From: Greg Kroah-Hartman Date: Mon, 9 May 2022 10:18:45 +0000 (+0200) Subject: 5.17-stable patches X-Git-Tag: v4.9.313~76 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=23a8481dcea76a3e98ad0026032f93fc299369e2;p=thirdparty%2Fkernel%2Fstable-queue.git 5.17-stable patches added patches: asoc-meson-fix-event-generation-for-aui-acodec-mux.patch asoc-meson-fix-event-generation-for-aui-codec-mux.patch asoc-meson-fix-event-generation-for-g12a-tohdmi-mux.patch asoc-rt9120-correct-the-reg-0x09-size-to-one-byte.patch asoc-wm8958-fix-change-notifications-for-dsp-controls.patch can-grcan-grcan_close-fix-deadlock.patch can-grcan-grcan_probe-fix-broken-system-id-check-for-errata-workaround-needs.patch can-grcan-only-use-the-napi-poll-budget-for-rx.patch can-grcan-use-ofdev-dev-when-allocating-dma-memory.patch can-isotp-remove-re-binding-of-bound-socket.patch s390-dasd-fix-data-corruption-for-ese-devices.patch s390-dasd-fix-read-for-ese-with-blksize-4k.patch s390-dasd-fix-read-inconsistency-for-ese-dasd-devices.patch s390-dasd-prevent-double-format-of-tracks-for-ese-devices.patch --- diff --git a/queue-5.17/asoc-meson-fix-event-generation-for-aui-acodec-mux.patch b/queue-5.17/asoc-meson-fix-event-generation-for-aui-acodec-mux.patch new file mode 100644 index 00000000000..ee2e05a69f5 --- /dev/null +++ b/queue-5.17/asoc-meson-fix-event-generation-for-aui-acodec-mux.patch @@ -0,0 +1,35 @@ +From 2e3a0d1bfa95b54333f7add3e50e288769373873 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Thu, 21 Apr 2022 13:38:01 +0100 +Subject: ASoC: meson: Fix event generation for AUI ACODEC mux + +From: Mark Brown + +commit 2e3a0d1bfa95b54333f7add3e50e288769373873 upstream. + +The AIU ACODEC has a custom put() operation which returns 0 when the value +of the mux changes, meaning that events are not generated for userspace. +Change to return 1 in this case, the function returns early in the case +where there is no change. + +Signed-off-by: Mark Brown +Reviewed-by: Jerome Brunet +Link: https://lore.kernel.org/r/20220421123803.292063-2-broonie@kernel.org +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/meson/aiu-acodec-ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/meson/aiu-acodec-ctrl.c ++++ b/sound/soc/meson/aiu-acodec-ctrl.c +@@ -58,7 +58,7 @@ static int aiu_acodec_ctrl_mux_put_enum( + + snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL); + +- return 0; ++ return 1; + } + + static SOC_ENUM_SINGLE_DECL(aiu_acodec_ctrl_mux_enum, AIU_ACODEC_CTRL, diff --git a/queue-5.17/asoc-meson-fix-event-generation-for-aui-codec-mux.patch b/queue-5.17/asoc-meson-fix-event-generation-for-aui-codec-mux.patch new file mode 100644 index 00000000000..f0a7fbd3017 --- /dev/null +++ b/queue-5.17/asoc-meson-fix-event-generation-for-aui-codec-mux.patch @@ -0,0 +1,35 @@ +From fce49921a22262736cdc3cc74fa67915b75e9363 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Thu, 21 Apr 2022 13:38:02 +0100 +Subject: ASoC: meson: Fix event generation for AUI CODEC mux + +From: Mark Brown + +commit fce49921a22262736cdc3cc74fa67915b75e9363 upstream. + +The AIU CODEC has a custom put() operation which returns 0 when the value +of the mux changes, meaning that events are not generated for userspace. +Change to return 1 in this case, the function returns early in the case +where there is no change. + +Signed-off-by: Mark Brown +Reviewed-by: Jerome Brunet +Link: https://lore.kernel.org/r/20220421123803.292063-3-broonie@kernel.org +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/meson/aiu-codec-ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/meson/aiu-codec-ctrl.c ++++ b/sound/soc/meson/aiu-codec-ctrl.c +@@ -57,7 +57,7 @@ static int aiu_codec_ctrl_mux_put_enum(s + + snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL); + +- return 0; ++ return 1; + } + + static SOC_ENUM_SINGLE_DECL(aiu_hdmi_ctrl_mux_enum, AIU_HDMI_CLK_DATA_CTRL, diff --git a/queue-5.17/asoc-meson-fix-event-generation-for-g12a-tohdmi-mux.patch b/queue-5.17/asoc-meson-fix-event-generation-for-g12a-tohdmi-mux.patch new file mode 100644 index 00000000000..8709805a04d --- /dev/null +++ b/queue-5.17/asoc-meson-fix-event-generation-for-g12a-tohdmi-mux.patch @@ -0,0 +1,35 @@ +From 12131008fc13ff7f7690d170b7a8f72d24fd7d1e Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Thu, 21 Apr 2022 13:38:03 +0100 +Subject: ASoC: meson: Fix event generation for G12A tohdmi mux + +From: Mark Brown + +commit 12131008fc13ff7f7690d170b7a8f72d24fd7d1e upstream. + +The G12A tohdmi has a custom put() operation which returns 0 when the value +of the mux changes, meaning that events are not generated for userspace. +Change to return 1 in this case, the function returns early in the case +where there is no change. + +Signed-off-by: Mark Brown +Reviewed-by: Jerome Brunet +Link: https://lore.kernel.org/r/20220421123803.292063-4-broonie@kernel.org +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/meson/g12a-tohdmitx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/meson/g12a-tohdmitx.c ++++ b/sound/soc/meson/g12a-tohdmitx.c +@@ -67,7 +67,7 @@ static int g12a_tohdmitx_i2s_mux_put_enu + + snd_soc_dapm_mux_update_power(dapm, kcontrol, mux, e, NULL); + +- return 0; ++ return 1; + } + + static SOC_ENUM_SINGLE_DECL(g12a_tohdmitx_i2s_mux_enum, TOHDMITX_CTRL0, diff --git a/queue-5.17/asoc-rt9120-correct-the-reg-0x09-size-to-one-byte.patch b/queue-5.17/asoc-rt9120-correct-the-reg-0x09-size-to-one-byte.patch new file mode 100644 index 00000000000..931cb519351 --- /dev/null +++ b/queue-5.17/asoc-rt9120-correct-the-reg-0x09-size-to-one-byte.patch @@ -0,0 +1,30 @@ +From 87c18514bb8477563a61f50b4285da156296edc4 Mon Sep 17 00:00:00 2001 +From: ChiYuan Huang +Date: Fri, 22 Apr 2022 14:26:50 +0800 +Subject: ASoC: rt9120: Correct the reg 0x09 size to one byte + +From: ChiYuan Huang + +commit 87c18514bb8477563a61f50b4285da156296edc4 upstream. + +Correct the reg 0x09 size to one byte. + +Signed-off-by: ChiYuan Huang +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1650608810-3829-1-git-send-email-u0084500@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/rt9120.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/soc/codecs/rt9120.c ++++ b/sound/soc/codecs/rt9120.c +@@ -341,7 +341,6 @@ static int rt9120_get_reg_size(unsigned + { + switch (reg) { + case 0x00: +- case 0x09: + case 0x20 ... 0x27: + return 2; + case 0x30 ... 0x3D: diff --git a/queue-5.17/asoc-wm8958-fix-change-notifications-for-dsp-controls.patch b/queue-5.17/asoc-wm8958-fix-change-notifications-for-dsp-controls.patch new file mode 100644 index 00000000000..3dd5167851d --- /dev/null +++ b/queue-5.17/asoc-wm8958-fix-change-notifications-for-dsp-controls.patch @@ -0,0 +1,61 @@ +From b4f5c6b2e52b27462c0599e64e96e53b58438de1 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Sat, 16 Apr 2022 13:54:08 +0100 +Subject: ASoC: wm8958: Fix change notifications for DSP controls + +From: Mark Brown + +commit b4f5c6b2e52b27462c0599e64e96e53b58438de1 upstream. + +The WM8958 DSP controls all return 0 on successful write, not a boolean +value indicating if the write changed the value of the control. Fix this +by returning 1 after a change, there is already a check at the start of +each put() that skips the function in the case that there is no change. + +Signed-off-by: Mark Brown +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20220416125408.197440-1-broonie@kernel.org +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/wm8958-dsp2.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/soc/codecs/wm8958-dsp2.c ++++ b/sound/soc/codecs/wm8958-dsp2.c +@@ -530,7 +530,7 @@ static int wm8958_mbc_put(struct snd_kco + + wm8958_dsp_apply(component, mbc, wm8994->mbc_ena[mbc]); + +- return 0; ++ return 1; + } + + #define WM8958_MBC_SWITCH(xname, xval) {\ +@@ -656,7 +656,7 @@ static int wm8958_vss_put(struct snd_kco + + wm8958_dsp_apply(component, vss, wm8994->vss_ena[vss]); + +- return 0; ++ return 1; + } + + +@@ -730,7 +730,7 @@ static int wm8958_hpf_put(struct snd_kco + + wm8958_dsp_apply(component, hpf % 3, ucontrol->value.integer.value[0]); + +- return 0; ++ return 1; + } + + #define WM8958_HPF_SWITCH(xname, xval) {\ +@@ -824,7 +824,7 @@ static int wm8958_enh_eq_put(struct snd_ + + wm8958_dsp_apply(component, eq, ucontrol->value.integer.value[0]); + +- return 0; ++ return 1; + } + + #define WM8958_ENH_EQ_SWITCH(xname, xval) {\ diff --git a/queue-5.17/can-grcan-grcan_close-fix-deadlock.patch b/queue-5.17/can-grcan-grcan_close-fix-deadlock.patch new file mode 100644 index 00000000000..e6f86c7b93b --- /dev/null +++ b/queue-5.17/can-grcan-grcan_close-fix-deadlock.patch @@ -0,0 +1,54 @@ +From 