--- /dev/null
+From c9046afa563f37801deb278842e6c2f94960cd11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 19:54:50 +0800
+Subject: ASoC: codecs: avoid possible garbage value in peb2466_reg_read()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 38cc0334baabc5baf08a1db753de521e016c0432 ]
+
+Clang static checker (scan-build) warning:
+sound/soc/codecs/peb2466.c:232:8:
+Assigned value is garbage or undefined [core.uninitialized.Assign]
+ 232 | *val = tmp;
+ | ^ ~~~
+
+When peb2466_read_byte() fails, 'tmp' will have a garbage value.
+Add a judgemnet to avoid this problem.
+
+Fixes: 227f609c7c0e ("ASoC: codecs: Add support for the Infineon PEB2466 codec")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Link: https://patch.msgid.link/20240911115448.277828-1-suhui@nfschina.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/peb2466.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/peb2466.c b/sound/soc/codecs/peb2466.c
+index 5dec69be0acb..06c83d2042f3 100644
+--- a/sound/soc/codecs/peb2466.c
++++ b/sound/soc/codecs/peb2466.c
+@@ -229,7 +229,8 @@ static int peb2466_reg_read(void *context, unsigned int reg, unsigned int *val)
+ case PEB2466_CMD_XOP:
+ case PEB2466_CMD_SOP:
+ ret = peb2466_read_byte(peb2466, reg, &tmp);
+- *val = tmp;
++ if (!ret)
++ *val = tmp;
+ break;
+ default:
+ dev_err(&peb2466->spi->dev, "Not a XOP or SOP command\n");
+--
+2.43.0
+
--- /dev/null
+From 760389c9ba4ed2ac7e0e8f6f60c863a53a7c5634 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 06:02:23 +0000
+Subject: ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit c4246f1fe9f24f8dcd97887ed67d8fcfd91f4796 ]
+
+There is no links_num in struct snd_soc_acpi_mach {}, and we test
+!link->num_adr as a condition to end the loop in hda_sdw_machine_select().
+So an empty item in struct snd_soc_acpi_link_adr array is required.
+
+Fixes: dd3bd9dc4708 ("ASoC: Intel: soc-acpi-intel-lnl-match: add cs42l43 only support")
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20240906060224.2241212-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-acpi-intel-lnl-match.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-lnl-match.c b/sound/soc/intel/common/soc-acpi-intel-lnl-match.c
+index e6ffcd5be6c5..edfb668d0580 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-lnl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-lnl-match.c
+@@ -208,6 +208,7 @@ static const struct snd_soc_acpi_link_adr lnl_cs42l43_l0[] = {
+ .num_adr = ARRAY_SIZE(cs42l43_0_adr),
+ .adr_d = cs42l43_0_adr,
+ },
++ {}
+ };
+
+ static const struct snd_soc_acpi_link_adr lnl_rvp[] = {
+--
+2.43.0
+
--- /dev/null
+From 08e5096499a42d7021f31e1f60db2739b7da5a46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 06:02:24 +0000
+Subject: ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit bf6d7a44a144aa9c476dee83c23faf3151181bab ]
+
+There is no links_num in struct snd_soc_acpi_mach {}, and we test
+!link->num_adr as a condition to end the loop in hda_sdw_machine_select().
+So an empty item in struct snd_soc_acpi_link_adr array is required.
+
+Fixes: f77ae7fcdc4763 ("ASoC: Intel: soc-acpi-intel-mtl-match: add cs42l43 only support")
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20240906060224.2241212-3-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-acpi-intel-mtl-match.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-mtl-match.c b/sound/soc/intel/common/soc-acpi-intel-mtl-match.c
+index 8e0ae3635a35..d4435a34a3a3 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-mtl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-mtl-match.c
+@@ -674,6 +674,7 @@ static const struct snd_soc_acpi_link_adr mtl_cs42l43_l0[] = {
+ .num_adr = ARRAY_SIZE(cs42l43_0_adr),
+ .adr_d = cs42l43_0_adr,
+ },
++ {}
+ };
+
+ static const struct snd_soc_acpi_link_adr mtl_cs42l43_cs35l56[] = {
+--
+2.43.0
+
--- /dev/null
+From 6c28e7ec9800b109959654e8250c7cc303b169a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 16:58:48 +0100
+Subject: cifs: Fix signature miscalculation
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 5a20b7cb0d8d3ee490a8e088dc2584aa782e3355 ]
+
+Fix the calculation of packet signatures by adding the offset into a page
+in the read or write data payload when hashing the pages from it.
