drop a bunch of patches

diff --git a/queue-5.15/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch b/queue-5.15/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch
deleted file mode 100644 (file)
index 5e17bcb..0000000
--- a/queue-5.15/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a Mon Sep 17 00:00:00 2001
-From: Javier Martinez Canillas <javierm@redhat.com>
-Date: Mon, 2 May 2022 15:50:14 +0200
-Subject: fbdev: Make fb_release() return -ENODEV if fbdev was unregistered
-
-From: Javier Martinez Canillas <javierm@redhat.com>
-
-commit aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a upstream.
-
-A reference to the framebuffer device struct fb_info is stored in the file
-private data, but this reference could no longer be valid and must not be
-accessed directly. Instead, the file_fb_info() accessor function must be
-used since it does sanity checking to make sure that the fb_info is valid.
-
-This can happen for example if the registered framebuffer device is for a
-driver that just uses a framebuffer provided by the system firmware. In
-that case, the fbdev core would unregister the framebuffer device when a
-real video driver is probed and ask to remove conflicting framebuffers.
-
-The bug has been present for a long time but commit 27599aacbaef ("fbdev:
-Hot-unplug firmware fb devices on forced removal") unmasked it since the
-fbdev core started unregistering the framebuffers' devices associated.
-
-Fixes: 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal")
-Reported-by: Maxime Ripard <maxime@cerno.tech>
-Reported-by: Junxiao Chang <junxiao.chang@intel.com>
-Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
-Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
-Link: https://patchwork.freedesktop.org/patch/msgid/20220502135014.377945-1-javierm@redhat.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/video/fbdev/core/fbmem.c |    5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/video/fbdev/core/fbmem.c
-+++ b/drivers/video/fbdev/core/fbmem.c
-@@ -1436,7 +1436,10 @@ fb_release(struct inode *inode, struct f
- __acquires(&info->lock)
- __releases(&info->lock)
- {
--      struct fb_info * const info = file->private_data;
-+      struct fb_info * const info = file_fb_info(file);
-+
-+      if (!info)
-+              return -ENODEV;
- 
-       lock_fb_info(info);
-       if (info->fbops->fb_release)

diff --git a/queue-5.15/gpio-mvebu-drop-pwm-base-assignment.patch b/queue-5.15/gpio-mvebu-drop-pwm-base-assignment.patch
deleted file mode 100644 (file)
index 5daeecf..0000000
--- a/queue-5.15/gpio-mvebu-drop-pwm-base-assignment.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From e5f6e5d554ac274f9c8ba60078103d0425b93c19 Mon Sep 17 00:00:00 2001
-From: Baruch Siach <baruch@tkos.co.il>
-Date: Mon, 11 Apr 2022 09:23:40 +0300
-Subject: gpio: mvebu: drop pwm base assignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Baruch Siach <baruch@tkos.co.il>
-
-commit e5f6e5d554ac274f9c8ba60078103d0425b93c19 upstream.
-
-pwmchip_add() unconditionally assigns the base ID dynamically. Commit
-f9a8ee8c8bcd1 ("pwm: Always allocate PWM chip base ID dynamically")
-dropped all base assignment from drivers under drivers/pwm/. It missed
-this driver. Fix that.
-
-Fixes: f9a8ee8c8bcd1 ("pwm: Always allocate PWM chip base ID dynamically")
-Signed-off-by: Baruch Siach <baruch@tkos.co.il>
-Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
-Acked-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/gpio/gpio-mvebu.c |    7 -------
- 1 file changed, 7 deletions(-)
-
---- a/drivers/gpio/gpio-mvebu.c
-+++ b/drivers/gpio/gpio-mvebu.c
-@@ -871,13 +871,6 @@ static int mvebu_pwm_probe(struct platfo
-       mvpwm->chip.dev = dev;
-       mvpwm->chip.ops = &mvebu_pwm_ops;
-       mvpwm->chip.npwm = mvchip->chip.ngpio;
--      /*
--       * There may already be some PWM allocated, so we can't force
--       * mvpwm->chip.base to a fixed point like mvchip->chip.base.
--       * So, we let pwmchip_add() do the numbering and take the next free
--       * region.
--       */
--      mvpwm->chip.base = -1;
- 
-       spin_lock_init(&mvpwm->lock);
- 

