Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- net/atm/resources.c | 3 +--
+ net/atm/resources.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/net/atm/resources.c b/net/atm/resources.c
-index 04b2235c5c261..e244c2576d1e0 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
-@@ -148,11 +148,10 @@ void atm_dev_deregister(struct atm_dev *dev)
+@@ -148,11 +148,10 @@ void atm_dev_deregister(struct atm_dev *
*/
mutex_lock(&atm_dev_mutex);
list_del(&dev->dev_list);
atm_dev_put(dev);
}
---
-2.39.5
-
--- /dev/null
+From 042bb9603c44620dce98717a2d23235ca57a00d7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Danis?= <frederic.danis@collabora.com>
+Date: Thu, 12 Jun 2025 09:50:34 +0200
+Subject: Bluetooth: L2CAP: Fix L2CAP MTU negotiation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frédéric Danis <frederic.danis@collabora.com>
+
+commit 042bb9603c44620dce98717a2d23235ca57a00d7 upstream.
+
+OBEX download from iPhone is currently slow due to small packet size
+used to transfer data which doesn't follow the MTU negotiated during
+L2CAP connection, i.e. 672 bytes instead of 32767:
+
+ < ACL Data TX: Handle 11 flags 0x00 dlen 12
+ L2CAP: Connection Request (0x02) ident 18 len 4
+ PSM: 4103 (0x1007)
+ Source CID: 72
+ > ACL Data RX: Handle 11 flags 0x02 dlen 16
+ L2CAP: Connection Response (0x03) ident 18 len 8
+ Destination CID: 14608
+ Source CID: 72
+ Result: Connection successful (0x0000)
+ Status: No further information available (0x0000)
+ < ACL Data TX: Handle 11 flags 0x00 dlen 27
+ L2CAP: Configure Request (0x04) ident 20 len 19
+ Destination CID: 14608
+ Flags: 0x0000
+ Option: Maximum Transmission Unit (0x01) [mandatory]
+ MTU: 32767
+ Option: Retransmission and Flow Control (0x04) [mandatory]
+ Mode: Enhanced Retransmission (0x03)
+ TX window size: 63
+ Max transmit: 3
+ Retransmission timeout: 2000
+ Monitor timeout: 12000
+ Maximum PDU size: 1009
+ > ACL Data RX: Handle 11 flags 0x02 dlen 26
+ L2CAP: Configure Request (0x04) ident 72 len 18
+ Destination CID: 72
+ Flags: 0x0000
+ Option: Retransmission and Flow Control (0x04) [mandatory]
+ Mode: Enhanced Retransmission (0x03)
+ TX window size: 32
+ Max transmit: 255
+ Retransmission timeout: 0
+ Monitor timeout: 0
+ Maximum PDU size: 65527
+ Option: Frame Check Sequence (0x05) [mandatory]
+ FCS: 16-bit FCS (0x01)
+ < ACL Data TX: Handle 11 flags 0x00 dlen 29
+ L2CAP: Configure Response (0x05) ident 72 len 21
+ Source CID: 14608
+ Flags: 0x0000
+ Result: Success (0x0000)
+ Option: Maximum Transmission Unit (0x01) [mandatory]
+ MTU: 672
+ Option: Retransmission and Flow Control (0x04) [mandatory]
+ Mode: Enhanced Retransmission (0x03)
+ TX window size: 32
+ Max transmit: 255
+ Retransmission timeout: 2000
+ Monitor timeout: 12000
+ Maximum PDU size: 1009
+ > ACL Data RX: Handle 11 flags 0x02 dlen 32
+ L2CAP: Configure Response (0x05) ident 20 len 24
+ Source CID: 72
+ Flags: 0x0000
+ Result: Success (0x0000)
+ Option: Maximum Transmission Unit (0x01) [mandatory]
+ MTU: 32767
+ Option: Retransmission and Flow Control (0x04) [mandatory]
+ Mode: Enhanced Retransmission (0x03)
+ TX window size: 63
+ Max transmit: 3
+ Retransmission timeout: 2000
+ Monitor timeout: 12000
+ Maximum PDU size: 1009
+ Option: Frame Check Sequence (0x05) [mandatory]
+ FCS: 16-bit FCS (0x01)
+ ...
