--- /dev/null
+From 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 Mon Sep 17 00:00:00 2001
+From: Zichen Xie <zichenxie0106@gmail.com>
+Date: Sun, 6 Oct 2024 15:57:37 -0500
+Subject: ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe()
+
+From: Zichen Xie <zichenxie0106@gmail.com>
+
+commit 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 upstream.
+
+A devm_kzalloc() in asoc_qcom_lpass_cpu_platform_probe() could
+possibly return NULL pointer. NULL Pointer Dereference may be
+triggerred without addtional check.
+Add a NULL check for the returned pointer.
+
+Fixes: b5022a36d28f ("ASoC: qcom: lpass: Use regmap_field for i2sctl and dmactl registers")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
+Link: https://patch.msgid.link/20241006205737.8829-1-zichenxie0106@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/qcom/lpass-cpu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/qcom/lpass-cpu.c
++++ b/sound/soc/qcom/lpass-cpu.c
+@@ -1246,6 +1246,8 @@ int asoc_qcom_lpass_cpu_platform_probe(s
+ /* Allocation for i2sctl regmap fields */
+ drvdata->i2sctl = devm_kzalloc(&pdev->dev, sizeof(struct lpaif_i2sctl),
+ GFP_KERNEL);
++ if (!drvdata->i2sctl)
++ return -ENOMEM;
+
+ /* Initialize bitfields for dai I2SCTL register */
+ ret = lpass_cpu_init_i2sctl_bitfields(dev, drvdata->i2sctl,
--- /dev/null
+From 8e59a2a5459fd9840dbe2cbde85fe154b11e1727 Mon Sep 17 00:00:00 2001
+From: Niklas Cassel <cassel@kernel.org>
+Date: Wed, 23 Oct 2024 12:55:41 +0200
+Subject: ata: libata: Set DID_TIME_OUT for commands that actually timed out
+
+From: Niklas Cassel <cassel@kernel.org>
+
+commit 8e59a2a5459fd9840dbe2cbde85fe154b11e1727 upstream.
+
+When ata_qc_complete() schedules a command for EH using
+ata_qc_schedule_eh(), blk_abort_request() will be called, which leads to
+req->q->mq_ops->timeout() / scsi_timeout() being called.
+
+scsi_timeout(), if the LLDD has no abort handler (libata has no abort
+handler), will set host byte to DID_TIME_OUT, and then call
+scsi_eh_scmd_add() to add the command to EH.
+
+Thus, when commands first enter libata's EH strategy_handler, all the
+commands that have been added to EH will have DID_TIME_OUT set.
+
+Commit e5dd410acb34 ("ata: libata: Clear DID_TIME_OUT for ATA PT commands
+with sense data") clears this bogus DID_TIME_OUT flag for all commands
+that reached libata's EH strategy_handler.
+
+libata has its own flag (AC_ERR_TIMEOUT), that it sets for commands that
+have not received a completion at the time of entering EH.
+
+ata_eh_worth_retry() has no special handling for AC_ERR_TIMEOUT, so by
+default timed out commands will get flag ATA_QCFLAG_RETRY set, and will be
+retried after the port has been reset (ata_eh_link_autopsy() always
+triggers a port reset if any command has AC_ERR_TIMEOUT set).
+
+For a command that has ATA_QCFLAG_RETRY set, while also having an error
+flag set (e.g. AC_ERR_TIMEOUT), ata_eh_finish() will not increment
+scmd->allowed, so the command will at most be retried scmd->allowed number
+of times (which by default is set to 3).
+
+However, scsi_eh_flush_done_q() will only retry commands for which
+scsi_noretry_cmd() returns false.
+
+For a command that has DID_TIME_OUT set, while also having either the
+FAILFAST flag set, or the command being a passthrough command,
+scsi_noretry_cmd() will return true. Thus, such a command will never be
+retried.
+
+Thus, make sure that libata sets SCSI's DID_TIME_OUT flag for commands that
+actually timed out (libata's AC_ERR_TIMEOUT flag), such that timed out
+commands will once again not be retried if they are also a FAILFAST or
+passthrough command.
