From: Sasha Levin Date: Sat, 18 Jan 2025 22:25:52 +0000 (-0500) Subject: Fixes for 6.12 X-Git-Tag: v6.1.126~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=13f31e8ae46731960d30461cc36fcbe0a63330d5;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.12 Signed-off-by: Sasha Levin --- diff --git a/queue-6.12/hwmon-ltc2991-fix-mixed-signed-unsigned-in-div_round.patch b/queue-6.12/hwmon-ltc2991-fix-mixed-signed-unsigned-in-div_round.patch new file mode 100644 index 0000000000..491013eeb0 --- /dev/null +++ b/queue-6.12/hwmon-ltc2991-fix-mixed-signed-unsigned-in-div_round.patch @@ -0,0 +1,47 @@ +From 650c0e6becd814d7d2c11082e681138ccdeda643 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 14:48:27 -0600 +Subject: hwmon: (ltc2991) Fix mixed signed/unsigned in DIV_ROUND_CLOSEST + +From: David Lechner + +[ Upstream commit e9b24deb84863c5a77dda5be57b6cb5bf4127b85 ] + +Fix use of DIV_ROUND_CLOSEST where a possibly negative value is divided +by an unsigned type by casting the unsigned type to the signed type of +the same size (st->r_sense_uohm[channel] has type of u32). + +The docs on the DIV_ROUND_CLOSEST macro explain that dividing a negative +value by an unsigned type is undefined behavior. The actual behavior is +that it converts both values to unsigned before doing the division, for +example: + + int ret = DIV_ROUND_CLOSEST(-100, 3U); + +results in ret == 1431655732 instead of -33. + +Fixes: 2b9ea4262ae9 ("hwmon: Add driver for ltc2991") +Signed-off-by: David Lechner +Link: https://lore.kernel.org/r/20250115-hwmon-ltc2991-fix-div-round-closest-v1-1-b4929667e457@baylibre.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ltc2991.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/ltc2991.c b/drivers/hwmon/ltc2991.c +index 7ca139e4b6aff..6d5d4cb846daf 100644 +--- a/drivers/hwmon/ltc2991.c ++++ b/drivers/hwmon/ltc2991.c +@@ -125,7 +125,7 @@ static int ltc2991_get_curr(struct ltc2991_state *st, u32 reg, int channel, + + /* Vx-Vy, 19.075uV/LSB */ + *val = DIV_ROUND_CLOSEST(sign_extend32(reg_val, 14) * 19075, +- st->r_sense_uohm[channel]); ++ (s32)st->r_sense_uohm[channel]); + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.12/hwmon-tmp513-fix-division-of-negative-numbers.patch b/queue-6.12/hwmon-tmp513-fix-division-of-negative-numbers.patch new file mode 100644 index 0000000000..bfdb988bf7 --- /dev/null +++ b/queue-6.12/hwmon-tmp513-fix-division-of-negative-numbers.patch @@ -0,0 +1,74 @@ +From f1030d95aaa5805613c9d8ed77166f6a2c9f07fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 15:45:52 -0600 +Subject: hwmon: (tmp513) Fix division of negative numbers + +From: David Lechner + +[ Upstream commit e2c68cea431d65292b592c9f8446c918d45fcf78 ] + +Fix several issues with division of negative numbers in the tmp513 +driver. + +The docs on the DIV_ROUND_CLOSEST macro explain that dividing a negative +value by an unsigned type is undefined behavior. The driver was doing +this in several places, i.e. data->shunt_uohms has type of u32. The +actual "undefined" behavior is that it converts both values to unsigned +before doing the division, for example: + + int ret = DIV_ROUND_CLOSEST(-100, 3U); + +results in ret == 1431655732 instead of -33. + +Furthermore the MILLI macro has a type of unsigned long. Multiplying a +signed long by an unsigned long results in an unsigned long. + +So, we need to cast both MILLI and data data->shunt_uohms to long when +using the DIV_ROUND_CLOSEST macro. + +Fixes: f07f9d2467f4 ("hwmon: (tmp513) Use SI constants from units.h") +Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.") +Signed-off-by: David Lechner +Link: https://lore.kernel.org/r/20250114-fix-si-prefix-macro-sign-bugs-v1-1-696fd8d10f00@baylibre.com +[groeck: Drop some continuation lines] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/tmp513.