hid-fix-i2c-read-buffer-overflow-in-raw_event-for-mcp2221.patch
serial-stm32-allow-selecting-console-when-the-driver-is-module.patch
staging-axis-fifo-fix-maximum-tx-packet-length-check.patch
-staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch
staging-axis-fifo-flush-rx-fifo-on-read-errors.patch
driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch
+++ /dev/null
-From 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 Mon Sep 17 00:00:00 2001
-From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-Date: Fri, 12 Sep 2025 13:13:21 +0300
-Subject: staging: axis-fifo: fix TX handling on copy_from_user() failure
-
-From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-
-commit 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 upstream.
-
-If copy_from_user() fails, write() currently returns -EFAULT, but any
-partially written data leaves the TX FIFO in an inconsistent state.
-Subsequent write() calls then fail with "transmit length mismatch"
-errors.
-
-Once partial data is written to the hardware FIFO, it cannot be removed
-without a TX reset. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove
-hardware resets for user errors") removed a full FIFO reset for this case,
-which fixed a potential RX data loss, but introduced this TX issue.
-
-Fix this by introducing a bounce buffer: copy the full packet from
-userspace first, and write to the hardware FIFO only if the copy
-was successful.
-
-Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors")
-Cc: stable@vger.kernel.org
-Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/staging/axis-fifo/axis-fifo.c | 36 +++++++++-------------------------
- 1 file changed, 10 insertions(+), 26 deletions(-)
-
---- a/drivers/staging/axis-fifo/axis-fifo.c
-+++ b/drivers/staging/axis-fifo/axis-fifo.c
-@@ -43,7 +43,6 @@
- #define DRIVER_NAME "axis_fifo"
-
- #define READ_BUF_SIZE 128U /* read buffer length in words */
--#define WRITE_BUF_SIZE 128U /* write buffer length in words */
-
- /* ----------------------------
- * IP register offsets
-@@ -474,11 +473,8 @@ static ssize_t axis_fifo_write(struct fi
- {
- struct axis_fifo *fifo = (struct axis_fifo *)f->private_data;
- unsigned int words_to_write;
-- unsigned int copied;
-- unsigned int copy;
-- unsigned int i;
-+ u32 *txbuf;
- int ret;
-- u32 tmp_buf[WRITE_BUF_SIZE];
-
- if (len % sizeof(u32)) {
- dev_err(fifo->dt_device,
-@@ -545,32 +541,20 @@ static ssize_t axis_fifo_write(struct fi
- }
- }
-
-- /* write data from an intermediate buffer into the fifo IP, refilling
-- * the buffer with userspace data as needed
-- */
-- copied = 0;
-- while (words_to_write > 0) {
-- copy = min(words_to_write, WRITE_BUF_SIZE);
--
-- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32),
-- copy * sizeof(u32))) {
-- ret = -EFAULT;
-- goto end_unlock;
-- }
--
-- for (i = 0; i < copy; i++)
-- iowrite32(tmp_buf[i], fifo->base_addr +
-- XLLF_TDFD_OFFSET);
--
-- copied += copy;
-- words_to_write -= copy;
-+ txbuf = vmemdup_user(buf, len);
-+ if (IS_ERR(txbuf)) {
-+ ret = PTR_ERR(txbuf);
-+ goto end_unlock;
- }
-
-- ret = copied * sizeof(u32);
-+ for (int i = 0; i < words_to_write; ++i)
-+ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET);
-
- /* write packet size to fifo */
-- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET);
-+ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET);
-
-+ ret = len;
-+ kvfree(txbuf);
- end_unlock:
- mutex_unlock(&fifo->write_lock);
-
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
-@@ -399,6 +399,7 @@ static ssize_t axis_fifo_read(struct fil
+@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil
}
bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET);
if (!bytes_available) {
dev_err(fifo->dt_device, "received a packet of length 0\n");
ret = -EIO;
-@@ -409,7 +410,7 @@ static ssize_t axis_fifo_read(struct fil
+@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fil
dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n",
bytes_available, len);
ret = -EINVAL;
}
if (bytes_available % sizeof(u32)) {
-@@ -418,11 +419,9 @@ static ssize_t axis_fifo_read(struct fil
+@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil
*/
dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n");
ret = -EIO;
/* read data into an intermediate buffer, copying the contents
* to userspace when the buffer is full
*/
-@@ -434,18 +433,23 @@ static ssize_t axis_fifo_read(struct fil
+@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil
tmp_buf[i] = ioread32(fifo->base_addr +
XLLF_RDFD_OFFSET);
}
hid-fix-i2c-read-buffer-overflow-in-raw_event-for-mcp2221.patch
serial-stm32-allow-selecting-console-when-the-driver-is-module.patch
staging-axis-fifo-fix-maximum-tx-packet-length-check.patch
-staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch
staging-axis-fifo-flush-rx-fifo-on-read-errors.patch
driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch
+++ /dev/null
-From 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 Mon Sep 17 00:00:00 2001
-From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-Date: Fri, 12 Sep 2025 13:13:21 +0300
-Subject: staging: axis-fifo: fix TX handling on copy_from_user() failure
-
-From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-
-commit 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 upstream.
