--- /dev/null
+From 40d8abf364bcab23bc715a9221a3c8623956257b Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 22 Mar 2022 17:02:05 +0100
+Subject: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 40d8abf364bcab23bc715a9221a3c8623956257b upstream.
+
+If the NumEntries field in the _CPC return package is less than 2, do
+not attempt to access the "Revision" element of that package, because
+it may not be present then.
+
+Fixes: 337aadff8e45 ("ACPI: Introduce CPU performance controls using CPPC")
+BugLink: https://lore.kernel.org/lkml/20220322143534.GC32582@xsang-OptiPlex-9020/
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/cppc_acpi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -676,6 +676,11 @@ int acpi_cppc_processor_probe(struct acp
+ cpc_obj = &out_obj->package.elements[0];
+ if (cpc_obj->type == ACPI_TYPE_INTEGER) {
+ num_ent = cpc_obj->integer.value;
++ if (num_ent <= 1) {
++ pr_debug("Unexpected _CPC NumEntries value (%d) for CPU:%d\n",
++ num_ent, pr->id);
++ goto out_free;
++ }
+ } else {
+ pr_debug("Unexpected entry type(%d) for NumEntries\n",
+ cpc_obj->type);
--- /dev/null
+From e2c0cb7c0cc72939b61a7efee376206725796625 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Tue, 22 Mar 2022 06:57:25 -0600
+Subject: io_uring: bump poll refs to full 31-bits
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit e2c0cb7c0cc72939b61a7efee376206725796625 upstream.
+
+The previous commit:
+
+1bc84c40088 ("io_uring: remove poll entry from list when canceling all")
+
+removed a potential overflow condition for the poll references. They
+are currently limited to 20-bits, even if we have 31-bits available. The
+upper bit is used to mark for cancelation.
+
+Bump the poll ref space to 31-bits, making that kind of situation much
+harder to trigger in general. We'll separately add overflow checking
+and handling.
+
+Fixes: aa43477b0402 ("io_uring: poll rework")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -5414,7 +5414,7 @@ struct io_poll_table {
+ };
+
+ #define IO_POLL_CANCEL_FLAG BIT(31)
+-#define IO_POLL_REF_MASK ((1u << 20)-1)
++#define IO_POLL_REF_MASK GENMASK(30, 0)
+
+ /*
+ * If refs part of ->poll_refs (see IO_POLL_REF_MASK) is 0, it's free. We can
--- /dev/null
+From c86d18f4aa93e0e66cda0e55827cd03eea6bc5f8 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Fri, 25 Mar 2022 16:36:31 +0000
+Subject: io_uring: fix memory leak of uid in files registration
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit c86d18f4aa93e0e66cda0e55827cd03eea6bc5f8 upstream.
+
+When there are no files for __io_sqe_files_scm() to process in the
+range, it'll free everything and return. However, it forgets to put uid.
+
+Fixes: 08a451739a9b5 ("io_uring: allow sparse fixed file sets")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/accee442376f33ce8aaebb099d04967533efde92.1648226048.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8241,6 +8241,7 @@ static int __io_sqe_files_scm(struct io_
+ fput(fpl->fp[i]);
+ } else {
+ kfree_skb(skb);
++ free_uid(fpl->user);
+ kfree(fpl);
+ }
+
--- /dev/null
+From 61bc84c4008812d784c398cfb54118c1ba396dfc Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Mon, 21 Mar 2022 19:03:24 -0600
+Subject: io_uring: remove poll entry from list when canceling all
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit 61bc84c4008812d784c398cfb54118c1ba396dfc upstream.
+
+When the ring is exiting, as part of the shutdown, poll requests are
+removed. But io_poll_remove_all() does not remove entries when finding
+them, and since completions are done out-of-band, we can find and remove
+the same entry multiple times.
+
+We do guard the poll execution by poll ownership, but that does not
+exclude us from reissuing a new one once the previous removal ownership
+goes away.
+
+This can race with poll execution as well, where we then end up seeing
+req->apoll be NULL because a previous task_work requeue finished the
+request.
+
+Remove the poll entry when we find it and get ownership of it. This
+prevents multiple invocations from finding it.
+
+Fixes: aa43477b0402 ("io_uring: poll rework")
+Reported-by: Dylan Yudaken <dylany@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/io_uring.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -5870,6 +5870,7 @@ static __cold bool io_poll_remove_all(st
+ list = &ctx->cancel_hash[i];
+ hlist_for_each_entry_safe(req, tmp, list, hash_node) {
+ if (io_match_task_safe(req, tsk, cancel_all)) {
++ hlist_del_init(&req->hash_node);
+ io_poll_cancel_req(req);
+ found = true;
+ }
--- /dev/null
+From ffebd90532728086007038986900426544e3df4e Mon Sep 17 00:00:00 2001
+From: Prashant Malani <pmalani@chromium.org>
+Date: Wed, 26 Jan 2022 19:02:20 +0000
+Subject: platform/chrome: cros_ec_typec: Check for EC device
+
+From: Prashant Malani <pmalani@chromium.org>
+
+commit ffebd90532728086007038986900426544e3df4e upstream.
