULL;
-+ state->private_objs[j].state = NULL;
-+ state->private_objs[j].old_state = NULL;
-+ state->private_objs[j].new_state = NULL;
-+
-+ state->num_private_objs = j;
-+ break;
-+ }
- }
- }
-
---
-2.27.0
-
diff --git a/queue/media-rc-prevent-memory-leak-in-cx23888_ir_probe.patch b/queue/media-rc-prevent-memory-leak-in-cx23888_ir_probe.patch
deleted file mode 100644
index f347f445..00000000
--- a/queue/media-rc-prevent-memory-leak-in-cx23888_ir_probe.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From a7b2df76b42bdd026e3106cf2ba97db41345a177 Mon Sep 17 00:00:00 2001
-From: Navid Emamdoost <navid.emamdoost@gmail.com>
-Date: Wed, 25 Sep 2019 12:02:41 -0300
-Subject: [PATCH] media: rc: prevent memory leak in cx23888_ir_probe
-
-commit a7b2df76b42bdd026e3106cf2ba97db41345a177 upstream.
-
-In cx23888_ir_probe if kfifo_alloc fails the allocated memory for state
-should be released.
-
-Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
-Signed-off-by: Sean Young <sean@mess.org>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
-
-diff --git a/drivers/media/pci/cx23885/cx23888-ir.c b/drivers/media/pci/cx23885/cx23888-ir.c
-index e880afe37f15..d59ca3601785 100644
---- a/drivers/media/pci/cx23885/cx23888-ir.c
-+++ b/drivers/media/pci/cx23885/cx23888-ir.c
-@@ -1167,8 +1167,11 @@ int cx23888_ir_probe(struct cx23885_dev *dev)
- return -ENOMEM;
-
- spin_lock_init(&state->rx_kfifo_lock);
-- if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL))
-+ if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE,
-+ GFP_KERNEL)) {
-+ kfree(state);
- return -ENOMEM;
-+ }
-
- state->dev = dev;
- sd = &state->sd;
---
-2.27.0
-
diff --git a/queue/series b/queue/series
index 824f5a21..d1ada38c 100644
--- a/queue/series
+++ b/queue/series
@@ -1,12 +1,7 @@
-crypto-ccp-Release-all-allocated-memory-if-sha-type-.patch
-media-rc-prevent-memory-leak-in-cx23888_ir_probe.patch
sunrpc-check-that-domain-table-is-empty-at-module-un.patch
ath10k-enable-transmit-data-ack-RSSI-for-QCA9884.patch
-PCI-ASPM-Disable-ASPM-on-ASMedia-ASM1083-1085-PCIe-t.patch
mm-filemap.c-don-t-bother-dropping-mmap_sem-for-zero.patch
ALSA-usb-audio-Add-implicit-feedback-quirk-for-SSL2.patch
-ALSA-hda-realtek-enable-headset-mic-of-ASUS-ROG-Zeph.patch
-ALSA-hda-realtek-typo_fix-enable-headset-mic-of-ASUS.patch
ALSA-hda-realtek-Fix-add-a-ultra_low_power-function-.patch
ALSA-hda-realtek-Fixed-HP-right-speaker-no-sound.patch
vhost-scsi-fix-up-req-type-endian-ness.patch
@@ -18,7 +13,6 @@ ARM-dts-imx6sx-sdb-Fix-the-phy-mode-on-fec2.patch
ARM-dts-imx6qdl-icore-Fix-OTG_ID-pin-and-sdcard-dete.patch
virtio_balloon-fix-up-endian-ness-for-free-cmd-id.patch
Revert-drm-amdgpu-Fix-NULL-dereference-in-dpm-sysfs-.patch
-drm-amd-display-Clear-dm_state-for-fast-updates.patch
drm-amdgpu-Prevent-kernel-infoleak-in-amdgpu_info_io.patch
drm-dbi-Fix-SPI-Type-1-9-bit-transfer.patch
