--- /dev/null
+From 15342f930ebebcfe36f2415049736a77d7d2e045 Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Mon, 13 Dec 2021 07:21:15 +0000
+Subject: malidp: Fix NULL vs IS_ERR() checking
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 15342f930ebebcfe36f2415049736a77d7d2e045 upstream.
+
+The get_sg_table() function does not return NULL.
+It returns error pointers.
+
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Link: https://lore.kernel.org/dri-devel/20211213072115.18098-1-linmq006@gmail.com/
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/arm/malidp_planes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/arm/malidp_planes.c
++++ b/drivers/gpu/drm/arm/malidp_planes.c
+@@ -348,7 +348,7 @@ static bool malidp_check_pages_threshold
+ else
+ sgt = obj->funcs->get_sg_table(obj);
+
+- if (!sgt)
++ if (IS_ERR(sgt))
+ return false;
+
+ sgl = sgt->sgl;
--- /dev/null
+From 619d9b710cf06f7a00a17120ca92333684ac45a8 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Thu, 5 Jan 2023 15:31:29 +0100
+Subject: media: uvcvideo: Fix race condition with usb_kill_urb
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 619d9b710cf06f7a00a17120ca92333684ac45a8 upstream.
+
+usb_kill_urb warranties that all the handlers are finished when it
+returns, but does not protect against threads that might be handling
+asynchronously the urb.
+
+For UVC, the function uvc_ctrl_status_event_async() takes care of
+control changes asynchronously.
+
+If the code is executed in the following order:
+
+CPU 0 CPU 1
+===== =====
+uvc_status_complete()
+ uvc_status_stop()
+uvc_ctrl_status_event_work()
+ uvc_status_start() -> FAIL
+
+Then uvc_status_start will keep failing and this error will be shown:
+
+<4>[ 5.540139] URB 0000000000000000 submitted while active
+drivers/usb/core/urb.c:378 usb_submit_urb+0x4c3/0x528
+
+Let's improve the current situation, by not re-submiting the urb if
+we are stopping the status event. Also process the queued work
+(if any) during stop.
+
+CPU 0 CPU 1
+===== =====
+uvc_status_complete()
+ uvc_status_stop()
+ uvc_status_start()
+uvc_ctrl_status_event_work() -> FAIL
+
+Hopefully, with the usb layer protection this should be enough to cover
+all the cases.
+
+Cc: stable@vger.kernel.org
+Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives")
+Reviewed-by: Yunke Cao <yunkec@chromium.org>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 5 +++++
+ drivers/media/usb/uvc/uvc_status.c | 37 +++++++++++++++++++++++++++++++++++++
+ drivers/media/usb/uvc/uvcvideo.h | 1 +
+ 3 files changed, 43 insertions(+)
+
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -6,6 +6,7 @@
+ * Laurent Pinchart (laurent.pinchart@ideasonboard.com)
+ */
+
++#include <asm/barrier.h>
+ #include <linux/kernel.h>
+ #include <linux/list.h>
+ #include <linux/module.h>
+@@ -1318,6 +1319,10 @@ static void uvc_ctrl_status_event_work(s
+
+ uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
+
++ /* The barrier is needed to synchronize with uvc_status_stop(). */
++ if (smp_load_acquire(&dev->flush_status))
++ return;
++
+ /* Resubmit the URB. */
+ w->urb->interval = dev->int_ep->desc.bInterval;
+ ret = usb_submit_urb(w->urb, GFP_KERNEL);
+--- a/drivers/media/usb/uvc/uvc_status.c
++++ b/drivers/media/usb/uvc/uvc_status.c
+@@ -6,6 +6,7 @@
+ * Laurent Pinchart (laurent.pinchart@ideasonboard.com)
+ */
+
++#include <asm/barrier.h>
+ #include <linux/kernel.h>
+ #include <linux/input.h>
+ #include <linux/slab.h>
+@@ -310,5 +311,41 @@ int uvc_status_start(struct uvc_device *
+
+ void uvc_status_stop(struct uvc_device *dev)
+ {
++ struct uvc_ctrl_work *w = &dev->async_ctrl;
++
++ /*
++ * Prevent the asynchronous control handler from requeing the URB. The
++ * barrier is needed so the flush_status change is visible to other
++ * CPUs running the asynchronous handler before usb_kill_urb() is
++ * called below.