-
-If copy_from_user() fails, write() currently returns -EFAULT, but any
-partially written data leaves the TX FIFO in an inconsistent state.
-Subsequent write() calls then fail with "transmit length mismatch"
-errors.
-
-Once partial data is written to the hardware FIFO, it cannot be removed
-without a TX reset. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove
-hardware resets for user errors") removed a full FIFO reset for this case,
-which fixed a potential RX data loss, but introduced this TX issue.
-
-Fix this by introducing a bounce buffer: copy the full packet from
-userspace first, and write to the hardware FIFO only if the copy
-was successful.
-
-Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors")
-Cc: stable@vger.kernel.org
-Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/staging/axis-fifo/axis-fifo.c | 36 +++++++++-------------------------
- 1 file changed, 10 insertions(+), 26 deletions(-)
-
---- a/drivers/staging/axis-fifo/axis-fifo.c
-+++ b/drivers/staging/axis-fifo/axis-fifo.c
-@@ -43,7 +43,6 @@
- #define DRIVER_NAME "axis_fifo"
-
- #define READ_BUF_SIZE 128U /* read buffer length in words */
--#define WRITE_BUF_SIZE 128U /* write buffer length in words */
-
- /* ----------------------------
- * IP register offsets
-@@ -474,11 +473,8 @@ static ssize_t axis_fifo_write(struct fi
- {
- struct axis_fifo *fifo = (struct axis_fifo *)f->private_data;
- unsigned int words_to_write;
-- unsigned int copied;
-- unsigned int copy;
-- unsigned int i;
-+ u32 *txbuf;
- int ret;
-- u32 tmp_buf[WRITE_BUF_SIZE];
-
- if (len % sizeof(u32)) {
- dev_err(fifo->dt_device,
-@@ -545,32 +541,20 @@ static ssize_t axis_fifo_write(struct fi
- }
- }
-
-- /* write data from an intermediate buffer into the fifo IP, refilling
-- * the buffer with userspace data as needed
-- */
-- copied = 0;
-- while (words_to_write > 0) {
-- copy = min(words_to_write, WRITE_BUF_SIZE);
--
-- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32),
-- copy * sizeof(u32))) {
-- ret = -EFAULT;
-- goto end_unlock;
-- }
--
-- for (i = 0; i < copy; i++)
-- iowrite32(tmp_buf[i], fifo->base_addr +
-- XLLF_TDFD_OFFSET);
--
-- copied += copy;
-- words_to_write -= copy;
-+ txbuf = vmemdup_user(buf, len);
-+ if (IS_ERR(txbuf)) {
-+ ret = PTR_ERR(txbuf);
-+ goto end_unlock;
- }
-
-- ret = copied * sizeof(u32);
-+ for (int i = 0; i < words_to_write; ++i)
-+ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET);
-
- /* write packet size to fifo */
-- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET);
-+ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET);
-
-+ ret = len;
-+ kvfree(txbuf);
- end_unlock:
- mutex_unlock(&fifo->write_lock);
-
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
-@@ -399,6 +399,7 @@ static ssize_t axis_fifo_read(struct fil
+@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil
}
bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET);
if (!bytes_available) {
dev_err(fifo->dt_device, "received a packet of length 0\n");
ret = -EIO;
-@@ -409,7 +410,7 @@ static ssize_t axis_fifo_read(struct fil
+@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fil
dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n",
bytes_available, len);
ret = -EINVAL;
}
if (bytes_available % sizeof(u32)) {
-@@ -418,11 +419,9 @@ static ssize_t axis_fifo_read(struct fil
+@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil
*/
dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n");
ret = -EIO;
/* read data into an intermediate buffer, copying the contents
* to userspace when the buffer is full
*/
-@@ -434,18 +433,23 @@ static ssize_t axis_fifo_read(struct fil
+@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil
tmp_buf[i] = ioread32(fifo->base_addr +
XLLF_RDFD_OFFSET);
}
perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch
serial-stm32-allow-selecting-console-when-the-driver-is-module.patch
staging-axis-fifo-fix-maximum-tx-packet-length-check.patch
-staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch
staging-axis-fifo-flush-rx-fifo-on-read-errors.patch
driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch
+++ /dev/null
-From 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 Mon Sep 17 00:00:00 2001
-From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-Date: Fri, 12 Sep 2025 13:13:21 +0300
-Subject: staging: axis-fifo: fix TX handling on copy_from_user() failure
-
-From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-
-commit 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 upstream.