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c +index 1c2cb12071b80..5acbfd7d088dd 100644 +--- a/drivers/hwmon/tmp513.c ++++ b/drivers/hwmon/tmp513.c +@@ -207,7 +207,8 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos, + *val = sign_extend32(regval, + reg == TMP51X_SHUNT_CURRENT_RESULT ? + 16 - tmp51x_get_pga_shift(data) : 15); +- *val = DIV_ROUND_CLOSEST(*val * 10 * MILLI, data->shunt_uohms); ++ *val = DIV_ROUND_CLOSEST(*val * 10 * (long)MILLI, (long)data->shunt_uohms); ++ + break; + case TMP51X_BUS_VOLTAGE_RESULT: + case TMP51X_BUS_VOLTAGE_H_LIMIT: +@@ -223,7 +224,7 @@ static int tmp51x_get_value(struct tmp51x_data *data, u8 reg, u8 pos, + case TMP51X_BUS_CURRENT_RESULT: + // Current = (ShuntVoltage * CalibrationRegister) / 4096 + *val = sign_extend32(regval, 15) * (long)data->curr_lsb_ua; +- *val = DIV_ROUND_CLOSEST(*val, MILLI); ++ *val = DIV_ROUND_CLOSEST(*val, (long)MILLI); + break; + case TMP51X_LOCAL_TEMP_RESULT: + case TMP51X_REMOTE_TEMP_RESULT_1: +@@ -263,7 +264,7 @@ static int tmp51x_set_value(struct tmp51x_data *data, u8 reg, long val) + * The user enter current value and we convert it to + * voltage. 1lsb = 10uV + */ +- val = DIV_ROUND_CLOSEST(val * data->shunt_uohms, 10 * MILLI); ++ val = DIV_ROUND_CLOSEST(val * (long)data->shunt_uohms, 10 * (long)MILLI); + max_val = U16_MAX >> tmp51x_get_pga_shift(data); + regval = clamp_val(val, -max_val, max_val); + break; +-- +2.39.5 + diff --git a/queue-6.12/i2c-core-fix-reference-leak-in-i2c_register_adapter.patch b/queue-6.12/i2c-core-fix-reference-leak-in-i2c_register_adapter.patch new file mode 100644 index 0000000000..2e05d70ddb --- /dev/null +++ b/queue-6.12/i2c-core-fix-reference-leak-in-i2c_register_adapter.patch @@ -0,0 +1,39 @@ +From d7fdea33e0475afe2ceb58c44f8c289259868438 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 12:08:03 +0900 +Subject: i2c: core: fix reference leak in i2c_register_adapter() + +From: Joe Hattori + +[ Upstream commit 3f8c4f5e9a57868fa107016c81165686d23325f2 ] + +The reference count of the device incremented in device_initialize() is +not decremented when device_add() fails. Add a put_device() call before +returning from the function. + +This bug was found by an experimental static analysis tool that I am +developing. + +Fixes: 60f68597024d ("i2c: core: Setup i2c_adapter runtime-pm before calling device_add()") +Signed-off-by: Joe Hattori +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 7c810893bfa33..75d30861ffe21 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -1562,6 +1562,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap) + res = device_add(&adap->dev); + if (res) { + pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); ++ put_device(&adap->dev); + goto out_list; + } + +-- +2.39.5 + diff --git a/queue-6.12/i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch b/queue-6.12/i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch new file mode 100644 index 0000000000..ce50aec0b9 --- /dev/null +++ b/queue-6.12/i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch @@ -0,0 +1,37 @@ +From 911f7d44960a391f9bfa346c7b4f3ea49667d368 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 08:29:45 +0100 +Subject: i2c: mux: demux-pinctrl: check initial mux selection, too + +From: Wolfram Sang + +[ Upstream commit ca89f73394daf92779ddaa37b42956f4953f3941 ] + +When misconfigured, the initial setup of the current mux channel can +fail, too. It must be checked as well. + +Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver") +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 7e2686b606c04..cec7f3447e193 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -261,7 +261,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + pm_runtime_no_callbacks(&pdev->dev); + + /* switch to first parent as active master */ +- i2c_demux_activate_master(priv, 0); ++ err = i2c_demux_activate_master(priv, 0); ++ if (err) ++ goto err_rollback; + + err = device_create_file(&pdev->dev, &dev_attr_available_masters); + if (err) +-- +2.39.5 + diff --git a/queue-6.12/i2c-rcar-fix-nack-handling-when-being-a-target.patch