6.6-stable patches

added patches:
	can-mcp251x-fix-deadlock-if-an-interrupt-occurs-during-mcp251x_open.patch
	clk-qcom-clk-alpha-pll-fix-the-pll-post-div-mask.patch
	clk-qcom-clk-alpha-pll-fix-the-trion-pll-postdiv-set-rate-api.patch
	clk-qcom-clk-alpha-pll-fix-zonda-set_rate-failure-when-pll-is-disabled.patch
	clk-qcom-clk-alpha-pll-update-set_rate-for-zonda-pll.patch
	clk-starfive-jh7110-sys-add-notifier-for-pll0-clock.patch
	kexec_file-fix-elfcorehdr-digest-exclusion-when-config_crash_hotplug-y.patch
	mm-vmalloc-ensure-vmap_block-is-initialised-before-adding-to-queue.patch

diff --git a/queue-6.6/can-mcp251x-fix-deadlock-if-an-interrupt-occurs-during-mcp251x_open.patch b/queue-6.6/can-mcp251x-fix-deadlock-if-an-interrupt-occurs-during-mcp251x_open.patch
new file mode 100644 (file)
index 0000000..f5ed8f7
--- /dev/null
+++ b/queue-6.6/can-mcp251x-fix-deadlock-if-an-interrupt-occurs-during-mcp251x_open.patch
@@ -0,0 +1,52 @@
+From 7dd9c26bd6cf679bcfdef01a8659791aa6487a29 Mon Sep 17 00:00:00 2001
+From: Simon Arlott <simon@octiron.net>
+Date: Thu, 22 Aug 2024 08:25:07 +0100
+Subject: can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
+
+From: Simon Arlott <simon@octiron.net>
+
+commit 7dd9c26bd6cf679bcfdef01a8659791aa6487a29 upstream.
+
+The mcp251x_hw_wake() function is called with the mpc_lock mutex held and
+disables the interrupt handler so that no interrupts can be processed while
+waking the device. If an interrupt has already occurred then waiting for
+the interrupt handler to complete will deadlock because it will be trying
+to acquire the same mutex.
+
+CPU0                           CPU1
+----                           ----
+mcp251x_open()
+ mutex_lock(&priv->mcp_lock)
+  request_threaded_irq()
+                               <interrupt>
+                               mcp251x_can_ist()
+                                mutex_lock(&priv->mcp_lock)
+  mcp251x_hw_wake()
+   disable_irq() <-- deadlock
+
+Use disable_irq_nosync() instead because the interrupt handler does
+everything while holding the mutex so it doesn't matter if it's still
+running.
+
+Fixes: 8ce8c0abcba3 ("can: mcp251x: only reset hardware as required")
+Signed-off-by: Simon Arlott <simon@octiron.net>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/4fc08687-1d80-43fe-9f0d-8ef8475e75f6@0882a8b5-c6c3-11e9-b005-00805fc181fe.uuid.home.arpa
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/spi/mcp251x.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -753,7 +753,7 @@ static int mcp251x_hw_wake(struct spi_de
+       int ret;
+ 
+       /* Force wakeup interrupt to wake device, but don't execute IST */
+-      disable_irq(spi->irq);
++      disable_irq_nosync(spi->irq);
+       mcp251x_write_2regs(spi, CANINTE, CANINTE_WAKIE, CANINTF_WAKIF);
+ 
+       /* Wait for oscillator startup timer after wake up */

diff --git a/queue-6.6/clk-qcom-clk-alpha-pll-fix-the-pll-post-div-mask.patch b/queue-6.6/clk-qcom-clk-alpha-pll-fix-the-pll-post-div-mask.patch
new file mode 100644 (file)
index 0000000..f685adc
--- /dev/null
+++ b/queue-6.6/clk-qcom-clk-alpha-pll-fix-the-pll-post-div-mask.patch
@@ -0,0 +1,33 @@
+From 2c4553e6c485a96b5d86989eb9654bf20e51e6dd Mon Sep 17 00:00:00 2001
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Date: Wed, 31 Jul 2024 11:59:09 +0530
+Subject: clk: qcom: clk-alpha-pll: Fix the pll post div mask
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+commit 2c4553e6c485a96b5d86989eb9654bf20e51e6dd upstream.
