5.10-stable patches

added patches:
	acpi-thermal-drop-an-always-true-check.patch
	ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch
	gcc-12-disable-wdangling-pointer-warning-for-now.patch

diff --git a/queue-5.10/acpi-thermal-drop-an-always-true-check.patch b/queue-5.10/acpi-thermal-drop-an-always-true-check.patch
new file mode 100644 (file)
index 0000000..3851b9d
--- /dev/null
+++ b/queue-5.10/acpi-thermal-drop-an-always-true-check.patch
@@ -0,0 +1,30 @@
+From e5b5d25444e9ee3ae439720e62769517d331fa39 Mon Sep 17 00:00:00 2001
+From: Adam Borowski <kilobyte@angband.pl>
+Date: Mon, 15 Nov 2021 18:32:08 +0100
+Subject: ACPI: thermal: drop an always true check
+
+From: Adam Borowski <kilobyte@angband.pl>
+
+commit e5b5d25444e9ee3ae439720e62769517d331fa39 upstream.
+
+Address of a field inside a struct can't possibly be null; gcc-12 warns
+about this.
+
+Signed-off-by: Adam Borowski <kilobyte@angband.pl>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/thermal.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/acpi/thermal.c
++++ b/drivers/acpi/thermal.c
+@@ -1120,8 +1120,6 @@ static int acpi_thermal_resume(struct de
+               return -EINVAL;
+ 
+       for (i = 0; i < ACPI_THERMAL_MAX_ACTIVE; i++) {
+-              if (!(&tz->trips.active[i]))
+-                      break;
+               if (!tz->trips.active[i].flags.valid)
+                       break;
+               tz->trips.active[i].flags.enabled = 1;

diff --git a/queue-5.10/ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch b/queue-5.10/ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch
new file mode 100644 (file)
index 0000000..d7eae3f
--- /dev/null
+++ b/queue-5.10/ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch
@@ -0,0 +1,98 @@
+From e3128a9d482cff9cc2a826adec5e1f7acb922b8f Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 8 Dec 2021 10:44:00 +0200
+Subject: ath6kl: Use struct_group() to avoid size-mismatched casting
+
+From: Kees Cook <keescook@chromium.org>
+
+commit e3128a9d482cff9cc2a826adec5e1f7acb922b8f upstream.
+
+In builds with -Warray-bounds, casts from smaller objects to larger
+objects will produce warnings. These can be overly conservative, but since
+-Warray-bounds has been finding legitimate bugs, it is desirable to turn
+it on globally. Instead of casting a u32 to a larger object, redefine
+the u32 portion of the header to a separate struct that can be used for
+both u32 operations and the distinct header fields. Silences this warning:
+
+drivers/net/wireless/ath/ath6kl/htc_mbox.c: In function 'htc_wait_for_ctrl_msg':
+drivers/net/wireless/ath/ath6kl/htc_mbox.c:2275:20: error: array subscript 'struct htc_frame_hdr[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'} [-Werror=array-bounds]
+ 2275 |         if (htc_hdr->eid != ENDPOINT_0)
+      |                    ^~
+drivers/net/wireless/ath/ath6kl/htc_mbox.c:2264:13: note: while referencing 'look_ahead'
+ 2264 |         u32 look_ahead;
+      |             ^~~~~~~~~~
+
+This change results in no executable instruction differences.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20211207063538.2767954-1-keescook@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath6kl/htc.h      |   15 +++++++++++----
+ drivers/net/wireless/ath/ath6kl/htc_mbox.c |   15 ++++++---------
+ 2 files changed, 17 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath6kl/htc.h
++++ b/drivers/net/wireless/ath/ath6kl/htc.h
+@@ -153,12 +153,19 @@
+  * implementations.
+  */
+ struct htc_frame_hdr {
+-      u8 eid;
+-      u8 flags;
++      struct_group_tagged(htc_frame_look_ahead, header,
++              union {
++                      struct {
++                              u8 eid;
++                              u8 flags;
+ 
+-      /* length of data (including trailer) that follows the header */
+-      __le16 payld_len;
++                              /* length of data (including trailer) that follows the header */
++                              __le16 payld_len;
+ 
++                      };
++                      u32 word;
++              };
++      );
+       /* end of 4-byte lookahead */
+ 
+       u8 ctrl[2];
+--- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c
++++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
+@@ -2260,19 +2260,16 @@ int ath6kl_htc_rxmsg_pending_handler(str
+ static struct htc_packet *htc_wait_for_ctrl_msg(struct htc_target *target)
+ {
+       struct htc_packet *packet = NULL;
+-      struct htc_frame_hdr *htc_hdr;
+-      u32 look_ahead;
++      struct htc_frame_look_ahead look_ahead;
+ 
+-      if (ath6kl_hif_poll_mboxmsg_rx(target->dev, &look_ahead,
++      if (ath6kl_hif_poll_mboxmsg_rx(target->dev, &look_ahead.word,
+                                      HTC_TARGET_RESPONSE_TIMEOUT))
+               return NULL;
+ 
+       ath6kl_dbg(ATH6KL_DBG_HTC,
+-                 "htc rx wait ctrl look_ahead 0x%X\n", look_ahead);
++                 "htc rx wait ctrl look_ahead 0x%X\n", look_ahead.word);
+ 
+-      htc_hdr = (struct htc_frame_hdr *)&look_ahead;
+-
+-      if (htc_hdr->eid != ENDPOINT_0)
++      if (look_ahead.eid != ENDPOINT_0)
+               return NULL;
+ 
+       packet = htc_get_control_buf(target, false);
+@@ -2281,8 +2278,8 @@ static struct htc_packet *htc_wait_for_c
+               return NULL;
+ 
+       packet->info.rx.rx_flags = 0;
+-      packet->info.rx.exp_hdr = look_ahead;
+-      packet->act_len = le16_to_cpu(htc_hdr->payld_len) + HTC_HDR_LENGTH;
++      packet->info.rx.exp_hdr = look_ahead.word;
++      packet->act_len = le16_to_cpu(look_ahead.payld_len) + HTC_HDR_LENGTH;
+ 
+       if (packet->act_len > packet->buf_len)
+               goto fail_ctrl_rx;