+
+Fixes: 39bc58203f04 ("cifs: Add a function to Hash the contents of an iterator")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Tom Talpey <tom@talpey.com>
+Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+cc: Shyam Prasad N <nspmangalore@gmail.com>
+cc: Rohith Surabattula <rohiths.msft@gmail.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsencrypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/cifsencrypt.c b/fs/smb/client/cifsencrypt.c
+index 6322f0f68a17..b0473c2567fe 100644
+--- a/fs/smb/client/cifsencrypt.c
++++ b/fs/smb/client/cifsencrypt.c
+@@ -129,7 +129,7 @@ static ssize_t cifs_shash_xarray(const struct iov_iter *iter, ssize_t maxsize,
+ for (j = foffset / PAGE_SIZE; j < npages; j++) {
+ len = min_t(size_t, maxsize, PAGE_SIZE - offset);
+ p = kmap_local_page(folio_page(folio, j));
+- ret = crypto_shash_update(shash, p, len);
++ ret = crypto_shash_update(shash, p + offset, len);
+ kunmap_local(p);
+ if (ret < 0)
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From 4bcffe725c5b907246467c42adddba3b1c64fcc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jul 2024 08:59:25 -0700
+Subject: drm/i915/guc: prevent a possible int overflow in wq offsets
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit d3d37f74683e2f16f2635ee265884f7ca69350ae ]
+
+It may be possible for the sum of the values derived from
+i915_ggtt_offset() and __get_parent_scratch_offset()/
+i915_ggtt_offset() to go over the u32 limit before being assigned
+to wq offsets of u64 type.
+
+Mitigate these issues by expanding one of the right operands
+to u64 to avoid any overflow issues just in case.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: c2aa552ff09d ("drm/i915/guc: Add multi-lrc context registration")
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240725155925.14707-1-n.zhandarovich@fintech.ru
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit 1f1c1bd56620b80ae407c5790743e17caad69cec)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+index 0eaa1064242c..f8e189a73a79 100644
+--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+@@ -2842,9 +2842,9 @@ static void prepare_context_registration_info_v70(struct intel_context *ce,
+ ce->parallel.guc.wqi_tail = 0;
+ ce->parallel.guc.wqi_head = 0;
+
+- wq_desc_offset = i915_ggtt_offset(ce->state) +
++ wq_desc_offset = (u64)i915_ggtt_offset(ce->state) +
+ __get_parent_scratch_offset(ce);
+- wq_base_offset = i915_ggtt_offset(ce->state) +
++ wq_base_offset = (u64)i915_ggtt_offset(ce->state) +
+ __get_wq_offset(ce);
+ info->wq_desc_lo = lower_32_bits(wq_desc_offset);
+ info->wq_desc_hi = upper_32_bits(wq_desc_offset);
+--
+2.43.0
+
--- /dev/null
+From e0d2dd3a656ab47911dd770dadfd67ac78d2bf53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2024 22:00:34 +0300
+Subject: drm/xe/display: fix compat IS_DISPLAY_STEP() range end
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit dd10595c3232d362f5a01e5d616434b2371ae8d4 ]
+
+It's supposed to be an open range at the end like in i915. Fingers
+crossed that nobody relies on this definition.
+
+Fixes: 44e694958b95 ("drm/xe/display: Implement display support")
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Acked-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/fe8743770694e429f6902491cdb306c97bdf701a.1724180287.git.jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 453afb1a439994deeacb8d9ecbb48c1f2348ea0a)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h b/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h
+index cd4632276141..68ade1a05ca9 100644
+--- a/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h
++++ b/drivers/gpu/drm/xe/compat-i915-headers/i915_drv.h
+@@ -96,7 +96,7 @@ static inline struct drm_i915_private *kdev_to_i915(struct device *kdev)
+ #define HAS_GMD_ID(xe) GRAPHICS_VERx100(xe) >= 1270
+
+ /* Workarounds not handled yet */
+-#define IS_DISPLAY_STEP(xe, first, last) ({u8 __step = (xe)->info.step.display; first <= __step && __step <= last; })
++#define IS_DISPLAY_STEP(xe, first, last) ({u8 __step = (xe)->info.step.display; first <= __step && __step < last; })
+
+ #define IS_LP(xe) (0)
+ #define IS_GEN9_LP(xe) (0)
+--
+2.43.0
+
drm-xe-client-fix-deadlock-in-show_meminfo.patch
drm-xe-client-add-missing-bo-locking-in-show_meminfo.patch
tracing-kprobes-fix-build-error-when-find_module-is-not-available.patch
+asoc-intel-soc-acpi-intel-lnl-match-add-missing-empt.patch
+asoc-intel-soc-acpi-intel-mtl-match-add-missing-empt.patch
+spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch
+spi-geni-qcom-fix-incorrect-free_irq-sequence.patch
+drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch
+asoc-codecs-avoid-possible-garbage-value-in-peb2466_.patch
+drm-xe-display-fix-compat-is_display_step-range-end.patch
+cifs-fix-signature-miscalculation.patch
--- /dev/null
+From 61290d00eab42d11bc5cfe40505ac0e0dff9f273 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 15:31:40 +0800
+Subject: spi: geni-qcom: Fix incorrect free_irq() sequence
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit b787a33864121a565aeb0e88561bf6062a19f99c ]
+
+In spi_geni_remove(), the free_irq() sequence is different from that
+on the probe error path. And the IRQ will still remain and it's interrupt
+handler may use the dma channel after release dma channel and before free
+irq, which is not secure, fix it.
