+++ /dev/null
-From ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 Mon Sep 17 00:00:00 2001
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Date: Mon, 5 May 2025 15:49:59 -0700
-Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-
-commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 upstream.
-
-Sysfs interface for updating firmware for RMI devices is available even
-when F34 probe fails. The code checks for presence of F34 "container"
-pointer and then tries to use the function data attached to the
-sub-device. F34 assigns the function data early, before it knows if
-probe will succeed, leaving behind a stale pointer.
-
-Fix this by expanding checks to not only test for presence of F34
-"container" but also check if there is driver data assigned to the
-sub-device, and call dev_set_drvdata() only after we are certain that
-probe is successful.
-
-This is not a complete fix, since F34 will be freed during firmware
-update, so there is still a race when fetching and accessing this
-pointer. This race will be addressed in follow-up changes.
-
-Reported-by: Hanno Böck <hanno@hboeck.de>
-Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash")
-Cc: stable@vger.kernel.org
-Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/input/rmi4/rmi_f34.c | 133 ++++++++++++++++++++++++-------------------
- 1 file changed, 75 insertions(+), 58 deletions(-)
-
---- a/drivers/input/rmi4/rmi_f34.c
-+++ b/drivers/input/rmi4/rmi_f34.c
-@@ -4,6 +4,7 @@
- * Copyright (C) 2016 Zodiac Inflight Innovations
- */
-
-+#include "linux/device.h"
- #include <linux/kernel.h>
- #include <linux/rmi.h>
- #include <linux/firmware.h>
-@@ -298,39 +299,30 @@ out:
- return ret;
- }
-
--static int rmi_f34_status(struct rmi_function *fn)
--{
-- struct f34_data *f34 = dev_get_drvdata(&fn->dev);
--
-- /*
-- * The status is the percentage complete, or once complete,
-- * zero for success or a negative return code.
-- */
-- return f34->update_status;
--}
--
- static ssize_t rmi_driver_bootloader_id_show(struct device *dev,
- struct device_attribute *dattr,
- char *buf)
- {
- struct rmi_driver_data *data = dev_get_drvdata(dev);
-- struct rmi_function *fn = data->f34_container;
-+ struct rmi_function *fn;
- struct f34_data *f34;
-
-- if (fn) {
-- f34 = dev_get_drvdata(&fn->dev);
-+ fn = data->f34_container;
-+ if (!fn)
-+ return -ENODEV;
-
-- if (f34->bl_version == 5)
-- return sysfs_emit(buf, "%c%c\n",
-- f34->bootloader_id[0],
-- f34->bootloader_id[1]);
-- else
-- return sysfs_emit(buf, "V%d.%d\n",
-- f34->bootloader_id[1],
-- f34->bootloader_id[0]);
-- }
-+ f34 = dev_get_drvdata(&fn->dev);
-+ if (!f34)
-+ return -ENODEV;
-
-- return 0;
-+ if (f34->bl_version == 5)
-+ return sysfs_emit(buf, "%c%c\n",
-+ f34->bootloader_id[0],
-+ f34->bootloader_id[1]);
-+ else
-+ return sysfs_emit(buf, "V%d.%d\n",
-+ f34->bootloader_id[1],
-+ f34->bootloader_id[0]);
- }
-
- static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL);
-@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_
- struct rmi_function *fn = data->f34_container;
- struct f34_data *f34;
-
-- if (fn) {
-- f34 = dev_get_drvdata(&fn->dev);
-+ fn = data->f34_container;
-+ if (!fn)
-+ return -ENODEV;
-
-- return sysfs_emit(buf, "%s\n", f34->configuration_id);
-- }
-+ f34 = dev_get_drvdata(&fn->dev);
-+ if (!f34)
-+ return -ENODEV;
-
-- return 0;
-+
-+ return sysfs_emit(buf, "%s\n", f34->configuration_id);
- }
-
- static DEVICE_ATTR(configuration_id, 0444,
-@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rm
-
- if (!data->f34_container) {
- dev_warn(dev, "%s: No F34 present!\n", __func__);
-- return -EINVAL;
-+ return -ENODEV;
- }
-
- f34 = dev_get_drvdata(&data->f34_container->dev);
-+ if (!f34) {
-+ dev_warn(dev, "%s: No valid F34 present!\n", __func__);
-+ return -ENODEV;
-+ }
-
- if (f34->bl_version >= 7) {
- if (data->pdt_props & HAS_BSR) {
-@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_stat
- char *buf)
- {
- struct rmi_driver_data *data = dev_get_drvdata(dev);
-- int update_status = 0;
-+ struct f34_data *f34;
-+ int update_status = -ENODEV;
-
-- if (data->f34_container)
-- update_status = rmi_f34_status(data->f34_container);
-+ /*
-+ * The status is the percentage complete, or once complete,
-+ * zero for success or a negative return code.
