From: Sasha Levin Date: Fri, 23 Feb 2024 17:44:26 +0000 (-0500) Subject: Fixes for 5.10 X-Git-Tag: v4.19.308~87 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1a1f38d07da8e4668bffe1f1522ed6030f72e845;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/ahci-add-43-bit-dma-address-quirk-for-asmedia-asm106.patch b/queue-5.10/ahci-add-43-bit-dma-address-quirk-for-asmedia-asm106.patch new file mode 100644 index 00000000000..8b70deb995b --- /dev/null +++ b/queue-5.10/ahci-add-43-bit-dma-address-quirk-for-asmedia-asm106.patch @@ -0,0 +1,159 @@ +From 84a8ef30b016cd2e101aacdb6d2328168404ad04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 17:04:01 +0200 +Subject: ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers + +From: Lennert Buytenhek + +[ Upstream commit 20730e9b277873deeb6637339edcba64468f3da3 ] + +With one of the on-board ASM1061 AHCI controllers (1b21:0612) on an +ASUSTeK Pro WS WRX80E-SAGE SE WIFI mainboard, a controller hang was +observed that was immediately preceded by the following kernel +messages: + +ahci 0000:28:00.0: Using 64-bit DMA addresses +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00000 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00300 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00380 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00400 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00680 flags=0x0000] +ahci 0000:28:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0035 address=0x7fffff00700 flags=0x0000] + +The first message is produced by code in drivers/iommu/dma-iommu.c +which is accompanied by the following comment that seems to apply: + + /* + * Try to use all the 32-bit PCI addresses first. The original SAC vs. + * DAC reasoning loses relevance with PCIe, but enough hardware and + * firmware bugs are still lurking out there that it's safest not to + * venture into the 64-bit space until necessary. + * + * If your device goes wrong after seeing the notice then likely either + * its driver is not setting DMA masks accurately, the hardware has + * some inherent bug in handling >32-bit addresses, or not all the + * expected address bits are wired up between the device and the IOMMU. + */ + +Asking the ASM1061 on a discrete PCIe card to DMA from I/O virtual +address 0xffffffff00000000 produces the following I/O page faults: + +vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000000 flags=0x0010] +vfio-pci 0000:07:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0021 address=0x7ff00000500 flags=0x0010] + +Note that the upper 21 bits of the logged DMA address are zero. (When +asking a different PCIe device in the same PCIe slot to DMA to the +same I/O virtual address, we do see all the upper 32 bits of the DMA +address as 1, so this is not an issue with the chipset or IOMMU +configuration on the test system.) + +Also, hacking libahci to always set the upper 21 bits of all DMA +addresses to 1 produces no discernible effect on the behavior of the +ASM1061, and mkfs/mount/scrub/etc work as without this hack. + +This all strongly suggests that the ASM1061 has a 43 bit DMA address +limit, and this commit therefore adds a quirk to deal with this limit. + +This issue probably applies to (some of) the other supported ASMedia +parts as well, but we limit it to the PCI IDs known to refer to +ASM1061 parts, as that's the only part we know for sure to be affected +by this issue at this point. + +Link: https://lore.kernel.org/linux-ide/ZaZ2PIpEId-rl6jv@wantstofly.org/ +Signed-off-by: Lennert Buytenhek +[cassel: drop date from error messages in commit log] +Signed-off-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 29 +++++++++++++++++++++++------ + drivers/ata/ahci.h | 1 + + 2 files changed, 24 insertions(+), 6 deletions(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 8bfada4843d83..6f7f8e41404dc 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -49,6 +49,7 @@ enum { + enum board_ids { + /* board IDs by feature in alphabetical order */ + board_ahci, ++ board_ahci_43bit_dma, + board_ahci_ign_iferr, + board_ahci_low_power, + board_ahci_no_debounce_delay, +@@ -129,6 +130,13 @@ static const struct ata_port_info ahci_port_info[] = { + .udma_mask = ATA_UDMA6, + .port_ops = &ahci_ops, + }, ++ [board_ahci_43bit_dma] = { ++ AHCI_HFLAGS (AHCI_HFLAG_43BIT_ONLY), ++ .flags = AHCI_FLAG_COMMON, ++ .pio_mask = ATA_PIO4, ++ .udma_mask = ATA_UDMA6, ++ .port_ops = &ahci_ops, ++ }, + [board_ahci_ign_iferr] = { + AHCI_HFLAGS (AHCI_HFLAG_IGN_IRQ_IF_ERR), + .flags = AHCI_FLAG_COMMON, +@@ -594,11 +602,11 @@ static const struct pci_device_id ahci_pci_tbl[] = { + { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */ + { PCI_VDEVICE(PROMISE, 0x3781), board_ahci }, /* FastTrak TX8660 ahci-mode */ + +- /* Asmedia */ ++ /* ASMedia */ + { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci }, /* ASM1060 */ + { PCI_VDEVICE(ASMEDIA, 0x0602), board_ahci }, /* ASM1060 */ +- { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */ +- { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */ ++ { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci_43bit_dma }, /* ASM1061 */ ++ { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci_43bit_dma }, /* ASM1061/1062 */ + { PCI_VDEVICE(ASMEDIA, 0x0621), board_ahci }, /* ASM1061R */ + { PCI_VDEVICE(ASMEDIA, 0x0622), board_ahci }, /* ASM1062R */ + +@@ -951,11 +959,20 @@ static int ahci_pci_device_resume(struct device *dev) + + #endif /* CONFIG_PM */ + +-static int ahci_configure_dma_masks(struct pci_dev *pdev, int using_dac) ++static int ahci_configure_dma_masks(struct pci_dev *pdev, ++ struct ahci_host_priv *hpriv) + { +- const int dma_bits = using_dac ? 64 : 32; ++ int dma_bits; + int rc; + ++ if (hpriv->cap & HOST_CAP_64) { ++ dma_bits = 64; ++ if (hpriv->flags & AHCI_HFLAG_43BIT_ONLY) ++ dma_bits = 43; ++ } else { ++ dma_bits = 32; ++ } ++ + /* + * If the device fixup already set the dma_mask to some non-standard + * value, don't extend it here. This happens on STA2X11, for example. +@@ -1933,7 +1950,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + ahci_gtf_filter_workaround(host); + + /* initialize adapter */ +- rc = ahci_configure_dma_masks(pdev, hpriv->cap & HOST_CAP_64); ++ rc = ahci_configure_dma_masks(pdev, hpriv); + if (rc) + return rc; + +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index 7cc6feb17e972..b8db2b0d74146 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -244,6 +244,7 @@ enum { + AHCI_HFLAG_IGN_NOTSUPP_POWER_ON = BIT(27), /* ignore -EOPNOTSUPP + from phy_power_on() */ + AHCI_HFLAG_NO_SXS = BIT(28), /* SXS not supported */ ++ AHCI_HFLAG_43BIT_ONLY = BIT(29), /* 43bit DMA addr limit */ + + /* ap->flags bits */ + +-- +2.43.0 + diff --git a/queue-5.10/ahci-asm1166-correct-count-of-reported-ports.patch b/queue-5.10/ahci-asm1166-correct-count-of-reported-ports.patch new file mode 100644 index 00000000000..9c34d2e01a4 --- /dev/null +++ b/queue-5.10/ahci-asm1166-correct-count-of-reported-ports.patch @@ -0,0 +1,52 @@ +From 761f961c00f9535a9766ab04f4db2d017219bd58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 19:30:02 +0100 +Subject: ahci: asm1166: correct count of reported ports + +From: Conrad Kostecki + +[ Upstream commit 0077a504e1a4468669fd2e011108db49133db56e ] + +The ASM1166 SATA host controller always reports wrongly, +that it has 32 ports. But in reality, it only has six ports. + +This seems to be a hardware issue, as all tested ASM1166 +SATA host controllers reports such high count of ports. + +Example output: ahci 0000:09:00.0: AHCI 0001.0301 +32 slots 32 ports 6 Gbps 0xffffff3f impl SATA mode. + +By adjusting the port_map, the count is limited to six ports. + +New output: ahci 0000:09:00.0: AHCI 0001.0301 +32 slots 32 ports 6 Gbps 0x3f impl SATA mode. + +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=211873 +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218346 +Signed-off-by: Conrad Kostecki +Reviewed-by: Hans de Goede +Signed-off-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 4297a8d69dbf7..8bfada4843d83 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -654,6 +654,11 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets"); + static void ahci_pci_save_initial_config(struct pci_dev *pdev, + struct ahci_host_priv *hpriv) + { ++ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1166) { ++ dev_info(&pdev->dev, "ASM1166 has only six ports\n"); ++ hpriv->saved_port_map = 0x3f; ++ } ++ + if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) { + dev_info(&pdev->dev, "JMB361 has only one port\n"); + hpriv->force_port_map = 1; +-- +2.43.0 + diff --git a/queue-5.10/asoc-sunxi-sun4i-spdif-add-support-for-allwinner-h61.patch b/queue-5.10/asoc-sunxi-sun4i-spdif-add-support-for-allwinner-h61.patch new file mode 100644 index 00000000000..e35ee5e2518 --- /dev/null +++ b/queue-5.10/asoc-sunxi-sun4i-spdif-add-support-for-allwinner-h61.patch @@ -0,0 +1,45 @@ +From 805b5ee793ff0d9cfb7cf690575d25452574a699 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 00:32:43 +0800 +Subject: ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 + +From: Chen-Yu Tsai + +[ Upstream commit 0adf963b8463faa44653e22e56ce55f747e68868 ] + +The SPDIF hardware block found in the H616 SoC has the same layout as +the one found in the H6 SoC, except that it is missing the receiver +side. + +Since the driver currently only supports the transmit function, support +for the H616 is identical to what is currently done for the H6. + +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Andre Przywara +Reviewed-by: Jernej Skrabec +Link: https://msgid.link/r/20240127163247.384439-4-wens@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-spdif.