++ */
++ smp_store_release(&dev->flush_status, true);
++
++ /*
++ * Cancel any pending asynchronous work. If any status event was queued,
++ * process it synchronously.
++ */
++ if (cancel_work_sync(&w->work))
++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
++
++ /* Kill the urb. */
+ usb_kill_urb(dev->int_urb);
++
++ /*
++ * The URB completion handler may have queued asynchronous work. This
++ * won't resubmit the URB as flush_status is set, but it needs to be
++ * cancelled before returning or it could then race with a future
++ * uvc_status_start() call.
++ */
++ if (cancel_work_sync(&w->work))
++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
++
++ /*
++ * From this point, there are no events on the queue and the status URB
++ * is dead. No events will be queued until uvc_status_start() is called.
++ * The barrier is needed to make sure that flush_status is visible to
++ * uvc_ctrl_status_event_work() when uvc_status_start() will be called
++ * again.
++ */
++ smp_store_release(&dev->flush_status, false);
+ }
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -670,6 +670,7 @@ struct uvc_device {
+ /* Status Interrupt Endpoint */
+ struct usb_host_endpoint *int_ep;
+ struct urb *int_urb;
++ bool flush_status;
+ u8 *status;
+ struct input_dev *input;
+ char input_phys[64];
--- /dev/null
+From d9c8763e61295be0a21dc04ad9c379d5d17c3d86 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Wed, 23 Dec 2020 14:35:20 +0100
+Subject: media: uvcvideo: Provide sync and async uvc_ctrl_status_event
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit d9c8763e61295be0a21dc04ad9c379d5d17c3d86 upstream.
+
+Split the functionality of void uvc_ctrl_status_event_work in two, so it
+can be called by functions outside interrupt context and not part of an
+URB.
+
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_ctrl.c | 25 +++++++++++++++----------
+ drivers/media/usb/uvc/uvc_status.c | 3 ++-
+ drivers/media/usb/uvc/uvcvideo.h | 4 +++-
+ 3 files changed, 20 insertions(+), 12 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_ctrl.c
++++ b/drivers/media/usb/uvc/uvc_ctrl.c
+@@ -1275,17 +1275,12 @@ static void uvc_ctrl_send_slave_event(st
+ uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes);
+ }
+
+-static void uvc_ctrl_status_event_work(struct work_struct *work)
++void uvc_ctrl_status_event(struct uvc_video_chain *chain,
++ struct uvc_control *ctrl, const u8 *data)
+ {
+- struct uvc_device *dev = container_of(work, struct uvc_device,
+- async_ctrl.work);
+- struct uvc_ctrl_work *w = &dev->async_ctrl;
+- struct uvc_video_chain *chain = w->chain;
+ struct uvc_control_mapping *mapping;
+- struct uvc_control *ctrl = w->ctrl;
+ struct uvc_fh *handle;
+ unsigned int i;
+- int ret;
+
+ mutex_lock(&chain->ctrl_mutex);
+
+@@ -1293,7 +1288,7 @@ static void uvc_ctrl_status_event_work(s
+ ctrl->handle = NULL;
+
+ list_for_each_entry(mapping, &ctrl->info.mappings, list) {
+- s32 value = __uvc_ctrl_get_value(mapping, w->data);
++ s32 value = __uvc_ctrl_get_value(mapping, data);
+
+ /*
+ * handle may be NULL here if the device sends auto-update
+@@ -1312,6 +1307,16 @@ static void uvc_ctrl_status_event_work(s
+ }
+
+ mutex_unlock(&chain->ctrl_mutex);
++}
++
++static void uvc_ctrl_status_event_work(struct work_struct *work)
++{
++ struct uvc_device *dev = container_of(work, struct uvc_device,
++ async_ctrl.work);
++ struct uvc_ctrl_work *w = &dev->async_ctrl;
++ int ret;
++