-+ */
-+ if (data->f34_container) {
-+ f34 = dev_get_drvdata(&data->f34_container->dev);
-+ if (f34)
-+ update_status = f34->update_status;
-+ }
-
- return sysfs_emit(buf, "%d\n", update_status);
- }
-@@ -517,33 +524,21 @@ static const struct attribute_group rmi_
- .attrs = rmi_firmware_attrs,
- };
-
--static int rmi_f34_probe(struct rmi_function *fn)
-+static int rmi_f34v5_probe(struct f34_data *f34)
- {
-- struct f34_data *f34;
-- unsigned char f34_queries[9];
-+ struct rmi_function *fn = f34->fn;
-+ u8 f34_queries[9];
- bool has_config_id;
-- u8 version = fn->fd.function_version;
-- int ret;
--
-- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
-- if (!f34)
-- return -ENOMEM;
--
-- f34->fn = fn;
-- dev_set_drvdata(&fn->dev, f34);
--
-- /* v5 code only supported version 0, try V7 probe */
-- if (version > 0)
-- return rmi_f34v7_probe(f34);
-+ int error;
-
- f34->bl_version = 5;
-
-- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-- f34_queries, sizeof(f34_queries));
-- if (ret) {
-+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-+ f34_queries, sizeof(f34_queries));
-+ if (error) {
- dev_err(&fn->dev, "%s: Failed to query properties\n",
- __func__);
-- return ret;
-+ return error;
- }
-
- snprintf(f34->bootloader_id, sizeof(f34->bootloader_id),
-@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_func
- f34->v5.config_blocks);
-
- if (has_config_id) {
-- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
-- f34_queries, sizeof(f34_queries));
-- if (ret) {
-+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
-+ f34_queries, sizeof(f34_queries));
-+ if (error) {
- dev_err(&fn->dev, "Failed to read F34 config ID\n");
-- return ret;
-+ return error;
- }
-
- snprintf(f34->configuration_id, sizeof(f34->configuration_id),
-@@ -582,11 +577,33 @@ static int rmi_f34_probe(struct rmi_func
- f34_queries[2], f34_queries[3]);
-
- rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n",
-- f34->configuration_id);
-+ f34->configuration_id);
- }
-
- return 0;
- }
-+
-+static int rmi_f34_probe(struct rmi_function *fn)
-+{
-+ struct f34_data *f34;
-+ u8 version = fn->fd.function_version;
-+ int error;
-+
-+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
-+ if (!f34)
-+ return -ENOMEM;
-+
-+ f34->fn = fn;
-+
-+ /* v5 code only supported version 0 */
-+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34);
-+ if (error)
-+ return error;
-+
-+ dev_set_drvdata(&fn->dev, f34);
-+
-+ return 0;
-+}
-
- int rmi_f34_create_sysfs(struct rmi_device *rmi_dev)
- {
smb-client-fix-use-after-free-in-cifs_fill_dirent.patch
smb-client-reset-all-search-buffer-pointers-when-releasing-buffer.patch
revert-drm-amd-keep-display-off-while-going-into-s4.patch
-input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch
memcg-always-call-cond_resched-after-fn.patch
mm-page_alloc.c-avoid-infinite-retries-caused-by-cpuset-race.patch
revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch
+++ /dev/null
-From ac663217ac4eeab508db348a67511d45ccd9846f Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 31 Jan 2025 21:18:05 -0500
-Subject: dm vdo vio-pool: allow variable-sized metadata vios
-
-From: Ken Raeburn <raeburn@redhat.com>
-
-[ Upstream commit f979da512553a41a657f2c1198277e84d66f8ce3 ]
-
-With larger-sized metadata vio pools, vdo will sometimes need to
-issue I/O with a smaller size than the allocated size. Since
-vio_reset_bio is where the bvec array and I/O size are initialized,
-this reset interface must now specify what I/O size to use.
-
-Signed-off-by: Ken Raeburn <raeburn@redhat.com>
-Signed-off-by: Matthew Sakai <msakai@redhat.com>
-Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/dm-vdo/io-submitter.c | 6 ++++--
- drivers/md/dm-vdo/io-submitter.h | 18 +++++++++++++---
- drivers/md/dm-vdo/types.h | 3 +++
- drivers/md/dm-vdo/vio.c | 36 +++++++++++++++++++-------------
- drivers/md/dm-vdo/vio.h | 2 ++
- 5 files changed, 46 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/md/dm-vdo/io-submitter.c b/drivers/md/dm-vdo/io-submitter.c
-index ab62abe18827b..a664be89c15d7 100644
---- a/drivers/md/dm-vdo/io-submitter.c
-+++ b/drivers/md/dm-vdo/io-submitter.c
-@@ -327,6 +327,7 @@ void vdo_submit_data_vio(struct data_vio *data_vio)
- * @error_handler: the handler for submission or I/O errors (may be NULL)
- * @operation: the type of I/O to perform
- * @data: the buffer to read or write (may be NULL)
-+ * @size: the I/O amount in bytes
- *
- * The vio is enqueued on a vdo bio queue so that bio submission (which may block) does not block
- * other vdo threads.
-@@ -338,7 +339,7 @@ void vdo_submit_data_vio(struct data_vio *data_vio)
- */
- void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical,
- bio_end_io_t callback, vdo_action_fn error_handler,
-- blk_opf_t operation, char *data)
-+ blk_opf_t operation, char *data, int size)
- {
- int result;
- struct vdo_completion *completion = &vio->completion;
-@@ -349,7 +350,8 @@ void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical,
-
- vdo_reset_completion(completion);
- completion->error_handler = error_handler;
-- result = vio_reset_bio(vio, data, callback, operation | REQ_META, physical);
-+ result = vio_reset_bio_with_size(vio, data, size, callback, operation | REQ_META,
-+ physical);
- if (result != VDO_SUCCESS) {
- continue_vio(vio, result);
- return;
-diff --git a/drivers/md/dm-vdo/io-submitter.h b/drivers/md/dm-vdo/io-submitter.h
-index 80748699496f2..3088f11055fdd 100644
---- a/drivers/md/dm-vdo/io-submitter.h
-+++ b/drivers/md/dm-vdo/io-submitter.h
-@@ -8,6 +8,7 @@
-
- #include <linux/bio.h>
-
-+#include "constants.h"
- #include "types.h"
-
- struct io_submitter;
-@@ -26,14 +27,25 @@ void vdo_submit_data_vio(struct data_vio *data_vio);
-
- void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical,
- bio_end_io_t callback, vdo_action_fn error_handler,
-- blk_opf_t operation, char *data);
-+ blk_opf_t operation, char *data, int size);
-
- static inline void vdo_submit_metadata_vio(struct vio *vio, physical_block_number_t physical,
- bio_end_io_t callback, vdo_action_fn error_handler,
- blk_opf_t operation)
- {
- __submit_metadata_vio(vio, physical, callback, error_handler,
-- operation, vio->data);
-+ operation, vio->data, vio->block_count * VDO_BLOCK_SIZE);
-+}
-+
-+static inline void vdo_submit_metadata_vio_with_size(struct vio *vio,
-+ physical_block_number_t physical,
-+ bio_end_io_t callback,
-+ vdo_action_fn error_handler,
-+ blk_opf_t operation,
-+ int size)
-+{
-+ __submit_metadata_vio(vio, physical, callback, error_handler,
-+ operation, vio->data, size);
- }
-
- static inline void vdo_submit_flush_vio(struct vio *vio, bio_end_io_t callback,
-@@ -41,7 +53,7 @@ static inline void vdo_submit_flush_vio(struct vio *vio, bio_end_io_t callback,
- {
- /* FIXME: Can we just use REQ_OP_FLUSH? */
- __submit_metadata_vio(vio, 0, callback, error_handler,
-- REQ_OP_WRITE | REQ_PREFLUSH, NULL);
-+ REQ_OP_WRITE | REQ_PREFLUSH, NULL, 0);
- }
-
- #endif /* VDO_IO_SUBMITTER_H */
-diff --git a/drivers/md/dm-vdo/types.h b/drivers/md/dm-vdo/types.h
-index dbe892b10f265..cdf36e7d77021 100644
---- a/drivers/md/dm-vdo/types.h
-+++ b/drivers/md/dm-vdo/types.h
-@@ -376,6 +376,9 @@ struct vio {
- /* The size of this vio in blocks */
- unsigned int block_count;
-
-+ /* The amount of data to be read or written, in bytes */
-+ unsigned int io_size;
-+
- /* The data being read or written. */
- char *data;
-
-diff --git a/drivers/md/dm-vdo/vio.c b/drivers/md/dm-vdo/vio.c
-index b291578f726f5..7c417c1af4516 100644
---- a/drivers/md/dm-vdo/vio.c
-+++ b/drivers/md/dm-vdo/vio.c
-@@ -188,14 +188,23 @@ void vdo_set_bio_properties(struct bio *bio, struct vio *vio, bio_end_io_t callb
-
- /*
- * Prepares the bio to perform IO with the specified buffer. May only be used on a VDO-allocated
-- * bio, as it assumes the bio wraps a 4k buffer that is 4k aligned, but there does not have to be a
-- * vio associated with the bio.