b/queue-6.12/i2c-rcar-fix-nack-handling-when-being-a-target.patch new file mode 100644 index 0000000000..718d2d8c62 --- /dev/null +++ b/queue-6.12/i2c-rcar-fix-nack-handling-when-being-a-target.patch @@ -0,0 +1,95 @@ +From 18bfbf6b328c4eaf74190790710a030033fdb86f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 13:36:23 +0100 +Subject: i2c: rcar: fix NACK handling when being a target + +From: Wolfram Sang + +[ Upstream commit 093f70c134f70e4632b295240f07d2b50b74e247 ] + +When this controller is a target, the NACK handling had two issues. +First, the return value from the backend was not checked on the initial +WRITE_REQUESTED. So, the driver missed to send a NACK in this case. +Also, the NACK always arrives one byte late on the bus, even in the +WRITE_RECEIVED case. This seems to be a HW issue. We should then not +rely on the backend to correctly NACK the superfluous byte as well. Fix +both issues by introducing a flag which gets set whenever the backend +requests a NACK and keep sending it until we get a STOP condition. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 9267df38c2d0a..3991224148214 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -130,6 +130,8 @@ + #define ID_P_PM_BLOCKED BIT(31) + #define ID_P_MASK GENMASK(31, 27) + ++#define ID_SLAVE_NACK BIT(0) ++ + enum rcar_i2c_type { + I2C_RCAR_GEN1, + I2C_RCAR_GEN2, +@@ -166,6 +168,7 @@ struct rcar_i2c_priv { + int irq; + + struct i2c_client *host_notify_client; ++ u8 slave_flags; + }; + + #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent) +@@ -655,6 +658,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + { + u32 ssr_raw, ssr_filtered; + u8 value; ++ int ret; + + ssr_raw = rcar_i2c_read(priv, ICSSR) & 0xff; + ssr_filtered = ssr_raw & rcar_i2c_read(priv, ICSIER); +@@ -670,7 +674,10 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + rcar_i2c_write(priv, ICRXTX, value); + rcar_i2c_write(priv, ICSIER, SDE | SSR | SAR); + } else { +- i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value); ++ ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_REQUESTED, &value); ++ if (ret) ++ priv->slave_flags |= ID_SLAVE_NACK; ++ + rcar_i2c_read(priv, ICRXTX); /* dummy read */ + rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); + } +@@ -683,18 +690,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); + rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ ++ priv->slave_flags &= ~ID_SLAVE_NACK; + rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } + + /* master wants to write to us */ + if (ssr_filtered & SDR) { +- int ret; +- + value = rcar_i2c_read(priv, ICRXTX); + ret = i2c_slave_event(priv->slave, I2C_SLAVE_WRITE_RECEIVED, &value); +- /* Send NACK in case of error */ +- rcar_i2c_write(priv, ICSCR, SIE | SDBS | (ret < 0 ? FNA : 0)); ++ if (ret) ++ priv->slave_flags |= ID_SLAVE_NACK; ++ ++ /* Send NACK in case of error, but it will come 1 byte late :( */ ++ rcar_i2c_write(priv, ICSCR, SIE | SDBS | ++ (priv->slave_flags & ID_SLAVE_NACK ? FNA : 0)); + rcar_i2c_write(priv, ICSSR, ~SDR & 0xff); + } + +-- +2.39.5 + diff --git a/queue-6.12/i2c-testunit-on-errors-repeat-nack-until-stop.patch b/queue-6.12/i2c-testunit-on-errors-repeat-nack-until-stop.patch new file mode 100644 index 0000000000..9f142d2be6 --- /dev/null +++ b/queue-6.12/i2c-testunit-on-errors-repeat-nack-until-stop.patch @@ -0,0 +1,85 @@ +From b21d0350d84581fa3c9c80f84bffb8a2bfe634f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 17:23:47 +0100 +Subject: i2c: testunit: on errors, repeat NACK until STOP + +From: Wolfram Sang + +[ Upstream commit 6ad30f7890423341f4b79329af1f9b9bb3cdec03 ] + +This backend requests a NACK from the controller driver when it detects +an error. If that request gets ignored from some reason, subsequent +accesses will wrongly be handled OK. To fix this, an error now changes +the state machine, so the backend will report NACK until a STOP +condition has been detected. This make the driver more robust against +controllers which will sadly apply the NACK not to the current byte but +the next one. + +Fixes: a8335c64c5f0 ("i2c: add slave testunit driver") +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-slave-testunit.