47f070a63e735bcc8d481de31be1b5a1aa62b31c Mon Sep 17 00:00:00 2001 +From: Duoming Zhou +Date: Mon, 25 Apr 2022 12:24:00 +0800 +Subject: can: grcan: grcan_close(): fix deadlock + +From: Duoming Zhou + +commit 47f070a63e735bcc8d481de31be1b5a1aa62b31c upstream. + +There are deadlocks caused by del_timer_sync(&priv->hang_timer) and +del_timer_sync(&priv->rr_timer) in grcan_close(), one of the deadlocks +are shown below: + + (Thread 1) | (Thread 2) + | grcan_reset_timer() +grcan_close() | mod_timer() + spin_lock_irqsave() //(1) | (wait a time) + ... | grcan_initiate_running_reset() + del_timer_sync() | spin_lock_irqsave() //(2) + (wait timer to stop) | ... + +We hold priv->lock in position (1) of thread 1 and use +del_timer_sync() to wait timer to stop, but timer handler also need +priv->lock in position (2) of thread 2. As a result, grcan_close() +will block forever. + +This patch extracts del_timer_sync() from the protection of +spin_lock_irqsave(), which could let timer handler to obtain the +needed lock. + +Link: https://lore.kernel.org/all/20220425042400.66517-1-duoming@zju.edu.cn +Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN cores") +Cc: stable@vger.kernel.org +Signed-off-by: Duoming Zhou +Reviewed-by: Andreas Larsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/grcan.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/grcan.c ++++ b/drivers/net/can/grcan.c +@@ -1102,8 +1102,10 @@ static int grcan_close(struct net_device + + priv->closing = true; + if (priv->need_txbug_workaround) { ++ spin_unlock_irqrestore(&priv->lock, flags); + del_timer_sync(&priv->hang_timer); + del_timer_sync(&priv->rr_timer); ++ spin_lock_irqsave(&priv->lock, flags); + } + netif_stop_queue(dev); + grcan_stop_hardware(dev); diff --git a/queue-5.17/can-grcan-grcan_probe-fix-broken-system-id-check-for-errata-workaround-needs.patch b/queue-5.17/can-grcan-grcan_probe-fix-broken-system-id-check-for-errata-workaround-needs.patch new file mode 100644 index 00000000000..ecfaefbb6af --- /dev/null +++ b/queue-5.17/can-grcan-grcan_probe-fix-broken-system-id-check-for-errata-workaround-needs.patch @@ -0,0 +1,61 @@ +From 1e93ed26acf03fe6c97c6d573a10178596aadd43 Mon Sep 17 00:00:00 2001 +From: Andreas Larsson +Date: Fri, 29 Apr 2022 10:46:55 +0200 +Subject: can: grcan: grcan_probe(): fix broken system id check for errata workaround needs + +From: Andreas Larsson + +commit 1e93ed26acf03fe6c97c6d573a10178596aadd43 upstream. + +The systemid property was checked for in the wrong place of the device +tree and compared to the wrong value. + +Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN cores") +Link: https://lore.kernel.org/all/20220429084656.29788-3-andreas@gaisler.com +Cc: stable@vger.kernel.org +Signed-off-by: Andreas Larsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/grcan.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/net/can/grcan.c ++++ b/drivers/net/can/grcan.c +@@ -241,7 +241,7 @@ struct grcan_device_config { + .rxsize = GRCAN_DEFAULT_BUFFER_SIZE, \ + } + +-#define GRCAN_TXBUG_SAFE_GRLIB_VERSION 0x4100 ++#define GRCAN_TXBUG_SAFE_GRLIB_VERSION 4100 + #define GRLIB_VERSION_MASK 0xffff + + /* GRCAN private data structure */ +@@ -1643,6 +1643,7 @@ exit_free_candev: + static int grcan_probe(struct platform_device *ofdev) + { + struct device_node *np = ofdev->dev.of_node; ++ struct device_node *sysid_parent; + u32 sysid, ambafreq; + int irq, err; + void __iomem *base; +@@ -1651,10 +1652,15 @@ static int grcan_probe(struct platform_d + /* Compare GRLIB version number with the first that does not + * have the tx bug (see start_xmit) + */ +- err = of_property_read_u32(np, "systemid", &sysid); +- if (!err && ((sysid & GRLIB_VERSION_MASK) +- >= GRCAN_TXBUG_SAFE_GRLIB_VERSION)) +- txbug = false; ++ sysid_parent = of_find_node_by_path("/ambapp0"); ++ if (sysid_parent) { ++ of_node_get(sysid_parent); ++ err = of_property_read_u32(sysid_parent, "systemid", &sysid); ++ if (!err && ((sysid & GRLIB_VERSION_MASK) >= ++ GRCAN_TXBUG_SAFE_GRLIB_VERSION)) ++ txbug = false; ++ of_node_put(sysid_parent); ++ } + + err = of_property_read_u32(np, "freq", &ambafreq); + if (err) { diff --git a/queue-5.17/can-grcan-only-use-the-napi-poll-budget-for-rx.patch b/queue-5.17/can-grcan-only-use-the-napi-poll-budget-for-rx.patch new file mode 100644 index 00000000000..9a710f99709 --- /dev/null +++ b/queue-5.17/can-grcan-only-use-the-napi-poll-budget-for-rx.patch @@ -0,0 +1,87 @@ +From 2873d4d52f7c52d60b316ba6c47bd7122b5a9861 Mon Sep 17 00:00:00 2001 +From: Andreas Larsson +Date: Fri, 29 Apr 2022 10:46:56 +0200 +Subject: can: grcan: only use the NAPI poll budget for RX + +From: Andreas Larsson + +commit 2873d4d52f7c52d60b316ba6c47bd7122b5a9861 upstream. + +The previous split budget between TX and RX made it return not using +the entire budget but at the same time not having calling called +napi_complete. This sometimes led to the poll to not be called, and at +the same time having TX and RX interrupts disabled resulting in the +driver getting stuck. + +Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN cores") +Link: https://lore.kernel.org/all/20220429084656.29788-4-andreas@gaisler.com +Cc: stable@vger.kernel.org +Signed-off-by: Andreas Larsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/grcan.c | 22 +++++++--------------- + 1 file changed, 7 insertions(+), 15 deletions(-) + +--- a/drivers/net/can/grcan.c ++++ b/drivers/net/can/grcan.c +@@ -1125,7 +1125,7 @@ static int grcan_close(struct net_device + return 0; + } + +-static int grcan_transmit_catch_up(struct net_device *dev, int budget) ++static void grcan_transmit_catch_up(struct net_device *dev) + { + struct grcan_priv *priv = netdev_priv(dev); + unsigned long flags; +@@ -1133,7 +1133,7 @@ static int grcan_transmit_catch_up(struc + + spin_lock_irqsave(&priv->lock, flags); + +- work_done = catch_up_echo_skb(dev, budget, true); ++ work_done = catch_up_echo_skb(dev, -1, true); + if (work_done) { + if (!priv->resetting && !priv->closing && + !(priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)) +@@ -1147,8 +1147,6 @@ static int grcan_transmit_catch_up(struc + } + + spin_unlock_irqrestore(&priv->lock, flags); +- +- return work_done; + } + + static int grcan_receive(struct net_device *dev, int budget) +@@ -1230,19 +1228,13 @@ static int grcan_poll(struct napi_struct + struct net_device *dev = priv->dev; + struct grcan_registers __iomem *regs = priv->regs; + unsigned long flags; +- int tx_work_done, rx_work_done; +- int rx_budget = budget / 2; +- int tx_budget = budget - rx_budget; ++ int work_done; + +- /* Half of the budget for receiving messages */ +- rx_work_done = grcan_receive(dev, rx_budget); ++ work_done = grcan_receive(dev, budget); + +- /* Half of the budget for transmitting messages as that can trigger echo +- * frames being received +- */ +- tx_work_done = grcan_transmit_catch_up(dev, tx_budget); ++ grcan_transmit_catch_up(dev); + +- if (rx_work_done < rx_budget && tx_work_done < tx_budget) { ++ if (work_done < budget) { + napi_complete(napi); + + /* Guarantee no interference with a running reset that otherwise +@@ -1259,7 +1251,7 @@ static int grcan_poll(struct napi_struct + spin_unlock_irqrestore(&priv->lock, flags); + } + +- return rx_work_done + tx_work_done; ++ return work_done; + } + + /* Work tx bug by waiting while for the risky situation to clear. If that fails, diff --git a/queue-5.17/can-grcan-use-ofdev-dev-when-allocating-dma-memory.patch b/queue-5.17/can-grcan-use-ofdev-dev-when-allocating-dma-memory.patch new file mode 100644 index 00000000000..df3d49d3560 --- /dev/null +++ b/queue-5.17/can-grcan-use-ofdev-dev-when-allocating-dma-memory.patch @@ -0,0 +1,63 @@ +From 101da4268626b00d16356a6bf284d66e44c46ff9 Mon Sep 17 00:00:00 2001 +From: Daniel Hellstrom +Date: Fri, 29 Apr 2022 10:46:54 +0200 +Subject: can: grcan: use ofdev->dev when allocating DMA memory + +From: Daniel Hellstrom + +commit 101da4268626b00d16356a6bf284d66e44c46ff9 upstream. + +Use the device of the device tree node should be rather than the +device of the struct net_device when allocating DMA buffers. + +The driver got away with it on sparc32 until commit 53b7670e5735 +("sparc: factor the dma coherent mapping into helper") after which the +driver oopses. + +Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN cores") +Link: https://lore.kernel.org/all/20220429084656.29788-2-andreas@gaisler.com +Cc: stable@vger.kernel.org +Signed-off-by: Daniel Hellstrom +Signed-off-by: Andreas Larsson +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/grcan.