-+ * bio, as it assumes the bio wraps a 4k-multiple buffer that is 4k aligned, but there does not
-+ * have to be a vio associated with the bio.
- */
- int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback,
- blk_opf_t bi_opf, physical_block_number_t pbn)
- {
-- int bvec_count, offset, len, i;
-+ return vio_reset_bio_with_size(vio, data, vio->block_count * VDO_BLOCK_SIZE,
-+ callback, bi_opf, pbn);
-+}
-+
-+int vio_reset_bio_with_size(struct vio *vio, char *data, int size, bio_end_io_t callback,
-+ blk_opf_t bi_opf, physical_block_number_t pbn)
-+{
-+ int bvec_count, offset, i;
- struct bio *bio = vio->bio;
-+ int vio_size = vio->block_count * VDO_BLOCK_SIZE;
-+ int remaining;
-
- bio_reset(bio, bio->bi_bdev, bi_opf);
- vdo_set_bio_properties(bio, vio, callback, bi_opf, pbn);
-@@ -204,22 +213,21 @@ int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback,
-
- bio->bi_io_vec = bio->bi_inline_vecs;
- bio->bi_max_vecs = vio->block_count + 1;
-- len = VDO_BLOCK_SIZE * vio->block_count;
-+ if (VDO_ASSERT(size <= vio_size, "specified size %d is not greater than allocated %d",
-+ size, vio_size) != VDO_SUCCESS)
-+ size = vio_size;
-+ vio->io_size = size;
- offset = offset_in_page(data);
-- bvec_count = DIV_ROUND_UP(offset + len, PAGE_SIZE);
-+ bvec_count = DIV_ROUND_UP(offset + size, PAGE_SIZE);
-+ remaining = size;
-
-- /*
-- * If we knew that data was always on one page, or contiguous pages, we wouldn't need the
-- * loop. But if we're using vmalloc, it's not impossible that the data is in different
-- * pages that can't be merged in bio_add_page...
-- */
-- for (i = 0; (i < bvec_count) && (len > 0); i++) {
-+ for (i = 0; (i < bvec_count) && (remaining > 0); i++) {
- struct page *page;
- int bytes_added;
- int bytes = PAGE_SIZE - offset;
-
-- if (bytes > len)
-- bytes = len;
-+ if (bytes > remaining)
-+ bytes = remaining;
-
- page = is_vmalloc_addr(data) ? vmalloc_to_page(data) : virt_to_page(data);
- bytes_added = bio_add_page(bio, page, bytes, offset);
-@@ -231,7 +239,7 @@ int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback,
- }
-
- data += bytes;
-- len -= bytes;
-+ remaining -= bytes;
- offset = 0;
- }
-
-diff --git a/drivers/md/dm-vdo/vio.h b/drivers/md/dm-vdo/vio.h
-index 3490e9f59b04a..74e8fd7c8c029 100644
---- a/drivers/md/dm-vdo/vio.h
-+++ b/drivers/md/dm-vdo/vio.h
-@@ -123,6 +123,8 @@ void vdo_set_bio_properties(struct bio *bio, struct vio *vio, bio_end_io_t callb
-
- int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback,
- blk_opf_t bi_opf, physical_block_number_t pbn);
-+int vio_reset_bio_with_size(struct vio *vio, char *data, int size, bio_end_io_t callback,
-+ blk_opf_t bi_opf, physical_block_number_t pbn);
-
- void update_vio_error_stats(struct vio *vio, const char *format, ...)
- __printf(2, 3);
---
-2.39.5
-
+++ /dev/null
-From ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 Mon Sep 17 00:00:00 2001
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Date: Mon, 5 May 2025 15:49:59 -0700
-Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-
-commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 upstream.
-
-Sysfs interface for updating firmware for RMI devices is available even
-when F34 probe fails. The code checks for presence of F34 "container"
-pointer and then tries to use the function data attached to the
-sub-device. F34 assigns the function data early, before it knows if
-probe will succeed, leaving behind a stale pointer.
-
-Fix this by expanding checks to not only test for presence of F34
-"container" but also check if there is driver data assigned to the
-sub-device, and call dev_set_drvdata() only after we are certain that
-probe is successful.
-
-This is not a complete fix, since F34 will be freed during firmware
-update, so there is still a race when fetching and accessing this
-pointer. This race will be addressed in follow-up changes.
-
-Reported-by: Hanno Böck <hanno@hboeck.de>
-Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash")
-Cc: stable@vger.kernel.org
-Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/input/rmi4/rmi_f34.c | 133 ++++++++++++++++++++++++-------------------
- 1 file changed, 75 insertions(+), 58 deletions(-)
-
---- a/drivers/input/rmi4/rmi_f34.c
-+++ b/drivers/input/rmi4/rmi_f34.c
-@@ -4,6 +4,7 @@
- * Copyright (C) 2016 Zodiac Inflight Innovations
- */
-
-+#include "linux/device.h"
- #include <linux/kernel.h>
- #include <linux/rmi.h>
- #include <linux/firmware.h>
-@@ -298,39 +299,30 @@ out:
- return ret;
- }
-
--static int rmi_f34_status(struct rmi_function *fn)
--{
-- struct f34_data *f34 = dev_get_drvdata(&fn->dev);
--
-- /*
-- * The status is the percentage complete, or once complete,
-- * zero for success or a negative return code.