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/i2c-slave-testunit.c b/drivers/i2c/i2c-slave-testunit.c +index 9fe3150378e86..7ae0c7902f670 100644 +--- a/drivers/i2c/i2c-slave-testunit.c ++++ b/drivers/i2c/i2c-slave-testunit.c +@@ -38,6 +38,7 @@ enum testunit_regs { + + enum testunit_flags { + TU_FLAG_IN_PROCESS, ++ TU_FLAG_NACK, + }; + + struct testunit_data { +@@ -90,8 +91,10 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client, + + switch (event) { + case I2C_SLAVE_WRITE_REQUESTED: +- if (test_bit(TU_FLAG_IN_PROCESS, &tu->flags)) +- return -EBUSY; ++ if (test_bit(TU_FLAG_IN_PROCESS | TU_FLAG_NACK, &tu->flags)) { ++ ret = -EBUSY; ++ break; ++ } + + memset(tu->regs, 0, TU_NUM_REGS); + tu->reg_idx = 0; +@@ -99,8 +102,10 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client, + break; + + case I2C_SLAVE_WRITE_RECEIVED: +- if (test_bit(TU_FLAG_IN_PROCESS, &tu->flags)) +- return -EBUSY; ++ if (test_bit(TU_FLAG_IN_PROCESS | TU_FLAG_NACK, &tu->flags)) { ++ ret = -EBUSY; ++ break; ++ } + + if (tu->reg_idx < TU_NUM_REGS) + tu->regs[tu->reg_idx] = *val; +@@ -129,6 +134,8 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client, + * here because we still need them in the workqueue! + */ + tu->reg_idx = 0; ++ ++ clear_bit(TU_FLAG_NACK, &tu->flags); + break; + + case I2C_SLAVE_READ_PROCESSED: +@@ -151,6 +158,10 @@ static int i2c_slave_testunit_slave_cb(struct i2c_client *client, + break; + } + ++ /* If an error occurred somewhen, we NACK everything until next STOP */ ++ if (ret) ++ set_bit(TU_FLAG_NACK, &tu->flags); ++ + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.12/platform-x86-dell-uart-backlight-fix-serdev-race.patch b/queue-6.12/platform-x86-dell-uart-backlight-fix-serdev-race.patch new file mode 100644 index 0000000000..0205f4ab2a --- /dev/null +++ b/queue-6.12/platform-x86-dell-uart-backlight-fix-serdev-race.patch @@ -0,0 +1,66 @@ +From 1f22e49e1424ddd96e75340f800cfc03e5cbeabb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jan 2025 12:01:18 -0600 +Subject: platform/x86: dell-uart-backlight: fix serdev race +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chenyuan Yang + +[ Upstream commit 1b2128aa2d45ab20b22548dcf4b48906298ca7fd ] + +The dell_uart_bl_serdev_probe() function calls devm_serdev_device_open() +before setting the client ops via serdev_device_set_client_ops(). This +ordering can trigger a NULL pointer dereference in the serdev controller's +receive_buf handler, as it assumes serdev->ops is valid when +SERPORT_ACTIVE is set. + +This is similar to the issue fixed in commit 5e700b384ec1 +("platform/chrome: cros_ec_uart: properly fix race condition") where +devm_serdev_device_open() was called before fully initializing the +device. + +Fix the race by ensuring client ops are set before enabling the port via +devm_serdev_device_open(). + +Note, serdev_device_set_baudrate() and serdev_device_set_flow_control() +calls should be after the devm_serdev_device_open() call. + +Fixes: 484bae9e4d6a ("platform/x86: Add new Dell UART backlight driver") +Signed-off-by: Chenyuan Yang +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20250111180118.2274516-1-chenyuan0y@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell/dell-uart-backlight.