drm-hold-gem-reference-until-object-is-no-longer-acc.patch
@@ -26,7 +20,6 @@ rds-Prevent-kernel-infoleak-in-rds_notify_queue_get.patch
libtraceevent-Fix-build-with-binutils-2.35.patch
net-x25-Fix-x25_neigh-refcnt-leak-when-x25-disconnec.patch
net-x25-Fix-null-ptr-deref-in-x25_disconnect.patch
-xfrm-policy-match-with-both-mark-and-mask-on-user-in.patch
ARM-dts-sunxi-Relax-a-bit-the-CMA-pool-allocation-ra.patch
xfrm-Fix-crash-when-the-hold-queue-is-used.patch
ARM-dts-armada-38x-fix-NETA-lockup-when-repeatedly-s.patch
@@ -49,7 +42,6 @@ ibmvnic-Fix-IRQ-mapping-disposal-in-error-path.patch
bpf-Fix-map-leak-in-HASH_OF_MAPS-map.patch
mac80211-mesh-Free-ie-data-when-leaving-mesh.patch
mac80211-mesh-Free-pending-skb-when-destroying-a-mpa.patch
-arm64-alternatives-move-length-validation-inside-the.patch
arm64-csum-Fix-handling-of-bad-packets.patch
Bluetooth-fix-kernel-oops-in-store_pending_adv_repor.patch
net-nixge-fix-potential-memory-leak-in-nixge_probe.patch
@@ -65,7 +57,6 @@ nfc-s3fwrn5-add-missing-release-on-skb-in-s3fwrn5_re.patch
scsi-core-Run-queue-in-case-of-I-O-resource-contenti.patch
parisc-add-support-for-cmpxchg-on-u8-pointers.patch
net-ethernet-ravb-exit-if-re-initialization-fails-in.patch
-Revert-i2c-cadence-Fix-the-hold-bit-setting.patch
x86-unwind-orc-Fix-ORC-for-newly-forked-tasks.patch
x86-stacktrace-Fix-reliable-check-for-empty-user-tas.patch
cxgb4-add-missing-release-on-skb-in-uld_send.patch
diff --git a/queue/xfrm-policy-match-with-both-mark-and-mask-on-user-in.patch b/queue/xfrm-policy-match-with-both-mark-and-mask-on-user-in.patch
deleted file mode 100644
index 3a4391d8..00000000
--- a/queue/xfrm-policy-match-with-both-mark-and-mask-on-user-in.patch
+++ /dev/null
@@ -1,255 +0,0 @@
-From 4f47e8ab6ab796b5380f74866fa5287aca4dcc58 Mon Sep 17 00:00:00 2001
-From: Xin Long <lucien.xin@gmail.com>
-Date: Mon, 22 Jun 2020 16:40:29 +0800
-Subject: [PATCH] xfrm: policy: match with both mark and mask on user
- interfaces
-
-commit 4f47e8ab6ab796b5380f74866fa5287aca4dcc58 upstream.
-
-In commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"),
-it would take 'priority' to make a policy unique, and allow duplicated
-policies with different 'priority' to be added, which is not expected
-by userland, as Tobias reported in strongswan.
-
-To fix this duplicated policies issue, and also fix the issue in
-commit ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list"),
-when doing add/del/get/update on user interfaces, this patch is to change
-to look up a policy with both mark and mask by doing:
-
- mark.v == pol->mark.v && mark.m == pol->mark.m
-
-and leave the check:
-
- (mark & pol->mark.m) == pol->mark.v
-
-for tx/rx path only.
-
-As the userland expects an exact mark and mask match to manage policies.
-
-v1->v2:
- - make xfrm_policy_mark_match inline and fix the changelog as
- Tobias suggested.