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c +index 228485fe07342..6dcad1aa25037 100644 +--- a/sound/soc/sunxi/sun4i-spdif.c ++++ b/sound/soc/sunxi/sun4i-spdif.c +@@ -464,6 +464,11 @@ static const struct of_device_id sun4i_spdif_of_match[] = { + .compatible = "allwinner,sun50i-h6-spdif", + .data = &sun50i_h6_spdif_quirks, + }, ++ { ++ .compatible = "allwinner,sun50i-h616-spdif", ++ /* Essentially the same as the H6, but without RX */ ++ .data = &sun50i_h6_spdif_quirks, ++ }, + { /* sentinel */ } + }; + MODULE_DEVICE_TABLE(of, sun4i_spdif_of_match); +-- +2.43.0 + diff --git a/queue-5.10/dmaengine-fsl-qdma-increase-size-of-irq_name.patch b/queue-5.10/dmaengine-fsl-qdma-increase-size-of-irq_name.patch new file mode 100644 index 00000000000..cda94d4e23d --- /dev/null +++ b/queue-5.10/dmaengine-fsl-qdma-increase-size-of-irq_name.patch @@ -0,0 +1,48 @@ +From dc6e7b38aa05b4f7516191498440a3043b4bfaae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 18:10:44 +0530 +Subject: dmaengine: fsl-qdma: increase size of 'irq_name' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vinod Koul + +[ Upstream commit 6386f6c995b3ab91c72cfb76e4465553c555a8da ] + +We seem to have hit warnings of 'output may be truncated' which is fixed +by increasing the size of 'irq_name' + +drivers/dma/fsl-qdma.c: In function ‘fsl_qdma_irq_init’: +drivers/dma/fsl-qdma.c:824:46: error: ‘%d’ directive writing between 1 and 11 bytes into a region of size 10 [-Werror=format-overflow=] + 824 | sprintf(irq_name, "qdma-queue%d", i); + | ^~ +drivers/dma/fsl-qdma.c:824:35: note: directive argument in the range [-2147483641, 2147483646] + 824 | sprintf(irq_name, "qdma-queue%d", i); + | ^~~~~~~~~~~~~~ +drivers/dma/fsl-qdma.c:824:17: note: ‘sprintf’ output between 12 and 22 bytes into a destination of size 20 + 824 | sprintf(irq_name, "qdma-queue%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 69385f32e2756..f383f219ed008 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -805,7 +805,7 @@ fsl_qdma_irq_init(struct platform_device *pdev, + int i; + int cpu; + int ret; +- char irq_name[20]; ++ char irq_name[32]; + + fsl_qdma->error_irq = + platform_get_irq_byname(pdev, "qdma-error"); +-- +2.43.0 + diff --git a/queue-5.10/dmaengine-shdma-increase-size-of-dev_id.patch b/queue-5.10/dmaengine-shdma-increase-size-of-dev_id.patch new file mode 100644 index 00000000000..187ce07b3b5 --- /dev/null +++ b/queue-5.10/dmaengine-shdma-increase-size-of-dev_id.patch @@ -0,0 +1,53 @@ +From 978e99f03cc56c9ab1c665b30b3a5bcf66d15451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jan 2024 18:10:44 +0530 +Subject: dmaengine: shdma: increase size of 'dev_id' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vinod Koul + +[ Upstream commit 404290240827c3bb5c4e195174a8854eef2f89ac ] + +We seem to have hit warnings of 'output may be truncated' which is fixed +by increasing the size of 'dev_id' + +drivers/dma/sh/shdmac.c: In function ‘sh_dmae_probe’: +drivers/dma/sh/shdmac.c:541:34: error: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 9 [-Werror=format-truncation=] + 541 | "sh-dmae%d.%d", pdev->id, id); + | ^~ +In function ‘sh_dmae_chan_probe’, + inlined from ‘sh_dmae_probe’ at drivers/dma/sh/shdmac.c:845:9: +drivers/dma/sh/shdmac.c:541:26: note: directive argument in the range [0, 2147483647] + 541 | "sh-dmae%d.%d", pdev->id, id); + | ^~~~~~~~~~~~~~ +drivers/dma/sh/shdmac.c:541:26: note: directive argument in the range [0, 19] +drivers/dma/sh/shdmac.c:540:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16 + 540 | snprintf(sh_chan->dev_id, sizeof(sh_chan->dev_id), + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 541 | "sh-dmae%d.%d", pdev->id, id); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sh/shdma.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/sh/shdma.h b/drivers/dma/sh/shdma.h +index 9c121a4b33ad8..f97d80343aea4 100644 +--- a/drivers/dma/sh/shdma.h ++++ b/drivers/dma/sh/shdma.h +@@ -25,7 +25,7 @@ struct sh_dmae_chan { + const struct sh_dmae_slave_config *config; /* Slave DMA configuration */ + int xmit_shift; /* log_2(bytes_per_xfer) */ + void __iomem *base; +- char dev_id[16]; /* unique name per DMAC of channel */ ++ char dev_id[32]; /* unique name per DMAC of channel */ + int pm_error; + dma_addr_t slave_addr; + }; +-- +2.43.0 + diff --git a/queue-5.10/dmaengine-ti-edma-add-some-null-pointer-checks-to-th.patch b/queue-5.10/dmaengine-ti-edma-add-some-null-pointer-checks-to-th.patch new file mode 100644 index 00000000000..1cf0145d539 --- /dev/null +++ b/queue-5.10/dmaengine-ti-edma-add-some-null-pointer-checks-to-th.patch @@ -0,0 +1,52 @@ +From 811ca4eda676a14c8a07c8143ae02eadd60b431c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 11:19:29 +0800 +Subject: dmaengine: ti: edma: Add some null pointer checks to the edma_probe + +From: Kunwu Chan + +[ Upstream commit 6e2276203ac9ff10fc76917ec9813c660f627369 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. Ensure the allocation was successful +by checking the pointer validity. + +Signed-off-by: Kunwu Chan +Link: https://lore.kernel.org/r/20240118031929.192192-1-chentao@kylinos.cn +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/edma.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c +index a1adc8d91fd8d..69292d4a0c441 100644 +--- a/drivers/dma/ti/edma.c ++++ b/drivers/dma/ti/edma.c +@@ -2462,6 +2462,11 @@ static int edma_probe(struct platform_device *pdev) + if (irq > 0) { + irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccint", + dev_name(dev)); ++ if (!irq_name) { ++ ret = -ENOMEM; ++ goto err_disable_pm; ++ } ++ + ret = devm_request_irq(dev, irq, dma_irq_handler, 0, irq_name, + ecc); + if (ret) { +@@ -2478,6 +2483,11 @@ static int edma_probe(struct platform_device *pdev) + if (irq > 0) { + irq_name = devm_kasprintf(dev, GFP_KERNEL, "%s_ccerrint", + dev_name(dev)); ++ if (!irq_name) { ++ ret = -ENOMEM; ++ goto err_disable_pm; ++ } ++ + ret = devm_request_irq(dev, irq, dma_ccerr_handler, 0, irq_name, + ecc); + if (ret) { +-- +2.43.0 + diff --git a/queue-5.10/efi-don-t-add-memblocks-for-soft-reserved-memory.patch b/queue-5.10/efi-don-t-add-memblocks-for-soft-reserved-memory.patch new file mode 100644 index 00000000000..eab8a56fb7a --- /dev/null +++ b/queue-5.10/efi-don-t-add-memblocks-for-soft-reserved-memory.patch @@ -0,0 +1,59 @@ +From d9bd5306ff9bf5c140cad6c199f9ce56a27d29b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 10:07:04 -0800 +Subject: efi: Don't add memblocks for soft-reserved memory + +From: Andrew Bresticker + +[ Upstream commit 0bcff59ef7a652fcdc6d535554b63278c2406c8f ] + +Adding memblocks for soft-reserved regions prevents them from later being +hotplugged in by dax_kmem. + +Signed-off-by: Andrew Bresticker +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/efi-init.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/firmware/efi/efi-init.c b/drivers/firmware/efi/efi-init.c +index f55a92ff12c0f..86da3c7a5036a 100644 +--- a/drivers/firmware/efi/efi-init.c ++++ b/drivers/firmware/efi/efi-init.c +@@ -141,15 +141,6 @@ static __init int is_usable_memory(efi_memory_desc_t *md) + case EFI_BOOT_SERVICES_DATA: + case EFI_CONVENTIONAL_MEMORY: + case EFI_PERSISTENT_MEMORY: +- /* +- * Special purpose memory is 'soft reserved', which means it +- * is set aside initially, but can be hotplugged back in or +- * be assigned to the dax driver after boot. +- */ +- if (efi_soft_reserve_enabled() && +- (md->attribute & EFI_MEMORY_SP)) +- return false; +- + /* + * According to the spec, these regions are no longer reserved + * after calling ExitBootServices(). However, we can only use +@@ -194,6 +185,16 @@ static __init void reserve_regions(void) + size = npages << PAGE_SHIFT; + + if (is_memory(md)) { ++ /* ++ * Special purpose memory is 'soft reserved', which ++ * means it is set aside initially. Don't add a memblock ++ * for it now so that it can be hotplugged back in or ++ * be assigned to the dax driver after boot. ++ */ ++ if (efi_soft_reserve_enabled() && ++ (md->attribute & EFI_MEMORY_SP)) ++ continue; ++ + early_init_dt_add_memory_arch(paddr, size); + + if (!is_usable_memory(md)) +-- +2.43.0 + diff --git a/queue-5.10/efi-runtime-fix-potential-overflow-of-soft-reserved-.patch b/queue-5.10/efi-runtime-fix-potential-overflow-of-soft-reserved-.patch new file mode 100644 index 00000000000..d634676f815 --- /dev/null +++ b/queue-5.10/efi-runtime-fix-potential-overflow-of-soft-reserved-.patch @@ -0,0 +1,49 @@ +From 59d6b081bae2a94adadea4dc26b42893614edafe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 10:07:03 -0800 +Subject: efi: runtime: Fix potential overflow of soft-reserved region size + +From: Andrew Bresticker + +[ Upstream commit de1034b38a346ef6be25fe8792f5d1e0684d5ff4 ] + +md_size will have been narrowed if we have >= 4GB worth of pages in a +soft-reserved region. + +Signed-off-by: Andrew Bresticker +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/arm-runtime.c | 2 +- + drivers/firmware/efi/riscv-runtime.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c +index 3359ae2adf24b..9054c2852580d 100644 +--- a/drivers/firmware/efi/arm-runtime.c ++++ b/drivers/firmware/efi/arm-runtime.c +@@ -107,7 +107,7 @@ static int __init arm_enable_runtime_services(void) + efi_memory_desc_t *md; + + for_each_efi_memory_desc(md) { +- int md_size = md->num_pages << EFI_PAGE_SHIFT; ++ u64 md_size = md->num_pages << EFI_PAGE_SHIFT; + struct resource *res; + + if (!(md->attribute & EFI_MEMORY_SP)) +diff --git a/drivers/firmware/efi/riscv-runtime.c b/drivers/firmware/efi/riscv-runtime.c +index d28e715d2bcc8..6711e64eb0b16 100644 +--- a/drivers/firmware/efi/riscv-runtime.c ++++ b/drivers/firmware/efi/riscv-runtime.c +@@ -85,7 +85,7 @@ static int __init riscv_enable_runtime_services(void) + efi_memory_desc_t *md; + + for_each_efi_memory_desc(md) { +- int md_size = md->num_pages << EFI_PAGE_SHIFT; ++ u64 md_size = md->num_pages << EFI_PAGE_SHIFT; + struct resource *res; + + if (!