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/dell/dell-uart-backlight.c b/drivers/platform/x86/dell/dell-uart-backlight.c +index 3995f90add456..c45bc332af7a0 100644 +--- a/drivers/platform/x86/dell/dell-uart-backlight.c ++++ b/drivers/platform/x86/dell/dell-uart-backlight.c +@@ -283,6 +283,9 @@ static int dell_uart_bl_serdev_probe(struct serdev_device *serdev) + init_waitqueue_head(&dell_bl->wait_queue); + dell_bl->dev = dev; + ++ serdev_device_set_drvdata(serdev, dell_bl); ++ serdev_device_set_client_ops(serdev, &dell_uart_bl_serdev_ops); ++ + ret = devm_serdev_device_open(dev, serdev); + if (ret) + return dev_err_probe(dev, ret, "opening UART device\n"); +@@ -290,8 +293,6 @@ static int dell_uart_bl_serdev_probe(struct serdev_device *serdev) + /* 9600 bps, no flow control, these are the default but set them to be sure */ + serdev_device_set_baudrate(serdev, 9600); + serdev_device_set_flow_control(serdev, false); +- serdev_device_set_drvdata(serdev, dell_bl); +- serdev_device_set_client_ops(serdev, &dell_uart_bl_serdev_ops); + + get_version[0] = DELL_SOF(GET_CMD_LEN); + get_version[1] = CMD_GET_VERSION; +-- +2.39.5 + diff --git a/queue-6.12/platform-x86-lenovo-yoga-tab2-pro-1380-fastcharger-f.patch b/queue-6.12/platform-x86-lenovo-yoga-tab2-pro-1380-fastcharger-f.patch new file mode 100644 index 0000000000..d66fdceab4 --- /dev/null +++ b/queue-6.12/platform-x86-lenovo-yoga-tab2-pro-1380-fastcharger-f.patch @@ -0,0 +1,65 @@ +From 12834b0c4f900d665235a6cfd15e1b8a6b6b058d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jan 2025 12:09:51 -0600 +Subject: platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chenyuan Yang + +[ Upstream commit 59616a91e5e74833b2008b56c66879857c616006 ] + +The yt2_1380_fc_serdev_probe() function calls devm_serdev_device_open() +before setting the client ops via serdev_device_set_client_ops(). This +ordering can trigger a NULL pointer dereference in the serdev controller's +receive_buf handler, as it assumes serdev->ops is valid when +SERPORT_ACTIVE is set. + +This is similar to the issue fixed in commit 5e700b384ec1 +("platform/chrome: cros_ec_uart: properly fix race condition") where +devm_serdev_device_open() was called before fully initializing the +device. + +Fix the race by ensuring client ops are set before enabling the port via +devm_serdev_device_open(). + +Note, serdev_device_set_baudrate() and serdev_device_set_flow_control() +calls should be after the devm_serdev_device_open() call. + +Fixes: b2ed33e8d486 ("platform/x86: Add lenovo-yoga-tab2-pro-1380-fastcharger driver") +Signed-off-by: Chenyuan Yang +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20250111180951.2277757-1-chenyuan0y@gmail.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c b/drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c +index d525bdc8ca9b3..32d9b6009c422 100644 +--- a/drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c ++++ b/drivers/platform/x86/lenovo-yoga-tab2-pro-1380-fastcharger.c +@@ -199,14 +199,15 @@ static int yt2_1380_fc_serdev_probe(struct serdev_device *serdev) + if (ret) + return ret; + ++ serdev_device_set_drvdata(serdev, fc); ++ serdev_device_set_client_ops(serdev, &yt2_1380_fc_serdev_ops); ++ + ret = devm_serdev_device_open(dev, serdev); + if (ret) + return dev_err_probe(dev, ret, "opening UART device\n"); + + serdev_device_set_baudrate(serdev, 600); + serdev_device_set_flow_control(serdev, false); +- serdev_device_set_drvdata(serdev, fc); +- serdev_device_set_client_ops(serdev, &yt2_1380_fc_serdev_ops); + + ret = devm_extcon_register_notifier_all(dev, fc->extcon, &fc->nb); + if (ret) +-- +2.39.5 + diff --git a/queue-6.12/reset-rzg2l-usbphy-ctrl-assign-proper-of-node-to-the.patch b/queue-6.12/reset-rzg2l-usbphy-ctrl-assign-proper-of-node-to-the.patch new file mode 100644 index 0000000000..f73088f152 --- /dev/null +++ b/queue-6.12/reset-rzg2l-usbphy-ctrl-assign-proper-of-node-to-the.patch @@ -0,0 +1,52 @@ +From 1b856e2073bfd274d6e9592713c2e082451b1da9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 10:55:54 +0200 +Subject: reset: rzg2l-usbphy-ctrl: Assign proper of node to the allocated + device + +From: Claudiu Beznea + +[ Upstream commit 1f8af9712413f456849fdf3f3a782cbe099476d7 ] + +The platform device named "rzg2l-usb-vbus-regulator", allocated by +the rzg2l-usbphy-ctrl driver, is used to instantiate a regulator driver. +This regulator driver is associated with a device tree (DT) node, which +is a child of the rzg2l-usbphy-ctrl DT node. The regulator's DT