From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 05:47:56 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.19.263~78 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=23c167a6c677636fb755897a31d34b76212429ae;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: alsa-au88x0-use-explicitly-signed-char.patch alsa-use-del_timer_sync-before-freeing-timer.patch usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch usb-bdc-change-state-when-port-disconnected.patch usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch --- diff --git a/queue-4.14/alsa-au88x0-use-explicitly-signed-char.patch b/queue-4.14/alsa-au88x0-use-explicitly-signed-char.patch new file mode 100644 index 00000000000..64917826fcc --- /dev/null +++ b/queue-4.14/alsa-au88x0-use-explicitly-signed-char.patch @@ -0,0 +1,64 @@ +From ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Mon, 24 Oct 2022 18:29:29 +0200 +Subject: ALSA: au88x0: use explicitly signed char + +From: Jason A. Donenfeld + +commit ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 upstream. + +With char becoming unsigned by default, and with `char` alone being +ambiguous and based on architecture, signed chars need to be marked +explicitly as such. This fixes warnings like: + +sound/pci/au88x0/au88x0_core.c:2029 vortex_adb_checkinout() warn: signedness bug returning '(-22)' +sound/pci/au88x0/au88x0_core.c:2046 vortex_adb_checkinout() warn: signedness bug returning '(-12)' +sound/pci/au88x0/au88x0_core.c:2125 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, (0), en, 0)' is unsigned +sound/pci/au88x0/au88x0_core.c:2170 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, stream->resources, en, 4)' is unsigned + +As well, since one function returns errnos, return an `int` rather than +a `signed char`. + +Signed-off-by: Jason A. Donenfeld +Cc: +Link: https://lore.kernel.org/r/20221024162929.536004-1-Jason@zx2c4.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/au88x0/au88x0.h | 6 +++--- + sound/pci/au88x0/au88x0_core.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/pci/au88x0/au88x0.h ++++ b/sound/pci/au88x0/au88x0.h +@@ -153,7 +153,7 @@ struct snd_vortex { + #ifndef CHIP_AU8810 + stream_t dma_wt[NR_WT]; + wt_voice_t wt_voice[NR_WT]; /* WT register cache. */ +- char mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */ ++ s8 mixwt[(NR_WT / NR_WTPB) * 6]; /* WT mixin objects */ + #endif + + /* Global resources */ +@@ -247,8 +247,8 @@ static int vortex_alsafmt_aspfmt(int als + static void vortex_connect_default(vortex_t * vortex, int en); + static int vortex_adb_allocroute(vortex_t * vortex, int dma, int nr_ch, + int dir, int type, int subdev); +-static char vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, +- int restype); ++static int vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, ++ int restype); + #ifndef CHIP_AU8810 + static int vortex_wt_allocroute(vortex_t * vortex, int dma, int nr_ch); + static void vortex_wt_connect(vortex_t * vortex, int en); +--- a/sound/pci/au88x0/au88x0_core.c ++++ b/sound/pci/au88x0/au88x0_core.c +@@ -2004,7 +2004,7 @@ static int resnum[VORTEX_RESOURCE_LAST] + out: Mean checkout if != 0. Else mean Checkin resource. + restype: Indicates type of resource to be checked in or out. + */ +-static char ++static int + vortex_adb_checkinout(vortex_t * vortex, int resmap[], int out, int restype) + { + int i, qty = resnum[restype], resinuse = 0; diff --git a/queue-4.14/alsa-use-del_timer_sync-before-freeing-timer.patch b/queue-4.14/alsa-use-del_timer_sync-before-freeing-timer.patch new file mode 100644 index 00000000000..f3d1a144435 --- /dev/null +++ b/queue-4.14/alsa-use-del_timer_sync-before-freeing-timer.patch @@ -0,0 +1,64 @@ +From f0a868788fcbf63cdab51f5adcf73b271ede8164 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Wed, 26 Oct 2022 23:12:36 -0400 +Subject: ALSA: Use del_timer_sync() before freeing timer + +From: Steven Rostedt (Google) + +commit f0a868788fcbf63cdab51f5adcf73b271ede8164 upstream. + +The current code for freeing the emux timer is extremely dangerous: + + CPU0 CPU1 + ---- ---- +snd_emux_timer_callback() + snd_emux_free() + spin_lock(&emu->voice_lock) + del_timer(&emu->tlist); <-- returns immediately + spin_unlock(&emu->voice_lock); + [..] + kfree(emu); + + spin_lock(&emu->voice_lock); + + [BOOM!] + +Instead just use del_timer_sync() which will wait for the timer to finish +before continuing. No need to check if the timer is active or not when +doing so. + +This doesn't fix the race of a possible re-arming of the timer, but at +least it won't use the data that has just been freed. + +[ Fixed unused variable warning by tiwai ] + +Cc: stable@vger.kernel.org +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Steven Rostedt (Google) +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20221026231236.6834b551@gandalf.local.home +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/synth/emux/emux.