diff --git a/queue-5.15/series b/queue-5.15/series
index 97e2266d2e20add7941ab3fe84f73571b1772928..9d4d5c319cee138e40ef69b20ae04b788e2591d3 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -38,7 +38,6 @@ can-grcan-only-use-the-napi-poll-budget-for-rx.patch
 nfc-replace-improper-check-device_is_registered-in-netlink-related-functions.patch
 nfc-nfcmrvl-main-reorder-destructive-operations-in-nfcmrvl_nci_unregister_dev-to-avoid-bugs.patch
 nfc-netlink-fix-sleep-in-atomic-bug-when-firmware-download-timeout.patch
-gpio-mvebu-drop-pwm-base-assignment.patch
 gpio-visconti-fix-fwnode-of-gpio-irq.patch
 gpio-pca953x-fix-irq_stat-not-updated-when-irq-is-disabled-irq_mask-not-set.patch
 hwmon-adt7470-fix-warning-on-module-removal.patch
@@ -47,7 +46,6 @@ asoc-dmaengine-restore-null-prepare_slave_config-callback.patch
 asoc-soc-ops-fix-error-handling.patch
 iommu-vt-d-drop-stop-marker-messages.patch
 iommu-dart-check-return-value-after-calling-platform_get_resource.patch
-fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch
 net-mlx5e-fix-trust-state-reset-in-reload.patch
 net-mlx5e-don-t-match-double-vlan-packets-if-cvlan-is-not-set.patch
 net-mlx5e-ct-fix-queued-up-restore-put-executing-after-relevant-ft-release.patch

diff --git a/queue-5.17/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch b/queue-5.17/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch
deleted file mode 100644 (file)
index 59b646a..0000000
--- a/queue-5.17/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a Mon Sep 17 00:00:00 2001
-From: Javier Martinez Canillas <javierm@redhat.com>
-Date: Mon, 2 May 2022 15:50:14 +0200
-Subject: fbdev: Make fb_release() return -ENODEV if fbdev was unregistered
-
-From: Javier Martinez Canillas <javierm@redhat.com>
-
-commit aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a upstream.
-
-A reference to the framebuffer device struct fb_info is stored in the file
-private data, but this reference could no longer be valid and must not be
-accessed directly. Instead, the file_fb_info() accessor function must be
-used since it does sanity checking to make sure that the fb_info is valid.
-
-This can happen for example if the registered framebuffer device is for a
-driver that just uses a framebuffer provided by the system firmware. In
-that case, the fbdev core would unregister the framebuffer device when a
-real video driver is probed and ask to remove conflicting framebuffers.
-
-The bug has been present for a long time but commit 27599aacbaef ("fbdev:
-Hot-unplug firmware fb devices on forced removal") unmasked it since the
-fbdev core started unregistering the framebuffers' devices associated.
-
-Fixes: 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal")
-Reported-by: Maxime Ripard <maxime@cerno.tech>
-Reported-by: Junxiao Chang <junxiao.chang@intel.com>
-Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
-Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
-Link: https://patchwork.freedesktop.org/patch/msgid/20220502135014.377945-1-javierm@redhat.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/video/fbdev/core/fbmem.c |    5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
---- a/drivers/video/fbdev/core/fbmem.c
-+++ b/drivers/video/fbdev/core/fbmem.c
-@@ -1438,7 +1438,10 @@ fb_release(struct inode *inode, struct f
- __acquires(&info->lock)
- __releases(&info->lock)
- {
--      struct fb_info * const info = file->private_data;
-+      struct fb_info * const info = file_fb_info(file);
-+
-+      if (!info)
-+              return -ENODEV;
- 
-       lock_fb_info(info);
-       if (info->fbops->fb_release)

diff --git a/queue-5.17/gpio-mvebu-drop-pwm-base-assignment.patch b/queue-5.17/gpio-mvebu-drop-pwm-base-assignment.patch
deleted file mode 100644 (file)
index 5daeecf..0000000
--- a/queue-5.17/gpio-mvebu-drop-pwm-base-assignment.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From e5f6e5d554ac274f9c8ba60078103d0425b93c19 Mon Sep 17 00:00:00 2001
-From: Baruch Siach <baruch@tkos.co.il>
-Date: Mon, 11 Apr 2022 09:23:40 +0300
-Subject: gpio: mvebu: drop pwm base assignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-From: Baruch Siach <baruch@tkos.co.il>
-
-commit e5f6e5d554ac274f9c8ba60078103d0425b93c19 upstream.
-
-pwmchip_add() unconditionally assigns the base ID dynamically. Commit
-f9a8ee8c8bcd1 ("pwm: Always allocate PWM chip base ID dynamically")
-dropped all base assignment from drivers under drivers/pwm/. It missed
-this driver. Fix that.
-
-Fixes: f9a8ee8c8bcd1 ("pwm: Always allocate PWM chip base ID dynamically")
-Signed-off-by: Baruch Siach <baruch@tkos.co.il>
-Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
-Acked-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/gpio/gpio-mvebu.c |    7 -------
- 1 file changed, 7 deletions(-)
-
---- a/drivers/gpio/gpio-mvebu.c
-+++ b/drivers/gpio/gpio-mvebu.c
-@@ -871,13 +871,6 @@ static int mvebu_pwm_probe(struct platfo
-       mvpwm->chip.dev = dev;
-       mvpwm->chip.ops = &mvebu_pwm_ops;
-       mvpwm->chip.npwm = mvchip->chip.ngpio;
--      /*
--       * There may already be some PWM allocated, so we can't force
--       * mvpwm->chip.base to a fixed point like mvchip->chip.base.
--       * So, we let pwmchip_add() do the numbering and take the next free
--       * region.
--       */
--      mvpwm->chip.base = -1;
- 
-       spin_lock_init(&mvpwm->lock);
- 

