forked from Ivasoft/openwrt
kernel: bump 4.19 to 4.19.16
Refresh patches. Remove upstreamed patches: - backport/096-mips-math-emu-Write-protect-delay-slot-emulation-pages.patch - backport/096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch - backport/424-v4.20-net-dsa-fix-88e6060-roaming.patch - hack/100-mtd-rawnand-qcom-fix-memory-corruption-that-causes-p.patch - pending/510-f2fs-fix-sanity_check_raw_super-on-big-endian-machines.patch Update patch that no longer applies: - backport/343-netfilter-nft_flow_offload-handle-netdevice-events-f.patch Compile-tested: mesongx Runtime-tested: mesongx Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
This commit is contained in:
@@ -1,83 +0,0 @@
|
||||
From c942c462411e4757aafba73bf13b5e5c7a4b62ca Mon Sep 17 00:00:00 2001
|
||||
From: Christian Lamparter <chunkeey@gmail.com>
|
||||
Date: Sun, 23 Dec 2018 00:38:55 +0100
|
||||
Subject: [PATCH] mtd: rawnand: qcom: fix memory corruption that causes panic
|
||||
|
||||
This patch fixes a memory corruption that occured in the
|
||||
qcom-nandc driver since it was converted to nand_scan().
|
||||
|
||||
On boot, an affected device will panic from a NPE at a weird place:
|
||||
| Unable to handle kernel NULL pointer dereference at virtual address 00000000
|
||||
| pgd = (ptrval)
|
||||
| [00000000] *pgd=00000000
|
||||
| Internal error: Oops: 80000005 [#1] SMP ARM
|
||||
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0
|
||||
| Hardware name: Generic DT based system
|
||||
| PC is at (null)
|
||||
| LR is at nand_block_isbad+0x90/0xa4
|
||||
| pc : [<00000000>] lr : [<c0592240>] psr: 80000013
|
||||
| sp : cf839d40 ip : 00000000 fp : cfae9e20
|
||||
| r10: cf815810 r9 : 00000000 r8 : 00000000
|
||||
| r7 : 00000000 r6 : 00000000 r5 : 00000001 r4 : cf815810
|
||||
| r3 : 00000000 r2 : cfae9810 r1 : ffffffff r0 : cf815810
|
||||
| Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
|
||||
| Control: 10c5387d Table: 8020406a DAC: 00000051
|
||||
| Process swapper/0 (pid: 1, stack limit = 0x(ptrval))
|
||||
| [<c0592240>] (nand_block_isbad) from [<c0580a94>] (allocate_partition+0x7a0/0x7dc)
|
||||
| [<c0580a94>] (allocate_partition) from [<c05811e4>] (add_mtd_partitions+0x58/0x10c)
|
||||
| [<c05811e4>] (add_mtd_partitions) from [<c0581164>] (parse_mtd_partitions+0x310/0x338)
|
||||
| [<c0581164>] (parse_mtd_partitions) from [<c057def4>] (mtd_device_parse_register+0x60/0x15c)
|
||||
| [<c057def4>] (mtd_device_parse_register) from [<c059d274>] (qcom_nandc_probe+0x770/0x8f4)
|
||||
| [<c059d274>] (qcom_nandc_probe) from [<c0567f00>] (platform_drv_probe+0x34/0x70)
|
||||
|
||||
The problem is that the nand_scan()'s qcom_nand_attach_chip callback
|
||||
is updating the nandc->max_cwperpage from 1 to 4. This causes the
|
||||
sg_init_table of clear_bam_transaction() in the driver's
|
||||
qcom_nandc_block_bad() to memset much more than what was initially
|
||||
allocated by alloc_bam_transaction().
|
||||
|
||||
Hence, this patch restores the old behavior by performing the
|
||||
alloc_bam_transaction() after the chip was identified.