+
+Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patch.msgid.link/20240909073141.951494-3-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index fef522fece1b..6f4057330444 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -1170,9 +1170,9 @@ static void spi_geni_remove(struct platform_device *pdev)
+ /* Unregister _before_ disabling pm_runtime() so we stop transfers */
+ spi_unregister_controller(spi);
+
+- spi_geni_release_dma_chan(mas);
+-
+ free_irq(mas->irq, spi);
++
++ spi_geni_release_dma_chan(mas);
+ }
+
+ static int __maybe_unused spi_geni_runtime_suspend(struct device *dev)
+--
+2.43.0
+
--- /dev/null
+From 300b3124b1b2304b00643672f0d67e67e0fe16ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2024 15:31:39 +0800
+Subject: spi: geni-qcom: Undo runtime PM changes at driver exit time
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 89e362c883c65ff94b76b9862285f63545fb5274 ]
+
+It's important to undo pm_runtime_use_autosuspend() with
+pm_runtime_dont_use_autosuspend() at driver exit time unless driver
+initially enabled pm_runtime with devm_pm_runtime_enable()
+(which handles it for you).
+
+Hence, switch to devm_pm_runtime_enable() to fix it, so the
+pm_runtime_disable() in probe error path and remove function
+can be removed.
+
+Fixes: cfdab2cd85ec ("spi: spi-geni-qcom: Set an autosuspend delay of 250 ms")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patch.msgid.link/20240909073141.951494-2-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-geni-qcom.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c
+index 37ef8c40b276..fef522fece1b 100644
+--- a/drivers/spi/spi-geni-qcom.c
++++ b/drivers/spi/spi-geni-qcom.c
+@@ -1110,25 +1110,27 @@ static int spi_geni_probe(struct platform_device *pdev)
+ spin_lock_init(&mas->lock);
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_set_autosuspend_delay(&pdev->dev, 250);
+- pm_runtime_enable(dev);
++ ret = devm_pm_runtime_enable(dev);
++ if (ret)
++ return ret;
+
+ if (device_property_read_bool(&pdev->dev, "spi-slave"))
+ spi->target = true;
+
+ ret = geni_icc_get(&mas->se, NULL);
+ if (ret)
+- goto spi_geni_probe_runtime_disable;
++ return ret;
+ /* Set the bus quota to a reasonable value for register access */
+ mas->se.icc_paths[GENI_TO_CORE].avg_bw = Bps_to_icc(CORE_2X_50_MHZ);
+ mas->se.icc_paths[CPU_TO_GENI].avg_bw = GENI_DEFAULT_BW;
+
+ ret = geni_icc_set_bw(&mas->se);
+ if (ret)
+- goto spi_geni_probe_runtime_disable;
++ return ret;
+
+ ret = spi_geni_init(mas);
+ if (ret)
+- goto spi_geni_probe_runtime_disable;
++ return ret;
+
+ /*
+ * check the mode supported and set_cs for fifo mode only
+@@ -1157,8 +1159,6 @@ static int spi_geni_probe(struct platform_device *pdev)
+ free_irq(mas->irq, spi);
+ spi_geni_release_dma:
+ spi_geni_release_dma_chan(mas);
+-spi_geni_probe_runtime_disable:
+- pm_runtime_disable(dev);
+ return ret;
+ }
+
+@@ -1173,7 +1173,6 @@ static void spi_geni_remove(struct platform_device *pdev)
+ spi_geni_release_dma_chan(mas);
+
+ free_irq(mas->irq, spi);
+- pm_runtime_disable(&pdev->dev);
+ }
+
+ static int __maybe_unused spi_geni_runtime_suspend(struct device *dev)
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