+
+The PLL_POST_DIV_MASK should be 0 to (width - 1) bits. Fix it.
+
+Fixes: 1c3541145cbf ("clk: qcom: support for 2 bit PLL post divider")
+Cc: stable@vger.kernel.org
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Link: https://lore.kernel.org/r/20240731062916.2680823-2-quic_skakitap@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -40,7 +40,7 @@
+ 
+ #define PLL_USER_CTL(p)               ((p)->offset + (p)->regs[PLL_OFF_USER_CTL])
+ # define PLL_POST_DIV_SHIFT   8
+-# define PLL_POST_DIV_MASK(p) GENMASK((p)->width, 0)
++# define PLL_POST_DIV_MASK(p) GENMASK((p)->width - 1, 0)
+ # define PLL_ALPHA_EN         BIT(24)
+ # define PLL_ALPHA_MODE               BIT(25)
+ # define PLL_VCO_SHIFT                20

diff --git a/queue-6.6/clk-qcom-clk-alpha-pll-fix-the-trion-pll-postdiv-set-rate-api.patch b/queue-6.6/clk-qcom-clk-alpha-pll-fix-the-trion-pll-postdiv-set-rate-api.patch
new file mode 100644 (file)
index 0000000..45466f8
--- /dev/null
+++ b/queue-6.6/clk-qcom-clk-alpha-pll-fix-the-trion-pll-postdiv-set-rate-api.patch
@@ -0,0 +1,37 @@
+From 4ad1ed6ef27cab94888bb3c740c14042d5c0dff2 Mon Sep 17 00:00:00 2001
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Date: Wed, 31 Jul 2024 11:59:10 +0530
+Subject: clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+commit 4ad1ed6ef27cab94888bb3c740c14042d5c0dff2 upstream.
+
+Correct the pll postdiv shift used in clk_trion_pll_postdiv_set_rate
+API. The shift value is not same for different types of plls and
+should be taken from the pll's .post_div_shift member.
+
+Fixes: 548a909597d5 ("clk: qcom: clk-alpha-pll: Add support for Trion PLLs")
+Cc: stable@vger.kernel.org
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240731062916.2680823-3-quic_skakitap@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -1478,8 +1478,8 @@ clk_trion_pll_postdiv_set_rate(struct cl
+       }
+ 
+       return regmap_update_bits(regmap, PLL_USER_CTL(pll),
+-                                PLL_POST_DIV_MASK(pll) << PLL_POST_DIV_SHIFT,
+-                                val << PLL_POST_DIV_SHIFT);
++                                PLL_POST_DIV_MASK(pll) << pll->post_div_shift,
++                                val << pll->post_div_shift);
+ }
+ 
+ const struct clk_ops clk_alpha_pll_postdiv_trion_ops = {

diff --git a/queue-6.6/clk-qcom-clk-alpha-pll-fix-zonda-set_rate-failure-when-pll-is-disabled.patch b/queue-6.6/clk-qcom-clk-alpha-pll-fix-zonda-set_rate-failure-when-pll-is-disabled.patch
new file mode 100644 (file)
index 0000000..968415f
--- /dev/null
+++ b/queue-6.6/clk-qcom-clk-alpha-pll-fix-zonda-set_rate-failure-when-pll-is-disabled.patch
@@ -0,0 +1,37 @@
+From 85e8ee59dfde1a7b847fbed0778391392cd985cb Mon Sep 17 00:00:00 2001
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Date: Wed, 31 Jul 2024 11:59:11 +0530
+Subject: clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+commit 85e8ee59dfde1a7b847fbed0778391392cd985cb upstream.