node allows +consumer nodes to reference the regulator and configure the regulator as +needed. + +Starting with commit cd7a38c40b23 ("regulator: core: do not silently ignore +provided init_data") the struct regulator_dev::dev::of_node is no longer +populated using of_node_get(config->of_node) if the regulator does not +provide init_data. Since the rzg2l-usb-vbus-regulator does not provide +init_data, this behaviour causes the of_find_regulator_by_node() function +to fails, resulting in errors when attempting to request the regulator. + +To fix this issue, call device_set_of_node_from_dev() for the +"rzg2l-usb-vbus-regulator" platform device. + +Fixes: 84fbd6198766 ("regulator: Add Renesas RZ/G2L USB VBUS regulator driver") +Signed-off-by: Claudiu Beznea +Reviewed-by: Biju Das +Link: https://lore.kernel.org/r/20241119085554.1035881-1-claudiu.beznea.uj@bp.renesas.com +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/reset-rzg2l-usbphy-ctrl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/reset/reset-rzg2l-usbphy-ctrl.c b/drivers/reset/reset-rzg2l-usbphy-ctrl.c +index 1cd157f4f03b4..4e2ac1f0060c0 100644 +--- a/drivers/reset/reset-rzg2l-usbphy-ctrl.c ++++ b/drivers/reset/reset-rzg2l-usbphy-ctrl.c +@@ -176,6 +176,7 @@ static int rzg2l_usbphy_ctrl_probe(struct platform_device *pdev) + vdev->dev.parent = dev; + priv->vdev = vdev; + ++ device_set_of_node_from_dev(&vdev->dev, dev); + error = platform_device_add(vdev); + if (error) + goto err_device_put; +-- +2.39.5 + diff --git a/queue-6.12/revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch b/queue-6.12/revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch new file mode 100644 index 0000000000..7f946f6ab4 --- /dev/null +++ b/queue-6.12/revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch @@ -0,0 +1,78 @@ +From 58a291eeacdf39ff055b4e62f9607643dd6fc6f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 13:41:56 +0000 +Subject: Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data" + +From: Pratyush Yadav + +[ Upstream commit d15638bf76ad47874ecb5dc386f0945fc0b2a875 ] + +This reverts commit 98d1fb94ce75f39febd456d6d3cbbe58b6678795. + +The commit uses data nbits instead of addr nbits for dummy phase. This +causes a regression for all boards where spi-tx-bus-width is smaller +than spi-rx-bus-width. It is a common pattern for boards to have +spi-tx-bus-width == 1 and spi-rx-bus-width > 1. The regression causes +all reads with a dummy phase to become unavailable for such boards, +leading to a usually slower 0-dummy-cycle read being selected. + +Most controllers' supports_op hooks call spi_mem_default_supports_op(). +In spi_mem_default_supports_op(), spi_mem_check_buswidth() is called to +check if the buswidths for the op can actually be supported by the +board's wiring. This wiring information comes from (among other things) +the spi-{tx,rx}-bus-width DT properties. Based on these properties, +SPI_TX_* or SPI_RX_* flags are set by of_spi_parse_dt(). +spi_mem_check_buswidth() then uses these flags to make the decision +whether an op can be supported by the board's wiring (in a way, +indirectly checking against spi-{rx,tx}-bus-width). + +Now the tricky bit here is that spi_mem_check_buswidth() does: + + if (op->dummy.nbytes && + spi_check_buswidth_req(mem, op->dummy.buswidth, true)) + return false; + +The true argument to spi_check_buswidth_req() means the op is treated as +a TX op. For a board that has say 1-bit TX and 4-bit RX, a 4-bit dummy +TX is considered as unsupported, and the op gets rejected. + +The commit being reverted uses the data buswidth for dummy buswidth. So +for reads, the RX buswidth gets used for the dummy phase, uncovering +this issue. In reality, a dummy phase is neither RX nor TX. As the name +suggests, these are just dummy cycles that send or receive no data, and +thus don't really need to have any buswidth at all. + +Ideally, dummy phases should not be checked against the board's wiring +capabilities at