(md->attribute & EFI_MEMORY_SP)) +-- +2.43.0 + diff --git a/queue-5.10/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch b/queue-5.10/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch new file mode 100644 index 00000000000..e827d31a2d5 --- /dev/null +++ b/queue-5.10/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch @@ -0,0 +1,65 @@ +From 14c0de4adfc6f786235cb5367ed49745aa3bbfd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 22:20:38 +0800 +Subject: ext4: avoid allocating blocks from corrupted group in + ext4_mb_try_best_found() + +From: Baokun Li + +[ Upstream commit 4530b3660d396a646aad91a787b6ab37cf604b53 ] + +Determine if the group block bitmap is corrupted before using ac_b_ex in +ext4_mb_try_best_found() to avoid allocating blocks from a group with a +corrupted block bitmap in the following concurrency and making the +situation worse. + +ext4_mb_regular_allocator + ext4_lock_group(sb, group) + ext4_mb_good_group + // check if the group bbitmap is corrupted + ext4_mb_complex_scan_group + // Scan group gets ac_b_ex but doesn't use it + ext4_unlock_group(sb, group) + ext4_mark_group_bitmap_corrupted(group) + // The block bitmap was corrupted during + // the group unlock gap. + ext4_mb_try_best_found + ext4_lock_group(ac->ac_sb, group) + ext4_mb_use_best_found + mb_mark_used + // Allocating blocks in block bitmap corrupted group + +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240104142040.2835097-7-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 9bec75847b856..ebb79f10330a8 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1854,6 +1854,9 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac, + return err; + + ext4_lock_group(ac->ac_sb, group); ++ if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) ++ goto out; ++ + max = mb_find_extent(e4b, ex.fe_start, ex.fe_len, &ex); + + if (max > 0) { +@@ -1861,6 +1864,7 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac, + ext4_mb_use_best_found(ac, e4b); + } + ++out: + ext4_unlock_group(ac->ac_sb, group); + ext4_mb_unload_buddy(e4b); + +-- +2.43.0 + diff --git a/queue-5.10/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch-5612 b/queue-5.10/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch-5612 new file mode 100644 index 00000000000..18517a71981 --- /dev/null +++ b/queue-5.10/ext4-avoid-allocating-blocks-from-corrupted-group-in.patch-5612 @@ -0,0 +1,54 @@ +From 8bf413205bebc523d82f794689846650a68816ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 22:20:39 +0800 +Subject: ext4: avoid allocating blocks from corrupted group in + ext4_mb_find_by_goal() + +From: Baokun Li + +[ Upstream commit 832698373a25950942c04a512daa652c18a9b513 ] + +Places the logic for checking if the group's block bitmap is corrupt under +the protection of the group lock to avoid allocating blocks from the group +with a corrupted block bitmap. + +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240104142040.2835097-8-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index ebb79f10330a8..46da6845c3072 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1893,12 +1893,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, + if (err) + return err; + +- if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) { +- ext4_mb_unload_buddy(e4b); +- return 0; +- } +- + ext4_lock_group(ac->ac_sb, group); ++ if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) ++ goto out; ++ + max = mb_find_extent(e4b, ac->ac_g_ex.fe_start, + ac->ac_g_ex.fe_len, &ex); + ex.fe_logical = 0xDEADFA11; /* debug value */ +@@ -1931,6 +1929,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac, + ac->ac_b_ex = ex; + ext4_mb_use_best_found(ac, e4b); + } ++out: + ext4_unlock_group(ac->ac_sb, group); + ext4_mb_unload_buddy(e4b); + +-- +2.43.0 + diff --git a/queue-5.10/ext4-correct-the-hole-length-returned-by-ext4_map_bl.patch b/queue-5.10/ext4-correct-the-hole-length-returned-by-ext4_map_bl.patch new file mode 100644 index 00000000000..37f781e722f --- /dev/null +++ b/queue-5.10/ext4-correct-the-hole-length-returned-by-ext4_map_bl.patch @@ -0,0 +1,189 @@ +From af1c6ea3b6db25781c25aa24ea060dcd2900df5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Jan 2024 09:58:02 +0800 +Subject: ext4: correct the hole length returned by ext4_map_blocks() + +From: Zhang Yi + +[ Upstream commit 6430dea07e85958fa87d0276c0c4388dd51e630b ] + +In ext4_map_blocks(), if we can't find a range of mapping in the +extents cache, we are calling ext4_ext_map_blocks() to search the real +path and ext4_ext_determine_hole() to determine the hole range. But if +the querying range was partially or completely overlaped by a delalloc +extent, we can't find it in the real extent path, so the returned hole +length could be incorrect. + +Fortunately, ext4_ext_put_gap_in_cache() have already handle delalloc +extent, but it searches start from the expanded hole_start, doesn't +start from the querying range, so the delalloc extent found could not be +the one that overlaped the querying range, plus, it also didn't adjust +the hole length. Let's just remove ext4_ext_put_gap_in_cache(), handle +delalloc and insert adjusted hole extent in ext4_ext_determine_hole(). + +Signed-off-by: Zhang Yi +Suggested-by: Jan Kara +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240127015825.1608160-4-yi.zhang@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 111 +++++++++++++++++++++++++++++----------------- + 1 file changed, 70 insertions(+), 41 deletions(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 193b13630ac1e..68aa8760cb465 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -2222,7 +2222,7 @@ static int ext4_fill_es_cache_info(struct inode *inode, + + + /* +- * ext4_ext_determine_hole - determine hole around given block ++ * ext4_ext_find_hole - find hole around given block according to the given path + * @inode: inode we lookup in + * @path: path in extent tree to @lblk + * @lblk: pointer to logical block around which we want to determine hole +@@ -2234,9 +2234,9 @@ static int ext4_fill_es_cache_info(struct inode *inode, + * The function returns the length of a hole starting at @lblk. We update @lblk + * to the beginning of the hole if we managed to find it. + */ +-static ext4_lblk_t ext4_ext_determine_hole(struct inode *inode, +- struct ext4_ext_path *path, +- ext4_lblk_t *lblk) ++static ext4_lblk_t ext4_ext_find_hole(struct inode *inode, ++ struct ext4_ext_path *path, ++ ext4_lblk_t *lblk) + { + int depth = ext_depth(inode); + struct ext4_extent *ex; +@@ -2263,30 +2263,6 @@ static ext4_lblk_t ext4_ext_determine_hole(struct inode *inode, + return len; + } + +-/* +- * ext4_ext_put_gap_in_cache: +- * calculate boundaries of the gap that the requested block fits into +- * and cache this gap +- */ +-static void +-ext4_ext_put_gap_in_cache(struct inode *inode, ext4_lblk_t hole_start, +- ext4_lblk_t hole_len) +-{ +- struct extent_status es; +- +- ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start, +- hole_start + hole_len - 1, &es); +- if (es.es_len) { +- /* There's delayed extent containing lblock? */ +- if (es.es_lblk <= hole_start) +- return; +- hole_len = min(es.es_lblk - hole_start, hole_len); +- } +- ext_debug(inode, " -> %u:%u\n", hole_start, hole_len); +- ext4_es_insert_extent(inode, hole_start, hole_len, ~0, +- EXTENT_STATUS_HOLE); +-} +- + /* + * ext4_ext_rm_idx: + * removes index from the index block. +@@ -4058,6 +4034,69 @@ static int get_implied_cluster_alloc(struct super_block *sb, + return 0; + } + ++/* ++ * Determine hole length around the given logical block, first try to ++ * locate and expand the hole from the given @path, and then adjust it ++ * if it's partially or completely converted to delayed extents, insert ++ * it into the extent cache tree if it's indeed a hole, finally return ++ * the length of the determined extent. ++ */ ++static ext4_lblk_t ext4_ext_determine_insert_hole(struct inode *inode, ++ struct ext4_ext_path *path, ++ ext4_lblk_t lblk) ++{ ++ ext4_lblk_t hole_start, len; ++ struct extent_status es; ++ ++ hole_start = lblk; ++ len = ext4_ext_find_hole(inode, path, &hole_start); ++again: ++ ext4_es_find_extent_range(inode, &ext4_es_is_delayed, hole_start, ++ hole_start + len - 1, &es); ++ if (!es.es_len) ++ goto insert_hole; ++ ++ /* ++ * There's a delalloc extent in the hole, handle it if the delalloc ++ * extent is in front of, behind and straddle the queried range. ++ */ ++ if (lblk >= es.es_lblk + es.es_len) { ++ /* ++ * The delalloc extent is in front of the queried range, ++ * find again from the queried start block. ++ */ ++ len -= lblk - hole_start; ++ hole_start = lblk; ++ goto again; ++ } else if (in_range(lblk, es.es_lblk, es.es_len)) { ++ /* ++ * The delalloc extent containing lblk, it must have been ++ * added after ext4_map_blocks() checked the extent status ++ * tree, adjust the length to the delalloc extent's after ++ * lblk. ++ */ ++ len = es.es_lblk + es.es_len - lblk; ++ return len; ++ } else { ++ /* ++ * The delalloc extent is partially or completely behind ++ * the queried range, update hole length until the ++ * beginning of the delalloc extent. ++ */ ++ len = min(es.es_lblk - hole_start, len); ++ } ++ ++insert_hole: ++ /* Put just found gap into cache to speed up subsequent requests */ ++ ext_debug(inode, " -> %u:%u\n", hole_start, len); ++ ext4_es_insert_extent(inode, hole_start, len, ~0, EXTENT_STATUS_HOLE); ++ ++ /* Update hole_len to reflect hole size after lblk */ ++ if (hole_start != lblk) ++ len -= lblk - hole_start; ++ ++ return len; ++} + + /* + * Block allocation/map/preallocation routine for extents based files +@@ -4175,22 +4214,12 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode, + * we couldn't try to create block if create flag is zero + */ + if ((flags & EXT4_GET_BLOCKS_CREATE) == 0) { +- ext4_lblk_t hole_start, hole_len; ++ ext4_lblk_t len; + +- hole_start = map->m_lblk; +- hole_len = ext4_ext_determine_hole(inode, path, &hole_start); +- /* +- * put just found gap into cache to speed up +- * subsequent requests +- */ +- ext4_ext_put_gap_in_cache(inode, hole_start, hole_len); ++ len = ext4_ext_determine_insert_hole(inode, path, map->m_lblk); + +- /* Update hole_len to reflect hole size after map->m_lblk */ +- if (hole_start != map->m_lblk) +- hole_len -= map->m_lblk - hole_start; + map->m_pblk = 0; +- map->m_len = min_t(unsigned int, map->m_len, hole_len); +- ++ map->m_len = min_t(unsigned int, map->m_len, len); + goto out; + } + +-- +2.43.0 + diff --git a/queue-5.10/fbdev-savage-error-out-if-pixclock-equals-zero.patch b/queue-5.10/fbdev-savage-error-out-if-pixclock-equals-zero.patch new file mode 100644 index 00000000000..bf266228f51 --- /dev/null +++ b/queue-5.10/fbdev-savage-error-out-if-pixclock-equals-zero.patch @@ -0,0 +1,45 @@ +From 3a1388a091a970d7228a92b14f4de8199b649dce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 11:49:40 +0800 +Subject: fbdev: savage: Error out if pixclock equals zero + +From: Fullway Wang + +[ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ] + +The userspace program could pass any values to the driver through +ioctl() interface. If the driver doesn't check the value of pixclock, +it may cause divide-by-zero error. + +Although pixclock is checked in savagefb_decode_var(), but it is not +checked properly in savagefb_probe(). Fix this by checking whether +pixclock is zero in the function savagefb_check_var() before +info->var.pixclock is used as the divisor. + +This is similar to CVE-2022-3061 in i740fb which was fixed by +commit 15cf0b8. + +Signed-off-by: Fullway Wang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/savage/savagefb_driver.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c +index 0ac750cc5ea13..94ebd8af50cf7 100644 +--- a/drivers/video/fbdev/savage/savagefb_driver.c ++++ b/drivers/video/fbdev/savage/savagefb_driver.c +@@ -868,6 +868,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var, + + DBG("savagefb_check_var"); + ++ if (!var->pixclock) ++ return -EINVAL; ++ + var->transp.offset = 0; + var->transp.length = 0; + switch (var->bits_per_pixel) { +-- +2.43.0 + diff --git a/queue-5.10/fbdev-sis-error-out-if-pixclock-equals-zero.patch b/queue-5.10/fbdev-sis-error-out-if-pixclock-equals-zero.patch new file mode 100644 index 00000000000..1e5deb8201d --- /dev/null +++ b/queue-5.10/fbdev-sis-error-out-if-pixclock-equals-zero.patch @@ -0,0 +1,43 @@ +From 3785439470f948e6bddcc776fe0c2b26d629c6a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 14:24:43 +0800 +Subject: fbdev: sis: Error out if pixclock equals zero + +From: Fullway Wang + +[ Upstream commit e421946be7d9bf545147bea8419ef8239cb7ca52 ] + +The userspace program could pass any values to the driver through +ioctl() interface. If the driver doesn't check the value of pixclock, +it may cause divide-by-zero error. + +In sisfb_check_var(), var->pixclock is used as a divisor to caculate +drate before it is checked against zero. Fix this by checking it +at the beginning. + +This is similar to CVE-2022-3061 in i740fb which was fixed by +commit 15cf0b8. + +Signed-off-by: Fullway Wang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sis/sis_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/sis/sis_main.c b/drivers/video/fbdev/sis/sis_main.c +index 03c736f6f3d08..e540cb0c51726 100644 +--- a/drivers/video/fbdev/sis/sis_main.c ++++ b/drivers/video/fbdev/sis/sis_main.c +@@ -1474,6 +1474,8 @@ sisfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + + vtotal = var->upper_margin + var->lower_margin + var->vsync_len; + ++ if (!var->pixclock) ++ return -EINVAL; + pixclock = var->pixclock; + + if((var->vmode & FB_VMODE_MASK) == FB_VMODE_NONINTERLACED) { +-- +2.43.0 + diff --git a/queue-5.10/firewire-core-send-bus-reset-promptly-on-gap-count-e.patch b/queue-5.10/firewire-core-send-bus-reset-promptly-on-gap-count-e.patch new file mode 100644 index 00000000000..8bcf174775b --- /dev/null +++ b/queue-5.10/firewire-core-send-bus-reset-promptly-on-gap-count-e.patch @@ -0,0 +1,129 @@ +From 89c0bdf6ccb1251eb763109dccd1132975685a20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Feb 2024 08:01:17 +0900 +Subject: firewire: core: send bus reset promptly on gap count error + +From: Takashi Sakamoto + +[ Upstream commit 7ed4380009e96d9e9c605e12822e987b35b05648 ] + +If we are bus manager and the bus has inconsistent gap counts, send a +bus reset immediately instead of trying to read the root node's config +ROM first. Otherwise, we could spend a lot of time trying to read the +config ROM but never succeeding. + +This eliminates a 50+ second delay before the FireWire bus is usable after +a newly connected device is powered on in certain circumstances. + +The delay occurs if a gap count inconsistency occurs, we are not the root +node, and we become bus manager. One scenario that causes this is with a TI +XIO2213B OHCI, the first time a Sony DSR-25 is powered on after being +connected to the FireWire cable. In this configuration, the Linux box will +not receive the initial PHY configuration packet sent by the DSR-25 as IRM, +resulting in the DSR-25 having a gap count of 44 while the Linux box has a +gap count of 63. + +FireWire devices have a gap count parameter, which is set to 63 on power-up +and can be changed with a PHY configuration packet. This determines the +duration of the subaction and arbitration gaps. For reliable communication, +all nodes on a FireWire bus must have the same gap count. + +A node may have zero or more of the following roles: root node, bus manager +(BM), isochronous resource manager (IRM), and cycle master. Unless a root +node was forced with a PHY configuration packet, any node might become root +node after a bus reset. Only the root node can become cycle master. If the +root node is not cycle master capable, the BM or IRM should force a change +of root node. + +After a bus reset, each node sends a self-ID packet, which contains its +current gap count. A single bus reset does not change the gap count, but +two bus resets in a row will set the gap count to 63. Because a consistent +gap count is required for reliable communication, IEEE 1394a-2000 requires +that the bus manager generate a bus reset if it detects that the gap count +is inconsistent. + +When the gap count is inconsistent, build_tree() will notice this after the +self identification process. It will set card->gap_count to the invalid +value 0. If we become bus master, this will force bm_work() to send a bus +reset when it performs gap count optimization. + +After a bus reset, there is no bus manager. We will almost always try to +become bus manager. Once we become bus manager, we will first determine +whether the root node is cycle master capable. Then, we will determine if +the gap count should be changed. If either the root node or the gap count +should be changed, we will generate a bus reset. + +To determine if the root node is cycle master capable, we read its +configuration ROM. bm_work() will wait until we have finished trying to +read the configuration ROM. + +However, an inconsistent gap count can make this take a long time. +read_config_rom() will read the first few quadlets from the config ROM. Due +to the gap count inconsistency, eventually one of the reads will time out. +When read_config_rom() fails, fw_device_init() calls it again until +MAX_RETRIES is reached. This takes 50+ seconds. + +Once we give up trying to read the configuration ROM, bm_work() will wake +up, assume that the root node is not cycle master capable, and do a bus +reset. Hopefully, this will resolve the gap count inconsistency. + +This change makes bm_work() check for an inconsistent gap count before +waiting for the root node's configuration ROM. If the gap count is +inconsistent, bm_work() will immediately do a bus reset. This eliminates +the 50+ second delay and rapidly brings the bus to a working state. + +I considered that if the gap count is inconsistent, a PHY configuration +packet might not be successful, so it could be desirable to skip the PHY +configuration packet before the bus reset in this case. However, IEEE +1394a-2000 and IEEE 1394-2008 say that the bus manager may transmit a PHY +configuration packet before a bus reset when correcting a gap count error. +Since the standard endorses this, I decided it's safe to retain the PHY +configuration packet transmission. + +Normally, after a topology change, we will reset the bus a maximum of 5 +times to change the root node and perform gap count optimization. However, +if there is a gap count inconsistency, we must always generate a bus reset. +Otherwise the gap count inconsistency will persist and communication will +be unreliable. For that reason, if there is a gap count inconstency, we +generate a bus reset even if we already reached the 5 reset limit. + +Signed-off-by: Adam Goldman +Reference: https://sourceforge.net/p/linux1394/mailman/message/58727806/ +Signed-off-by: Takashi Sakamoto +Signed-off-by: Sasha Levin +--- + drivers/firewire/core-card.