6.6-stable patches

added patches:
	bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
	mtd-spinand-add-support-for-5-byte-ids.patch

diff --git a/queue-6.6/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch b/queue-6.6/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
new file mode 100644 (file)
index 0000000..e2d0ee6
--- /dev/null
+++ b/queue-6.6/bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
@@ -0,0 +1,68 @@
+From 1c3366abdbe884be62e5a7502b4db758aa3974c6 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 26 Mar 2024 12:43:17 -0400
+Subject: Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 1c3366abdbe884be62e5a7502b4db758aa3974c6 upstream.
+
+hci_cmd_sync_cancel_sync shall check the error passed to it since it
+will be propagated using req_result which is __u32 it needs to be
+properly set to a positive value if it was passed as negative othertise
+IS_ERR will not trigger as -(errno) would be converted to a positive
+value.
+
+Fixes: 63298d6e752f ("Bluetooth: hci_core: Cancel request on command timeout")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Reported-and-tested-by: Thorsten Leemhuis <linux@leemhuis.info>
+Closes: https://lore.kernel.org/all/08275279-7462-4f4a-a0ee-8aa015f829bc@leemhuis.info/
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/hci_core.c |    6 +++---
+ net/bluetooth/hci_sync.c |    5 ++++-
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -2842,7 +2842,7 @@ static void hci_cancel_cmd_sync(struct h
+       cancel_delayed_work_sync(&hdev->ncmd_timer);
+       atomic_set(&hdev->cmd_cnt, 1);
+ 
+-      hci_cmd_sync_cancel_sync(hdev, -err);
++      hci_cmd_sync_cancel_sync(hdev, err);
+ }
+ 
+ /* Suspend HCI device */
+@@ -2862,7 +2862,7 @@ int hci_suspend_dev(struct hci_dev *hdev
+               return 0;
+ 
+       /* Cancel potentially blocking sync operation before suspend */
+-      hci_cancel_cmd_sync(hdev, -EHOSTDOWN);
++      hci_cancel_cmd_sync(hdev, EHOSTDOWN);
+ 
+       hci_req_sync_lock(hdev);
+       ret = hci_suspend_sync(hdev);
+@@ -4178,7 +4178,7 @@ static void hci_send_cmd_sync(struct hci
+ 
+       err = hci_send_frame(hdev, skb);
+       if (err < 0) {
+-              hci_cmd_sync_cancel_sync(hdev, err);
++              hci_cmd_sync_cancel_sync(hdev, -err);
+               return;
+       }
+ 
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -679,7 +679,10 @@ void hci_cmd_sync_cancel_sync(struct hci
+       bt_dev_dbg(hdev, "err 0x%2.2x", err);
+ 
+       if (hdev->req_status == HCI_REQ_PEND) {
+-              hdev->req_result = err;
++              /* req_result is __u32 so error must be positive to be properly
++               * propagated.
++               */
++              hdev->req_result = err < 0 ? -err : err;
+               hdev->req_status = HCI_REQ_CANCELED;
+ 
+               wake_up_interruptible(&hdev->req_wait_q);

diff --git a/queue-6.6/mtd-spinand-add-support-for-5-byte-ids.patch b/queue-6.6/mtd-spinand-add-support-for-5-byte-ids.patch
new file mode 100644 (file)
index 0000000..fc06490
--- /dev/null
+++ b/queue-6.6/mtd-spinand-add-support-for-5-byte-ids.patch
@@ -0,0 +1,40 @@
+From 34a956739d295de6010cdaafeed698ccbba87ea4 Mon Sep 17 00:00:00 2001
+From: Ezra Buehler <ezra.buehler@husqvarnagroup.com>
+Date: Thu, 25 Jan 2024 22:01:07 +0200
+Subject: mtd: spinand: Add support for 5-byte IDs
+
+From: Ezra Buehler <ezra.buehler@husqvarnagroup.com>
+
+commit 34a956739d295de6010cdaafeed698ccbba87ea4 upstream.
+
+E.g. ESMT chips will return an identification code with a length of 5
+bytes. In order to prevent ambiguity, flash chips would actually need to
+return IDs that are up to 17 or more bytes long due to JEDEC's
+continuation scheme. I understand that if a manufacturer ID is located
+in bank N of JEDEC's database (there are currently 16 banks), N - 1
+continuation codes (7Fh) need to be added to the identification code
+(comprising of manufacturer ID and device ID). However, most flash chip
+manufacturers don't seem to implement this (correctly).
+
+Signed-off-by: Ezra Buehler <ezra.buehler@husqvarnagroup.com>
+Reviewed-by: Martin Kurbanov <mmkurbanov@salutedevices.com>
+Tested-by: Martin Kurbanov <mmkurbanov@salutedevices.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240125200108.24374-2-ezra@easyb.ch
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/mtd/spinand.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -169,7 +169,7 @@
+ struct spinand_op;
+ struct spinand_device;
+ 
+-#define SPINAND_MAX_ID_LEN    4
++#define SPINAND_MAX_ID_LEN    5
+ /*
+  * For erase, write and read operation, we got the following timings :
+  * tBERS (erase) 1ms to 4ms

diff --git a/queue-6.6/series b/queue-6.6/series
index b486795aade28729c32c00da679eab92ee9b0525..49bb7395486606ff858ea996a11b8d1d3a382521 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -344,3 +344,5 @@ drm-i915-bios-tolerate-devdata-null-in-intel_bios_encoder_supports_dp_dual_mode.
 drm-i915-dsi-go-back-to-the-previous-init_otp-display_on-order-mostly.patch
 drm-i915-do-not-match-jsl-in-ehl_combo_pll_div_frac_wa_needed.patch
 drm-i915-gt-reset-queue_priority_hint-on-parking.patch
+bluetooth-hci_sync-fix-not-checking-error-on-hci_cmd_sync_cancel_sync.patch
+mtd-spinand-add-support-for-5-byte-ids.patch