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/grcan.c ++++ b/drivers/net/can/grcan.c +@@ -248,6 +248,7 @@ struct grcan_device_config { + struct grcan_priv { + struct can_priv can; /* must be the first member */ + struct net_device *dev; ++ struct device *ofdev_dev; + struct napi_struct napi; + + struct grcan_registers __iomem *regs; /* ioremap'ed registers */ +@@ -921,7 +922,7 @@ static void grcan_free_dma_buffers(struc + struct grcan_priv *priv = netdev_priv(dev); + struct grcan_dma *dma = &priv->dma; + +- dma_free_coherent(&dev->dev, dma->base_size, dma->base_buf, ++ dma_free_coherent(priv->ofdev_dev, dma->base_size, dma->base_buf, + dma->base_handle); + memset(dma, 0, sizeof(*dma)); + } +@@ -946,7 +947,7 @@ static int grcan_allocate_dma_buffers(st + + /* Extra GRCAN_BUFFER_ALIGNMENT to allow for alignment */ + dma->base_size = lsize + ssize + GRCAN_BUFFER_ALIGNMENT; +- dma->base_buf = dma_alloc_coherent(&dev->dev, ++ dma->base_buf = dma_alloc_coherent(priv->ofdev_dev, + dma->base_size, + &dma->base_handle, + GFP_KERNEL); +@@ -1589,6 +1590,7 @@ static int grcan_setup_netdev(struct pla + memcpy(&priv->config, &grcan_module_config, + sizeof(struct grcan_device_config)); + priv->dev = dev; ++ priv->ofdev_dev = &ofdev->dev; + priv->regs = base; + priv->can.bittiming_const = &grcan_bittiming_const; + priv->can.do_set_bittiming = grcan_set_bittiming; diff --git a/queue-5.17/can-isotp-remove-re-binding-of-bound-socket.patch b/queue-5.17/can-isotp-remove-re-binding-of-bound-socket.patch new file mode 100644 index 00000000000..ce407b9808c --- /dev/null +++ b/queue-5.17/can-isotp-remove-re-binding-of-bound-socket.patch @@ -0,0 +1,74 @@ +From 72ed3ee9fa0b461ad086403a8b5336154bd82234 Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Fri, 22 Apr 2022 10:23:37 +0200 +Subject: can: isotp: remove re-binding of bound socket + +From: Oliver Hartkopp + +commit 72ed3ee9fa0b461ad086403a8b5336154bd82234 upstream. + +As a carry over from the CAN_RAW socket (which allows to change the CAN +interface while mantaining the filter setup) the re-binding of the +CAN_ISOTP socket needs to take care about CAN ID address information and +subscriptions. It turned out that this feature is so limited (e.g. the +sockopts remain fix) that it finally has never been needed/used. + +In opposite to the stateless CAN_RAW socket the switching of the CAN ID +subscriptions might additionally lead to an interrupted ongoing PDU +reception. So better remove this unneeded complexity. + +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Link: https://lore.kernel.org/all/20220422082337.1676-1-socketcan@hartkopp.net +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/isotp.c | 22 +++++----------------- + 1 file changed, 5 insertions(+), 17 deletions(-) + +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1146,6 +1146,11 @@ static int isotp_bind(struct socket *soc + + lock_sock(sk); + ++ if (so->bound) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* do not register frame reception for functional addressing */ + if (so->opt.flags & CAN_ISOTP_SF_BROADCAST) + do_rx_reg = 0; +@@ -1156,10 +1161,6 @@ static int isotp_bind(struct socket *soc + goto out; + } + +- if (so->bound && addr->can_ifindex == so->ifindex && +- rx_id == so->rxid && tx_id == so->txid) +- goto out; +- + dev = dev_get_by_index(net, addr->can_ifindex); + if (!dev) { + err = -ENODEV; +@@ -1186,19 +1187,6 @@ static int isotp_bind(struct socket *soc + + dev_put(dev); + +- if (so->bound && do_rx_reg) { +- /* unregister old filter */ +- if (so->ifindex) { +- dev = dev_get_by_index(net, so->ifindex); +- if (dev) { +- can_rx_unregister(net, dev, so->rxid, +- SINGLE_MASK(so->rxid), +- isotp_rcv, sk); +- dev_put(dev); +- } +- } +- } +- + /* switch to new settings */ + so->ifindex = ifindex; + so->rxid = rx_id; diff --git a/queue-5.17/s390-dasd-fix-data-corruption-for-ese-devices.patch b/queue-5.17/s390-dasd-fix-data-corruption-for-ese-devices.patch new file mode 100644 index 00000000000..86dc1aa561c --- /dev/null +++ b/queue-5.17/s390-dasd-fix-data-corruption-for-ese-devices.patch @@ -0,0 +1,95 @@ +From 5b53a405e4658580e1faf7c217db3f55a21ba849 Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Thu, 5 May 2022 16:17:29 +0200 +Subject: s390/dasd: fix data corruption for ESE devices + +From: Stefan Haberland + +commit 5b53a405e4658580e1faf7c217db3f55a21ba849 upstream. + +For ESE devices we get