+
+Currently, clk_zonda_pll_set_rate polls for the PLL to lock even if the
+PLL is disabled. However, if the PLL is disabled then LOCK_DET will
+never assert and we'll return an error. There is no reason to poll
+LOCK_DET if the PLL is already disabled, so skip polling in this case.
+
+Fixes: f21b6bfecc27 ("clk: qcom: clk-alpha-pll: add support for zonda pll")
+Cc: stable@vger.kernel.org
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240731062916.2680823-4-quic_skakitap@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -2062,6 +2062,9 @@ static int clk_zonda_pll_set_rate(struct
+       regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), a);
+       regmap_write(pll->clkr.regmap, PLL_L_VAL(pll), l);
+ 
++      if (!clk_hw_is_enabled(hw))
++              return 0;
++
+       /* Wait before polling for the frequency latch */
+       udelay(5);
+ 

diff --git a/queue-6.6/clk-qcom-clk-alpha-pll-update-set_rate-for-zonda-pll.patch b/queue-6.6/clk-qcom-clk-alpha-pll-update-set_rate-for-zonda-pll.patch
new file mode 100644 (file)
index 0000000..cd372a5
--- /dev/null
+++ b/queue-6.6/clk-qcom-clk-alpha-pll-update-set_rate-for-zonda-pll.patch
@@ -0,0 +1,63 @@
+From f4973130d255dd4811006f5822d4fa4d0de9d712 Mon Sep 17 00:00:00 2001
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Date: Wed, 31 Jul 2024 11:59:12 +0530
+Subject: clk: qcom: clk-alpha-pll: Update set_rate for Zonda PLL
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+commit f4973130d255dd4811006f5822d4fa4d0de9d712 upstream.
+
+The Zonda PLL has a 16 bit signed alpha and in the cases where the alpha
+value is greater than 0.5, the L value needs to be adjusted accordingly.
+Thus update the logic to handle the signed alpha val.
+
+Fixes: f21b6bfecc27 ("clk: qcom: clk-alpha-pll: add support for zonda pll")
+Cc: stable@vger.kernel.org
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240731062916.2680823-5-quic_skakitap@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c |   16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -41,6 +41,7 @@
+ #define PLL_USER_CTL(p)               ((p)->offset + (p)->regs[PLL_OFF_USER_CTL])
+ # define PLL_POST_DIV_SHIFT   8
+ # define PLL_POST_DIV_MASK(p) GENMASK((p)->width - 1, 0)
++# define PLL_ALPHA_MSB                BIT(15)
+ # define PLL_ALPHA_EN         BIT(24)
+ # define PLL_ALPHA_MODE               BIT(25)
+ # define PLL_VCO_SHIFT                20
+@@ -2043,6 +2044,18 @@ static void clk_zonda_pll_disable(struct
+       regmap_write(regmap, PLL_OPMODE(pll), 0x0);
+ }
+ 
++static void zonda_pll_adjust_l_val(unsigned long rate, unsigned long prate, u32 *l)
++{
++      u64 remainder, quotient;
++
++      quotient = rate;
++      remainder = do_div(quotient, prate);
++      *l = quotient;
++
++      if ((remainder * 2) / prate)
++              *l = *l + 1;
++}
++
+ static int clk_zonda_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+                                 unsigned long prate)
+ {
+@@ -2059,6 +2072,9 @@ static int clk_zonda_pll_set_rate(struct
+       if (ret < 0)
+               return ret;
+ 
++      if (a & PLL_ALPHA_MSB)
++              zonda_pll_adjust_l_val(rate, prate, &l);
++
+       regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), a);
+       regmap_write(pll->clkr.regmap, PLL_L_VAL(pll), l);
+ 

diff --git a/queue-6.6/clk-starfive-jh7110-sys-add-notifier-for-pll0-clock.patch b/queue-6.6/clk-starfive-jh7110-sys-add-notifier-for-pll0-clock.patch
new file mode 100644 (file)
index 0000000..003b1e0
--- /dev/null
+++ b/queue-6.6/clk-starfive-jh7110-sys-add-notifier-for-pll0-clock.patch
@@ -0,0 +1,93 @@
+From 538d5477b25289ac5d46ca37b9e5b4d685cbe019 Mon Sep 17 00:00:00 2001
+From: Xingyu Wu <xingyu.wu@starfivetech.com>
+Date: Mon, 26 Aug 2024 16:04:29 +0800
+Subject: clk: starfive: jh7110-sys: Add notifier for PLL0 clock
+
+From: Xingyu Wu <xingyu.wu@starfivetech.com>
+
+commit 538d5477b25289ac5d46ca37b9e5b4d685cbe019 upstream.