+ > ACL Data RX: Handle 11 flags 0x02 dlen 680
+ Channel: 72 len 676 ctrl 0x0202 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
+ I-frame: Unsegmented TxSeq 1 ReqSeq 2
+ < ACL Data TX: Handle 11 flags 0x00 dlen 13
+ Channel: 14608 len 9 ctrl 0x0204 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
+ I-frame: Unsegmented TxSeq 2 ReqSeq 2
+ > ACL Data RX: Handle 11 flags 0x02 dlen 680
+ Channel: 72 len 676 ctrl 0x0304 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
+ I-frame: Unsegmented TxSeq 2 ReqSeq 3
+
+The MTUs are negotiated for each direction. In this traces 32767 for
+iPhone->localhost and no MTU for localhost->iPhone, which based on
+'4.4 L2CAP_CONFIGURATION_REQ' (Core specification v5.4, Vol. 3, Part
+A):
+
+ The only parameters that should be included in the
+ L2CAP_CONFIGURATION_REQ packet are those that require different
+ values than the default or previously agreed values.
+ ...
+ Any missing configuration parameters are assumed to have their
+ most recently explicitly or implicitly accepted values.
+
+and '5.1 Maximum transmission unit (MTU)':
+
+ If the remote device sends a positive L2CAP_CONFIGURATION_RSP
+ packet it should include the actual MTU to be used on this channel
+ for traffic flowing into the local device.
+ ...
+ The default value is 672 octets.
+
+is set by BlueZ to 672 bytes.
+
+It seems that the iPhone used the lowest negotiated value to transfer
+data to the localhost instead of the negotiated one for the incoming
+direction.
+
+This could be fixed by using the MTU negotiated for the other
+direction, if exists, in the L2CAP_CONFIGURATION_RSP.
+This allows to use segmented packets as in the following traces:
+
+ < ACL Data TX: Handle 11 flags 0x00 dlen 12
+ L2CAP: Connection Request (0x02) ident 22 len 4
+ PSM: 4103 (0x1007)
+ Source CID: 72
+ < ACL Data TX: Handle 11 flags 0x00 dlen 27
+ L2CAP: Configure Request (0x04) ident 24 len 19
+ Destination CID: 2832
+ Flags: 0x0000
+ Option: Maximum Transmission Unit (0x01) [mandatory]
+ MTU: 32767
+ Option: Retransmission and Flow Control (0x04) [mandatory]
+ Mode: Enhanced Retransmission (0x03)
+ TX window size: 63
+ Max transmit: 3
+ Retransmission timeout: 2000
+ Monitor timeout: 12000
+ Maximum PDU size: 1009
+ > ACL Data RX: Handle 11 flags 0x02 dlen 26
+ L2CAP: Configure Request (0x04) ident 15 len 18
+ Destination CID: 72
+ Flags: 0x0000
+ Option: Retransmission and Flow Control (0x04) [mandatory]
+ Mode: Enhanced Retransmission (0x03)
+ TX window size: 32
+ Max transmit: 255
+ Retransmission timeout: 0
+ Monitor timeout: 0
+ Maximum PDU size: 65527
+ Option: Frame Check Sequence (0x05) [mandatory]
+ FCS: 16-bit FCS (0x01)
+ < ACL Data TX: Handle 11 flags 0x00 dlen 29
+ L2CAP: Configure Response (0x05) ident 15 len 21
+ Source CID: 2832
+ Flags: 0x0000
+ Result: Success (0x0000)
+ Option: Maximum Transmission Unit (0x01) [mandatory]
+ MTU: 32767
+ Option: Retransmission and Flow Control (0x04) [mandatory]
+ Mode: Enhanced Retransmission (0x03)
+ TX window size: 32
+ Max transmit: 255
+ Retransmission timeout: 2000
+ Monitor timeout: 12000
+ Maximum PDU size: 1009
+ > ACL Data RX: Handle 11 flags 0x02 dlen 32
+ L2CAP: Configure Response (0x05) ident 24 len 24
+ Source CID: 72
+ Flags: 0x0000
+ Result: Success (0x0000)
+ Option: Maximum Transmission Unit (0x01) [mandatory]
+ MTU: 32767
+ Option: Retransmission and Flow Control (0x04) [mandatory]
+ Mode: Enhanced Retransmission (0x03)
+ TX window size: 63
+ Max transmit: 3
+ Retransmission timeout: 2000
+ Monitor timeout: 12000
+ Maximum PDU size: 1009
+ Option: Frame Check Sequence (0x05) [mandatory]
+ FCS: 16-bit FCS (0x01)
+ ...