-
-Fixes: 295fae568885 ("xfrm: Allow user space manipulation of SPD mark")
-Fixes: ed17b8d377ea ("xfrm: fix a warning in xfrm_policy_insert_list")
-Reported-by: Tobias Brunner <tobias@strongswan.org>
-Tested-by: Tobias Brunner <tobias@strongswan.org>
-Signed-off-by: Xin Long <lucien.xin@gmail.com>
-Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
-
-diff --git a/include/net/xfrm.h b/include/net/xfrm.h
-index c7d213c9f9d8..5c20953c8deb 100644
---- a/include/net/xfrm.h
-+++ b/include/net/xfrm.h
-@@ -1630,13 +1630,16 @@ int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
- void *);
- void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net);
- int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
--struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
-- u8 type, int dir,
-+struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net,
-+ const struct xfrm_mark *mark,
-+ u32 if_id, u8 type, int dir,
- struct xfrm_selector *sel,
- struct xfrm_sec_ctx *ctx, int delete,
- int *err);
--struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id, u8,
-- int dir, u32 id, int delete, int *err);
-+struct xfrm_policy *xfrm_policy_byid(struct net *net,
-+ const struct xfrm_mark *mark, u32 if_id,
-+ u8 type, int dir, u32 id, int delete,
-+ int *err);
- int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
- void xfrm_policy_hash_rebuild(struct net *net);
- u32 xfrm_get_acqseq(void);
-diff --git a/net/key/af_key.c b/net/key/af_key.c
-index b67ed3a8486c..979c579afc63 100644
---- a/net/key/af_key.c
-+++ b/net/key/af_key.c
-@@ -2400,7 +2400,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
- return err;
- }
-
-- xp = xfrm_policy_bysel_ctx(net, DUMMY_MARK, 0, XFRM_POLICY_TYPE_MAIN,
-+ xp = xfrm_policy_bysel_ctx(net, &dummy_mark, 0, XFRM_POLICY_TYPE_MAIN,
- pol->sadb_x_policy_dir - 1, &sel, pol_ctx,
- 1, &err);
- security_xfrm_policy_free(pol_ctx);
-@@ -2651,7 +2651,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_
- return -EINVAL;
-
- delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
-- xp = xfrm_policy_byid(net, DUMMY_MARK, 0, XFRM_POLICY_TYPE_MAIN,
-+ xp = xfrm_policy_byid(net, &dummy_mark, 0, XFRM_POLICY_TYPE_MAIN,
- dir, pol->sadb_x_policy_id, delete, &err);
- if (xp == NULL)
- return -ENOENT;
-diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
-index 564aa6492e7c..6847b3579f54 100644
---- a/net/xfrm/xfrm_policy.c
-+++ b/net/xfrm/xfrm_policy.c
-@@ -1433,14 +1433,10 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
- spin_unlock_bh(&pq->hold_queue.lock);
- }
-
--static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
-- struct xfrm_policy *pol)
-+static inline bool xfrm_policy_mark_match(const struct xfrm_mark *mark,
-+ struct xfrm_policy *pol)
- {
-- if (policy->mark.v == pol->mark.v &&
-- policy->priority == pol->priority)
-- return true;
--
-- return false;
-+ return mark->v == pol->mark.v && mark->m == pol->mark.m;
- }
-
- static u32 xfrm_pol_bin_key(const void *data, u32 len, u32 seed)
-@@ -1503,7 +1499,7 @@ static void xfrm_policy_insert_inexact_list(struct hlist_head *chain,
- if (pol->type == policy->type &&
- pol->if_id == policy->if_id &&
- !selector_cmp(&pol->selector, &policy->selector) &&
-- xfrm_policy_mark_match(policy, pol) &&
-+ xfrm_policy_mark_match(&policy->mark, pol) &&
- xfrm_sec_ctx_match(pol->security, policy->security) &&
- !WARN_ON(delpol)) {
- delpol = pol;
-@@ -1538,7 +1534,7 @@ static struct xfrm_policy *xfrm_policy_insert_list(struct hlist_head *chain,
- if (pol->type == policy->type &&
- pol->if_id == policy->if_id &&
- !selector_cmp(&pol->selector, &policy->selector) &&
-- xfrm_policy_mark_match(policy, pol) &&
-+ xfrm_policy_mark_match(&policy->mark, pol) &&
- xfrm_sec_ctx_match(pol->security, policy->security) &&
- !WARN_ON(delpol)) {
- if (excl)
-@@ -1610,9 +1606,8 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
- EXPORT_SYMBOL(xfrm_policy_insert);
-
- static struct xfrm_policy *
--__xfrm_policy_bysel_ctx(struct hlist_head *chain, u32 mark, u32 if_id,
-- u8 type, int dir,
-- struct xfrm_selector *sel,