++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data);
+
+ /* Resubmit the URB. */
+ w->urb->interval = dev->int_ep->desc.bInterval;
+@@ -1321,8 +1326,8 @@ static void uvc_ctrl_status_event_work(s
+ ret);
+ }
+
+-bool uvc_ctrl_status_event(struct urb *urb, struct uvc_video_chain *chain,
+- struct uvc_control *ctrl, const u8 *data)
++bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain,
++ struct uvc_control *ctrl, const u8 *data)
+ {
+ struct uvc_device *dev = chain->dev;
+ struct uvc_ctrl_work *w = &dev->async_ctrl;
+--- a/drivers/media/usb/uvc/uvc_status.c
++++ b/drivers/media/usb/uvc/uvc_status.c
+@@ -179,7 +179,8 @@ static bool uvc_event_control(struct urb
+
+ switch (status->bAttribute) {
+ case UVC_CTRL_VALUE_CHANGE:
+- return uvc_ctrl_status_event(urb, chain, ctrl, status->bValue);
++ return uvc_ctrl_status_event_async(urb, chain, ctrl,
++ status->bValue);
+
+ case UVC_CTRL_INFO_CHANGE:
+ case UVC_CTRL_FAILURE_CHANGE:
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -839,7 +839,9 @@ int uvc_ctrl_add_mapping(struct uvc_vide
+ int uvc_ctrl_init_device(struct uvc_device *dev);
+ void uvc_ctrl_cleanup_device(struct uvc_device *dev);
+ int uvc_ctrl_restore_values(struct uvc_device *dev);
+-bool uvc_ctrl_status_event(struct urb *urb, struct uvc_video_chain *chain,
++bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain,
++ struct uvc_control *ctrl, const u8 *data);
++void uvc_ctrl_status_event(struct uvc_video_chain *chain,
+ struct uvc_control *ctrl, const u8 *data);
+
+ int uvc_ctrl_begin(struct uvc_video_chain *chain);
--- /dev/null
+From 6ac451d8d12b4309b523b600449bb2f4494ac5bb Mon Sep 17 00:00:00 2001
+From: Salvatore Bonaccorso <carnil@debian.org>
+Date: Wed, 8 Mar 2023 17:14:56 +0100
+Subject: Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()"
+
+From: Salvatore Bonaccorso <carnil@debian.org>
+
+This reverts commit e0e0747de0ea3dd87cdbb0393311e17471a9baf1.
+
+As noted in 1a2dcbdde82e ("scsi: mpt3sas: re-do lost mpt3sas DMA mask
+fix") in mainline there was a mis-merge in commit 62e6e5940c0c ("Merge
+tag 'scsi-misc' of
+git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi"). causing that
+the fix needed to be redone later on again. To make series of patches
+apply cleanly to the stable series where e0e0747de0ea ("scsi: mpt3sas:
+Fix return value check of dma_get_required_mask()") was backported,
+revert the aforementioned commit.
+
+No upstream commit exists for this commit.
+
+Link: https://lore.kernel.org/regressions/yq1sfehmjnb.fsf@ca-mkp.ca.oracle.com/
+Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -2825,7 +2825,7 @@ _base_config_dma_addressing(struct MPT3S
+
+ if (ioc->is_mcpu_endpoint ||
+ sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma ||
+- dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32))
++ dma_get_required_mask(&pdev->dev) <= 32)
+ ioc->dma_mask = 32;
+ /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */
+ else if (ioc->hba_mpi_version_belonged > MPI2_VERSION)
--- /dev/null
+From 7e4f02c0747d8713735098ddb9744bd30f0903af Mon Sep 17 00:00:00 2001
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Date: Thu, 25 Aug 2022 13:24:54 +0530
+Subject: scsi: mpt3sas: Don't change DMA mask while reallocating pools
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream.
+
+When a pool crosses the 4GB boundary region then before reallocating pools
+change the coherent DMA mask to 32 bits and keep the normal DMA mask set to
+63/64 bits.