-- */
-- return f34->update_status;
--}
--
- static ssize_t rmi_driver_bootloader_id_show(struct device *dev,
- struct device_attribute *dattr,
- char *buf)
- {
- struct rmi_driver_data *data = dev_get_drvdata(dev);
-- struct rmi_function *fn = data->f34_container;
-+ struct rmi_function *fn;
- struct f34_data *f34;
-
-- if (fn) {
-- f34 = dev_get_drvdata(&fn->dev);
-+ fn = data->f34_container;
-+ if (!fn)
-+ return -ENODEV;
-
-- if (f34->bl_version == 5)
-- return sysfs_emit(buf, "%c%c\n",
-- f34->bootloader_id[0],
-- f34->bootloader_id[1]);
-- else
-- return sysfs_emit(buf, "V%d.%d\n",
-- f34->bootloader_id[1],
-- f34->bootloader_id[0]);
-- }
-+ f34 = dev_get_drvdata(&fn->dev);
-+ if (!f34)
-+ return -ENODEV;
-
-- return 0;
-+ if (f34->bl_version == 5)
-+ return sysfs_emit(buf, "%c%c\n",
-+ f34->bootloader_id[0],
-+ f34->bootloader_id[1]);
-+ else
-+ return sysfs_emit(buf, "V%d.%d\n",
-+ f34->bootloader_id[1],
-+ f34->bootloader_id[0]);
- }
-
- static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL);
-@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_
- struct rmi_function *fn = data->f34_container;
- struct f34_data *f34;
-
-- if (fn) {
-- f34 = dev_get_drvdata(&fn->dev);
-+ fn = data->f34_container;
-+ if (!fn)
-+ return -ENODEV;
-
-- return sysfs_emit(buf, "%s\n", f34->configuration_id);
-- }
-+ f34 = dev_get_drvdata(&fn->dev);
-+ if (!f34)
-+ return -ENODEV;
-
-- return 0;
-+
-+ return sysfs_emit(buf, "%s\n", f34->configuration_id);
- }
-
- static DEVICE_ATTR(configuration_id, 0444,
-@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rm
-
- if (!data->f34_container) {
- dev_warn(dev, "%s: No F34 present!\n", __func__);
-- return -EINVAL;
-+ return -ENODEV;
- }
-
- f34 = dev_get_drvdata(&data->f34_container->dev);
-+ if (!f34) {
-+ dev_warn(dev, "%s: No valid F34 present!\n", __func__);
-+ return -ENODEV;
-+ }
-
- if (f34->bl_version >= 7) {
- if (data->pdt_props & HAS_BSR) {
-@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_stat
- char *buf)
- {
- struct rmi_driver_data *data = dev_get_drvdata(dev);
-- int update_status = 0;
-+ struct f34_data *f34;
-+ int update_status = -ENODEV;
-
-- if (data->f34_container)
-- update_status = rmi_f34_status(data->f34_container);
-+ /*
-+ * The status is the percentage complete, or once complete,
-+ * zero for success or a negative return code.
-+ */
-+ if (data->f34_container) {
-+ f34 = dev_get_drvdata(&data->f34_container->dev);
-+ if (f34)
-+ update_status = f34->update_status;
-+ }
-
- return sysfs_emit(buf, "%d\n", update_status);
- }
-@@ -517,33 +524,21 @@ static const struct attribute_group rmi_
- .attrs = rmi_firmware_attrs,
- };
-
--static int rmi_f34_probe(struct rmi_function *fn)
-+static int rmi_f34v5_probe(struct f34_data *f34)
- {
-- struct f34_data *f34;
-- unsigned char f34_queries[9];
-+ struct rmi_function *fn = f34->fn;
-+ u8 f34_queries[9];
- bool has_config_id;
-- u8 version = fn->fd.function_version;
-- int ret;
--
-- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
-- if (!f34)
-- return -ENOMEM;
--
-- f34->fn = fn;
-- dev_set_drvdata(&fn->dev, f34);
--
-- /* v5 code only supported version 0, try V7 probe */
-- if (version > 0)
-- return rmi_f34v7_probe(f34);
-+ int error;
-
- f34->bl_version = 5;
-
-- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-- f34_queries, sizeof(f34_queries));
-- if (ret) {
-+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-+ f34_queries, sizeof(f34_queries));
-+ if (error) {
- dev_err(&fn->dev, "%s: Failed to query properties\n",
- __func__);
-- return ret;
-+ return error;
- }
-
- snprintf(f34->bootloader_id, sizeof(f34->bootloader_id),
-@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_func
- f34->v5.config_blocks);
-
- if (has_config_id) {
-- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
-- f34_queries, sizeof(f34_queries));
-- if (ret) {
-+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
-+ f34_queries, sizeof(f34_queries));
-+ if (error) {
- dev_err(&fn->dev, "Failed to read F34 config ID\n");
-- return ret;
-+ return error;
- }
-
- snprintf(f34->configuration_id, sizeof(f34->configuration_id),
-@@ -582,11 +577,33 @@ static int rmi_f34_probe(struct rmi_func
- f34_queries[2], f34_queries[3]);
-
- rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n",
-- f34->configuration_id);
-+ f34->configuration_id);
- }
-
- return 0;
- }
-+
-+static int rmi_f34_probe(struct rmi_function *fn)
-+{
-+ struct f34_data *f34;
-+ u8 version = fn->fd.function_version;
-+ int error;
-+
-+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
-+ if (!f34)
-+ return -ENOMEM;
-+
-+ f34->fn = fn;
-+
-+ /* v5 code only supported version 0 */
-+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34);
-+ if (error)
-+ return error;
-+
-+ dev_set_drvdata(&fn->dev, f34);
-+
-+ return 0;
-+}
-
- int rmi_f34_create_sysfs(struct rmi_device *rmi_dev)
- {
asoc-codecs-pcm3168a-allow-for-24-bit-in-provider-mo.patch
asoc-rt722-sdca-add-some-missing-readable-registers.patch
irqchip-riscv-aplic-add-support-for-hart-indexes.patch
-dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch
dm-vdo-indexer-prevent-unterminated-string-warning.patch
dm-vdo-use-a-short-static-string-for-thread-name-pre.patch
drm-ast-find-vbios-mode-from-regular-display-size.patch
smb-client-reset-all-search-buffer-pointers-when-releasing-buffer.patch
revert-drm-amd-keep-display-off-while-going-into-s4.patch
input-xpad-add-more-controllers.patch
-input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch
highmem-add-folio_test_partial_kmap.patch
memcg-always-call-cond_resched-after-fn.patch
mm-page_alloc.c-avoid-infinite-retries-caused-by-cpuset-race.patch
+++ /dev/null
-From 921200c5e2f6a07ad93419d800d6a1a2fbf7abc7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 31 Jan 2025 21:18:05 -0500
-Subject: dm vdo vio-pool: allow variable-sized metadata vios
-
-From: Ken Raeburn <raeburn@redhat.com>
-
-[ Upstream commit f979da512553a41a657f2c1198277e84d66f8ce3 ]
-
-With larger-sized metadata vio pools, vdo will sometimes need to
-issue I/O with a smaller size than the allocated size. Since
-vio_reset_bio is where the bvec array and I/O size are initialized,
-this reset interface must now specify what I/O size to use.