diff --git a/queue-5.17/net-rds-acquire-refcount-on-tcp-sockets.patch b/queue-5.17/net-rds-acquire-refcount-on-tcp-sockets.patch
deleted file mode 100644 (file)
index 10313de..0000000
--- a/queue-5.17/net-rds-acquire-refcount-on-tcp-sockets.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 3a58f13a881ed351198ffab4cf9953cf19d2ab3a Mon Sep 17 00:00:00 2001
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Date: Mon, 2 May 2022 10:40:18 +0900
-Subject: net: rds: acquire refcount on TCP sockets
-
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-
-commit 3a58f13a881ed351198ffab4cf9953cf19d2ab3a upstream.
-
-syzbot is reporting use-after-free read in tcp_retransmit_timer() [1],
-for TCP socket used by RDS is accessing sock_net() without acquiring a
-refcount on net namespace. Since TCP's retransmission can happen after
-a process which created net namespace terminated, we need to explicitly
-acquire a refcount.
-
-Link: https://syzkaller.appspot.com/bug?extid=694120e1002c117747ed [1]
-Reported-by: syzbot <syzbot+694120e1002c117747ed@syzkaller.appspotmail.com>
-Fixes: 26abe14379f8e2fa ("net: Modify sk_alloc to not reference count the netns of kernel sockets.")
-Fixes: 8a68173691f03661 ("net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket")
-Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Tested-by: syzbot <syzbot+694120e1002c117747ed@syzkaller.appspotmail.com>
-Link: https://lore.kernel.org/r/a5fb1fc4-2284-3359-f6a0-e4e390239d7b@I-love.SAKURA.ne.jp
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- net/rds/tcp.c |    8 ++++++++
- 1 file changed, 8 insertions(+)
-
---- a/net/rds/tcp.c
-+++ b/net/rds/tcp.c
-@@ -495,6 +495,14 @@ void rds_tcp_tune(struct socket *sock)
- 
-       tcp_sock_set_nodelay(sock->sk);
-       lock_sock(sk);
-+      /* TCP timer functions might access net namespace even after
-+       * a process which created this net namespace terminated.
-+       */
-+      if (!sk->sk_net_refcnt) {
-+              sk->sk_net_refcnt = 1;
-+              get_net_track(net, &sk->ns_tracker, GFP_KERNEL);
-+              sock_inuse_add(net, 1);
-+      }
-       if (rtn->sndbuf_size > 0) {
-               sk->sk_sndbuf = rtn->sndbuf_size;
-               sk->sk_userlocks |= SOCK_SNDBUF_LOCK;

diff --git a/queue-5.17/series b/queue-5.17/series
index 3ccfd94fe19d29c50104899513f9e1f405015493..4fcccf3817dd124cef0c5ee9a77fa355fd6684dd 100644 (file)
--- a/queue-5.17/series
+++ b/queue-5.17/series
@@ -51,7 +51,6 @@ can-grcan-only-use-the-napi-poll-budget-for-rx.patch
 nfc-replace-improper-check-device_is_registered-in-netlink-related-functions.patch
 nfc-nfcmrvl-main-reorder-destructive-operations-in-nfcmrvl_nci_unregister_dev-to-avoid-bugs.patch
 nfc-netlink-fix-sleep-in-atomic-bug-when-firmware-download-timeout.patch
-gpio-mvebu-drop-pwm-base-assignment.patch
 gpio-visconti-fix-fwnode-of-gpio-irq.patch
 gpio-pca953x-fix-irq_stat-not-updated-when-irq-is-disabled-irq_mask-not-set.patch
 hwmon-adt7470-fix-warning-on-module-removal.patch
@@ -62,7 +61,6 @@ asoc-meson-axg-card-fix-nonatomic-links.patch
 asoc-soc-ops-fix-error-handling.patch
 iommu-vt-d-drop-stop-marker-messages.patch
 iommu-dart-check-return-value-after-calling-platform_get_resource.patch
-fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch
 net-mlx5e-fix-trust-state-reset-in-reload.patch
 net-mlx5-fix-slab-out-of-bounds-while-reading-resource-dump-menu.patch
 net-mlx5e-fix-wrong-source-vport-matching-on-tunnel-rule.patch
@@ -90,7 +88,6 @@ net-stmmac-dwmac-sun8i-add-missing-of_node_put-in-sun8i_dwmac_register_mdio_mux.
 net-mdio-fix-enomem-return-value-in-bcm6368-mux-bus-controller.patch
 net-cpsw-add-missing-of_node_put-in-cpsw_probe_dt.patch
 net-igmp-respect-rcu-rules-in-ip_mc_source-and-ip_mc_msfilter.patch
-net-rds-acquire-refcount-on-tcp-sockets.patch
 net-emaclite-add-error-handling-for-of_address_to_resource.patch
 selftests-net-so_txtime-fix-parsing-of-start-time-stamp-on-32-bit-systems.patch
 selftests-net-so_txtime-usage-fix-documentation-of-default-clock.patch