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c +index f3b3953cac834..be195ba834632 100644 +--- a/drivers/firewire/core-card.c ++++ b/drivers/firewire/core-card.c +@@ -429,7 +429,23 @@ static void bm_work(struct work_struct *work) + */ + card->bm_generation = generation; + +- if (root_device == NULL) { ++ if (card->gap_count == 0) { ++ /* ++ * If self IDs have inconsistent gap counts, do a ++ * bus reset ASAP. The config rom read might never ++ * complete, so don't wait for it. However, still ++ * send a PHY configuration packet prior to the ++ * bus reset. The PHY configuration packet might ++ * fail, but 1394-2008 8.4.5.2 explicitly permits ++ * it in this case, so it should be safe to try. ++ */ ++ new_root_id = local_id; ++ /* ++ * We must always send a bus reset if the gap count ++ * is inconsistent, so bypass the 5-reset limit. ++ */ ++ card->bm_retries = 0; ++ } else if (root_device == NULL) { + /* + * Either link_on is false, or we failed to read the + * config rom. In either case, pick another root. +-- +2.43.0 + diff --git a/queue-5.10/hwmon-coretemp-enlarge-per-package-core-count-limit.patch b/queue-5.10/hwmon-coretemp-enlarge-per-package-core-count-limit.patch new file mode 100644 index 00000000000..d30485309a5 --- /dev/null +++ b/queue-5.10/hwmon-coretemp-enlarge-per-package-core-count-limit.patch @@ -0,0 +1,43 @@ +From a622e2d17acd45aa9a012331f9007cc98eea79b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 17:21:36 +0800 +Subject: hwmon: (coretemp) Enlarge per package core count limit + +From: Zhang Rui + +[ Upstream commit 34cf8c657cf0365791cdc658ddbca9cc907726ce ] + +Currently, coretemp driver supports only 128 cores per package. +This loses some core temperature information on systems that have more +than 128 cores per package. + [ 58.685033] coretemp coretemp.0: Adding Core 128 failed + [ 58.692009] coretemp coretemp.0: Adding Core 129 failed + ... + +Enlarge the limitation to 512 because there are platforms with more than +256 cores per package. + +Signed-off-by: Zhang Rui +Link: https://lore.kernel.org/r/20240202092144.71180-4-rui.zhang@intel.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/coretemp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c +index d67d972d18aa2..cbe2f874b5e2f 100644 +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -40,7 +40,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius"); + + #define PKG_SYSFS_ATTR_NO 1 /* Sysfs attribute for package temp */ + #define BASE_SYSFS_ATTR_NO 2 /* Sysfs Base attr no for coretemp */ +-#define NUM_REAL_CORES 128 /* Number of Real cores per cpu */ ++#define NUM_REAL_CORES 512 /* Number of Real cores per cpu */ + #define CORETEMP_NAME_LENGTH 28 /* String Length of attrs */ + #define MAX_CORE_ATTRS 4 /* Maximum no of basic attrs */ + #define TOTAL_ATTRS (MAX_CORE_ATTRS + 1) +-- +2.43.0 + diff --git a/queue-5.10/input-i8042-add-fujitsu-lifebook-u728-to-i8042-quirk.patch b/queue-5.10/input-i8042-add-fujitsu-lifebook-u728-to-i8042-quirk.patch new file mode 100644 index 00000000000..634c820cdab --- /dev/null +++ b/queue-5.10/input-i8042-add-fujitsu-lifebook-u728-to-i8042-quirk.patch @@ -0,0 +1,55 @@ +From a4f15a6025f883d6bf3b80414ab69c6e1e2bf289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Feb 2024 10:28:59 -0800 +Subject: Input: i8042 - add Fujitsu Lifebook U728 to i8042 quirk table + +From: Szilard Fabian + +[ Upstream commit 4255447ad34c5c3785fcdcf76cfa0271d6e5ed39 ] + +Another Fujitsu-related patch. + +In the initial boot stage the integrated keyboard of Fujitsu Lifebook U728 +refuses to work and it's not possible to type for example a dm-crypt +passphrase without the help of an external keyboard. + +i8042.nomux kernel parameter resolves this issue but using that a PS/2 +mouse is detected. This input device is unused even when the i2c-hid-acpi +kernel module is blacklisted making the integrated ELAN touchpad +(04F3:3092) not working at all. + +So this notebook uses a hid-over-i2c touchpad which is managed by the +i2c_designware input driver. Since you can't find a PS/2 mouse port on this +computer and you can't connect a PS/2 mouse to it even with an official +port replicator I think it's safe to not use the PS/2 mouse port at all. + +Signed-off-by: Szilard Fabian +Link: https://lore.kernel.org/r/20240103014717.127307-2-szfabian@bluemarch.art +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h +index cd21c92a6b2cd..6804970d8f51a 100644 +--- a/drivers/input/serio/i8042-acpipnpio.h ++++ b/drivers/input/serio/i8042-acpipnpio.h +@@ -625,6 +625,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { + }, + .driver_data = (void *)(SERIO_QUIRK_NOAUX) + }, ++ { ++ /* Fujitsu Lifebook U728 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U728"), ++ }, ++ .driver_data = (void *)(SERIO_QUIRK_NOAUX) ++ }, + { + /* Gigabyte M912 */ + .matches = { +-- +2.43.0 + diff --git a/queue-5.10/netfilter-conntrack-check-sctp_cid_shutdown_ack-for-.patch b/queue-5.10/netfilter-conntrack-check-sctp_cid_shutdown_ack-for-.patch new file mode 100644 index 00000000000..663766f0a19 --- /dev/null +++ b/queue-5.10/netfilter-conntrack-check-sctp_cid_shutdown_ack-for-.patch @@ -0,0 +1,71 @@ +From 579f184c5600ecf2013ccc51af1074c50c1654f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 17:29:46 -0500 +Subject: netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in + sctp_new + +From: Xin Long + +[ Upstream commit 6e348067ee4bc5905e35faa3a8fafa91c9124bc7 ] + +The annotation says in sctp_new(): "If it is a shutdown ack OOTB packet, we +expect a return shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8)". +However, it does not check SCTP_CID_SHUTDOWN_ACK before setting vtag[REPLY] +in the conntrack entry(ct). + +Because of that, if the ct in Router disappears for some reason in [1] +with the packet sequence like below: + + Client > Server: sctp (1) [INIT] [init tag: 3201533963] + Server > Client: sctp (1) [INIT ACK] [init tag: 972498433] + Client > Server: sctp (1) [COOKIE ECHO] + Server > Client: sctp (1) [COOKIE ACK] + Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057809] + Server > Client: sctp (1) [SACK] [cum ack 3075057809] + Server > Client: sctp (1) [HB REQ] + (the ct in Router disappears somehow) <-------- [1] + Client > Server: sctp (1) [HB ACK] + Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] + Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] + Client > Server: sctp (1) [HB REQ] + Client > Server: sctp (1) [DATA] (B)(E) [TSN: 3075057810] + Client > Server: sctp (1) [HB REQ] + Client > Server: sctp (1) [ABORT] + +when processing HB ACK packet in Router it calls sctp_new() to initialize +the new ct with vtag[REPLY] set to HB_ACK packet's vtag. + +Later when sending DATA from Client, all the SACKs from Server will get +dropped in Router, as the SACK packet's vtag does not match vtag[REPLY] +in the ct. The worst thing is the vtag in this ct will never get fixed +by the upcoming packets from Server. + +This patch fixes it by checking SCTP_CID_SHUTDOWN_ACK before setting +vtag[REPLY] in the ct in sctp_new() as the annotation says. With this +fix, it will leave vtag[REPLY] in ct to 0 in the case above, and the +next HB REQ/ACK from Server is able to fix the vtag as its value is 0 +in nf_conntrack_sctp_packet(). + +Signed-off-by: Xin Long +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_sctp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c +index e7545bcca805e..6b2a215b27862 100644 +--- a/net/netfilter/nf_conntrack_proto_sctp.c ++++ b/net/netfilter/nf_conntrack_proto_sctp.c +@@ -299,7 +299,7 @@ sctp_new(struct nf_conn *ct, const struct sk_buff *skb, + pr_debug("Setting vtag %x for secondary conntrack\n", + sh->vtag); + ct->proto.sctp.vtag[IP_CT_DIR_ORIGINAL] = sh->vtag; +- } else { ++ } else if (sch->type == SCTP_CID_SHUTDOWN_ACK) { + /* If it is a shutdown ack OOTB packet, we expect a return + shutdown complete, otherwise an ABORT Sec 8.4 (5) and (8) */ + pr_debug("Setting vtag %x for new conn OOTB\n", +-- +2.43.0 + diff --git a/queue-5.10/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch b/queue-5.10/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch new file mode 100644 index 00000000000..e107d27b61c --- /dev/null +++ b/queue-5.10/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch @@ -0,0 +1,145 @@ +From 9841f461f55d4bb659465aebc3855964b95a066d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:01 +0100 +Subject: nvme-fc: do not wait in vain when unloading module + +From: Daniel Wagner + +[ Upstream commit 70fbfc47a392b98e5f8dba70c6efc6839205c982 ] + +The module exit path has race between deleting all controllers and +freeing 'left over IDs'. To prevent double free a synchronization +between nvme_delete_ctrl and ida_destroy has been added by the initial +commit. + +There is some logic around trying to prevent from hanging forever in +wait_for_completion, though it does not handling all cases. E.g. +blktests is able to reproduce the situation where the module unload +hangs forever. + +If we completely rely on the cleanup code executed from the +nvme_delete_ctrl path, all IDs will be freed eventually. This makes +calling ida_destroy unnecessary. We only have to ensure that all +nvme_delete_ctrl code has been executed before we leave +nvme_fc_exit_module. This is done by flushing the nvme_delete_wq +workqueue. + +While at it, remove the unused nvme_fc_wq workqueue too. + +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 47 ++++++------------------------------------ + 1 file changed, 6 insertions(+), 41 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 906cab35afe7a..8e05239073ef2 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -220,11 +220,6 @@ static LIST_HEAD(nvme_fc_lport_list); + static DEFINE_IDA(nvme_fc_local_port_cnt); + static DEFINE_IDA(nvme_fc_ctrl_cnt); + +-static struct workqueue_struct *nvme_fc_wq; +- +-static bool