an error when accessing an unformatted track. +The handling of this error will return zero data for read requests and +format the track on demand before writing to it. To do this the code needs +to distinguish between read and write requests. This is done with data from +the blocklayer request. A pointer to the blocklayer request is stored in +the CQR. + +If there is an error on the device an ERP request is built to do error +recovery. While the ERP request is mostly a copy of the original CQR the +pointer to the blocklayer request is not copied to not accidentally pass +it back to the blocklayer without cleanup. + +This leads to the error that during ESE handling after an ERP request was +built it is not possible to determine the IO direction. This leads to the +formatting of a track for read requests which might in turn lead to data +corruption. + +Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes") +Cc: stable@vger.kernel.org # 5.3+ +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Link: https://lore.kernel.org/r/20220505141733.1989450-2-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd.c | 8 +++++++- + drivers/s390/block/dasd_eckd.c | 2 +- + drivers/s390/block/dasd_int.h | 12 ++++++++++++ + 3 files changed, 20 insertions(+), 2 deletions(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -1639,6 +1639,7 @@ void dasd_int_handler(struct ccw_device + unsigned long now; + int nrf_suppressed = 0; + int fp_suppressed = 0; ++ struct request *req; + u8 *sense = NULL; + int expires; + +@@ -1739,7 +1740,12 @@ void dasd_int_handler(struct ccw_device + } + + if (dasd_ese_needs_format(cqr->block, irb)) { +- if (rq_data_dir((struct request *)cqr->callback_data) == READ) { ++ req = dasd_get_callback_data(cqr); ++ if (!req) { ++ cqr->status = DASD_CQR_ERROR; ++ return; ++ } ++ if (rq_data_dir(req) == READ) { + device->discipline->ese_read(cqr, irb); + cqr->status = DASD_CQR_SUCCESS; + cqr->stopclk = now; +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -3145,7 +3145,7 @@ dasd_eckd_ese_format(struct dasd_device + sector_t curr_trk; + int rc; + +- req = cqr->callback_data; ++ req = dasd_get_callback_data(cqr); + block = cqr->block; + base = block->base; + private = base->private; +--- a/drivers/s390/block/dasd_int.h ++++ b/drivers/s390/block/dasd_int.h +@@ -757,6 +757,18 @@ dasd_check_blocksize(int bsize) + return 0; + } + ++/* ++ * return the callback data of the original request in case there are ++ * ERP requests build on top of it ++ */ ++static inline void *dasd_get_callback_data(struct dasd_ccw_req *cqr) ++{ ++ while (cqr->refers) ++ cqr = cqr->refers; ++ ++ return cqr->callback_data; ++} ++ + /* externals in dasd.c */ + #define DASD_PROFILE_OFF 0 + #define DASD_PROFILE_ON 1 diff --git a/queue-5.17/s390-dasd-fix-read-for-ese-with-blksize-4k.patch b/queue-5.17/s390-dasd-fix-read-for-ese-with-blksize-4k.patch new file mode 100644 index 00000000000..156cc89aad2 --- /dev/null +++ b/queue-5.17/s390-dasd-fix-read-for-ese-with-blksize-4k.patch @@ -0,0 +1,63 @@ +From cd68c48ea15c85f1577a442dc4c285e112ff1b37 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20H=C3=B6ppner?= +Date: Thu, 5 May 2022 16:17:31 +0200 +Subject: s390/dasd: Fix read for ESE with blksize < 4k +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jan Höppner + +commit cd68c48ea15c85f1577a442dc4c285e112ff1b37 upstream. + +When reading unformatted tracks on ESE devices, the corresponding memory +areas are simply set to zero for each segment. This is done incorrectly +for blocksizes < 4096. + +There are two problems. First, the increment of dst is done using the +counter of the loop (off), which is increased by blksize every +iteration. This leads to a much bigger increment for dst as actually +intended. Second, the increment of dst is done before the memory area +is set to 0, skipping a significant amount of bytes of memory. + +This leads to illegal overwriting of memory and ultimately to a kernel +panic. + +This is not a problem with 4k blocksize because +blk_queue_max_segment_size is set to PAGE_SIZE, always resulting in a +single iteration for the inner segment loop (bv.bv_len == blksize). The +incorrectly used 'off' value to increment dst is 0 and the correct +memory area is used. + +In order to fix this for blksize < 4k, increment dst correctly using the +blksize and only do it at the end of the loop. + +Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes") +Cc: stable@vger.kernel.org # v5.3+ +Signed-off-by: Jan Höppner +Reviewed-by: Stefan Haberland +Link: https://lore.kernel.org/r/20220505141733.1989450-4-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd_eckd.