|
||||
|
||||
Fixes: 6a3cec64f18c ("mtd: rawnand: qcom: convert driver to nand_scan()")
|
||||
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
|
||||
---
|
||||
drivers/mtd/nand/raw/qcom_nandc.c | 20 ++++++++++----------
|
||||
1 file changed, 10 insertions(+), 10 deletions(-)
|
||||
|
||||
--- a/drivers/mtd/nand/raw/qcom_nandc.c
|
||||
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
|
||||
@@ -2839,6 +2839,16 @@ static int qcom_nand_host_init_and_regis
|
||||
if (ret)
|
||||
return ret;
|
||||
|
||||
+ if (nandc->props->is_bam) {
|
||||
+ free_bam_transaction(nandc);
|
||||
+ nandc->bam_txn = alloc_bam_transaction(nandc);
|
||||
+ if (!nandc->bam_txn) {
|
||||
+ dev_err(nandc->dev,
|
||||
+ "failed to allocate bam transaction\n");
|
||||
+ return -ENOMEM;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
ret = mtd_device_register(mtd, NULL, 0);
|
||||
if (ret)
|
||||
nand_cleanup(chip);
|
||||
@@ -2853,16 +2863,6 @@ static int qcom_probe_nand_devices(struc
|
||||
struct qcom_nand_host *host;
|
||||
int ret;
|
||||
|
||||
- if (nandc->props->is_bam) {
|
||||
- free_bam_transaction(nandc);
|
||||
- nandc->bam_txn = alloc_bam_transaction(nandc);
|
||||
- if (!nandc->bam_txn) {
|
||||
- dev_err(nandc->dev,
|
||||
- "failed to allocate bam transaction\n");
|
||||
- return -ENOMEM;
|
||||
- }
|
||||
- }
|
||||
-
|
||||
for_each_available_child_of_node(dn, child) {
|
||||
host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
|
||||
if (!host) {
|
||||
@@ -27,11 +27,9 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
|
||||
drivers/leds/led-triggers.c | 19 ++++++++++---------
|
||||
1 file changed, 10 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
|
||||
index 17d73db1456e..08e7c724a9dc 100644
|
||||
--- a/drivers/leds/led-triggers.c
|
||||
+++ b/drivers/leds/led-triggers.c
|
||||
@@ -134,6 +134,12 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig)
|
||||
@@ -134,6 +134,12 @@ int led_trigger_set(struct led_classdev
|
||||
led_set_brightness(led_cdev, LED_OFF);
|
||||
}
|
||||
if (trig) {
|
||||
@@ -44,7 +42,7 @@ index 17d73db1456e..08e7c724a9dc 100644
|
||||
write_lock_irqsave(&trig->leddev_list_lock, flags);
|
||||
list_add_tail(&led_cdev->trig_list, &trig->led_cdevs);
|
||||
write_unlock_irqrestore(&trig->leddev_list_lock, flags);
|
||||
@@ -146,12 +152,6 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig)
|
||||
@@ -146,12 +152,6 @@ int led_trigger_set(struct led_classdev
|
||||
|
||||
if (ret)
|
||||
goto err_activate;
|
||||
@@ -57,7 +55,7 @@ index 17d73db1456e..08e7c724a9dc 100644
|
||||
}
|
||||
|
||||
if (event) {
|
||||
@@ -165,17 +165,18 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig)
|
||||
@@ -165,17 +165,18 @@ int led_trigger_set(struct led_classdev
|
||||
|
||||
return 0;
|
||||
|
||||
@@ -79,6 +77,3 @@ index 17d73db1456e..08e7c724a9dc 100644
|
||||
led_set_brightness(led_cdev, LED_OFF);
|
||||
|
||||
return ret;
|
||||
--
|
||||
2.20.1
|
||||
|
||||
|
||||
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
|
||||
--- a/init/Kconfig
|
||||
+++ b/init/Kconfig
|
||||
@@ -1988,6 +1988,13 @@ config TRIM_UNUSED_KSYMS
|
||||
@@ -1993,6 +1993,13 @@ config TRIM_UNUSED_KSYMS
|
||||
|
||||
If unsure, or if you need to build out-of-tree modules, say N.
