--- /dev/null
+From efeae011b1e62afcbb290f011e4e835d2027e54a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 15:45:52 -0600
+Subject: hwmon: (tmp513) Fix division of negative numbers
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit e2c68cea431d65292b592c9f8446c918d45fcf78 ]
+
+Fix several issues with division of negative numbers in the tmp513
+driver.
+
+The docs on the DIV_ROUND_CLOSEST macro explain that dividing a negative
+value by an unsigned type is undefined behavior. The driver was doing
+this in several places, i.e. data->shunt_uohms has type of u32. The
+actual "undefined" behavior is that it converts both values to unsigned
+before doing the division, for example:
+
+ int ret = DIV_ROUND_CLOSEST(-100, 3U);
+
+results in ret == 1431655732 instead of -33.
+
+Furthermore the MILLI macro has a type of unsigned long. Multiplying a
+signed long by an unsigned long results in an unsigned long.
+
+So, we need to cast both MILLI and data data->shunt_uohms to long when
+using the DIV_ROUND_CLOSEST macro.
+
+Fixes: f07f9d2467f4 ("hwmon: (tmp513) Use SI constants from units.h")
+Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://lore.kernel.org/r/20250114-fix-si-prefix-macro-sign-bugs-v1-1-696fd8d10f00@baylibre.com
+[groeck: Drop some continuation lines]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/tmp513.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
+index 070f93226ed69..62d31aadda4bb 100644
+--- a/drivers/hwmon/tmp513.c
++++ b/drivers/hwmon/tmp513.c
+@@ -203,7 +203,8 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
+ *val = sign_extend32(regval,
+ reg == TMP51X_SHUNT_CURRENT_RESULT ?
+ 16 - tmp51x_get_pga_shift(data) : 15);
+- *val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms);
++ *val = DIV_ROUND_CLOSEST(*val * 10 * (long)MILLI, (long)data->shunt_uohms);
++
+ break;
+ case TMP51X_BUS_VOLTAGE_RESULT:
+ case TMP51X_BUS_VOLTAGE_H_LIMIT:
+@@ -219,7 +220,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos,
+ case TMP51X_BUS_CURRENT_RESULT:
+ // Current = (ShuntVoltage * CalibrationRegister) / 4096
+ *val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua;
+- *val = DIV_ROUND_CLOSEST(*val, MILLI);
++ *val = DIV_ROUND_CLOSEST(*val, (long)MILLI);
+ break;
+ case TMP51X_LOCAL_TEMP_RESULT:
+ case TMP51X_REMOTE_TEMP_RESULT_1:
+@@ -259,7 +260,7 @@ static int tmp51x_set_value(struct tmp51x_data *data, u8 reg, long val)
+ * The user enter current value and we convert it to
+ * voltage. 1lsb = 10uV
+ */
+- val = DIV_ROUND_CLOSEST(val * data->shunt_uohms, 10 * MILLI);
++ val = DIV_ROUND_CLOSEST(val * (long)data->shunt_uohms, 10 * (long)MILLI);
+ max_val = U16_MAX >> tmp51x_get_pga_shift(data);
+ regval = clamp_val(val, -max_val, max_val);
+ break;
+--
+2.39.5
+
--- /dev/null
+From 6b62cebb995f6dfc3a5771613e2ff26712e90c0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 08:29:45 +0100
+Subject: i2c: mux: demux-pinctrl: check initial mux selection, too
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit ca89f73394daf92779ddaa37b42956f4953f3941 ]
+
+When misconfigured, the initial setup of the current mux channel can
+fail, too. It must be checked as well.
+
+Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 9f2e4aa281593..299abb6dd9423 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -261,7 +261,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ pm_runtime_no_callbacks(&pdev->dev);
+
+ /* switch to first parent as active master */
+- i2c_demux_activate_master(priv, 0);
++ err = i2c_demux_activate_master(priv, 0);
++ if (err)
++ goto err_rollback;
+
+ err = device_create_file(&pdev->dev, &dev_attr_available_masters);
+ if (err)
+--
+2.39.5
+
--- /dev/null
+From 029d7678985802d5761540dc0696423923502881 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 13:36:23 +0100
+Subject: i2c: rcar: fix NACK handling when being a target
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 093f70c134f70e4632b295240f07d2b50b74e247 ]
+
+When this controller is a target, the NACK handling had two issues.