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -3285,12 +3285,11 @@ static int dasd_eckd_ese_read(struct das + cqr->proc_bytes = blk_count * blksize; + return 0; + } +- if (dst && !skip_block) { +- dst += off; ++ if (dst && !skip_block) + memset(dst, 0, blksize); +- } else { ++ else + skip_block--; +- } ++ dst += blksize; + blk_count++; + } + } diff --git a/queue-5.17/s390-dasd-fix-read-inconsistency-for-ese-dasd-devices.patch b/queue-5.17/s390-dasd-fix-read-inconsistency-for-ese-dasd-devices.patch new file mode 100644 index 00000000000..40cd589ccb1 --- /dev/null +++ b/queue-5.17/s390-dasd-fix-read-inconsistency-for-ese-dasd-devices.patch @@ -0,0 +1,55 @@ +From b9c10f68e23c13f56685559a0d6fdaca9f838324 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20H=C3=B6ppner?= +Date: Thu, 5 May 2022 16:17:32 +0200 +Subject: s390/dasd: Fix read inconsistency for ESE DASD devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jan Höppner + +commit b9c10f68e23c13f56685559a0d6fdaca9f838324 upstream. + +Read requests that return with NRF error are partially completed in +dasd_eckd_ese_read(). The function keeps track of the amount of +processed bytes and the driver will eventually return this information +back to the block layer for further processing via __dasd_cleanup_cqr() +when the request is in the final stage of processing (from the driver's +perspective). + +For this, blk_update_request() is used which requires the number of +bytes to complete the request. As per documentation the nr_bytes +parameter is described as follows: + "number of bytes to complete for @req". + +This was mistakenly interpreted as "number of bytes _left_ for @req" +leading to new requests with incorrect data length. The consequence are +inconsistent and completely wrong read requests as data from random +memory areas are read back. + +Fix this by correctly specifying the amount of bytes that should be used +to complete the request. + +Fixes: 5e6bdd37c552 ("s390/dasd: fix data corruption for thin provisioned devices") +Cc: stable@vger.kernel.org # 5.3+ +Signed-off-by: Jan Höppner +Reviewed-by: Stefan Haberland +Link: https://lore.kernel.org/r/20220505141733.1989450-5-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -2778,8 +2778,7 @@ static void __dasd_cleanup_cqr(struct da + * complete a request partially. + */ + if (proc_bytes) { +- blk_update_request(req, BLK_STS_OK, +- blk_rq_bytes(req) - proc_bytes); ++ blk_update_request(req, BLK_STS_OK, proc_bytes); + blk_mq_requeue_request(req, true); + } else if (likely(!blk_should_fake_timeout(req->q))) { + blk_mq_complete_request(req); diff --git a/queue-5.17/s390-dasd-prevent-double-format-of-tracks-for-ese-devices.patch b/queue-5.17/s390-dasd-prevent-double-format-of-tracks-for-ese-devices.patch new file mode 100644 index 00000000000..3097073545f --- /dev/null +++ b/queue-5.17/s390-dasd-prevent-double-format-of-tracks-for-ese-devices.patch @@ -0,0 +1,123 @@ +From 71f3871657370dbbaf942a1c758f64e49a36c70f Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Thu, 5 May 2022 16:17:30 +0200 +Subject: s390/dasd: prevent double format of tracks for ESE devices + +From: Stefan Haberland + +commit 71f3871657370dbbaf942a1c758f64e49a36c70f upstream. + +For ESE devices we get an error for write operations on an unformatted +track. Afterwards the track will be formatted and the IO operation +restarted. +When using alias devices a track might be accessed by multiple requests +simultaneously and there is a race window that a track gets formatted +twice resulting in data loss. + +Prevent this by remembering the amount of formatted tracks when starting +a request and comparing this number before actually formatting a track +on the fly. If the number has changed there is a chance that the current +track was finally formatted in between. As a result do not format the +track and restart the current IO to check. + +The number of formatted tracks does not match the overall number of +formatted tracks