+ > ACL Data RX: Handle 11 flags 0x02 dlen 1009
+ Channel: 72 len 1005 ctrl 0x4202 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
+ I-frame: Start (len 21884) TxSeq 1 ReqSeq 2
+ > ACL Data RX: Handle 11 flags 0x02 dlen 1009
+ Channel: 72 len 1005 ctrl 0xc204 [PSM 4103 mode Enhanced Retransmission (0x03)] {chan 8}
+ I-frame: Continuation TxSeq 2 ReqSeq 2
+
+This has been tested with kernel 5.4 and BlueZ 5.77.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/l2cap_core.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -3373,7 +3373,7 @@ static int l2cap_parse_conf_req(struct l
+ struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
+ struct l2cap_conf_efs efs;
+ u8 remote_efs = 0;
+- u16 mtu = L2CAP_DEFAULT_MTU;
++ u16 mtu = 0;
+ u16 result = L2CAP_CONF_SUCCESS;
+ u16 size;
+
+@@ -3484,6 +3484,13 @@ done:
+ /* Configure output options and let the other side know
+ * which ones we don't like. */
+
++ /* If MTU is not provided in configure request, use the most recently
++ * explicitly or implicitly accepted value for the other direction,
++ * or the default value.
++ */
++ if (mtu == 0)
++ mtu = chan->imtu ? chan->imtu : L2CAP_DEFAULT_MTU;
++
+ if (mtu < L2CAP_DEFAULT_MIN_MTU)
+ result = L2CAP_CONF_UNACCEPT;
+ else {
--- /dev/null
+From db53805156f1e0aa6d059c0d3f9ac660d4ef3eb4 Mon Sep 17 00:00:00 2001
+From: Heinz Mauelshagen <heinzm@redhat.com>
+Date: Tue, 10 Jun 2025 20:53:30 +0200
+Subject: dm-raid: fix variable in journal device check
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+commit db53805156f1e0aa6d059c0d3f9ac660d4ef3eb4 upstream.
+
+Replace "rdev" with correct loop variable name "r".
+
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Cc: stable@vger.kernel.org
+Fixes: 63c32ed4afc2 ("dm raid: add raid4/5/6 journaling support")
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-raid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -2406,7 +2406,7 @@ static int super_init_validation(struct
+ */
+ sb_retrieve_failed_devices(sb, failed_devices);
+ rdev_for_each(r, mddev) {
+- if (test_bit(Journal, &rdev->flags) ||
++ if (test_bit(Journal, &r->flags) ||
+ !r->sb_page)
+ continue;
+ sb2 = page_address(r->sb_page);
--- /dev/null
+From 9ff4fdf4f44b69237c0afc1d3a8dac916ce66f3e Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Mon, 21 Apr 2025 11:13:05 -0500
+Subject: drm/tegra: Assign plane type before registration
+
+From: Thierry Reding <treding@nvidia.com>
+
+commit 9ff4fdf4f44b69237c0afc1d3a8dac916ce66f3e upstream.