all, and should only be sanity-checked for having a sane +buswidth value. Since we are now at rc7 and such a change might +introduce many unexpected bugs, revert the commit for now. It can be +sent out later along with the spi_mem_check_buswidth() fix. + +Fixes: 98d1fb94ce75 ("mtd: spi-nor: core: replace dummy buswidth from addr to data") +Reported-by: Alexander Stein +Closes: https://lore.kernel.org/linux-mtd/3342163.44csPzL39Z@steina-w/ +Tested-by: Alexander Stein +Reviewed-by: Tudor Ambarus +Signed-off-by: Pratyush Yadav +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c +index 8c57df44c40fe..9d6e85bf227b9 100644 +--- a/drivers/mtd/spi-nor/core.c ++++ b/drivers/mtd/spi-nor/core.c +@@ -89,7 +89,7 @@ void spi_nor_spimem_setup_op(const struct spi_nor *nor, + op->addr.buswidth = spi_nor_get_protocol_addr_nbits(proto); + + if (op->dummy.nbytes) +- op->dummy.buswidth = spi_nor_get_protocol_data_nbits(proto); ++ op->dummy.buswidth = spi_nor_get_protocol_addr_nbits(proto); + + if (op->data.nbytes) + op->data.buswidth = spi_nor_get_protocol_data_nbits(proto); +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series index b643f30bfa..10cbc1c7fc 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -34,3 +34,15 @@ drm-tests-helpers-fix-compiler-warning.patch drm-vmwgfx-unreserve-bo-on-error.patch drm-vmwgfx-add-new-keep_resv-bo-param.patch drm-v3d-ensure-job-pointer-is-set-to-null-after-job-.patch +reset-rzg2l-usbphy-ctrl-assign-proper-of-node-to-the.patch +soc-ti-pruss-fix-pruss-apis.patch +i2c-core-fix-reference-leak-in-i2c_register_adapter.patch +platform-x86-dell-uart-backlight-fix-serdev-race.patch +platform-x86-lenovo-yoga-tab2-pro-1380-fastcharger-f.patch +hwmon-tmp513-fix-division-of-negative-numbers.patch +revert-mtd-spi-nor-core-replace-dummy-buswidth-from-.patch +i2c-mux-demux-pinctrl-check-initial-mux-selection-to.patch +i2c-rcar-fix-nack-handling-when-being-a-target.patch +i2c-testunit-on-errors-repeat-nack-until-stop.patch +hwmon-ltc2991-fix-mixed-signed-unsigned-in-div_round.patch +smb-client-fix-double-free-of-tcp_server_info-hostna.patch diff --git a/queue-6.12/smb-client-fix-double-free-of-tcp_server_info-hostna.patch b/queue-6.12/smb-client-fix-double-free-of-tcp_server_info-hostna.patch new file mode 100644 index 0000000000..eee8ad9732 --- /dev/null +++ b/queue-6.12/smb-client-fix-double-free-of-tcp_server_info-hostna.patch @@ -0,0 +1,90 @@ +From 0fb7e0bf660bbb840e9db6401da518164c9ff0f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jan 2025 12:48:48 -0300 +Subject: smb: client: fix double free of TCP_Server_Info::hostname + +From: Paulo Alcantara + +[ Upstream commit fa2f9906a7b333ba757a7dbae0713d8a5396186e ] + +When shutting down the server in cifs_put_tcp_session(), cifsd thread +might be reconnecting to multiple DFS targets before it realizes it +should exit the loop, so @server->hostname can't be freed as long as +cifsd thread isn't done. Otherwise the following can happen: + + RIP: 0010:__slab_free+0x223/0x3c0 + Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89 + 1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff <0f> + 0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80 + RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246 + RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068 + RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400 + RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000 + R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500 + R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068 + FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000) + 000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4: + PKRU: 55555554 + Call Trace: + + ? show_trace_log_lvl+0x1c4/0x2df + ? show_trace_log_lvl+0x1c4/0x2df + ? __reconnect_target_unlocked+0x3e/0x160 [cifs] + ? __die_body.cold+0x8/0xd + ? die+0x2b/0x50 + ? do_trap+0xce/0x120 + ? __slab_free+0x223/0x3c0 + ? do_error_trap+0x65/0x80 + ? __slab_free+0x223/0x3c0 + ? exc_invalid_op+0x4e/0x70 + ? __slab_free+0x223/0x3c0 + ? asm_exc_invalid_op+0x16/0x20 + ? __slab_free+0x223/0x3c0 + ? extract_hostname+0x5c/0xa0 [cifs] + ? extract_hostname+0x5c/0xa0 [cifs] + ? __kmalloc+0x4b/0x140 + __reconnect_target_unlocked+0x3e/0x160 [cifs] + reconnect_dfs_server+0x145/0x430 [cifs] + cifs_handle_standard+0x1ad/0x1d0 [cifs] + cifs_demultiplex_thread+0x592/0x730 [cifs] + ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs] + kthread+0xdd/0x100 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x29/0x50 + + +Fixes: 7be3248f3139 ("cifs: To match file servers, make sure the server hostname matches") +Reported-by: Jay Shin +Signed-off-by: Paulo Alcantara (Red Hat) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/connect.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c +index fe40152b915d8..fb51cdf552061 100644 +--- a/fs/smb/client/connect.c ++++ b/fs/smb/client/connect.c +@@ -1044,6 +1044,7 @@ clean_demultiplex_info(struct TCP_Server_Info *server) + /* Release netns reference for this server. */ + put_net(cifs_net_ns(server)); + kfree(server->leaf_fullpath); ++ kfree(server->hostname); + kfree(server); + + length = atomic_dec_return(&tcpSesAllocCount); +@@ -1670,8 +1671,6 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) + kfree_sensitive(server->session_key.response); + server->session_key.response = NULL; + server->session_key.len = 0; +- kfree(server->hostname); +- server->hostname = NULL; + + task = xchg(&server->tsk, NULL); + if (task) +-- +2.39.5 + diff --git a/queue-6.12/soc-ti-pruss-fix-pruss-apis.patch b/queue-6.12/soc-ti-pruss-fix-pruss-apis.patch new file mode 100644 index 0000000000..df4e823d81 --- /dev/null +++ b/queue-6.12/soc-ti-pruss-fix-pruss-apis.patch @@ -0,0 +1,76 @@ +From bff7fa016a263f89cbaf1f3b50733da0295b8d76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2024 15:35:07 +0530 +Subject: soc: ti: pruss: Fix pruss APIs + +From: MD Danish Anwar + +[ Upstream commit 202580b60229345dc2637099f10c8a8857c1fdc2 ] + +PRUSS APIs in pruss_driver.h produce lots of compilation errors when +CONFIG_TI_PRUSS is not set. + +The errors and warnings, +warning: returning 'void *' from a function with return type 'int' makes + integer from pointer without a cast [-Wint-conversion] +error: expected identifier or '(' before '{' token + +Fix these warnings and errors by fixing the return type of pruss APIs as +well as removing the misplaced semicolon from pruss_cfg_xfr_enable() + +Fixes: 0211cc1e4fbb ("soc: ti: pruss: Add helper functions to set GPI mode, MII_RT_event and XFR") +Signed-off-by: MD Danish Anwar +Reviewed-by: Roger Quadros +Link: https://lore.kernel.org/r/20241220100508.1554309-2-danishanwar@ti.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + include/linux/pruss_driver.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/linux/pruss_driver.h b/include/linux/pruss_driver.h +index c9a31c567e85b..2e18fef1a2e10 100644 +--- a/include/linux/pruss_driver.h ++++ b/include/linux/pruss_driver.h +@@ -144,32 +144,32 @@ static inline int pruss_release_mem_region(struct pruss *pruss, + static inline int pruss_cfg_get_gpmux(struct pruss *pruss, + enum pruss_pru_id pru_id, u8 *mux) + { +- return ERR_PTR(-EOPNOTSUPP); ++ return -EOPNOTSUPP; + } + + static inline int pruss_cfg_set_gpmux(struct pruss *pruss, + enum pruss_pru_id pru_id, u8 mux) + { +- return ERR_PTR(-EOPNOTSUPP); ++ return -EOPNOTSUPP; + } + + static inline int pruss_cfg_gpimode(struct pruss *pruss, + enum pruss_pru_id pru_id, + enum pruss_gpi_mode mode) + { +- return ERR_PTR(-EOPNOTSUPP); ++ return -EOPNOTSUPP; + } + + static inline int pruss_cfg_miirt_enable(struct pruss *pruss, bool enable) + { +- return ERR_PTR(-EOPNOTSUPP); ++ return -EOPNOTSUPP; + } + + static inline int pruss_cfg_xfr_enable(struct pruss *pruss, + enum pru_type pru_type, +- bool enable); ++ bool enable) + { +- return ERR_PTR(-EOPNOTSUPP); ++ return -EOPNOTSUPP; + } + + #endif /* CONFIG_TI_PRUSS */ +-- +2.39.5 +