on the device and it might wrap around but this is no +problem. It is only needed to recognize that a track has been formatted at +all in between. + +Fixes: 5e2b17e712cf ("s390/dasd: Add dynamic formatting support for ESE volumes") +Cc: stable@vger.kernel.org # 5.3+ +Signed-off-by: Stefan Haberland +Reviewed-by: Jan Hoeppner +Link: https://lore.kernel.org/r/20220505141733.1989450-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd.c | 7 +++++++ + drivers/s390/block/dasd_eckd.c | 19 +++++++++++++++++-- + drivers/s390/block/dasd_int.h | 2 ++ + 3 files changed, 26 insertions(+), 2 deletions(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -1422,6 +1422,13 @@ int dasd_start_IO(struct dasd_ccw_req *c + if (!cqr->lpm) + cqr->lpm = dasd_path_get_opm(device); + } ++ /* ++ * remember the amount of formatted tracks to prevent double format on ++ * ESE devices ++ */ ++ if (cqr->block) ++ cqr->trkcount = atomic_read(&cqr->block->trkcount); ++ + if (cqr->cpmode == 1) { + rc = ccw_device_tm_start(device->cdev, cqr->cpaddr, + (long) cqr, cqr->lpm); +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -3083,13 +3083,24 @@ static int dasd_eckd_format_device(struc + } + + static bool test_and_set_format_track(struct dasd_format_entry *to_format, +- struct dasd_block *block) ++ struct dasd_ccw_req *cqr) + { ++ struct dasd_block *block = cqr->block; + struct dasd_format_entry *format; + unsigned long flags; + bool rc = false; + + spin_lock_irqsave(&block->format_lock, flags); ++ if (cqr->trkcount != atomic_read(&block->trkcount)) { ++ /* ++ * The number of formatted tracks has changed after request ++ * start and we can not tell if the current track was involved. ++ * To avoid data corruption treat it as if the current track is ++ * involved ++ */ ++ rc = true; ++ goto out; ++ } + list_for_each_entry(format, &block->format_list, list) { + if (format->track == to_format->track) { + rc = true; +@@ -3109,6 +3120,7 @@ static void clear_format_track(struct da + unsigned long flags; + + spin_lock_irqsave(&block->format_lock, flags); ++ atomic_inc(&block->trkcount); + list_del_init(&format->list); + spin_unlock_irqrestore(&block->format_lock, flags); + } +@@ -3170,8 +3182,11 @@ dasd_eckd_ese_format(struct dasd_device + } + format->track = curr_trk; + /* test if track is already in formatting by another thread */ +- if (test_and_set_format_track(format, block)) ++ if (test_and_set_format_track(format, cqr)) { ++ /* this is no real error so do not count down retries */ ++ cqr->retries++; + return ERR_PTR(-EEXIST); ++ } + + fdata.start_unit = curr_trk; + fdata.stop_unit = curr_trk; +--- a/drivers/s390/block/dasd_int.h ++++ b/drivers/s390/block/dasd_int.h +@@ -188,6 +188,7 @@ struct dasd_ccw_req { + void (*callback)(struct dasd_ccw_req *, void *data); + void *callback_data; + unsigned int proc_bytes; /* bytes for partial completion */ ++ unsigned int trkcount; /* count formatted tracks */ + }; + + /* +@@ -611,6 +612,7 @@ struct dasd_block { + + struct list_head format_list; + spinlock_t format_lock; ++ atomic_t trkcount; + }; + + struct dasd_attention_data { diff --git a/queue-5.17/series b/queue-5.17/series index f92a2018f1a..ba6c6d5d667 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -34,3 +34,17 @@ btrfs-do-not-allow-compression-on-nodatacow-files.patch btrfs-skip-compression-property-for-anything-other-than-files-and-dirs.patch genirq-synchronize-interrupt-thread-startup.patch asoc-da7219-fix-change-notifications-for-tone-generator-frequency.patch +asoc-rt9120-correct-the-reg-0x09-size-to-one-byte.patch +asoc-wm8958-fix-change-notifications-for-dsp-controls.patch +asoc-meson-fix-event-generation-for-aui-acodec-mux.patch +asoc-meson-fix-event-generation-for-g12a-tohdmi-mux.patch +asoc-meson-fix-event-generation-for-aui-codec-mux.patch +s390-dasd-fix-data-corruption-for-ese-devices.patch +s390-dasd-prevent-double-format-of-tracks-for-ese-devices.patch +s390-dasd-fix-read-for-ese-with-blksize-4k.patch +s390-dasd-fix-read-inconsistency-for-ese-dasd-devices.patch +can-grcan-grcan_close-fix-deadlock.patch +can-isotp-remove-re-binding-of-bound-socket.patch +can-grcan-use-ofdev-dev-when-allocating-dma-memory.patch +can-grcan-grcan_probe-fix-broken-system-id-check-for-errata-workaround-needs.patch +can-grcan-only-use-the-napi-poll-budget-for-rx.patch