+First, the return value from the backend was not checked on the initial
+WRITE_REQUESTED. So, the driver missed to send a NACK in this case.
+Also, the NACK always arrives one byte late on the bus, even in the
+WRITE_RECEIVED case. This seems to be a HW issue. We should then not
+rely on the backend to correctly NACK the superfluous byte as well. Fix
+both issues by introducing a flag which gets set whenever the backend
+requests a NACK and keep sending it until we get a STOP condition.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 84fdd3f5cc844..610df67cedaad 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -110,6 +110,8 @@
+ #define ID_P_PM_BLOCKED BIT(31)
+ #define ID_P_MASK GENMASK(31, 28)
+
++#define ID_SLAVE_NACK BIT(0)
++
+ enum rcar_i2c_type {
+ I2C_RCAR_GEN1,
+ I2C_RCAR_GEN2,
+@@ -143,6 +145,7 @@ struct rcar_i2c_priv {
+ int irq;
+
+ struct i2c_client *host_notify_client;
++ u8 slave_flags;
+ };
+
+ #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent)
+@@ -597,6 +600,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ {
+ u32 ssr_raw, ssr_filtered;
+ u8 value;
++ int ret;
+
+ ssr_raw = rcar_i2c_read(priv, ICSSR) & 0xff;
+ ssr_filtered = ssr_raw & rcar_i2c_read(priv, ICSIER);
+@@ -612,7 +616,10 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ rcar_i2c_write(priv, ICRXTX, value);
+ rcar_i2c_write(priv, ICSIER, SDE | SSR | SAR);
+ } else {
+- i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value);
++ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value);
++ if (ret)
++ priv->slave_flags |= ID_SLAVE_NACK;
++
+ rcar_i2c_read(priv, ICRXTX); /* dummy read */
+ rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
+ }
+@@ -625,18 +632,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ if (ssr_filtered & SSR) {
+ i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
++ priv->slave_flags &= ~ID_SLAVE_NACK;
+ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
+ }
+
+ /* master wants to write to us */
+ if (ssr_filtered & SDR) {
+- int ret;
+-
+ value = rcar_i2c_read(priv, ICRXTX);
+ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_RECEIVED, &value);
+- /* Send NACK in case of error */
+- rcar_i2c_write(priv, ICSCR, SIE | SDBS | (ret < 0 ? FNA : 0));
++ if (ret)
++ priv->slave_flags |= ID_SLAVE_NACK;
++
++ /* Send NACK in case of error, but it will come 1 byte late :( */
++ rcar_i2c_write(priv, ICSCR, SIE | SDBS |
++ (priv->slave_flags & ID_SLAVE_NACK ? FNA : 0));
+ rcar_i2c_write(priv, ICSSR, ~SDR & 0xff);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 444429ea7f42d63b7e4d6b239e3e1dc68be4f095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 13:41:56 +0000
+Subject: Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
+
+From: Pratyush Yadav <pratyush@kernel.org>
+
+[ Upstream commit d15638bf76ad47874ecb5dc386f0945fc0b2a875 ]
+
+This reverts commit 98d1fb94ce75f39febd456d6d3cbbe58b6678795.
+
+The commit uses data nbits instead of addr nbits for dummy phase. This
+causes a regression for all boards where spi-tx-bus-width is smaller
+than spi-rx-bus-width. It is a common pattern for boards to have
+spi-tx-bus-width == 1 and spi-rx-bus-width > 1. The regression causes
+all reads with a dummy phase to become unavailable for such boards,
+leading to a usually slower 0-dummy-cycle read being selected.
+
+Most controllers' supports_op hooks call spi_mem_default_supports_op().
+In spi_mem_default_supports_op(), spi_mem_check_buswidth() is called to
+check if the buswidths for the op can actually be supported by the
+board's wiring. This wiring information comes from (among other things)
+the spi-{tx,rx}-bus-width DT properties. Based on these properties,
+SPI_TX_* or SPI_RX_* flags are set by of_spi_parse_dt().
