--- /dev/null
+From ca66a5a90398f04697057c171cc978c1e6db5cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2024 10:56:05 +0800
+Subject: HID: multitouch: Add support for lenovo Y9000P Touchpad
+
+From: He Lugang <helugang@uniontech.com>
+
+[ Upstream commit 251efae73bd46b097deec4f9986d926813aed744 ]
+
+The 2024 Lenovo Y9000P which use GT7868Q chip also needs a fixup.
+The information of the chip is as follows:
+I2C HID v1.00 Mouse [GXTP5100:00 27C6:01E0]
+
+Signed-off-by: He Lugang <helugang@uniontech.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 8 ++++++--
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ede3a052ead55..5f98c33ed67ba 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -506,6 +506,7 @@
+ #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
+
+ #define I2C_VENDOR_ID_GOODIX 0x27c6
++#define I2C_DEVICE_ID_GOODIX_01E0 0x01e0
+ #define I2C_DEVICE_ID_GOODIX_01E8 0x01e8
+ #define I2C_DEVICE_ID_GOODIX_01E9 0x01e9
+ #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 6d76463f5896f..e7199ae2e3d91 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1447,7 +1447,8 @@ static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ {
+ if (hdev->vendor == I2C_VENDOR_ID_GOODIX &&
+ (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 ||
+- hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) {
++ hdev->product == I2C_DEVICE_ID_GOODIX_01E9 ||
++ hdev->product == I2C_DEVICE_ID_GOODIX_01E0)) {
+ if (rdesc[607] == 0x15) {
+ rdesc[607] = 0x25;
+ dev_info(
+@@ -2068,7 +2069,10 @@ static const struct hid_device_id mt_devices[] = {
+ I2C_DEVICE_ID_GOODIX_01E8) },
+ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
+ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX,
+- I2C_DEVICE_ID_GOODIX_01E8) },
++ I2C_DEVICE_ID_GOODIX_01E9) },
++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
++ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX,
++ I2C_DEVICE_ID_GOODIX_01E0) },
+
+ /* GoodTouch panels */
+ { .driver_data = MT_CLS_NSMU,
+--
+2.43.0
+
--- /dev/null
+From 808cc78ef04125c81fb498e513e683f68af369f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 03:08:08 +0200
+Subject: hwmon: (adm9240) Add missing dependency on REGMAP_I2C
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+[ Upstream commit 14849a2ec175bb8a2280ce20efe002bb19f1e274 ]
+
+This driver requires REGMAP_I2C to be selected in order to get access to
+regmap_config and devm_regmap_init_i2c. Add the missing dependency.
+
+Fixes: df885d912f67 ("hwmon: (adm9240) Convert to regmap")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Message-ID: <20241002-hwmon-select-regmap-v1-1-548d03268934@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index 6d4c4003c1e46..054ceca18e20c 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -166,6 +166,7 @@ config SENSORS_ADM9240
+ tristate "Analog Devices ADM9240 and compatibles"
+ depends on I2C
+ select HWMON_VID
++ select REGMAP_I2C
+ help
+ If you say yes here you get support for Analog Devices ADM9240,
+ Dallas DS1780, National Semiconductor LM81 sensor chips.
+--
+2.43.0
+
--- /dev/null
+From 4bbc47fc2d4717fba11c25de9dfcea6ada653e5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 03:08:09 +0200
+Subject: hwmon: (adt7470) Add missing dependency on REGMAP_I2C
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+[ Upstream commit b6abcc19566509ab4812bd5ae5df46515d0c1d70 ]
+
+This driver requires REGMAP_I2C to be selected in order to get access to
+regmap_config and devm_regmap_init_i2c. Add the missing dependency.
+
+Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Message-ID: <20241002-hwmon-select-regmap-v1-2-548d03268934@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index 054ceca18e20c..7884fcb95c3e5 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -228,6 +228,7 @@ config SENSORS_ADT7462
+ config SENSORS_ADT7470
+ tristate "Analog Devices ADT7470"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ If you say yes here you get support for the Analog Devices
+ ADT7470 temperature monitoring chips.
+--
+2.43.0
+
--- /dev/null
+From d4f6ea19c29c67db52fa4ba0cd5b5467472bcd40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 11:37:15 -0700
+Subject: hwmon: (tmp513) Add missing dependency on REGMAP_I2C
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 193bc02c664999581a1f38c152f379fce91afc0c ]
+
+0-day reports:
+
+drivers/hwmon/tmp513.c:162:21: error:
+ variable 'tmp51x_regmap_config' has initializer but incomplete type
+162 | static const struct regmap_config tmp51x_regmap_config = {
+ | ^
+
+struct regmap_config is only available if REGMAP is enabled.