+
+Add notifier function for PLL0 clock. In the function, the cpu_root clock
+should be operated by saving its current parent and setting a new safe
+parent (osc clock) before setting the PLL0 clock rate. After setting PLL0
+rate, it should be switched back to the original parent clock.
+
+Fixes: e2c510d6d630 ("riscv: dts: starfive: Add cpu scaling for JH7110 SoC")
+Cc: stable@vger.kernel.org
+Reviewed-by: Emil Renner Berthing <emil.renner.berthing@canonical.com>
+Signed-off-by: Xingyu Wu <xingyu.wu@starfivetech.com>
+Link: https://lore.kernel.org/r/20240826080430.179788-2-xingyu.wu@starfivetech.com
+Reviewed-by: Hal Feng <hal.feng@starfivetech.com>
+Tested-by: Michael Jeanson <mjeanson@efficios.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../clk/starfive/clk-starfive-jh7110-sys.c    | 31 ++++++++++++++++++-
+ drivers/clk/starfive/clk-starfive-jh71x0.h    |  2 ++
+ 2 files changed, 32 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/starfive/clk-starfive-jh7110-sys.c b/drivers/clk/starfive/clk-starfive-jh7110-sys.c
+index 8f5e5abfa178..17325f17696f 100644
+--- a/drivers/clk/starfive/clk-starfive-jh7110-sys.c
++++ b/drivers/clk/starfive/clk-starfive-jh7110-sys.c
+@@ -385,6 +385,32 @@ int jh7110_reset_controller_register(struct jh71x0_clk_priv *priv,
+ }
+ EXPORT_SYMBOL_GPL(jh7110_reset_controller_register);
+ 
++/*
++ * This clock notifier is called when the rate of PLL0 clock is to be changed.
++ * The cpu_root clock should save the curent parent clock and switch its parent
++ * clock to osc before PLL0 rate will be changed. Then switch its parent clock
++ * back after the PLL0 rate is completed.
++ */
++static int jh7110_pll0_clk_notifier_cb(struct notifier_block *nb,
++                                     unsigned long action, void *data)
++{
++      struct jh71x0_clk_priv *priv = container_of(nb, struct jh71x0_clk_priv, pll_clk_nb);
++      struct clk *cpu_root = priv->reg[JH7110_SYSCLK_CPU_ROOT].hw.clk;
++      int ret = 0;
++
++      if (action == PRE_RATE_CHANGE) {
++              struct clk *osc = clk_get(priv->dev, "osc");
++
++              priv->original_clk = clk_get_parent(cpu_root);
++              ret = clk_set_parent(cpu_root, osc);
++              clk_put(osc);
++      } else if (action == POST_RATE_CHANGE) {
++              ret = clk_set_parent(cpu_root, priv->original_clk);
++      }
++
++      return notifier_from_errno(ret);
++}
++
+ static int __init jh7110_syscrg_probe(struct platform_device *pdev)
+ {
+       struct jh71x0_clk_priv *priv;
+@@ -413,7 +439,10 @@ static int __init jh7110_syscrg_probe(struct platform_device *pdev)
+               if (IS_ERR(priv->pll[0]))
+                       return PTR_ERR(priv->pll[0]);
+       } else {
+-              clk_put(pllclk);
++              priv->pll_clk_nb.notifier_call = jh7110_pll0_clk_notifier_cb;
++              ret = clk_notifier_register(pllclk, &priv->pll_clk_nb);
++              if (ret)
++                      return ret;
+               priv->pll[0] = NULL;
+       }
+ 
+diff --git a/drivers/clk/starfive/clk-starfive-jh71x0.h b/drivers/clk/starfive/clk-starfive-jh71x0.h