+
+Changes to a plane's type after it has been registered aren't propagated
+to userspace automatically. This could possibly be achieved by updating
+the property, but since we can already determine which type this should
+be before the registration, passing in the right type from the start is
+a much better solution.
+
+Suggested-by: Aaron Kling <webgeek1234@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Cc: stable@vger.kernel.org
+Fixes: 473079549f27 ("drm/tegra: dc: Add Tegra186 support")
+Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20250421-tegra-drm-primary-v2-1-7f740c4c2121@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/tegra/dc.c | 12 ++++++++----
+ drivers/gpu/drm/tegra/hub.c | 4 ++--
+ drivers/gpu/drm/tegra/hub.h | 3 ++-
+ 3 files changed, 12 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/tegra/dc.c
++++ b/drivers/gpu/drm/tegra/dc.c
+@@ -1103,10 +1103,16 @@ static struct drm_plane *tegra_dc_add_sh
+ if (wgrp->dc == dc->pipe) {
+ for (j = 0; j < wgrp->num_windows; j++) {
+ unsigned int index = wgrp->windows[j];
++ enum drm_plane_type type;
++
++ if (primary)
++ type = DRM_PLANE_TYPE_OVERLAY;
++ else
++ type = DRM_PLANE_TYPE_PRIMARY;
+
+ plane = tegra_shared_plane_create(drm, dc,
+ wgrp->index,
+- index);
++ index, type);
+ if (IS_ERR(plane))
+ return plane;
+
+@@ -1114,10 +1120,8 @@ static struct drm_plane *tegra_dc_add_sh
+ * Choose the first shared plane owned by this
+ * head as the primary plane.
+ */
+- if (!primary) {
+- plane->type = DRM_PLANE_TYPE_PRIMARY;
++ if (!primary)
+ primary = plane;
+- }
+ }
+ }
+ }
+--- a/drivers/gpu/drm/tegra/hub.c
++++ b/drivers/gpu/drm/tegra/hub.c
+@@ -533,9 +533,9 @@ static const struct drm_plane_helper_fun
+ struct drm_plane *tegra_shared_plane_create(struct drm_device *drm,
+ struct tegra_dc *dc,
+ unsigned int wgrp,
+- unsigned int index)
++ unsigned int index,
++ enum drm_plane_type type)
+ {
+- enum drm_plane_type type = DRM_PLANE_TYPE_OVERLAY;
+ struct tegra_drm *tegra = drm->dev_private;
+ struct tegra_display_hub *hub = tegra->hub;
+ /* planes can be assigned to arbitrary CRTCs */
+--- a/drivers/gpu/drm/tegra/hub.h
++++ b/drivers/gpu/drm/tegra/hub.h
+@@ -81,7 +81,8 @@ void tegra_display_hub_cleanup(struct te
+ struct drm_plane *tegra_shared_plane_create(struct drm_device *drm,
+ struct tegra_dc *dc,
+ unsigned int wgrp,
+- unsigned int index);
++ unsigned int index,
++ enum drm_plane_type type);
+
+ int tegra_display_hub_atomic_check(struct drm_device *drm,
+ struct drm_atomic_state *state);
--- /dev/null
+From 85a720f4337f0ddf1603c8b75a8f1ffbbe022ef9 Mon Sep 17 00:00:00 2001
+From: Qasim Ijaz <qasdev00@gmail.com>
+Date: Fri, 6 Jun 2025 19:49:59 +0100
+Subject: HID: wacom: fix kobject reference count leak
+
+From: Qasim Ijaz <qasdev00@gmail.com>
+
+commit 85a720f4337f0ddf1603c8b75a8f1ffbbe022ef9 upstream.
+
+When sysfs_create_files() fails in wacom_initialize_remotes() the error
+is returned and the cleanup action will not have been registered yet.