+
+The Type C ACPI device on older Chromebooks is not generated correctly
+(since their EC firmware doesn't support the new commands required). In
+such cases, the crafted ACPI device doesn't have an EC parent, and it is
+therefore not useful (it shouldn't be generated in the first place since
+the EC firmware doesn't support any of the Type C commands).
+
+To handle devices which use these older firmware revisions, check for
+the parent EC device handle, and fail the probe if it's not found.
+
+Fixes: fdc6b21e2444 ("platform/chrome: Add Type C connector class driver")
+Reported-by: Alyssa Ross <hi@alyssa.is>
+Reviewed-by: Tzung-Bi Shih <tzungbi@google.com>
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Alyssa Ross <hi@alyssa.is>
+Tested-by: Alyssa Ross <hi@alyssa.is>
+Link: https://lore.kernel.org/r/20220126190219.3095419-1-pmalani@chromium.org
+Signed-off-by: Benson Leung <bleung@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/chrome/cros_ec_typec.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/platform/chrome/cros_ec_typec.c
++++ b/drivers/platform/chrome/cros_ec_typec.c
+@@ -1075,7 +1075,13 @@ static int cros_typec_probe(struct platf
+ return -ENOMEM;
+
+ typec->dev = dev;
++
+ typec->ec = dev_get_drvdata(pdev->dev.parent);
++ if (!typec->ec) {
++ dev_err(dev, "couldn't find parent EC device\n");
++ return -ENODEV;
++ }
++
+ platform_set_drvdata(pdev, typec);
+
+ ret = cros_typec_get_cmd_version(typec);
--- /dev/null
+From d717e4509af0380a94dbc28b61839df39f17e1eb Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 5 Feb 2022 12:28:40 +0100
+Subject: platform/x86: asus-wmi: Fix regression when probing for fan curve control
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit d717e4509af0380a94dbc28b61839df39f17e1eb upstream.
+
+The fan curve control patches introduced a regression for at least the
+TUF FX506 and possibly other TUF series laptops that do not have support
+for fan curve control.
+
+As part of the probing process, asus_wmi_evaluate_method_buf is called
+to get the factory default fan curve . The WMI management function
+returns 0 on certain laptops to indicate lack of fan curve control
+instead of ASUS_WMI_UNSUPPORTED_METHOD. This 0 is transformed to
+-ENODATA which results in failure when probing.
+
+Fixes: 0f0ac158d28f ("platform/x86: asus-wmi: Add support for custom fan curves")
+Reported-and-tested-by: Abhijeet V <abhijeetviswa@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20220205112840.33095-1-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/asus-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -2059,7 +2059,7 @@ static int fan_boost_mode_check_present(
+ err = asus_wmi_get_devstate(asus, ASUS_WMI_DEVID_FAN_BOOST_MODE,
+ &result);
+ if (err) {
+- if (err == -ENODEV)
++ if (err == -ENODEV || err == -ENODATA)
+ return 0;
+ else
+ return err;
--- /dev/null
+From 60210a3d86dc57ce4a76a366e7841dda746a33f7 Mon Sep 17 00:00:00 2001
+From: Fangrui Song <maskray@google.com>
+Date: Mon, 21 Mar 2022 18:26:17 -0700
+Subject: riscv module: remove (NOLOAD)
+
+From: Fangrui Song <maskray@google.com>
+
+commit 60210a3d86dc57ce4a76a366e7841dda746a33f7 upstream.
+
+On ELF, (NOLOAD) sets the section type to SHT_NOBITS[1]. It is conceptually
+inappropriate for .plt, .got, and .got.plt sections which are always
+SHT_PROGBITS.
+
+In GNU ld, if PLT entries are needed, .plt will be SHT_PROGBITS anyway
+and (NOLOAD) will be essentially ignored. In ld.lld, since
+https://reviews.llvm.org/D118840 ("[ELF] Support (TYPE=<value>) to
+customize the output section type"), ld.lld will report a `section type
+mismatch` error (later changed to a warning). Just remove (NOLOAD) to
+fix the warning.