+index 23e052fc1549..e3f441393e48 100644
+--- a/drivers/clk/starfive/clk-starfive-jh71x0.h
++++ b/drivers/clk/starfive/clk-starfive-jh71x0.h
+@@ -114,6 +114,8 @@ struct jh71x0_clk_priv {
+       spinlock_t rmw_lock;
+       struct device *dev;
+       void __iomem *base;
++      struct clk *original_clk;
++      struct notifier_block pll_clk_nb;
+       struct clk_hw *pll[3];
+       struct jh71x0_clk reg[];
+ };
+-- 
+2.46.0
+

diff --git a/queue-6.6/kexec_file-fix-elfcorehdr-digest-exclusion-when-config_crash_hotplug-y.patch b/queue-6.6/kexec_file-fix-elfcorehdr-digest-exclusion-when-config_crash_hotplug-y.patch
new file mode 100644 (file)
index 0000000..d1a4331
--- /dev/null
+++ b/queue-6.6/kexec_file-fix-elfcorehdr-digest-exclusion-when-config_crash_hotplug-y.patch
@@ -0,0 +1,44 @@
+From 6dacd79d28842ff01f18b4900d897741aac5999e Mon Sep 17 00:00:00 2001
+From: Petr Tesarik <ptesarik@suse.com>
+Date: Mon, 5 Aug 2024 17:07:50 +0200
+Subject: kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y
+
+From: Petr Tesarik <ptesarik@suse.com>
+
+commit 6dacd79d28842ff01f18b4900d897741aac5999e upstream.
+
+Fix the condition to exclude the elfcorehdr segment from the SHA digest
+calculation.
+
+The j iterator is an index into the output sha_regions[] array, not into
+the input image->segment[] array.  Once it reaches
+image->elfcorehdr_index, all subsequent segments are excluded.  Besides,
+if the purgatory segment precedes the elfcorehdr segment, the elfcorehdr
+may be wrongly included in the calculation.
+
+Link: https://lkml.kernel.org/r/20240805150750.170739-1-petr.tesarik@suse.com
+Fixes: f7cc804a9fd4 ("kexec: exclude elfcorehdr from the segment digest")
+Signed-off-by: Petr Tesarik <ptesarik@suse.com>
+Acked-by: Baoquan He <bhe@redhat.com>
+Cc: Eric Biederman <ebiederm@xmission.com>
+Cc: Hari Bathini <hbathini@linux.ibm.com>
+Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
+Cc: Eric DeVolder <eric_devolder@yahoo.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/kexec_file.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/kexec_file.c
++++ b/kernel/kexec_file.c
+@@ -728,7 +728,7 @@ static int kexec_calculate_store_digests
+ 
+ #ifdef CONFIG_CRASH_HOTPLUG
+               /* Exclude elfcorehdr segment to allow future changes via hotplug */
+-              if (j == image->elfcorehdr_index)
++              if (i == image->elfcorehdr_index)
+                       continue;
+ #endif
+ 

diff --git a/queue-6.6/mm-vmalloc-ensure-vmap_block-is-initialised-before-adding-to-queue.patch b/queue-6.6/mm-vmalloc-ensure-vmap_block-is-initialised-before-adding-to-queue.patch
new file mode 100644 (file)
index 0000000..3d36745
--- /dev/null
+++ b/queue-6.6/mm-vmalloc-ensure-vmap_block-is-initialised-before-adding-to-queue.patch
@@ -0,0 +1,72 @@
+From 3e3de7947c751509027d26b679ecd243bc9db255 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Mon, 12 Aug 2024 18:16:06 +0100
+Subject: mm: vmalloc: ensure vmap_block is initialised before adding to queue
+
+From: Will Deacon <will@kernel.org>
+
+commit 3e3de7947c751509027d26b679ecd243bc9db255 upstream.