-
-Signed-off-by: Ken Raeburn <raeburn@redhat.com>
-Signed-off-by: Matthew Sakai <msakai@redhat.com>
-Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/md/dm-vdo/io-submitter.c | 6 ++++--
- drivers/md/dm-vdo/io-submitter.h | 18 +++++++++++++---
- drivers/md/dm-vdo/types.h | 3 +++
- drivers/md/dm-vdo/vio.c | 36 +++++++++++++++++++-------------
- drivers/md/dm-vdo/vio.h | 2 ++
- 5 files changed, 46 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/md/dm-vdo/io-submitter.c b/drivers/md/dm-vdo/io-submitter.c
-index 421e5436c32c9..11d47770b54d2 100644
---- a/drivers/md/dm-vdo/io-submitter.c
-+++ b/drivers/md/dm-vdo/io-submitter.c
-@@ -327,6 +327,7 @@ void vdo_submit_data_vio(struct data_vio *data_vio)
- * @error_handler: the handler for submission or I/O errors (may be NULL)
- * @operation: the type of I/O to perform
- * @data: the buffer to read or write (may be NULL)
-+ * @size: the I/O amount in bytes
- *
- * The vio is enqueued on a vdo bio queue so that bio submission (which may block) does not block
- * other vdo threads.
-@@ -338,7 +339,7 @@ void vdo_submit_data_vio(struct data_vio *data_vio)
- */
- void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical,
- bio_end_io_t callback, vdo_action_fn error_handler,
-- blk_opf_t operation, char *data)
-+ blk_opf_t operation, char *data, int size)
- {
- int result;
- struct vdo_completion *completion = &vio->completion;
-@@ -349,7 +350,8 @@ void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical,
-
- vdo_reset_completion(completion);
- completion->error_handler = error_handler;
-- result = vio_reset_bio(vio, data, callback, operation | REQ_META, physical);
-+ result = vio_reset_bio_with_size(vio, data, size, callback, operation | REQ_META,
-+ physical);
- if (result != VDO_SUCCESS) {
- continue_vio(vio, result);
- return;
-diff --git a/drivers/md/dm-vdo/io-submitter.h b/drivers/md/dm-vdo/io-submitter.h
-index 80748699496f2..3088f11055fdd 100644
---- a/drivers/md/dm-vdo/io-submitter.h
-+++ b/drivers/md/dm-vdo/io-submitter.h
-@@ -8,6 +8,7 @@
-
- #include <linux/bio.h>
-
-+#include "constants.h"
- #include "types.h"
-
- struct io_submitter;
-@@ -26,14 +27,25 @@ void vdo_submit_data_vio(struct data_vio *data_vio);
-
- void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical,
- bio_end_io_t callback, vdo_action_fn error_handler,
-- blk_opf_t operation, char *data);
-+ blk_opf_t operation, char *data, int size);
-
- static inline void vdo_submit_metadata_vio(struct vio *vio, physical_block_number_t physical,
- bio_end_io_t callback, vdo_action_fn error_handler,
- blk_opf_t operation)
- {
- __submit_metadata_vio(vio, physical, callback, error_handler,
-- operation, vio->data);
-+ operation, vio->data, vio->block_count * VDO_BLOCK_SIZE);
-+}
-+
-+static inline void vdo_submit_metadata_vio_with_size(struct vio *vio,
-+ physical_block_number_t physical,
-+ bio_end_io_t callback,
-+ vdo_action_fn error_handler,
-+ blk_opf_t operation,
-+ int size)
-+{
-+ __submit_metadata_vio(vio, physical, callback, error_handler,
-+ operation, vio->data, size);
- }
-
- static inline void vdo_submit_flush_vio(struct vio *vio, bio_end_io_t callback,
-@@ -41,7 +53,7 @@ static inline void vdo_submit_flush_vio(struct vio *vio, bio_end_io_t callback,
- {
- /* FIXME: Can we just use REQ_OP_FLUSH? */
- __submit_metadata_vio(vio, 0, callback, error_handler,
-- REQ_OP_WRITE | REQ_PREFLUSH, NULL);
-+ REQ_OP_WRITE | REQ_PREFLUSH, NULL, 0);
- }
-
- #endif /* VDO_IO_SUBMITTER_H */
-diff --git a/drivers/md/dm-vdo/types.h b/drivers/md/dm-vdo/types.h
-index dbe892b10f265..cdf36e7d77021 100644
---- a/drivers/md/dm-vdo/types.h
-+++ b/drivers/md/dm-vdo/types.h
-@@ -376,6 +376,9 @@ struct vio {
- /* The size of this vio in blocks */
- unsigned int block_count;
-
-+ /* The amount of data to be read or written, in bytes */
-+ unsigned int io_size;
-+
- /* The data being read or written. */
- char *data;
-
-diff --git a/drivers/md/dm-vdo/vio.c b/drivers/md/dm-vdo/vio.c
-index e710f3c5a972d..725d87ecf2150 100644
---- a/drivers/md/dm-vdo/vio.c
-+++ b/drivers/md/dm-vdo/vio.c
-@@ -188,14 +188,23 @@ void vdo_set_bio_properties(struct bio *bio, struct vio *vio, bio_end_io_t callb
-
- /*
- * Prepares the bio to perform IO with the specified buffer. May only be used on a VDO-allocated
-- * bio, as it assumes the bio wraps a 4k buffer that is 4k aligned, but there does not have to be a
-- * vio associated with the bio.
-+ * bio, as it assumes the bio wraps a 4k-multiple buffer that is 4k aligned, but there does not
-+ * have to be a vio associated with the bio.