diff --git a/queue-5.10/gcc-12-disable-wdangling-pointer-warning-for-now.patch b/queue-5.10/gcc-12-disable-wdangling-pointer-warning-for-now.patch
new file mode 100644 (file)
index 0000000..2b56f61
--- /dev/null
+++ b/queue-5.10/gcc-12-disable-wdangling-pointer-warning-for-now.patch
@@ -0,0 +1,68 @@
+From f7d63b50898172b9eb061b9e2daad61b428792d0 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 9 Jun 2022 09:41:42 -0700
+Subject: gcc-12: disable '-Wdangling-pointer' warning for now
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit f7d63b50898172b9eb061b9e2daad61b428792d0 upstream.
+
+[ Upstream commit 49beadbd47c270a00754c107a837b4f29df4c822 ]
+
+While the concept of checking for dangling pointers to local variables
+at function exit is really interesting, the gcc-12 implementation is not
+compatible with reality, and results in false positives.
+
+For example, gcc sees us putting things on a local list head allocated
+on the stack, which involves exactly those kinds of pointers to the
+local stack entry:
+
+  In function ‘__list_add’,
+      inlined from ‘list_add_tail’ at include/linux/list.h:102:2,
+      inlined from ‘rebuild_snap_realms’ at fs/ceph/snap.c:434:2:
+  include/linux/list.h:74:19: warning: storing the address of local variable ‘realm_queue’ in ‘*&realm_27(D)->rebuild_item.prev’ [-Wdangling-pointer=]
+     74 |         new->prev = prev;
+        |         ~~~~~~~~~~^~~~~~
+
+But then gcc - understandably - doesn't really understand the big
+picture how the doubly linked list works, so doesn't see how we then end
+up emptying said list head in a loop and the pointer we added has been
+removed.
+
+Gcc also complains about us (intentionally) using this as a way to store
+a kind of fake stack trace, eg
+
+  drivers/acpi/acpica/utdebug.c:40:38: warning: storing the address of local variable ‘current_sp’ in ‘acpi_gbl_entry_stack_pointer’ [-Wdangling-pointer=]
+     40 |         acpi_gbl_entry_stack_pointer = &current_sp;
+        |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~
+
+which is entirely reasonable from a compiler standpoint, and we may want
+to change those kinds of patterns, but not not.
+
+So this is one of those "it would be lovely if the compiler were to
+complain about us leaving dangling pointers to the stack", but not this
+way.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Makefile |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/Makefile
++++ b/Makefile
+@@ -808,6 +808,10 @@ endif
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable)
+ 
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
++
++# These result in bogus false positives
++KBUILD_CFLAGS += $(call cc-disable-warning, dangling-pointer)
++
+ ifdef CONFIG_FRAME_POINTER
+ KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
+ else

diff --git a/queue-5.10/series b/queue-5.10/series
index d389e2c3c06e1e41316724eaa27be1a5ccad145c..cd3a271841d5933bfe5f6ecaaa573a7764f9f6df 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -88,3 +88,6 @@ misc-fastrpc-reject-new-invocations-during-device-removal.patch
 scsi-stex-fix-gcc-13-warnings.patch
 ata-libata-scsi-use-correct-device-no-in-ata_find_dev.patch
 x86-boot-wrap-literal-addresses-in-absolute_pointer.patch
+acpi-thermal-drop-an-always-true-check.patch
+ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch
+gcc-12-disable-wdangling-pointer-warning-for-now.patch