|
||||
|
||||
|
||||
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
|
||||
--- a/Makefile
|
||||
+++ b/Makefile
|
||||
@@ -1224,7 +1224,6 @@ all: modules
|
||||
@@ -1227,7 +1227,6 @@ all: modules
|
||||
|
||||
PHONY += modules
|
||||
modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
|
||||
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
@$(kecho) ' Building modules, stage 2.';
|
||||
$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
|
||||
|
||||
@@ -1253,7 +1252,6 @@ _modinst_:
|
||||
@@ -1256,7 +1255,6 @@ _modinst_:
|
||||
rm -f $(MODLIB)/build ; \
|
||||
ln -s $(CURDIR) $(MODLIB)/build ; \
|
||||
fi
|
||||
|
||||
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
---
|
||||
--- a/arch/mips/include/asm/r4kcache.h
|
||||
+++ b/arch/mips/include/asm/r4kcache.h
|
||||
@@ -682,16 +682,48 @@ static inline void prot##extra##blast_##
|
||||
@@ -683,16 +683,48 @@ static inline void prot##extra##blast_##
|
||||
unsigned long end) \
|
||||
{ \
|
||||
unsigned long lsize = cpu_##desc##_line_size(); \
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
|
||||
--- a/drivers/net/phy/phy_device.c
|
||||
+++ b/drivers/net/phy/phy_device.c
|
||||
@@ -1509,6 +1509,9 @@ int genphy_update_link(struct phy_device
|
||||
@@ -1506,6 +1506,9 @@ int genphy_update_link(struct phy_device
|
||||
{
|
||||
int status;
|
||||
|
||||
|
||||
@@ -56,7 +56,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
*/
|
||||
--- a/include/linux/skbuff.h
|
||||
+++ b/include/linux/skbuff.h
|
||||
@@ -2516,6 +2516,10 @@ static inline int pskb_trim(struct sk_bu
|
||||
@@ -2527,6 +2527,10 @@ static inline int pskb_trim(struct sk_bu
|
||||
return (len < skb->len) ? __pskb_trim(skb, len) : 0;
|
||||
}
|
||||
|
||||
@@ -67,7 +67,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
/**
|
||||
* pskb_trim_unique - remove end from a paged unique (not cloned) buffer
|
||||
* @skb: buffer to alter
|
||||
@@ -2646,16 +2650,6 @@ static inline struct sk_buff *dev_alloc_
|
||||
@@ -2657,16 +2661,6 @@ static inline struct sk_buff *dev_alloc_
|
||||
}
|
||||
|
||||
|
||||
@@ -101,7 +101,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
help
|
||||
--- a/net/core/dev.c
|
||||
+++ b/net/core/dev.c
|
||||
@@ -3233,10 +3233,20 @@ static int xmit_one(struct sk_buff *skb,
|
||||
@@ -3238,10 +3238,20 @@ static int xmit_one(struct sk_buff *skb,
|
||||
if (!list_empty(&ptype_all) || !list_empty(&dev->ptype_all))
|
||||
dev_queue_xmit_nit(skb, dev);
|
||||
|
||||
|
||||
@@ -327,7 +327,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
|
||||
--- a/net/core/sock.c
|
||||
+++ b/net/core/sock.c
|
||||
@@ -3477,6 +3477,8 @@ static __net_initdata struct pernet_oper
|
||||
@@ -3482,6 +3482,8 @@ static __net_initdata struct pernet_oper
|
||||
|
||||
static int __init proto_init(void)
|
||||
{
|
||||
|
||||
@@ -54,7 +54,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
+MODULE_LICENSE("GPL");
|
||||
--- a/kernel/sched/core.c
|
||||
+++ b/kernel/sched/core.c
|
||||
@@ -2128,6 +2128,7 @@ int wake_up_state(struct task_struct *p,
|
||||
@@ -2127,6 +2127,7 @@ int wake_up_state(struct task_struct *p,
|
||||
{
|
||||
return try_to_wake_up(p, state, 0);
|
||||
}
|
||||
|
||||
@@ -41,7 +41,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
+#endif
|
||||
--- a/init/Kconfig
|
||||
+++ b/init/Kconfig
|
||||
@@ -1041,6 +1041,10 @@ config RELAY
|
||||
@@ -1046,6 +1046,10 @@ config RELAY
|
||||
|
||||
If unsure, say N.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user