- */
- int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback,
- blk_opf_t bi_opf, physical_block_number_t pbn)
- {
-- int bvec_count, offset, len, i;
-+ return vio_reset_bio_with_size(vio, data, vio->block_count * VDO_BLOCK_SIZE,
-+ callback, bi_opf, pbn);
-+}
-+
-+int vio_reset_bio_with_size(struct vio *vio, char *data, int size, bio_end_io_t callback,
-+ blk_opf_t bi_opf, physical_block_number_t pbn)
-+{
-+ int bvec_count, offset, i;
- struct bio *bio = vio->bio;
-+ int vio_size = vio->block_count * VDO_BLOCK_SIZE;
-+ int remaining;
-
- bio_reset(bio, bio->bi_bdev, bi_opf);
- vdo_set_bio_properties(bio, vio, callback, bi_opf, pbn);
-@@ -205,22 +214,21 @@ int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback,
- bio->bi_ioprio = 0;
- bio->bi_io_vec = bio->bi_inline_vecs;
- bio->bi_max_vecs = vio->block_count + 1;
-- len = VDO_BLOCK_SIZE * vio->block_count;
-+ if (VDO_ASSERT(size <= vio_size, "specified size %d is not greater than allocated %d",
-+ size, vio_size) != VDO_SUCCESS)
-+ size = vio_size;
-+ vio->io_size = size;
- offset = offset_in_page(data);
-- bvec_count = DIV_ROUND_UP(offset + len, PAGE_SIZE);
-+ bvec_count = DIV_ROUND_UP(offset + size, PAGE_SIZE);
-+ remaining = size;
-
-- /*
-- * If we knew that data was always on one page, or contiguous pages, we wouldn't need the
-- * loop. But if we're using vmalloc, it's not impossible that the data is in different
-- * pages that can't be merged in bio_add_page...
-- */
-- for (i = 0; (i < bvec_count) && (len > 0); i++) {
-+ for (i = 0; (i < bvec_count) && (remaining > 0); i++) {
- struct page *page;
- int bytes_added;
- int bytes = PAGE_SIZE - offset;
-
-- if (bytes > len)
-- bytes = len;
-+ if (bytes > remaining)
-+ bytes = remaining;
-
- page = is_vmalloc_addr(data) ? vmalloc_to_page(data) : virt_to_page(data);
- bytes_added = bio_add_page(bio, page, bytes, offset);
-@@ -232,7 +240,7 @@ int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback,
- }
-
- data += bytes;
-- len -= bytes;
-+ remaining -= bytes;
- offset = 0;
- }
-
-diff --git a/drivers/md/dm-vdo/vio.h b/drivers/md/dm-vdo/vio.h
-index 3490e9f59b04a..74e8fd7c8c029 100644
---- a/drivers/md/dm-vdo/vio.h
-+++ b/drivers/md/dm-vdo/vio.h
-@@ -123,6 +123,8 @@ void vdo_set_bio_properties(struct bio *bio, struct vio *vio, bio_end_io_t callb
-
- int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback,
- blk_opf_t bi_opf, physical_block_number_t pbn);
-+int vio_reset_bio_with_size(struct vio *vio, char *data, int size, bio_end_io_t callback,
-+ blk_opf_t bi_opf, physical_block_number_t pbn);
-
- void update_vio_error_stats(struct vio *vio, const char *format, ...)
- __printf(2, 3);
---
-2.39.5
-
+++ /dev/null
-From ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 Mon Sep 17 00:00:00 2001
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Date: Mon, 5 May 2025 15:49:59 -0700
-Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-
-commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 upstream.
-
-Sysfs interface for updating firmware for RMI devices is available even
-when F34 probe fails. The code checks for presence of F34 "container"
-pointer and then tries to use the function data attached to the
-sub-device. F34 assigns the function data early, before it knows if
-probe will succeed, leaving behind a stale pointer.
-
-Fix this by expanding checks to not only test for presence of F34
-"container" but also check if there is driver data assigned to the
-sub-device, and call dev_set_drvdata() only after we are certain that
-probe is successful.
-
-This is not a complete fix, since F34 will be freed during firmware
-update, so there is still a race when fetching and accessing this
-pointer. This race will be addressed in follow-up changes.
-
-Reported-by: Hanno Böck <hanno@hboeck.de>
-Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash")
-Cc: stable@vger.kernel.org
-Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/input/rmi4/rmi_f34.c | 133 ++++++++++++++++++++++++-------------------
- 1 file changed, 75 insertions(+), 58 deletions(-)
-
---- a/drivers/input/rmi4/rmi_f34.c
-+++ b/drivers/input/rmi4/rmi_f34.c
-@@ -4,6 +4,7 @@
- * Copyright (C) 2016 Zodiac Inflight Innovations
- */
-
-+#include "linux/device.h"
- #include <linux/kernel.h>
- #include <linux/rmi.h>
- #include <linux/firmware.h>
-@@ -289,39 +290,30 @@ static int rmi_f34_update_firmware(struc
- return rmi_f34_flash_firmware(f34, syn_fw);
- }
-
--static int rmi_f34_status(struct rmi_function *fn)
--{
-- struct f34_data *f34 = dev_get_drvdata(&fn->dev);
--
-- /*
-- * The status is the percentage complete, or once complete,
-- * zero for success or a negative return code.
-- */
-- return f34->update_status;
--}
--
- static ssize_t rmi_driver_bootloader_id_show(struct device *dev,
- struct device_attribute *dattr,
- char *buf)
- {
- struct rmi_driver_data *data = dev_get_drvdata(dev);
-- struct rmi_function *fn = data->f34_container;
-+ struct rmi_function *fn;
- struct f34_data *f34;
-
-- if (fn) {
-- f34 = dev_get_drvdata(&fn->dev);
-+ fn = data->f34_container;
-+ if (!fn)
-+ return -ENODEV;
-
-- if (f34->bl_version == 5)
-- return sysfs_emit(buf, "%c%c\n",
-- f34->bootloader_id[0],
-- f34->bootloader_id[1]);
-- else
-- return sysfs_emit(buf, "V%d.%d\n",
-- f34->bootloader_id[1],
-- f34->bootloader_id[0]);
-- }
-+ f34 = dev_get_drvdata(&fn->dev);
-+ if (!f34)
-+ return -ENODEV;
-
-- return 0;
-+ if (f34->bl_version == 5)
-+ return sysfs_emit(buf, "%c%c\n",
-+ f34->bootloader_id[0],
-+ f34->bootloader_id[1]);
-+ else
-+ return sysfs_emit(buf, "V%d.%d\n",
-+ f34->bootloader_id[1],
-+ f34->bootloader_id[0]);
- }
-
- static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL);
-@@ -334,13 +326,16 @@ static ssize_t rmi_driver_configuration_
- struct rmi_function *fn = data->f34_container;
- struct f34_data *f34;
-
-- if (fn) {
-- f34 = dev_get_drvdata(&fn->dev);
-+ fn = data->f34_container;
-+ if (!fn)
-+ return -ENODEV;
-
-- return sysfs_emit(buf, "%s\n", f34->configuration_id);
-- }
-+ f34 = dev_get_drvdata(&fn->dev);
-+ if (!f34)
-+ return -ENODEV;
-
-- return 0;
-+
-+ return sysfs_emit(buf, "%s\n", f34->configuration_id);
- }
-
- static DEVICE_ATTR(configuration_id, 0444,
-@@ -356,10 +351,14 @@ static int rmi_firmware_update(struct rm
-
- if (!data->f34_container) {
- dev_warn(dev, "%s: No F34 present!\n", __func__);
-- return -EINVAL;
-+ return -ENODEV;
- }
-
- f34 = dev_get_drvdata(&data->f34_container->dev);
-+ if (!f34) {
-+ dev_warn(dev, "%s: No valid F34 present!\n", __func__);
-+ return -ENODEV;
-+ }
-
- if (f34->bl_version >= 7) {
- if (data->pdt_props & HAS_BSR) {
-@@ -485,10 +484,18 @@ static ssize_t rmi_driver_update_fw_stat
- char *buf)
- {
- struct rmi_driver_data *data = dev_get_drvdata(dev);
-- int update_status = 0;
-+ struct f34_data *f34;
-+ int update_status = -ENODEV;
-
-- if (data->f34_container)
-- update_status = rmi_f34_status(data->f34_container);
-+ /*
-+ * The status is the percentage complete, or once complete,
-+ * zero for success or a negative return code.