+
+As a result the kobject???s refcount is never dropped, so the
+kobject can never be freed leading to a reference leak.
+
+Fix this by calling kobject_put() before returning.
+
+Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated")
+Acked-by: Ping Cheng <ping.cheng@wacom.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/wacom_sys.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -2031,6 +2031,7 @@ static int wacom_initialize_remotes(stru
+ hid_err(wacom->hdev,
+ "cannot create sysfs group err: %d\n", error);
+ kfifo_free(&remote->remote_fifo);
++ kobject_put(remote->remote_dir);
+ return error;
+ }
+
--- /dev/null
+From 5ae416c5b1e2e816aee7b3fc8347adf70afabb4c Mon Sep 17 00:00:00 2001
+From: Qasim Ijaz <qasdev00@gmail.com>
+Date: Fri, 6 Jun 2025 19:49:57 +0100
+Subject: HID: wacom: fix memory leak on kobject creation failure
+
+From: Qasim Ijaz <qasdev00@gmail.com>
+
+commit 5ae416c5b1e2e816aee7b3fc8347adf70afabb4c upstream.
+
+During wacom_initialize_remotes() a fifo buffer is allocated
+with kfifo_alloc() and later a cleanup action is registered
+during devm_add_action_or_reset() to clean it up.
+
+However if the code fails to create a kobject and register it
+with sysfs the code simply returns -ENOMEM before the cleanup
+action is registered leading to a memory leak.
+
+Fix this by ensuring the fifo is freed when the kobject creation
+and registration process fails.
+
+Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated")
+Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/wacom_sys.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -2020,8 +2020,10 @@ static int wacom_initialize_remotes(stru
+
+ remote->remote_dir = kobject_create_and_add("wacom_remote",
+ &wacom->hdev->dev.kobj);
+- if (!remote->remote_dir)
++ if (!remote->remote_dir) {
++ kfifo_free(&remote->remote_fifo);
+ return -ENOMEM;
++ }
+
+ error = sysfs_create_files(remote->remote_dir, remote_unpair_attrs);
+
--- /dev/null
+From 1a19ae437ca5d5c7d9ec2678946fb339b1c706bf Mon Sep 17 00:00:00 2001
+From: Qasim Ijaz <qasdev00@gmail.com>
+Date: Fri, 6 Jun 2025 19:49:58 +0100
+Subject: HID: wacom: fix memory leak on sysfs attribute creation failure
+
+From: Qasim Ijaz <qasdev00@gmail.com>
+
+commit 1a19ae437ca5d5c7d9ec2678946fb339b1c706bf upstream.
+
+When sysfs_create_files() fails during wacom_initialize_remotes() the
+fifo buffer is not freed leading to a memory leak.
+
+Fix this by calling kfifo_free() before returning.
+
+Fixes: 83e6b40e2de6 ("HID: wacom: EKR: have the wacom resources dynamically allocated")
+Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/wacom_sys.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -2030,6 +2030,7 @@ static int wacom_initialize_remotes(stru
+ if (error) {
+ hid_err(wacom->hdev,
+ "cannot create sysfs group err: %d\n", error);
++ kfifo_free(&remote->remote_fifo);
+ return error;
+ }
+
um-ubd-add-missing-error-check-in-start_io_thread.patch
net-enetc-correct-endianness-handling-in-_enetc_rd_r.patch
atm-release-atm_dev_mutex-after-removing-procfs-in-a.patch
+bluetooth-l2cap-fix-l2cap-mtu-negotiation.patch
+dm-raid-fix-variable-in-journal-device-check.patch
+hid-wacom-fix-memory-leak-on-kobject-creation-failure.patch
+hid-wacom-fix-memory-leak-on-sysfs-attribute-creation-failure.patch
+hid-wacom-fix-kobject-reference-count-leak.patch
+drm-tegra-assign-plane-type-before-registration.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