+spi_mem_check_buswidth() then uses these flags to make the decision
+whether an op can be supported by the board's wiring (in a way,
+indirectly checking against spi-{rx,tx}-bus-width).
+
+Now the tricky bit here is that spi_mem_check_buswidth() does:
+
+ if (op->dummy.nbytes &&
+ spi_check_buswidth_req(mem, op->dummy.buswidth, true))
+ return false;
+
+The true argument to spi_check_buswidth_req() means the op is treated as
+a TX op. For a board that has say 1-bit TX and 4-bit RX, a 4-bit dummy
+TX is considered as unsupported, and the op gets rejected.
+
+The commit being reverted uses the data buswidth for dummy buswidth. So
+for reads, the RX buswidth gets used for the dummy phase, uncovering
+this issue. In reality, a dummy phase is neither RX nor TX. As the name
+suggests, these are just dummy cycles that send or receive no data, and
+thus don't really need to have any buswidth at all.
+
+Ideally, dummy phases should not be checked against the board's wiring
+capabilities at all, and should only be sanity-checked for having a sane
+buswidth value. Since we are now at rc7 and such a change might
+introduce many unexpected bugs, revert the commit for now. It can be
+sent out later along with the spi_mem_check_buswidth() fix.
+
+Fixes: 98d1fb94ce75 ("mtd: spi-nor: core: replace dummy buswidth from addr to data")
+Reported-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Closes: https://lore.kernel.org/linux-mtd/3342163.44csPzL39Z@steina-w/
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
+index 8d75a66775cb1..1b0c6770c14e4 100644
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -89,7 +89,7 @@ void spi_nor_spimem_setup_op(const struct spi_nor *nor,
+ op->addr.buswidth = spi_nor_get_protocol_addr_nbits(proto);
+
+ if (op->dummy.nbytes)
+- op->dummy.buswidth = spi_nor_get_protocol_data_nbits(proto);
++ op->dummy.buswidth = spi_nor_get_protocol_addr_nbits(proto);
+
+ if (op->data.nbytes)
+ op->data.buswidth = spi_nor_get_protocol_data_nbits(proto);
+--
+2.39.5
+
net-mlx5e-always-start-ipsec-sequence-number-from-1.patch
drm-vmwgfx-add-new-keep_resv-bo-param.patch
drm-v3d-ensure-job-pointer-is-set-to-null-after-job-.patch
+soc-ti-pruss-fix-pruss-apis.patch
+hwmon-tmp513-fix-division-of-negative-numbers.patch
+revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch
+i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch
+i2c-rcar-fix-nack-handling-when-being-a-target.patch
+smb-client-fix-double-free-of-tcp_server_info-hostna.patch
--- /dev/null
+From 7d432a84288cf9d569b6007552ceb939cd8edf15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 12:48:48 -0300
+Subject: smb: client: fix double free of TCP_Server_Info::hostname
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+[ Upstream commit fa2f9906a7b333ba757a7dbae0713d8a5396186e ]
+
+When shutting down the server in cifs_put_tcp_session(), cifsd thread
+might be reconnecting to multiple DFS targets before it realizes it
+should exit the loop, so @server->hostname can't be freed as long as
+cifsd thread isn't done. Otherwise the following can happen:
+
+ RIP: 0010:__slab_free+0x223/0x3c0
+ Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89
+ 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f>
+ 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80
+ RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246
+ RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068
+ RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400
+ RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000
+ R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500
+ R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068
+ FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000)
+ 000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4:
+ PKRU: 55555554
+ Call Trace:
+ <TASK>
+ ? show_trace_log_lvl+0x1c4/0x2df
+ ? show_trace_log_lvl+0x1c4/0x2df
+ ? __reconnect_target_unlocked+0x3e/0x160 [cifs]