-+ */
-+ if (data->f34_container) {
-+ f34 = dev_get_drvdata(&data->f34_container->dev);
-+ if (f34)
-+ update_status = f34->update_status;
-+ }
-
- return sysfs_emit(buf, "%d\n", update_status);
- }
-@@ -508,33 +515,21 @@ static const struct attribute_group rmi_
- .attrs = rmi_firmware_attrs,
- };
-
--static int rmi_f34_probe(struct rmi_function *fn)
-+static int rmi_f34v5_probe(struct f34_data *f34)
- {
-- struct f34_data *f34;
-- unsigned char f34_queries[9];
-+ struct rmi_function *fn = f34->fn;
-+ u8 f34_queries[9];
- bool has_config_id;
-- u8 version = fn->fd.function_version;
-- int ret;
--
-- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
-- if (!f34)
-- return -ENOMEM;
--
-- f34->fn = fn;
-- dev_set_drvdata(&fn->dev, f34);
--
-- /* v5 code only supported version 0, try V7 probe */
-- if (version > 0)
-- return rmi_f34v7_probe(f34);
-+ int error;
-
- f34->bl_version = 5;
-
-- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-- f34_queries, sizeof(f34_queries));
-- if (ret) {
-+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-+ f34_queries, sizeof(f34_queries));
-+ if (error) {
- dev_err(&fn->dev, "%s: Failed to query properties\n",
- __func__);
-- return ret;
-+ return error;
- }
-
- snprintf(f34->bootloader_id, sizeof(f34->bootloader_id),
-@@ -560,11 +555,11 @@ static int rmi_f34_probe(struct rmi_func
- f34->v5.config_blocks);
-
- if (has_config_id) {
-- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
-- f34_queries, sizeof(f34_queries));
-- if (ret) {
-+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
-+ f34_queries, sizeof(f34_queries));
-+ if (error) {
- dev_err(&fn->dev, "Failed to read F34 config ID\n");
-- return ret;
-+ return error;
- }
-
- snprintf(f34->configuration_id, sizeof(f34->configuration_id),
-@@ -573,11 +568,33 @@ static int rmi_f34_probe(struct rmi_func
- f34_queries[2], f34_queries[3]);
-
- rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n",
-- f34->configuration_id);
-+ f34->configuration_id);
- }
-
- return 0;
- }
-+
-+static int rmi_f34_probe(struct rmi_function *fn)
-+{
-+ struct f34_data *f34;
-+ u8 version = fn->fd.function_version;
-+ int error;
-+
-+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
-+ if (!f34)
-+ return -ENOMEM;
-+
-+ f34->fn = fn;
-+
-+ /* v5 code only supported version 0 */
-+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34);
-+ if (error)
-+ return error;
-+
-+ dev_set_drvdata(&fn->dev, f34);
-+
-+ return 0;
-+}
-
- int rmi_f34_create_sysfs(struct rmi_device *rmi_dev)
- {
asoc-codecs-pcm3168a-allow-for-24-bit-in-provider-mo.patch
asoc-rt722-sdca-add-some-missing-readable-registers.patch
irqchip-riscv-aplic-add-support-for-hart-indexes.patch
-dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch
dm-vdo-indexer-prevent-unterminated-string-warning.patch
dm-vdo-use-a-short-static-string-for-thread-name-pre.patch
drm-ast-find-vbios-mode-from-regular-display-size.patch
smb-client-reset-all-search-buffer-pointers-when-releasing-buffer.patch
revert-drm-amd-keep-display-off-while-going-into-s4.patch
input-xpad-add-more-controllers.patch
-input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch
alloc_tag-allocate-percpu-counters-for-module-tags-dynamically.patch
highmem-add-folio_test_partial_kmap.patch
kasan-avoid-sleepable-page-allocation-from-atomic-context.patch
+++ /dev/null
-From ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 Mon Sep 17 00:00:00 2001
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Date: Mon, 5 May 2025 15:49:59 -0700
-Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-
-commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 upstream.
-
-Sysfs interface for updating firmware for RMI devices is available even
-when F34 probe fails. The code checks for presence of F34 "container"
-pointer and then tries to use the function data attached to the
-sub-device. F34 assigns the function data early, before it knows if
-probe will succeed, leaving behind a stale pointer.
-
-Fix this by expanding checks to not only test for presence of F34
-"container" but also check if there is driver data assigned to the
-sub-device, and call dev_set_drvdata() only after we are certain that
-probe is successful.
-
-This is not a complete fix, since F34 will be freed during firmware
-update, so there is still a race when fetching and accessing this
-pointer. This race will be addressed in follow-up changes.
-
-Reported-by: Hanno Böck <hanno@hboeck.de>
-Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash")
-Cc: stable@vger.kernel.org
-Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com
-Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/input/rmi4/rmi_f34.c | 133 ++++++++++++++++++++++++-------------------
- 1 file changed, 75 insertions(+), 58 deletions(-)
-
---- a/drivers/input/rmi4/rmi_f34.c
-+++ b/drivers/input/rmi4/rmi_f34.c
-@@ -4,6 +4,7 @@
- * Copyright (C) 2016 Zodiac Inflight Innovations
- */
-
-+#include "linux/device.h"
- #include <linux/kernel.h>
- #include <linux/rmi.h>
- #include <linux/firmware.h>
-@@ -298,39 +299,30 @@ out:
- return ret;
- }
-
--static int rmi_f34_status(struct rmi_function *fn)
--{
-- struct f34_data *f34 = dev_get_drvdata(&fn->dev);
--
-- /*
-- * The status is the percentage complete, or once complete,
-- * zero for success or a negative return code.