nvme_fc_waiting_to_unload; +-static DECLARE_COMPLETION(nvme_fc_unload_proceed); +- + /* + * These items are short-term. They will eventually be moved into + * a generic FC class. See comments in module init. +@@ -254,8 +249,6 @@ nvme_fc_free_lport(struct kref *ref) + /* remove from transport list */ + spin_lock_irqsave(&nvme_fc_lock, flags); + list_del(&lport->port_list); +- if (nvme_fc_waiting_to_unload && list_empty(&nvme_fc_lport_list)) +- complete(&nvme_fc_unload_proceed); + spin_unlock_irqrestore(&nvme_fc_lock, flags); + + ida_simple_remove(&nvme_fc_local_port_cnt, lport->localport.port_num); +@@ -3823,10 +3816,6 @@ static int __init nvme_fc_init_module(void) + { + int ret; + +- nvme_fc_wq = alloc_workqueue("nvme_fc_wq", WQ_MEM_RECLAIM, 0); +- if (!nvme_fc_wq) +- return -ENOMEM; +- + /* + * NOTE: + * It is expected that in the future the kernel will combine +@@ -3844,7 +3833,7 @@ static int __init nvme_fc_init_module(void) + ret = class_register(&fc_class); + if (ret) { + pr_err("couldn't register class fc\n"); +- goto out_destroy_wq; ++ return ret; + } + + /* +@@ -3868,8 +3857,6 @@ static int __init nvme_fc_init_module(void) + device_destroy(&fc_class, MKDEV(0, 0)); + out_destroy_class: + class_unregister(&fc_class); +-out_destroy_wq: +- destroy_workqueue(nvme_fc_wq); + + return ret; + } +@@ -3889,45 +3876,23 @@ nvme_fc_delete_controllers(struct nvme_fc_rport *rport) + spin_unlock(&rport->lock); + } + +-static void +-nvme_fc_cleanup_for_unload(void) ++static void __exit nvme_fc_exit_module(void) + { + struct nvme_fc_lport *lport; + struct nvme_fc_rport *rport; +- +- list_for_each_entry(lport, &nvme_fc_lport_list, port_list) { +- list_for_each_entry(rport, &lport->endp_list, endp_list) { +- nvme_fc_delete_controllers(rport); +- } +- } +-} +- +-static void __exit nvme_fc_exit_module(void) +-{ + unsigned long flags; +- bool need_cleanup = false; + + spin_lock_irqsave(&nvme_fc_lock, flags); +- nvme_fc_waiting_to_unload = true; +- if (!list_empty(&nvme_fc_lport_list)) { +- need_cleanup = true; +- nvme_fc_cleanup_for_unload(); +- } ++ list_for_each_entry(lport, &nvme_fc_lport_list, port_list) ++ list_for_each_entry(rport, &lport->endp_list, endp_list) ++ nvme_fc_delete_controllers(rport); + spin_unlock_irqrestore(&nvme_fc_lock, flags); +- if (need_cleanup) { +- pr_info("%s: waiting for ctlr deletes\n", __func__); +- wait_for_completion(&nvme_fc_unload_proceed); +- pr_info("%s: ctrl deletes complete\n", __func__); +- } ++ flush_workqueue(nvme_delete_wq); + + nvmf_unregister_transport(&nvme_fc_transport); + +- ida_destroy(&nvme_fc_local_port_cnt); +- ida_destroy(&nvme_fc_ctrl_cnt); +- + device_destroy(&fc_class, MKDEV(0, 0)); + class_unregister(&fc_class); +- destroy_workqueue(nvme_fc_wq); + } + + module_init(nvme_fc_init_module); +-- +2.43.0 + diff --git a/queue-5.10/nvmet-fc-abort-command-when-there-is-no-binding.patch b/queue-5.10/nvmet-fc-abort-command-when-there-is-no-binding.patch new file mode 100644 index 00000000000..4ebb5fb9b80 --- /dev/null +++ b/queue-5.10/nvmet-fc-abort-command-when-there-is-no-binding.patch @@ -0,0 +1,51 @@ +From c3d425e3df8e55cd5ba36d2e67482462710908c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:09 +0100 +Subject: nvmet-fc: abort command when there is no binding + +From: Daniel Wagner + +[ Upstream commit 3146345c2e9c2f661527054e402b0cfad80105a4 ] + +When the target port has not active port binding, there is no point in +trying to process the command as it has to fail anyway. Instead adding +checks to all commands abort the command early. + +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 18a64a4fd8da9..846fb41da6430 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -1102,6 +1102,9 @@ nvmet_fc_alloc_target_assoc(struct nvmet_fc_tgtport *tgtport, void *hosthandle) + int idx; + bool needrandom = true; + ++ if (!tgtport->pe) ++ return NULL; ++ + assoc = kzalloc(sizeof(*assoc), GFP_KERNEL); + if (!assoc) + return NULL; +@@ -2529,8 +2532,9 @@ nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, + + fod->req.cmd = &fod->cmdiubuf.sqe; + fod->req.cqe = &fod->rspiubuf.cqe; +- if (tgtport->pe) +- fod->req.port = tgtport->pe->port; ++ if (!tgtport->pe) ++ goto transport_error; ++ fod->req.port = tgtport->pe->port; + + /* clear any response payload */ + memset(&fod->rspiubuf, 0, sizeof(fod->rspiubuf)); +-- +2.43.0 + diff --git a/queue-5.10/nvmet-fc-release-reference-on-target-port.patch b/queue-5.10/nvmet-fc-release-reference-on-target-port.patch new file mode 100644 index 00000000000..ea2bfe13be0 --- /dev/null +++ b/queue-5.10/nvmet-fc-release-reference-on-target-port.patch @@ -0,0 +1,45 @@ +From c70c01cc7c992691e7128255e2f40e5c88bccf6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:03 +0100 +Subject: nvmet-fc: release reference on target port + +From: Daniel Wagner + +[ Upstream commit c691e6d7e13dab81ac8c7489c83b5dea972522a5 ] + +In case we return early out of __nvmet_fc_finish_ls_req() we still have +to release the reference on the target port. + +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 46fc44ce86712..18a64a4fd8da9 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -357,7 +357,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + + if (!lsop->req_queued) { + spin_unlock_irqrestore(&tgtport->lock, flags); +- return; ++ goto out_puttgtport; + } + + list_del(&lsop->lsreq_list); +@@ -370,6 +370,7 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop) + (lsreq->rqstlen + lsreq->rsplen), + DMA_BIDIRECTIONAL); + ++out_puttgtport: + nvmet_fc_tgtport_put(tgtport); + } + +-- +2.43.0 + diff --git a/queue-5.10/nvmet-fcloop-swap-the-list_add_tail-arguments.patch b/queue-5.10/nvmet-fcloop-swap-the-list_add_tail-arguments.patch new file mode 100644 index 00000000000..04c7bfff263 --- /dev/null +++ b/queue-5.10/nvmet-fcloop-swap-the-list_add_tail-arguments.patch @@ -0,0 +1,56 @@ +From 939a9e5c6b76e0374675ffeaf4599bb77cbfff6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 09:51:02 +0100 +Subject: nvmet-fcloop: swap the list_add_tail arguments + +From: Daniel Wagner + +[ Upstream commit dcfad4ab4d6733f2861cd241d8532a0004fc835a ] + +The first argument of list_add_tail function is the new element which +should be added to the list which is the second argument. Swap the +arguments to allow processing more than one element at a time. + +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index 80a208fb34f52..f2c5136bf2b82 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -358,7 +358,7 @@ fcloop_h2t_ls_req(struct nvme_fc_local_port *localport, + if (!rport->targetport) { + tls_req->status = -ECONNREFUSED; + spin_lock(&rport->lock); +- list_add_tail(&rport->ls_list, &tls_req->ls_list); ++ list_add_tail(&tls_req->ls_list, &rport->ls_list); + spin_unlock(&rport->lock); + schedule_work(&rport->ls_work); + return ret; +@@ -391,7 +391,7 @@ fcloop_h2t_xmt_ls_rsp(struct nvmet_fc_target_port *targetport, + if (remoteport) { + rport = remoteport->private; + spin_lock(&rport->lock); +- list_add_tail(&rport->ls_list, &tls_req->ls_list); ++ list_add_tail(&tls_req->ls_list, &rport->ls_list); + spin_unlock(&rport->lock); + schedule_work(&rport->ls_work); + } +@@ -446,7 +446,7 @@ fcloop_t2h_ls_req(struct nvmet_fc_target_port *targetport, void *hosthandle, + if (!tport->remoteport) { + tls_req->status = -ECONNREFUSED; + spin_lock(&tport->lock); +- list_add_tail(&tport->ls_list, &tls_req->ls_list); ++ list_add_tail(&tls_req->ls_list, &tport->ls_list); + spin_unlock(&tport->lock); + schedule_work(&tport->ls_work); + return ret; +-- +2.43.0 + diff --git a/queue-5.10/nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch b/queue-5.10/nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch new file mode 100644 index 00000000000..18b56f2cea0 --- /dev/null +++ b/queue-5.10/nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch @@ -0,0 +1,36 @@ +From 52c55d34828bc99c5ff498dca563c0b5bdd17b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jan 2024 16:26:43 +0800 +Subject: nvmet-tcp: fix nvme tcp ida memory leak + +From: Guixin Liu + +[ Upstream commit 47c5dd66c1840524572dcdd956f4af2bdb6fbdff ] + +The nvmet_tcp_queue_ida should be destroy when the nvmet-tcp module +exit. + +Signed-off-by: Guixin Liu +Reviewed-by: Christoph Hellwig +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 116ae6fd35e2d..d70a2fa4ba45f 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1852,6 +1852,7 @@ static void __exit nvmet_tcp_exit(void) + flush_scheduled_work(); + + destroy_workqueue(nvmet_tcp_wq); ++ ida_destroy(&nvmet_tcp_queue_ida); + } + + module_init(nvmet_tcp_init); +-- +2.43.0 + diff --git a/queue-5.10/regulator-pwm-regulator-add-validity-checks-in-conti.patch b/queue-5.10/regulator-pwm-regulator-add-validity-checks-in-conti.patch new file mode 100644 index 00000000000..568fc75a345 --- /dev/null +++ b/queue-5.10/regulator-pwm-regulator-add-validity-checks-in-conti.patch @@ -0,0 +1,43 @@ +From 68baa1b2c929875356178c38031cea342abc3931 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jan 2024 23:46:26 +0100 +Subject: regulator: pwm-regulator: Add validity checks in continuous + .get_voltage +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Blumenstingl + +[ Upstream commit c92688cac239794e4a1d976afa5203a4d3a2ac0e ] + +Continuous regulators can be configured to operate only in a certain +duty cycle range (for example from 0..91%). Add a check to error out if +the duty cycle translates to an unsupported (or out of range) voltage. + +Suggested-by: Uwe Kleine-König +Signed-off-by: Martin Blumenstingl +Link: https://msgid.link/r/20240113224628.377993-2-martin.blumenstingl@googlemail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/pwm-regulator.