+
+Commit 8c61291fd850 ("mm: fix incorrect vbq reference in
+purge_fragmented_block") extended the 'vmap_block' structure to contain a
+'cpu' field which is set at allocation time to the id of the initialising
+CPU.
+
+When a new 'vmap_block' is being instantiated by new_vmap_block(), the
+partially initialised structure is added to the local 'vmap_block_queue'
+xarray before the 'cpu' field has been initialised.  If another CPU is
+concurrently walking the xarray (e.g.  via vm_unmap_aliases()), then it
+may perform an out-of-bounds access to the remote queue thanks to an
+uninitialised index.
+
+This has been observed as UBSAN errors in Android:
+
+ | Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP
+ |
+ | Call trace:
+ |  purge_fragmented_block+0x204/0x21c
+ |  _vm_unmap_aliases+0x170/0x378
+ |  vm_unmap_aliases+0x1c/0x28
+ |  change_memory_common+0x1dc/0x26c
+ |  set_memory_ro+0x18/0x24
+ |  module_enable_ro+0x98/0x238
+ |  do_init_module+0x1b0/0x310
+
+Move the initialisation of 'vb->cpu' in new_vmap_block() ahead of the
+addition to the xarray.
+
+Link: https://lkml.kernel.org/r/20240812171606.17486-1-will@kernel.org
+Fixes: 8c61291fd850 ("mm: fix incorrect vbq reference in purge_fragmented_block")
+Signed-off-by: Will Deacon <will@kernel.org>
+Reviewed-by: Baoquan He <bhe@redhat.com>
+Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Cc: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
+Cc: Hailong.Liu <hailong.liu@oppo.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Lorenzo Stoakes <lstoakes@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/vmalloc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -2066,6 +2066,7 @@ static void *new_vmap_block(unsigned int
+       vb->dirty_max = 0;
+       bitmap_set(vb->used_map, 0, (1UL << order));
+       INIT_LIST_HEAD(&vb->free_list);
++      vb->cpu = raw_smp_processor_id();
+ 
+       xa = addr_to_vb_xa(va->va_start);
+       vb_idx = addr_to_vb_idx(va->va_start);
+@@ -2082,7 +2083,6 @@ static void *new_vmap_block(unsigned int
+        * integrity together with list_for_each_rcu from read
+        * side.
+        */
+-      vb->cpu = raw_smp_processor_id();
+       vbq = per_cpu_ptr(&vmap_block_queue, vb->cpu);
+       spin_lock(&vbq->lock);
+       list_add_tail_rcu(&vb->free_list, &vbq->free);

diff --git a/queue-6.6/series b/queue-6.6/series
index 664ffed193c666823c502519b99593ba1f46bc58..c955cc0d75685b8adb2dfa7e627b1c13f2111655 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -29,3 +29,11 @@ mmc-cqhci-fix-checking-of-cqhci_halt-state.patch
 fuse-update-stats-for-pages-in-dropped-aux-writeback-list.patch
 fuse-use-unsigned-type-for-getxattr-listxattr-size-truncation.patch
 fuse-fix-memory-leak-in-fuse_create_open.patch
+clk-starfive-jh7110-sys-add-notifier-for-pll0-clock.patch
+clk-qcom-clk-alpha-pll-fix-the-pll-post-div-mask.patch
+clk-qcom-clk-alpha-pll-fix-the-trion-pll-postdiv-set-rate-api.patch
+clk-qcom-clk-alpha-pll-fix-zonda-set_rate-failure-when-pll-is-disabled.patch
+clk-qcom-clk-alpha-pll-update-set_rate-for-zonda-pll.patch
+can-mcp251x-fix-deadlock-if-an-interrupt-occurs-during-mcp251x_open.patch
+kexec_file-fix-elfcorehdr-digest-exclusion-when-config_crash_hotplug-y.patch
+mm-vmalloc-ensure-vmap_block-is-initialised-before-adding-to-queue.patch