-- */
-- return f34->update_status;
--}
--
- static ssize_t rmi_driver_bootloader_id_show(struct device *dev,
- struct device_attribute *dattr,
- char *buf)
- {
- struct rmi_driver_data *data = dev_get_drvdata(dev);
-- struct rmi_function *fn = data->f34_container;
-+ struct rmi_function *fn;
- struct f34_data *f34;
-
-- if (fn) {
-- f34 = dev_get_drvdata(&fn->dev);
-+ fn = data->f34_container;
-+ if (!fn)
-+ return -ENODEV;
-
-- if (f34->bl_version == 5)
-- return sysfs_emit(buf, "%c%c\n",
-- f34->bootloader_id[0],
-- f34->bootloader_id[1]);
-- else
-- return sysfs_emit(buf, "V%d.%d\n",
-- f34->bootloader_id[1],
-- f34->bootloader_id[0]);
-- }
-+ f34 = dev_get_drvdata(&fn->dev);
-+ if (!f34)
-+ return -ENODEV;
-
-- return 0;
-+ if (f34->bl_version == 5)
-+ return sysfs_emit(buf, "%c%c\n",
-+ f34->bootloader_id[0],
-+ f34->bootloader_id[1]);
-+ else
-+ return sysfs_emit(buf, "V%d.%d\n",
-+ f34->bootloader_id[1],
-+ f34->bootloader_id[0]);
- }
-
- static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL);
-@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_
- struct rmi_function *fn = data->f34_container;
- struct f34_data *f34;
-
-- if (fn) {
-- f34 = dev_get_drvdata(&fn->dev);
-+ fn = data->f34_container;
-+ if (!fn)
-+ return -ENODEV;
-
-- return sysfs_emit(buf, "%s\n", f34->configuration_id);
-- }
-+ f34 = dev_get_drvdata(&fn->dev);
-+ if (!f34)
-+ return -ENODEV;
-
-- return 0;
-+
-+ return sysfs_emit(buf, "%s\n", f34->configuration_id);
- }
-
- static DEVICE_ATTR(configuration_id, 0444,
-@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rm
-
- if (!data->f34_container) {
- dev_warn(dev, "%s: No F34 present!\n", __func__);
-- return -EINVAL;
-+ return -ENODEV;
- }
-
- f34 = dev_get_drvdata(&data->f34_container->dev);
-+ if (!f34) {
-+ dev_warn(dev, "%s: No valid F34 present!\n", __func__);
-+ return -ENODEV;
-+ }
-
- if (f34->bl_version >= 7) {
- if (data->pdt_props & HAS_BSR) {
-@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_stat
- char *buf)
- {
- struct rmi_driver_data *data = dev_get_drvdata(dev);
-- int update_status = 0;
-+ struct f34_data *f34;
-+ int update_status = -ENODEV;
-
-- if (data->f34_container)
-- update_status = rmi_f34_status(data->f34_container);
-+ /*
-+ * The status is the percentage complete, or once complete,
-+ * zero for success or a negative return code.
-+ */
-+ if (data->f34_container) {
-+ f34 = dev_get_drvdata(&data->f34_container->dev);
-+ if (f34)
-+ update_status = f34->update_status;
-+ }
-
- return sysfs_emit(buf, "%d\n", update_status);
- }
-@@ -517,33 +524,21 @@ static const struct attribute_group rmi_
- .attrs = rmi_firmware_attrs,
- };
-
--static int rmi_f34_probe(struct rmi_function *fn)
-+static int rmi_f34v5_probe(struct f34_data *f34)
- {
-- struct f34_data *f34;
-- unsigned char f34_queries[9];
-+ struct rmi_function *fn = f34->fn;
-+ u8 f34_queries[9];
- bool has_config_id;
-- u8 version = fn->fd.function_version;
-- int ret;
--
-- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
-- if (!f34)
-- return -ENOMEM;
--
-- f34->fn = fn;
-- dev_set_drvdata(&fn->dev, f34);
--
-- /* v5 code only supported version 0, try V7 probe */
-- if (version > 0)
-- return rmi_f34v7_probe(f34);
-+ int error;
-
- f34->bl_version = 5;
-
-- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-- f34_queries, sizeof(f34_queries));
-- if (ret) {
-+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr,
-+ f34_queries, sizeof(f34_queries));
-+ if (error) {
- dev_err(&fn->dev, "%s: Failed to query properties\n",
- __func__);
-- return ret;
-+ return error;
- }
-
- snprintf(f34->bootloader_id, sizeof(f34->bootloader_id),
-@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_func
- f34->v5.config_blocks);
-
- if (has_config_id) {
-- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
-- f34_queries, sizeof(f34_queries));
-- if (ret) {
-+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr,
-+ f34_queries, sizeof(f34_queries));
-+ if (error) {
- dev_err(&fn->dev, "Failed to read F34 config ID\n");
-- return ret;
-+ return error;
- }
-
- snprintf(f34->configuration_id, sizeof(f34->configuration_id),
-@@ -582,11 +577,33 @@ static int rmi_f34_probe(struct rmi_func
- f34_queries[2], f34_queries[3]);
-
- rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n",
-- f34->configuration_id);
-+ f34->configuration_id);
- }
-
- return 0;
- }
-+
-+static int rmi_f34_probe(struct rmi_function *fn)
-+{
-+ struct f34_data *f34;
-+ u8 version = fn->fd.function_version;
-+ int error;
-+
-+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL);
-+ if (!f34)
-+ return -ENOMEM;
-+
-+ f34->fn = fn;
-+
-+ /* v5 code only supported version 0 */
-+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34);
-+ if (error)
-+ return error;
-+
-+ dev_set_drvdata(&fn->dev, f34);
-+
-+ return 0;
-+}
-
- int rmi_f34_create_sysfs(struct rmi_device *rmi_dev)
- {
smb-client-reset-all-search-buffer-pointers-when-releasing-buffer.patch
revert-drm-amd-keep-display-off-while-going-into-s4.patch
input-xpad-add-more-controllers.patch
-input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch
memcg-always-call-cond_resched-after-fn.patch
mm-page_alloc.c-avoid-infinite-retries-caused-by-cpuset-race.patch
revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