-
-If copy_from_user() fails, write() currently returns -EFAULT, but any
-partially written data leaves the TX FIFO in an inconsistent state.
-Subsequent write() calls then fail with "transmit length mismatch"
-errors.
-
-Once partial data is written to the hardware FIFO, it cannot be removed
-without a TX reset. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove
-hardware resets for user errors") removed a full FIFO reset for this case,
-which fixed a potential RX data loss, but introduced this TX issue.
-
-Fix this by introducing a bounce buffer: copy the full packet from
-userspace first, and write to the hardware FIFO only if the copy
-was successful.
-
-Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors")
-Cc: stable@vger.kernel.org
-Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
-Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/staging/axis-fifo/axis-fifo.c | 36 +++++++++-------------------------
- 1 file changed, 10 insertions(+), 26 deletions(-)
-
---- a/drivers/staging/axis-fifo/axis-fifo.c
-+++ b/drivers/staging/axis-fifo/axis-fifo.c
-@@ -43,7 +43,6 @@
- #define DRIVER_NAME "axis_fifo"
-
- #define READ_BUF_SIZE 128U /* read buffer length in words */
--#define WRITE_BUF_SIZE 128U /* write buffer length in words */
-
- /* ----------------------------
- * IP register offsets
-@@ -474,11 +473,8 @@ static ssize_t axis_fifo_write(struct fi
- {
- struct axis_fifo *fifo = (struct axis_fifo *)f->private_data;
- unsigned int words_to_write;
-- unsigned int copied;
-- unsigned int copy;
-- unsigned int i;
-+ u32 *txbuf;
- int ret;
-- u32 tmp_buf[WRITE_BUF_SIZE];
-
- if (len % sizeof(u32)) {
- dev_err(fifo->dt_device,
-@@ -544,32 +540,20 @@ static ssize_t axis_fifo_write(struct fi
- }
- }
-
-- /* write data from an intermediate buffer into the fifo IP, refilling
-- * the buffer with userspace data as needed
-- */
-- copied = 0;
-- while (words_to_write > 0) {
-- copy = min(words_to_write, WRITE_BUF_SIZE);
--
-- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32),
-- copy * sizeof(u32))) {
-- ret = -EFAULT;
-- goto end_unlock;
-- }
--
-- for (i = 0; i < copy; i++)
-- iowrite32(tmp_buf[i], fifo->base_addr +
-- XLLF_TDFD_OFFSET);
--
-- copied += copy;
-- words_to_write -= copy;
-+ txbuf = vmemdup_user(buf, len);
-+ if (IS_ERR(txbuf)) {
-+ ret = PTR_ERR(txbuf);
-+ goto end_unlock;
- }
-
-- ret = copied * sizeof(u32);
-+ for (int i = 0; i < words_to_write; ++i)
-+ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET);
-
- /* write packet size to fifo */
-- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET);
-+ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET);
-
-+ ret = len;
-+ kvfree(txbuf);
- end_unlock:
- mutex_unlock(&fifo->write_lock);
-
--- a/drivers/staging/axis-fifo/axis-fifo.c
+++ b/drivers/staging/axis-fifo/axis-fifo.c
-@@ -399,6 +399,7 @@ static ssize_t axis_fifo_read(struct fil
+@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil
}
bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET);
if (!bytes_available) {
dev_err(fifo->dt_device, "received a packet of length 0\n");
ret = -EIO;
-@@ -409,7 +410,7 @@ static ssize_t axis_fifo_read(struct fil
+@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fil
dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n",
bytes_available, len);
ret = -EINVAL;
}
if (bytes_available % sizeof(u32)) {
-@@ -418,11 +419,9 @@ static ssize_t axis_fifo_read(struct fil
+@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil
*/
dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n");
ret = -EIO;
/* read data into an intermediate buffer, copying the contents
* to userspace when the buffer is full
*/
-@@ -434,18 +433,23 @@ static ssize_t axis_fifo_read(struct fil
+@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil
tmp_buf[i] = ioread32(fifo->base_addr +
XLLF_RDFD_OFFSET);
}
projects / thirdparty / kernel / stable-queue.git / commitdiff