+Add the missing Kconfig dependency to fix the problem.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202410020246.2cTDDx0X-lkp@intel.com/
+Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
+Cc: Eric Tremblay <etremblay@distech-controls.com>
+Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index a5143d01b95f8..6d4c4003c1e46 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -2101,6 +2101,7 @@ config SENSORS_TMP464
+ config SENSORS_TMP513
+ tristate "Texas Instruments TMP513 and compatibles"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ If you say yes here you get support for Texas Instruments TMP512,
+ and TMP513 temperature and power supply sensor chips.
+--
+2.43.0
+
--- /dev/null
+From 659a51c0ae7856d806f0d02df1615f9e7788e843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 15:01:07 +0800
+Subject: net/mlx5: Always drain health in shutdown callback
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 1b75da22ed1e6171e261bc9265370162553d5393 ]
+
+There is no point in recovery during device shutdown. if health
+work started need to wait for it to avoid races and NULL pointer
+access.
+
+Hence, drain health WQ on shutdown callback.
+
+Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver")
+Fixes: d2aa060d40fa ("net/mlx5: Cancel health poll before sending panic teardown command")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Link: https://patch.msgid.link/20240730061638.1831002-2-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+[Xiangyu: Modified to apply on 6.1.y to fix CVE-2024-43866]
+Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 76af59cfdd0e6..825ad7663fa45 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1950,7 +1950,6 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev)
+ /* Panic tear down fw command will stop the PCI bus communication
+ * with the HCA, so the health poll is no longer needed.
+ */
+- mlx5_drain_health_wq(dev);
+ mlx5_stop_health_poll(dev, false);
+
+ ret = mlx5_cmd_fast_teardown_hca(dev);
+@@ -1985,6 +1984,7 @@ static void shutdown(struct pci_dev *pdev)
+
+ mlx5_core_info(dev, "Shutdown was called\n");
+ set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state);
++ mlx5_drain_health_wq(dev);
+ err = mlx5_try_fast_unload(dev);
+ if (err)
+ mlx5_unload_one(dev, false);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
+index 2424cdf9cca99..d6850eb0ed7f4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
+@@ -75,6 +75,7 @@ static void mlx5_sf_dev_shutdown(struct auxiliary_device *adev)
+ {
+ struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev);
+
++ mlx5_drain_health_wq(sf_dev->mdev);
+ mlx5_unload_one(sf_dev->mdev, false);
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 65d15142e3974a28a8fab7d9ad1a7ae4d5a2b26d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Oct 2024 12:39:55 -0400
+Subject: Revert "net: ibm/emac: allocate dummy net_device dynamically"
+
+This reverts commit b40eeedbbc0833716b5ccae64cf914f2604a3e5e, which was
+upstream commit 2eb5e25d8495 ("net: ibm/emac: allocate dummy net_device
+dynamically").
+
+alloc_netdev_dummy(( does not exist in 6.1, so all this backport did was
+break the build.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/emac/mal.c | 14 +++-----------
+ drivers/net/ethernet/ibm/emac/mal.h | 2 +-
+ 2 files changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c
+index 1ebe44804f9d0..f30a2b8a7c173 100644
+--- a/drivers/net/ethernet/ibm/emac/mal.c
++++ b/drivers/net/ethernet/ibm/emac/mal.c
+@@ -603,13 +603,9 @@ static int mal_probe(struct platform_device *ofdev)
+ INIT_LIST_HEAD(&mal->list);
+ spin_lock_init(&mal->lock);
+
+- mal->dummy_dev = alloc_netdev_dummy(0);
+- if (!mal->dummy_dev) {
+- err = -ENOMEM;
+- goto fail_unmap;
+- }
++ init_dummy_netdev(&mal->dummy_dev);
+
+- netif_napi_add_weight(mal->dummy_dev, &mal->napi, mal_poll,
++ netif_napi_add_weight(&mal->dummy_dev, &mal->napi, mal_poll,
+ CONFIG_IBM_EMAC_POLL_WEIGHT);
+
+ /* Load power-on reset defaults */
+@@ -639,7 +635,7 @@ static int mal_probe(struct platform_device *ofdev)
+ GFP_KERNEL);
+ if (mal->bd_virt == NULL) {
+ err = -ENOMEM;
+- goto fail_dummy;
++ goto fail_unmap;
+ }
+
+ for (i = 0; i < mal->num_tx_chans; ++i)
+@@ -705,8 +701,6 @@ static int mal_probe(struct platform_device *ofdev)
+ free_irq(mal->serr_irq, mal);