+ ? __die_body.cold+0x8/0xd
+ ? die+0x2b/0x50
+ ? do_trap+0xce/0x120
+ ? __slab_free+0x223/0x3c0
+ ? do_error_trap+0x65/0x80
+ ? __slab_free+0x223/0x3c0
+ ? exc_invalid_op+0x4e/0x70
+ ? __slab_free+0x223/0x3c0
+ ? asm_exc_invalid_op+0x16/0x20
+ ? __slab_free+0x223/0x3c0
+ ? extract_hostname+0x5c/0xa0 [cifs]
+ ? extract_hostname+0x5c/0xa0 [cifs]
+ ? __kmalloc+0x4b/0x140
+ __reconnect_target_unlocked+0x3e/0x160 [cifs]
+ reconnect_dfs_server+0x145/0x430 [cifs]
+ cifs_handle_standard+0x1ad/0x1d0 [cifs]
+ cifs_demultiplex_thread+0x592/0x730 [cifs]
+ ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
+ kthread+0xdd/0x100
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x29/0x50
+ </TASK>
+
+Fixes: 7be3248f3139 ("cifs: To match file servers, make sure the server hostname matches")
+Reported-by: Jay Shin <jaeshin@redhat.com>
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/connect.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
+index 20f303f2a5d75..dbcaaa274abdb 100644
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -1061,6 +1061,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server)
+ /* Release netns reference for this server. */
+ put_net(cifs_net_ns(server));
+ kfree(server->leaf_fullpath);
++ kfree(server->hostname);
+ kfree(server);
+
+ length = atomic_dec_return(&tcpSesAllocCount);
+@@ -1684,8 +1685,6 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
+ kfree_sensitive(server->session_key.response);
+ server->session_key.response = NULL;
+ server->session_key.len = 0;
+- kfree(server->hostname);
+- server->hostname = NULL;
+
+ task = xchg(&server->tsk, NULL);
+ if (task)
+--
+2.39.5
+
--- /dev/null
+From 96cddbad40edc466c4c1d4124303a9985b24fb11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 15:35:07 +0530
+Subject: soc: ti: pruss: Fix pruss APIs
+
+From: MD Danish Anwar <danishanwar@ti.com>
+
+[ Upstream commit 202580b60229345dc2637099f10c8a8857c1fdc2 ]
+
+PRUSS APIs in pruss_driver.h produce lots of compilation errors when
+CONFIG_TI_PRUSS is not set.
+
+The errors and warnings,
+warning: returning 'void *' from a function with return type 'int' makes
+ integer from pointer without a cast [-Wint-conversion]
+error: expected identifier or '(' before '{' token
+
+Fix these warnings and errors by fixing the return type of pruss APIs as
+well as removing the misplaced semicolon from pruss_cfg_xfr_enable()
+
+Fixes: 0211cc1e4fbb ("soc: ti: pruss: Add helper functions to set GPI mode, MII_RT_event and XFR")
+Signed-off-by: MD Danish Anwar <danishanwar@ti.com>
+Reviewed-by: Roger Quadros <rogerq@kernel.org>
+Link: https://lore.kernel.org/r/20241220100508.1554309-2-danishanwar@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pruss_driver.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/pruss_driver.h b/include/linux/pruss_driver.h
+index c9a31c567e85b..2e18fef1a2e10 100644
+--- a/include/linux/pruss_driver.h
++++ b/include/linux/pruss_driver.h
+@@ -144,32 +144,32 @@ static inline int pruss_release_mem_region(struct pruss *pruss,
+ static inline int pruss_cfg_get_gpmux(struct pruss *pruss,
+ enum pruss_pru_id pru_id, u8 *mux)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ static inline int pruss_cfg_set_gpmux(struct pruss *pruss,
+ enum pruss_pru_id pru_id, u8 mux)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ static inline int pruss_cfg_gpimode(struct pruss *pruss,
+ enum pruss_pru_id pru_id,
+ enum pruss_gpi_mode mode)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ static inline int pruss_cfg_miirt_enable(struct pruss *pruss, bool enable)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ static inline int pruss_cfg_xfr_enable(struct pruss *pruss,
+ enum pru_type pru_type,
+- bool enable);
++ bool enable)
+ {
+- return ERR_PTR(-EOPNOTSUPP);
++ return -EOPNOTSUPP;
+ }
+
+ #endif /* CONFIG_TI_PRUSS */
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