+
+Cc: stable@vger.kernel.org
+Fixes: e5dd410acb34 ("ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data")
+Reported-by: Lai, Yi <yi1.lai@linux.intel.com>
+Closes: https://lore.kernel.org/linux-ide/ZxYz871I3Blsi30F@ly-workstation/
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20241023105540.1070012-2-cassel@kernel.org
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-eh.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -636,6 +636,7 @@ void ata_scsi_cmd_error_handler(struct S
+ /* the scmd has an associated qc */
+ if (!(qc->flags & ATA_QCFLAG_EH)) {
+ /* which hasn't failed yet, timeout */
++ set_host_byte(scmd, DID_TIME_OUT);
+ qc->err_mask |= AC_ERR_TIMEOUT;
+ qc->flags |= ATA_QCFLAG_EH;
+ nr_timedout++;
--- /dev/null
+From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001
+From: Xinyu Zhang <xizhang@purestorage.com>
+Date: Wed, 23 Oct 2024 15:15:19 -0600
+Subject: block: fix sanity checks in blk_rq_map_user_bvec
+
+From: Xinyu Zhang <xizhang@purestorage.com>
+
+commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream.
+
+blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which
+causes unnecessary failures in NVMe passthrough I/O, reproducible as
+follows:
+
+- register a 2 page, page-aligned buffer against a ring
+- use that buffer to do a 1 page io_uring NVMe passthrough read
+
+The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will
+then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so
+the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to
+fail. This failure is unnecessary, as when the check succeeds, it means
+we've checked the entire buffer that will be used by the request - i.e.
+blk_rq_map_user_bvec should complete successfully. Therefore, terminate
+the loop early and return successfully when the check bytes + bv->bv_len
+> nr_iter succeeds.
+
+While we're at it, also remove the check that all segments in the bvec
+are single-page. While this seems to be true for all users of the
+function, it doesn't appear to be required anywhere downstream.
+
+CC: stable@vger.kernel.org
+Signed-off-by: Xinyu Zhang <xizhang@purestorage.com>
+Co-developed-by: Uday Shankar <ushankar@purestorage.com>
+Signed-off-by: Uday Shankar <ushankar@purestorage.com>
+Fixes: 37987547932c ("block: extend functionality to map bvec iterator")
+Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-map.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/block/blk-map.c
++++ b/block/blk-map.c
+@@ -600,9 +600,7 @@ static int blk_rq_map_user_bvec(struct r
+ if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len)
+ goto put_bio;
+ if (bytes + bv->bv_len > nr_iter)
+- goto put_bio;
+- if (bv->bv_offset + bv->bv_len > PAGE_SIZE)
+- goto put_bio;
++ break;
+
+ nsegs++;
+ bytes += bv->bv_len;
--- /dev/null
+From de96f6a3003513c796bbe4e23210a446913f5c00 Mon Sep 17 00:00:00 2001
+From: Michel Alex <Alex.Michel@wiedemann-group.com>
+Date: Wed, 16 Oct 2024 12:11:15 +0000
+Subject: net: phy: dp83822: Fix reset pin definitions
+
+From: Michel Alex <Alex.Michel@wiedemann-group.com>
+
+commit de96f6a3003513c796bbe4e23210a446913f5c00 upstream.
+
+This change fixes a rare issue where the PHY fails to detect a link
+due to incorrect reset behavior.
+
+The SW_RESET definition was incorrectly assigned to bit 14, which is the
+Digital Restart bit according to the datasheet. This commit corrects
+SW_RESET to bit 15 and assigns DIG_RESTART to bit 14 as per the
+datasheet specifications.
+
+The SW_RESET define is only used in the phy_reset function, which fully
+re-initializes the PHY after the reset is performed. The change in the
+bit definitions should not have any negative impact on the functionality
+of the PHY.
+
+v2:
+- added Fixes tag
+- improved commit message
+
+Cc: stable@vger.kernel.org
+Fixes: 5dc39fd5ef35 ("net: phy: DP83822: Add ability to advertise Fiber connection")
+Signed-off-by: Alex Michel <alex.michel@wiedemann-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Message-ID: <AS1P250MB0608A798661549BF83C4B43EA9462@AS1P250MB0608.EURP250.PROD.OUTLOOK.COM>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/dp83822.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -40,8 +40,8 @@
+ /* Control Register 2 bits */
+ #define DP83822_FX_ENABLE BIT(14)
+
+-#define DP83822_HW_RESET BIT(15)
+-#define DP83822_SW_RESET BIT(14)
++#define DP83822_SW_RESET BIT(15)
++#define DP83822_DIG_RESTART BIT(14)
+
+ /* PHY STS bits */
+ #define DP83822_PHYSTS_DUPLEX BIT(2)
hv_netvsc-fix-vf-namespace-also-in-synthetic-nic-netdev_register-event.patch
drm-amd-display-disable-psr-su-on-parade-08-01-tcon-too.patch
selinux-improve-error-checking-in-sel_write_load.patch
+net-phy-dp83822-fix-reset-pin-definitions.patch
+block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch
+ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch
+asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