-+__xfrm_policy_bysel_ctx(struct hlist_head *chain, const struct xfrm_mark *mark,
-+ u32 if_id, u8 type, int dir, struct xfrm_selector *sel,
- struct xfrm_sec_ctx *ctx)
- {
- struct xfrm_policy *pol;
-@@ -1623,7 +1618,7 @@ __xfrm_policy_bysel_ctx(struct hlist_head *chain, u32 mark, u32 if_id,
- hlist_for_each_entry(pol, chain, bydst) {
- if (pol->type == type &&
- pol->if_id == if_id &&
-- (mark & pol->mark.m) == pol->mark.v &&
-+ xfrm_policy_mark_match(mark, pol) &&
- !selector_cmp(sel, &pol->selector) &&
- xfrm_sec_ctx_match(ctx, pol->security))
- return pol;
-@@ -1632,11 +1627,10 @@ __xfrm_policy_bysel_ctx(struct hlist_head *chain, u32 mark, u32 if_id,
- return NULL;
- }
-
--struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
-- u8 type, int dir,
-- struct xfrm_selector *sel,
-- struct xfrm_sec_ctx *ctx, int delete,
-- int *err)
-+struct xfrm_policy *
-+xfrm_policy_bysel_ctx(struct net *net, const struct xfrm_mark *mark, u32 if_id,
-+ u8 type, int dir, struct xfrm_selector *sel,
-+ struct xfrm_sec_ctx *ctx, int delete, int *err)
- {
- struct xfrm_pol_inexact_bin *bin = NULL;
- struct xfrm_policy *pol, *ret = NULL;
-@@ -1703,9 +1697,9 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id,
- }
- EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
-
--struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id,
-- u8 type, int dir, u32 id, int delete,
-- int *err)
-+struct xfrm_policy *
-+xfrm_policy_byid(struct net *net, const struct xfrm_mark *mark, u32 if_id,
-+ u8 type, int dir, u32 id, int delete, int *err)
- {
- struct xfrm_policy *pol, *ret;
- struct hlist_head *chain;
-@@ -1720,8 +1714,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id,
- ret = NULL;
- hlist_for_each_entry(pol, chain, byidx) {
- if (pol->type == type && pol->index == id &&
-- pol->if_id == if_id &&
-- (mark & pol->mark.m) == pol->mark.v) {
-+ pol->if_id == if_id && xfrm_policy_mark_match(mark, pol)) {
- xfrm_pol_hold(pol);
- if (delete) {
- *err = security_xfrm_policy_delete(
-diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
-index e6cfaa680ef3..fbb7d9d06478 100644
---- a/net/xfrm/xfrm_user.c
-+++ b/net/xfrm/xfrm_user.c
-@@ -1863,7 +1863,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
- struct km_event c;
- int delete;
- struct xfrm_mark m;
-- u32 mark = xfrm_mark_get(attrs, &m);
- u32 if_id = 0;
-
- p = nlmsg_data(nlh);
-@@ -1880,8 +1879,11 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
- if (attrs[XFRMA_IF_ID])
- if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
-
-+ xfrm_mark_get(attrs, &m);
-+
- if (p->index)
-- xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, delete, &err);
-+ xp = xfrm_policy_byid(net, &m, if_id, type, p->dir,
-+ p->index, delete, &err);
- else {
- struct nlattr *rt = attrs[XFRMA_SEC_CTX];
- struct xfrm_sec_ctx *ctx;
-@@ -1898,8 +1900,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
- if (err)
- return err;
- }
-- xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir, &p->sel,
-- ctx, delete, &err);
-+ xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
-+ &p->sel, ctx, delete, &err);
- security_xfrm_policy_free(ctx);
- }
- if (xp == NULL)
-@@ -2166,7 +2168,6 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
- u8 type = XFRM_POLICY_TYPE_MAIN;
- int err = -ENOENT;
- struct xfrm_mark m;
-- u32 mark = xfrm_mark_get(attrs, &m);
- u32 if_id = 0;
-
- err = copy_from_user_policy_type(&type, attrs);
-@@ -2180,8 +2181,11 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
- if (attrs[XFRMA_IF_ID])
- if_id = nla_get_u32(attrs[XFRMA_IF_ID]);
-
-+ xfrm_mark_get(attrs, &m);
-+
- if (p->index)
-- xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, 0, &err);
-+ xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index,
-+ 0, &err);
- else {
- struct nlattr *rt = attrs[XFRMA_SEC_CTX];
- struct xfrm_sec_ctx *ctx;
-@@ -2198,7 +2202,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
- if (err)
- return err;
- }
-- xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir,
-+ xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir,
- &p->sel, ctx, 0, &err);
- security_xfrm_policy_free(ctx);
- }
---
-2.27.0
-