+
+Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.com
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -2822,19 +2822,26 @@ static int
+ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev)
+ {
+ struct sysinfo s;
++ u64 coherent_dma_mask, dma_mask;
+
+- if (ioc->is_mcpu_endpoint ||
+- sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma ||
+- dma_get_required_mask(&pdev->dev) <= 32)
++ if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 ||
++ dma_get_required_mask(&pdev->dev) <= 32) {
+ ioc->dma_mask = 32;
++ coherent_dma_mask = dma_mask = DMA_BIT_MASK(32);
+ /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */
+- else if (ioc->hba_mpi_version_belonged > MPI2_VERSION)
++ } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) {
+ ioc->dma_mask = 63;
+- else
++ coherent_dma_mask = dma_mask = DMA_BIT_MASK(63);
++ } else {
+ ioc->dma_mask = 64;
++ coherent_dma_mask = dma_mask = DMA_BIT_MASK(64);
++ }
+
+- if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) ||
+- dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)))
++ if (ioc->use_32bit_dma)
++ coherent_dma_mask = DMA_BIT_MASK(32);
++
++ if (dma_set_mask(&pdev->dev, dma_mask) ||
++ dma_set_coherent_mask(&pdev->dev, coherent_dma_mask))
+ return -ENODEV;
+
+ if (ioc->dma_mask > 32) {
--- /dev/null
+From 2de98253a5e5f612b4dd3991eaf12da2f87fd835 Mon Sep 17 00:00:00 2001
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Date: Tue, 13 Sep 2022 17:35:38 +0530
+Subject: scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+commit 1a2dcbdde82e3a5f1db9b2f4c48aa1aeba534fb2 upstream.
+
+This is a re-do of commit e0e0747de0ea ("scsi: mpt3sas: Fix return value
+check of dma_get_required_mask()"), which I ended up undoing in a
+mis-merge in commit 62e6e5940c0c ("Merge tag 'scsi-misc' of
+git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi").
+
+The original commit message was
+
+ scsi: mpt3sas: Fix return value check of dma_get_required_mask()
+
+ Fix the incorrect return value check of dma_get_required_mask(). Due to
+ this incorrect check, the driver was always setting the DMA mask to 63 bit.
+
+ Link: https://lore.kernel.org/r/20220913120538.18759-2-sreekanth.reddy@broadcom.com
+ Fixes: ba27c5cf286d ("scsi: mpt3sas: Don't change the DMA coherent mask after allocations")
+ Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+ Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+
+and this fix was lost when I mis-merged the conflict with commit
+9df650963bf6 ("scsi: mpt3sas: Don't change DMA mask while reallocating
+pools").
+
+Reported-by: Juergen Gross <jgross@suse.com>
+Fixes: 62e6e5940c0c ("Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi")
+Link: https://lore.kernel.org/all/CAHk-=wjaK-TxrNaGtFDpL9qNHL1MVkWXO1TT6vObD5tXMSC4Zg@mail.gmail.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -2825,7 +2825,7 @@ _base_config_dma_addressing(struct MPT3S
+ u64 coherent_dma_mask, dma_mask;
+
+ if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 ||
+- dma_get_required_mask(&pdev->dev) <= 32) {
++ dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) {
+ ioc->dma_mask = 32;
+ coherent_dma_mask = dma_mask = DMA_BIT_MASK(32);
+ /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */
--- /dev/null
+From 7f67a3498048f7e5be3dc5e8b32eebda115d409f Mon Sep 17 00:00:00 2001
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Date: Fri, 28 Oct 2022 14:46:55 +0530
+Subject: scsi: mpt3sas: Remove usage of dma_get_required_mask() API
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream.
+
+Remove the usage of dma_get_required_mask() API. Directly set the DMA mask
+to 63/64 if the system is a 64bit machine.
+
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.com
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3S
+ struct sysinfo s;
+ u64 coherent_dma_mask, dma_mask;
+
+- if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 ||
+- dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) {
++ if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) {
+ ioc->dma_mask = 32;
+ coherent_dma_mask = dma_mask = DMA_BIT_MASK(32);
+ /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */
bluetooth-hci_sock-purge-socket-queues-in-the-destruct-callback.patch
tcp-fix-listen-regression-in-5.15.88.patch
drm-virtio-fix-error-code-in-virtio_gpu_object_shmem_init.patch
+media-uvcvideo-provide-sync-and-async-uvc_ctrl_status_event.patch
+media-uvcvideo-fix-race-condition-with-usb_kill_urb.patch
+revert-scsi-mpt3sas-fix-return-value-check-of-dma_get_required_mask.patch
+scsi-mpt3sas-don-t-change-dma-mask-while-reallocating-pools.patch
+scsi-mpt3sas-re-do-lost-mpt3sas-dma-mask-fix.patch
+scsi-mpt3sas-remove-usage-of-dma_get_required_mask-api.patch
+malidp-fix-null-vs-is_err-checking.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