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c +index 7629476d94aeb..f4d9d9455dea6 100644 +--- a/drivers/regulator/pwm-regulator.c ++++ b/drivers/regulator/pwm-regulator.c +@@ -158,6 +158,9 @@ static int pwm_regulator_get_voltage(struct regulator_dev *rdev) + pwm_get_state(drvdata->pwm, &pstate); + + voltage = pwm_get_relative_duty_cycle(&pstate, duty_unit); ++ if (voltage < min(max_uV_duty, min_uV_duty) || ++ voltage > max(max_uV_duty, min_uV_duty)) ++ return -ENOTRECOVERABLE; + + /* + * The dutycycle for min_uV might be greater than the one for max_uV. +-- +2.43.0 + diff --git a/queue-5.10/scsi-lpfc-use-unsigned-type-for-num_sge.patch b/queue-5.10/scsi-lpfc-use-unsigned-type-for-num_sge.patch new file mode 100644 index 00000000000..9b1d7fc273c --- /dev/null +++ b/queue-5.10/scsi-lpfc-use-unsigned-type-for-num_sge.patch @@ -0,0 +1,80 @@ +From 55000a8dd61f1d6af8fba31c49717ee5fe099810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 17:26:58 +0100 +Subject: scsi: lpfc: Use unsigned type for num_sge + +From: Hannes Reinecke + +[ Upstream commit d6c1b19153f92e95e5e1801d540e98771053afae ] + +LUNs going into "failed ready running" state observed on >1T and on even +numbers of size (2T, 4T, 6T, 8T and 10T). The issue occurs when DIF is +enabled at the host. + +The kernel logs: + + Cannot setup S/G List for HBAIO segs 1/1 SGL 512 SCSI 256: 3 0 + +The host lpfc driver is failing to setup scatter/gather list (protection +data) for the I/Os. + +The return type lpfc_bg_setup_sgl()/lpfc_bg_setup_sgl_prot() causes the +compiler to remove the most significant bit. Use an unsigned type instead. + +Signed-off-by: Hannes Reinecke +[dwagner: added commit message] +Signed-off-by: Daniel Wagner +Link: https://lore.kernel.org/r/20231220162658.12392-1-dwagner@suse.de +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_scsi.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index 983eeb0e3d07e..b4b87e5d8b291 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -1944,7 +1944,7 @@ lpfc_bg_setup_bpl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + * + * Returns the number of SGEs added to the SGL. + **/ +-static int ++static uint32_t + lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + struct sli4_sge *sgl, int datasegcnt, + struct lpfc_io_buf *lpfc_cmd) +@@ -1952,8 +1952,8 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + struct scatterlist *sgde = NULL; /* s/g data entry */ + struct sli4_sge_diseed *diseed = NULL; + dma_addr_t physaddr; +- int i = 0, num_sge = 0, status; +- uint32_t reftag; ++ int i = 0, status; ++ uint32_t reftag, num_sge = 0; + uint8_t txop, rxop; + #ifdef CONFIG_SCSI_LPFC_DEBUG_FS + uint32_t rc; +@@ -2124,7 +2124,7 @@ lpfc_bg_setup_sgl(struct lpfc_hba *phba, struct scsi_cmnd *sc, + * + * Returns the number of SGEs added to the SGL. + **/ +-static int ++static uint32_t + lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + struct sli4_sge *sgl, int datacnt, int protcnt, + struct lpfc_io_buf *lpfc_cmd) +@@ -2148,8 +2148,8 @@ lpfc_bg_setup_sgl_prot(struct lpfc_hba *phba, struct scsi_cmnd *sc, + uint32_t rc; + #endif + uint32_t checking = 1; +- uint32_t dma_offset = 0; +- int num_sge = 0, j = 2; ++ uint32_t dma_offset = 0, num_sge = 0; ++ int j = 2; + struct sli4_hybrid_sgl *sgl_xtra = NULL; + + sgpe = scsi_prot_sglist(sc); +-- +2.43.0 + diff --git a/queue-5.10/scsi-target-core-add-tmf-to-tmr_list-handling.patch b/queue-5.10/scsi-target-core-add-tmf-to-tmr_list-handling.patch new file mode 100644 index 00000000000..09f0a1472be --- /dev/null +++ b/queue-5.10/scsi-target-core-add-tmf-to-tmr_list-handling.patch @@ -0,0 +1,88 @@ +From 9fb9ceccf8bdd6acc47adf80855a9a9b8501866c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jan 2024 15:59:41 +0300 +Subject: scsi: target: core: Add TMF to tmr_list handling + +From: Dmitry Bogdanov + +[ Upstream commit 83ab68168a3d990d5ff39ab030ad5754cbbccb25 ] + +An abort that is responded to by iSCSI itself is added to tmr_list but does +not go to target core. A LUN_RESET that goes through tmr_list takes a +refcounter on the abort and waits for completion. However, the abort will +be never complete because it was not started in target core. + + Unable to locate ITT: 0x05000000 on CID: 0 + Unable to locate RefTaskTag: 0x05000000 on CID: 0. + wait_for_tasks: Stopping tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop + wait for tasks: tmf LUN_RESET with tag 0x0 ref_task_tag 0x0 i_state 34 t_state ISTATE_PROCESSING refcnt 2 transport_state active,stop,fabric_stop +... + INFO: task kworker/0:2:49 blocked for more than 491 seconds. + task:kworker/0:2 state:D stack: 0 pid: 49 ppid: 2 flags:0x00000800 + Workqueue: events target_tmr_work [target_core_mod] +Call Trace: + __switch_to+0x2c4/0x470 + _schedule+0x314/0x1730 + schedule+0x64/0x130 + schedule_timeout+0x168/0x430 + wait_for_completion+0x140/0x270 + target_put_cmd_and_wait+0x64/0xb0 [target_core_mod] + core_tmr_lun_reset+0x30/0xa0 [target_core_mod] + target_tmr_work+0xc8/0x1b0 [target_core_mod] + process_one_work+0x2d4/0x5d0 + worker_thread+0x78/0x6c0 + +To fix this, only add abort to tmr_list if it will be handled by target +core. + +Signed-off-by: Dmitry Bogdanov +Link: https://lore.kernel.org/r/20240111125941.8688-1-d.bogdanov@yadro.com +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 5 ----- + drivers/target/target_core_transport.c | 4 ++++ + 2 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 9aeedcff7d02e..daa4d06ce2336 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -150,7 +150,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd) + struct se_session *se_sess = se_cmd->se_sess; + struct se_node_acl *nacl = se_sess->se_node_acl; + struct se_tmr_req *se_tmr = se_cmd->se_tmr_req; +- unsigned long flags; + + rcu_read_lock(); + deve = target_nacl_find_deve(nacl, se_cmd->orig_fe_lun); +@@ -181,10 +180,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd) + se_cmd->se_dev = rcu_dereference_raw(se_lun->lun_se_dev); + se_tmr->tmr_dev = rcu_dereference_raw(se_lun->lun_se_dev); + +- spin_lock_irqsave(&se_tmr->tmr_dev->se_tmr_lock, flags); +- list_add_tail(&se_tmr->tmr_list, &se_tmr->tmr_dev->dev_tmr_list); +- spin_unlock_irqrestore(&se_tmr->tmr_dev->se_tmr_lock, flags); +- + return 0; + } + EXPORT_SYMBOL(transport_lookup_tmr_lun); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 2e97937f005ff..8d294b658592c 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -3436,6 +3436,10 @@ int transport_generic_handle_tmr( + unsigned long flags; + bool aborted = false; + ++ spin_lock_irqsave(&cmd->se_dev->se_tmr_lock, flags); ++ list_add_tail(&cmd->se_tmr_req->tmr_list, &cmd->se_dev->dev_tmr_list); ++ spin_unlock_irqrestore(&cmd->se_dev->se_tmr_lock, flags); ++ + spin_lock_irqsave(&cmd->t_state_lock, flags); + if (cmd->transport_state & CMD_T_ABORTED) { + aborted = true; +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 5db977a9d83..4b4c6b9dbb0 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -9,3 +9,33 @@ userfaultfd-fix-mmap_changing-checking-in-mfill_atomic_hugetlb.patch zonefs-improve-error-handling.patch sched-rt-fix-sysctl_sched_rr_timeslice-intial-value.patch sched-rt-disallow-writing-invalid-values-to-sched_rt_period_us.patch +scsi-target-core-add-tmf-to-tmr_list-handling.patch +dmaengine-shdma-increase-size-of-dev_id.patch +dmaengine-fsl-qdma-increase-size-of-irq_name.patch +wifi-cfg80211-fix-missing-interfaces-when-dumping.patch +wifi-mac80211-fix-race-condition-on-enabling-fast-xm.patch +fbdev-savage-error-out-if-pixclock-equals-zero.patch +fbdev-sis-error-out-if-pixclock-equals-zero.patch +spi-hisi-sfc-v3xx-return-irq_none-if-no-interrupts-w.patch +ahci-asm1166-correct-count-of-reported-ports.patch +ahci-add-43-bit-dma-address-quirk-for-asmedia-asm106.patch +ext4-avoid-allocating-blocks-from-corrupted-group-in.patch +ext4-avoid-allocating-blocks-from-corrupted-group-in.patch-5612 +dmaengine-ti-edma-add-some-null-pointer-checks-to-th.patch +regulator-pwm-regulator-add-validity-checks-in-conti.patch +nvmet-tcp-fix-nvme-tcp-ida-memory-leak.patch +asoc-sunxi-sun4i-spdif-add-support-for-allwinner-h61.patch +spi-sh-msiof-avoid-integer-overflow-in-constants.patch +netfilter-conntrack-check-sctp_cid_shutdown_ack-for-.patch +nvme-fc-do-not-wait-in-vain-when-unloading-module.patch +nvmet-fcloop-swap-the-list_add_tail-arguments.patch +nvmet-fc-release-reference-on-target-port.patch +nvmet-fc-abort-command-when-there-is-no-binding.patch +ext4-correct-the-hole-length-returned-by-ext4_map_bl.patch +input-i8042-add-fujitsu-lifebook-u728-to-i8042-quirk.patch +efi-runtime-fix-potential-overflow-of-soft-reserved-.patch +efi-don-t-add-memblocks-for-soft-reserved-memory.patch +hwmon-coretemp-enlarge-per-package-core-count-limit.patch +scsi-lpfc-use-unsigned-type-for-num_sge.patch +firewire-core-send-bus-reset-promptly-on-gap-count-e.patch +virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch diff --git a/queue-5.10/spi-hisi-sfc-v3xx-return-irq_none-if-no-interrupts-w.patch b/queue-5.10/spi-hisi-sfc-v3xx-return-irq_none-if-no-interrupts-w.patch new file mode 100644 index 00000000000..465536c639a --- /dev/null +++ b/queue-5.10/spi-hisi-sfc-v3xx-return-irq_none-if-no-interrupts-w.patch @@ -0,0 +1,47 @@ +From 05e1fc25368574735fad18f2d6e61180716c36d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 15:11:49 +0800 +Subject: spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected + +From: Devyn Liu + +[ Upstream commit de8b6e1c231a95abf95ad097b993d34b31458ec9 ] + +Return IRQ_NONE from the interrupt handler when no interrupt was +detected. Because an empty interrupt will cause a null pointer error: + + Unable to handle kernel NULL pointer dereference at virtual + address 0000000000000008 + Call trace: + complete+0x54/0x100 + hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx] + __handle_irq_event_percpu+0x64/0x1e0 + handle_irq_event+0x7c/0x1cc + +Signed-off-by: Devyn Liu +Link: https://msgid.link/r/20240123071149.917678-1-liudingyuan@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-hisi-sfc-v3xx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/spi/spi-hisi-sfc-v3xx.c b/drivers/spi/spi-hisi-sfc-v3xx.c +index 4650b483a33d3..e0c3ad73c576d 100644 +--- a/drivers/spi/spi-hisi-sfc-v3xx.c ++++ b/drivers/spi/spi-hisi-sfc-v3xx.c +@@ -365,6 +365,11 @@ static const struct spi_controller_mem_ops hisi_sfc_v3xx_mem_ops = { + static irqreturn_t hisi_sfc_v3xx_isr(int irq, void *data) + { + struct hisi_sfc_v3xx_host *host = data; ++ u32 reg; ++ ++ reg = readl(host->regbase + HISI_SFC_V3XX_INT_STAT); ++ if (!reg) ++ return IRQ_NONE; + + hisi_sfc_v3xx_disable_int(host); + +-- +2.43.0 + diff --git a/queue-5.10/spi-sh-msiof-avoid-integer-overflow-in-constants.patch b/queue-5.10/spi-sh-msiof-avoid-integer-overflow-in-constants.patch new file mode 100644 index 00000000000..5fcf35f6750 --- /dev/null +++ b/queue-5.10/spi-sh-msiof-avoid-integer-overflow-in-constants.patch @@ -0,0 +1,53 @@ +From fe72192927da5bef738b27a184df51d4d2cceeff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jan 2024 10:40:53 +0100 +Subject: spi: sh-msiof: avoid integer overflow in constants + +From: Wolfram Sang + +[ Upstream commit 6500ad28fd5d67d5ca0fee9da73c463090842440 ] + +cppcheck rightfully warned: + + drivers/spi/spi-sh-msiof.c:792:28: warning: Signed integer overflow for expression '7<<29'. [integerOverflow] + sh_msiof_write(p, SIFCTR, SIFCTR_TFWM_1 | SIFCTR_RFWM_1); + +Signed-off-by: Wolfram Sang +Reviewed-by: Geert Uytterhoeven +Link: https://msgid.link/r/20240130094053.10672-1-wsa+renesas@sang-engineering.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sh-msiof.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 35d30378256f6..12fd02f92e37b 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -137,14 +137,14 @@ struct sh_msiof_spi_priv { + + /* SIFCTR */ + #define SIFCTR_TFWM_MASK GENMASK(31, 29) /* Transmit FIFO Watermark */ +-#define SIFCTR_TFWM_64 (0 << 29) /* Transfer Request when 64 empty stages */ +-#define SIFCTR_TFWM_32 (1 << 29) /* Transfer Request when 32 empty stages */ +-#define SIFCTR_TFWM_24 (2 << 29) /* Transfer Request when 24 empty stages */ +-#define SIFCTR_TFWM_16 (3 << 29) /* Transfer Request when 16 empty stages */ +-#define SIFCTR_TFWM_12 (4 << 29) /* Transfer Request when 12 empty stages */ +-#define SIFCTR_TFWM_8 (5 << 29) /* Transfer Request when 8 empty stages */ +-#define SIFCTR_TFWM_4 (6 << 29) /* Transfer Request when 4 empty stages */ +-#define SIFCTR_TFWM_1 (7 << 29) /* Transfer Request when 1 empty stage */ ++#define SIFCTR_TFWM_64 (0UL << 29) /* Transfer Request when 64 empty stages */ ++#define SIFCTR_TFWM_32 (1UL << 29) /* Transfer Request when 32 empty stages */ ++#define SIFCTR_TFWM_24 (2UL << 29) /* Transfer Request when 24 empty stages */ ++#define SIFCTR_TFWM_16 (3UL << 29) /* Transfer Request when 16 empty stages */ ++#define SIFCTR_TFWM_12 (4UL << 29) /* Transfer Request when 12 empty stages */ ++#define SIFCTR_TFWM_8 (5UL << 29) /* Transfer Request when 8 empty stages */ ++#define SIFCTR_TFWM_4 (6UL << 29) /* Transfer Request when 4 empty stages */ ++#define SIFCTR_TFWM_1 (7UL << 29) /* Transfer Request when 1 empty stage */ + #define SIFCTR_TFUA_MASK GENMASK(26, 20) /* Transmit FIFO Usable Area */ + #define SIFCTR_TFUA_SHIFT 20 + #define SIFCTR_TFUA(i) ((i) << SIFCTR_TFUA_SHIFT) +-- +2.43.0 + diff --git a/queue-5.10/virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch b/queue-5.10/virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch new file mode 100644 index 00000000000..2de84729bc7 --- /dev/null +++ b/queue-5.10/virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch @@ -0,0 +1,64 @@ +From 3479ea8bcda944536a93703d65c6b24ccd80dec4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jan 2024 16:52:50 +0800 +Subject: virtio-blk: Ensure no requests in virtqueues before deleting vqs. + +From: Yi Sun + +[ Upstream commit 4ce6e2db00de8103a0687fb0f65fd17124a51aaa ] + +Ensure no remaining requests in virtqueues before resetting vdev and +deleting virtqueues. Otherwise these requests will never be completed. +It may cause the system to become unresponsive. + +Function blk_mq_quiesce_queue() can ensure that requests have become +in_flight status, but it cannot guarantee that requests have been +processed by the device. Virtqueues should never be deleted before +all requests become complete status. + +Function blk_mq_freeze_queue() ensure that all requests in virtqueues +become complete status. And no requests can enter in virtqueues. + +Signed-off-by: Yi Sun +Reviewed-by: Stefan Hajnoczi +Link: https://lore.kernel.org/r/20240129085250.1550594-1-yi.sun@unisoc.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 9b54eec9b17eb..7eae3f3732336 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -952,14 +952,15 @@ static int virtblk_freeze(struct virtio_device *vdev) + { + struct virtio_blk *vblk = vdev->priv; + ++ /* Ensure no requests in virtqueues before deleting vqs. */ ++ blk_mq_freeze_queue(vblk->disk->queue); ++ + /* Ensure we don't receive any more interrupts */ + vdev->config->reset(vdev); + + /* Make sure no work handler is accessing the device. */ + flush_work(&vblk->config_work); + +- blk_mq_quiesce_queue(vblk->disk->queue); +- + vdev->config->del_vqs(vdev); + kfree(vblk->vqs); + +@@ -977,7 +978,7 @@ static int virtblk_restore(struct virtio_device *vdev) + + virtio_device_ready(vdev); + +- blk_mq_unquiesce_queue(vblk->disk->queue); ++ blk_mq_unfreeze_queue(vblk->disk->queue); + return 0; + } + #endif +-- +2.43.0 + diff --git a/queue-5.10/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch b/queue-5.10/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch new file mode 100644 index 00000000000..5504d3c97a3 --- /dev/null +++ b/queue-5.10/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch @@ -0,0 +1,71 @@ +From 049b6b71b6bc56badd016220c31ff813ec142a2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jan 2024 14:22:57 +0000 +Subject: wifi: cfg80211: fix missing interfaces when dumping + +From: Michal Kazior + +[ Upstream commit a6e4f85d3820d00694ed10f581f4c650445dbcda ] + +The nl80211_dump_interface() supports resumption +in case nl80211_send_iface() doesn't have the +resources to complete its work. + +The logic would store the progress as iteration +offsets for rdev and wdev loops. + +However the logic did not properly handle +resumption for non-last rdev. Assuming a system +with 2 rdevs, with 2 wdevs each, this could +happen: + + dump(cb=[0, 0]): + if_start=cb[1] (=0) + send rdev0.wdev0 -> ok + send rdev0.wdev1 -> yield + cb[1] = 1 + + dump(cb=[0, 1]): + if_start=cb[1] (=1) + send rdev0.wdev1 -> ok + // since if_start=1 the rdev0.wdev0 got skipped + // through if_idx < if_start + send rdev1.wdev1 -> ok + +The if_start needs to be reset back to 0 upon wdev +loop end. + +The problem is actually hard to hit on a desktop, +and even on most routers. The prerequisites for +this manifesting was: + - more than 1 wiphy + - a few handful of interfaces + - dump without rdev or wdev filter + +I was seeing this with 4 wiphys 9 interfaces each. +It'd miss 6 interfaces from the last wiphy +reported to userspace. + +Signed-off-by: Michal Kazior +Link: https://msgid.link/20240116142340.89678-1-kazikcz@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 0ac829c8f1888..279f4977e2eed 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3595,6 +3595,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback * + if_idx++; + } + ++ if_start = 0; + wp_idx++; + } + out: +-- +2.43.0 + diff --git a/queue-5.10/wifi-mac80211-fix-race-condition-on-enabling-fast-xm.patch b/queue-5.10/wifi-mac80211-fix-race-condition-on-enabling-fast-xm.patch new file mode 100644 index 00000000000..b0eea59b212 --- /dev/null +++ b/queue-5.10/wifi-mac80211-fix-race-condition-on-enabling-fast-xm.patch @@ -0,0 +1,53 @@ +From 913a488f4d8639d37ab39b4a10fae223e430070d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 19:10:59 +0100 +Subject: wifi: mac80211: fix race condition on enabling fast-xmit + +From: Felix Fietkau + +[ Upstream commit bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f ] + +fast-xmit must only be enabled after the sta has been uploaded to the driver, +otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls +to the driver, leading to potential crashes because of uninitialized drv_priv +data. +Add a missing sta->uploaded check and re-check fast xmit after inserting a sta. + +Signed-off-by: Felix Fietkau +Link: https://msgid.link/20240104181059.84032-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 2 ++ + net/mac80211/tx.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 2e84360990f0c..44bd03c6b8473 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -700,6 +700,8 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) + if (ieee80211_vif_is_mesh(&sdata->vif)) + mesh_accept_plinks_update(sdata); + ++ ieee80211_check_fast_xmit(sta); ++ + return 0; + out_remove: + sta_info_hash_del(local, sta); +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 55abc06214c4d..0d6d12fc3c07e 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -2959,7 +2959,7 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) + sdata->vif.type == NL80211_IFTYPE_STATION) + goto out; + +- if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED)) ++ if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED) || !sta->uploaded) + goto out; + + if (test_sta_flag(sta, WLAN_STA_PS_STA) || +-- +2.43.0 +