+ fail2:
+ dma_free_coherent(&ofdev->dev, bd_size, mal->bd_virt, mal->bd_dma);
+- fail_dummy:
+- free_netdev(mal->dummy_dev);
+ fail_unmap:
+ dcr_unmap(mal->dcr_host, 0x100);
+ fail:
+@@ -738,8 +732,6 @@ static int mal_remove(struct platform_device *ofdev)
+
+ mal_reset(mal);
+
+- free_netdev(mal->dummy_dev);
+-
+ dcr_unmap(mal->dcr_host, 0x100);
+
+ dma_free_coherent(&ofdev->dev,
+diff --git a/drivers/net/ethernet/ibm/emac/mal.h b/drivers/net/ethernet/ibm/emac/mal.h
+index e0ddc41186a28..d212373a72e7c 100644
+--- a/drivers/net/ethernet/ibm/emac/mal.h
++++ b/drivers/net/ethernet/ibm/emac/mal.h
+@@ -205,7 +205,7 @@ struct mal_instance {
+ int index;
+ spinlock_t lock;
+
+- struct net_device *dummy_dev;
++ struct net_device dummy_dev;
+
+ unsigned int features;
+ };
+--
+2.43.0
+
ppp-fix-ppp_async_encode-illegal-access.patch
slip-make-slhc_remember-more-robust-against-maliciou.patch
rust-macros-provide-correct-provenance-when-construc.patch
+hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch
+net-mlx5-always-drain-health-in-shutdown-callback.patch
+wifi-mac80211-avoid-address-calculations-via-out-of-.patch
+hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch
+hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch
+hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch
+revert-net-ibm-emac-allocate-dummy-net_device-dynami.patch
--- /dev/null
+From f576013175680dfea282be15ec34c81e78d93e89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 14:50:09 +0800
+Subject: wifi: mac80211: Avoid address calculations via out of bounds array
+ indexing
+
+From: Kenton Groombridge <concord@gentoo.org>
+
+[ Upstream commit 2663d0462eb32ae7c9b035300ab6b1523886c718 ]
+
+req->n_channels must be set before req->channels[] can be used.
+
+This patch fixes one of the issues encountered in [1].
+
+[ 83.964255] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4
+[ 83.964258] index 0 is out of range for type 'struct ieee80211_channel *[]'
+[...]
+[ 83.964264] Call Trace:
+[ 83.964267] <TASK>
+[ 83.964269] dump_stack_lvl+0x3f/0xc0
+[ 83.964274] __ubsan_handle_out_of_bounds+0xec/0x110
+[ 83.964278] ieee80211_prep_hw_scan+0x2db/0x4b0
+[ 83.964281] __ieee80211_start_scan+0x601/0x990
+[ 83.964291] nl80211_trigger_scan+0x874/0x980
+[ 83.964295] genl_family_rcv_msg_doit+0xe8/0x160
+[ 83.964298] genl_rcv_msg+0x240/0x270
+[...]
+
+[1] https://bugzilla.kernel.org/show_bug.cgi?id=218810
+
+Co-authored-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Kenton Groombridge <concord@gentoo.org>
+Link: https://msgid.link/20240605152218.236061-1-concord@gentoo.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+[Xiangyu: Modified to apply on 6.1.y and 6.6.y]
+Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/scan.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
+index 0a6e40bd42f62..edbf468e0bea3 100644
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -357,7 +357,8 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata)
+ struct cfg80211_scan_request *req;
+ struct cfg80211_chan_def chandef;
+ u8 bands_used = 0;
+- int i, ielen, n_chans;
++ int i, ielen;
++ u32 *n_chans;
+ u32 flags = 0;
+
+ req = rcu_dereference_protected(local->scan_req,
+@@ -367,34 +368,34 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata)
+ return false;
+
+ if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) {
++ local->hw_scan_req->req.n_channels = req->n_channels;
++
+ for (i = 0; i < req->n_channels; i++) {
+ local->hw_scan_req->req.channels[i] = req->channels[i];
+ bands_used |= BIT(req->channels[i]->band);
+ }
+-
+- n_chans = req->n_channels;
+ } else {
+ do {
+ if (local->hw_scan_band == NUM_NL80211_BANDS)
+ return false;
+
+- n_chans = 0;
++ n_chans = &local->hw_scan_req->req.n_channels;
++ *n_chans = 0;
+
+ for (i = 0; i < req->n_channels; i++) {
+ if (req->channels[i]->band !=
+ local->hw_scan_band)
+ continue;
+- local->hw_scan_req->req.channels[n_chans] =
++ local->hw_scan_req->req.channels[(*n_chans)++] =
+ req->channels[i];
+- n_chans++;
++
+ bands_used |= BIT(req->channels[i]->band);
+ }
+
+ local->hw_scan_band++;
+- } while (!n_chans);
++ } while (!*n_chans);
+ }
+
+- local->hw_scan_req->req.n_channels = n_chans;
+ ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
+
+ if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