+
+[1] https://lld.llvm.org/ELF/linker_script.html As of today, "The
+section should be marked as not loadable" on
+https://sourceware.org/binutils/docs/ld/Output-Section-Type.html is
+outdated for ELF.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/1597
+Fixes: ab1ef68e5401 ("RISC-V: Add sections of PLT and GOT for kernel module")
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Fangrui Song <maskray@google.com>
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/include/asm/module.lds.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/riscv/include/asm/module.lds.h
++++ b/arch/riscv/include/asm/module.lds.h
+@@ -2,8 +2,8 @@
+ /* Copyright (C) 2017 Andes Technology Corporation */
+ #ifdef CONFIG_MODULE_SECTIONS
+ SECTIONS {
+- .plt (NOLOAD) : { BYTE(0) }
+- .got (NOLOAD) : { BYTE(0) }
+- .got.plt (NOLOAD) : { BYTE(0) }
++ .plt : { BYTE(0) }
++ .got : { BYTE(0) }
++ .got.plt : { BYTE(0) }
+ }
+ #endif
revert-virtio-pci-harden-intx-interrupts.patch
revert-virtio_pci-harden-msi-x-interrupts.patch
virtio-use-virtio_device_ready-in-virtio_device_restore.patch
+io_uring-remove-poll-entry-from-list-when-canceling-all.patch
+io_uring-bump-poll-refs-to-full-31-bits.patch
+io_uring-fix-memory-leak-of-uid-in-files-registration.patch
+riscv-module-remove-noload.patch
+acpi-cppc-avoid-out-of-bounds-access-when-parsing-_cpc-data.patch
+vhost-handle-error-while-adding-split-ranges-to-iotlb.patch
+spi-fix-tegra-qspi-example.patch
+platform-chrome-cros_ec_typec-check-for-ec-device.patch
+platform-x86-asus-wmi-fix-regression-when-probing-for-fan-curve-control.patch
--- /dev/null
+From 320689a1b543ca1396b3ed43bb18045e4a7ffd79 Mon Sep 17 00:00:00 2001
+From: Jon Hunter <jonathanh@nvidia.com>
+Date: Mon, 7 Mar 2022 11:35:29 +0000
+Subject: spi: Fix Tegra QSPI example
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+commit 320689a1b543ca1396b3ed43bb18045e4a7ffd79 upstream.
+
+When running dt_binding_check on the nvidia,tegra210-quad.yaml binding
+document the following error is reported ...
+
+ nvidia,tegra210-quad.example.dt.yaml:0:0: /example-0/spi@70410000/flash@0:
+ failed to match any schema with compatible: ['spi-nor']
+
+Update the example in the binding document to fix the above error.
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Fixes: 9684752e5fe3 ("dt-bindings: spi: Add Tegra Quad SPI device tree binding")
+Link: https://lore.kernel.org/r/20220307113529.315685-1-jonathanh@nvidia.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/spi/nvidia,tegra210-quad.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/spi/nvidia,tegra210-quad.yaml
++++ b/Documentation/devicetree/bindings/spi/nvidia,tegra210-quad.yaml
+@@ -106,7 +106,7 @@ examples:
+ dma-names = "rx", "tx";
+
+ flash@0 {
+- compatible = "spi-nor";
++ compatible = "jedec,spi-nor";
+ reg = <0>;
+ spi-max-frequency = <104000000>;
+ spi-tx-bus-width = <2>;
--- /dev/null
+From 03a91c9af2c42ae14afafb829a4b7e6589ab5892 Mon Sep 17 00:00:00 2001
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+Date: Sat, 12 Mar 2022 19:41:21 +0530
+Subject: vhost: handle error while adding split ranges to iotlb
+
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+
+commit 03a91c9af2c42ae14afafb829a4b7e6589ab5892 upstream.
+
+vhost_iotlb_add_range_ctx() handles the range [0, ULONG_MAX] by
+splitting it into two ranges and adding them separately. The return
+value of adding the first range to the iotlb is currently ignored.
+Check the return value and bail out in case of an error.
+
+Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
+Link: https://lore.kernel.org/r/20220312141121.4981-1-mail@anirudhrb.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Fixes: e2ae38cf3d91 ("vhost: fix hung thread due to erroneous iotlb entries")
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vhost/iotlb.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/vhost/iotlb.c
++++ b/drivers/vhost/iotlb.c
+@@ -62,8 +62,12 @@ int vhost_iotlb_add_range_ctx(struct vho
+ */
+ if (start == 0 && last == ULONG_MAX) {
+ u64 mid = last / 2;
++ int err = vhost_iotlb_add_range_ctx(iotlb, start, mid, addr,
++ perm, opaque);
++
++ if (err)
++ return err;
+
+- vhost_iotlb_add_range_ctx(iotlb, start, mid, addr, perm, opaque);
+ addr += mid + 1;
+ start = mid + 1;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