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/sound/synth/emux/emux.c ++++ b/sound/synth/emux/emux.c +@@ -138,15 +138,10 @@ EXPORT_SYMBOL(snd_emux_register); + */ + int snd_emux_free(struct snd_emux *emu) + { +- unsigned long flags; +- + if (! emu) + return -EINVAL; + +- spin_lock_irqsave(&emu->voice_lock, flags); +- if (emu->timer_active) +- del_timer(&emu->tlist); +- spin_unlock_irqrestore(&emu->voice_lock, flags); ++ del_timer_sync(&emu->tlist); + + snd_emux_proc_free(emu); + snd_emux_delete_virmidi(emu); diff --git a/queue-4.14/series b/queue-4.14/series index 2d9d47a5474..65262a43818 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -14,3 +14,10 @@ net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-buffers-across-ioctls.patch acpi-video-force-backlight-native-for-more-tongfang-devices.patch +alsa-use-del_timer_sync-before-freeing-timer.patch +alsa-au88x0-use-explicitly-signed-char.patch +usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch +usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch +usb-bdc-change-state-when-port-disconnected.patch +usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch +xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch diff --git a/queue-4.14/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch b/queue-4.14/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch new file mode 100644 index 00000000000..bd4cee86818 --- /dev/null +++ b/queue-4.14/usb-add-reset_resume-quirk-for-nvidia-jetson-devices-in-rcm.patch @@ -0,0 +1,48 @@ +From fc4ade55c617dc73c7e9756b57f3230b4ff24540 Mon Sep 17 00:00:00 2001 +From: Hannu Hartikainen +Date: Mon, 19 Sep 2022 20:16:10 +0300 +Subject: USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM + +From: Hannu Hartikainen + +commit fc4ade55c617dc73c7e9756b57f3230b4ff24540 upstream. + +NVIDIA Jetson devices in Force Recovery mode (RCM) do not support +suspending, ie. flashing fails if the device has been suspended. The +devices are still visible in lsusb and seem to work otherwise, making +the issue hard to debug. This has been discovered in various forum +posts, eg. [1]. + +The patch has been tested on NVIDIA Jetson AGX Xavier, but I'm adding +all the Jetson models listed in [2] on the assumption that they all +behave similarly. + +[1]: https://forums.developer.nvidia.com/t/flashing-not-working/72365 +[2]: https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3271/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/quick_start.html + +Signed-off-by: Hannu Hartikainen +Cc: stable # after 6.1-rc3 +Link: https://lore.kernel.org/r/20220919171610.30484-1-hannu@hrtk.in +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -227,6 +227,15 @@ static const struct usb_device_id usb_qu + /* Kingston DataTraveler 3.0 */ + { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* NVIDIA Jetson devices in Force Recovery mode */ ++ { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + diff --git a/queue-4.14/usb-bdc-change-state-when-port-disconnected.patch b/queue-4.14/usb-bdc-change-state-when-port-disconnected.patch new file mode 100644 index 00000000000..6740f97c4f6 --- /dev/null +++ b/queue-4.14/usb-bdc-change-state-when-port-disconnected.patch @@ -0,0 +1,33 @@ +From fb8f60dd1b67520e0e0d7978ef17d015690acfc1 Mon Sep 17 00:00:00 2001 +From: Justin Chen +Date: Wed, 5 Oct 2022 12:13:55 -0700 +Subject: usb: bdc: change state when port disconnected + +From: Justin Chen + +commit fb8f60dd1b67520e0e0d7978ef17d015690acfc1 upstream. + +When port is connected and then disconnected, the state stays as +configured. Which is incorrect as the port is no longer configured, +but in a not attached state. + +Signed-off-by: Justin Chen +Acked-by: Florian Fainelli +Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC") +Cc: stable +Link: https://lore.kernel.org/r/1664997235-18198-1-git-send-email-justinpopo6@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/gadget/udc/bdc/bdc_udc.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_udc.c +@@ -156,6 +156,7 @@ static void bdc_uspc_disconnected(struct + bdc->delayed_status = false; + bdc->reinit = reinit; + bdc->test_mode = false; ++ usb_gadget_set_state(&bdc->gadget, USB_STATE_NOTATTACHED); + } + + /* TNotify wkaeup timer */ diff --git a/queue-4.14/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch b/queue-4.14/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch new file mode 100644 index 00000000000..23670c2fcc0 --- /dev/null +++ b/queue-4.14/usb-dwc3-gadget-don-t-set-imi-for-no_interrupt.patch @@ -0,0 +1,39 @@ +From 308c316d16cbad99bb834767382baa693ac42169 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 25 Oct 2022 15:10:20 -0700 +Subject: usb: dwc3: gadget: Don't set IMI for no_interrupt + +From: Thinh Nguyen + +commit 308c316d16cbad99bb834767382baa693ac42169 upstream. + +The gadget driver may have a certain expectation of how the request +completion flow should be from to its configuration. Make sure the +controller driver respect that. That is, don't set IMI (Interrupt on +Missed Isoc) when usb_request->no_interrupt is set. Also, the driver +should only set IMI to the last TRB of a chain. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Reviewed-by: Jeff Vanhoof +Tested-by: Jeff Vanhoof +Link: https://lore.kernel.org/r/ced336c84434571340c07994e3667a0ee284fefe.1666735451.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -965,8 +965,8 @@ static void __dwc3_prepare_one_trb(struc + trb->ctrl = DWC3_TRBCTL_ISOCHRONOUS; + } + +- /* always enable Interrupt on Missed ISOC */ +- trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; ++ if (!no_interrupt && !chain) ++ trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; + break; + + case USB_ENDPOINT_XFER_BULK: diff --git a/queue-4.14/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch b/queue-4.14/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch new file mode 100644 index 00000000000..747871f1f74 --- /dev/null +++ b/queue-4.14/usb-xhci-add-xhci_spurious_success-to-asm1042-despite-being-a-v0.96-controller.patch @@ -0,0 +1,45 @@ +From 4f547472380136718b56064ea5689a61e135f904 Mon Sep 17 00:00:00 2001 +From: Jens Glathe +Date: Mon, 24 Oct 2022 17:27:17 +0300 +Subject: usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller + +From: Jens Glathe + +commit 4f547472380136718b56064ea5689a61e135f904 upstream. + +This appears to fix the error: +"xhci_hcd
; ERROR Transfer event TRB DMA ptr not part of +current TD ep_index 2 comp_code 13" that appear spuriously (or pretty +often) when using a r8152 USB3 ethernet adapter with integrated hub. + +ASM1042 reports as a 0.96 controller, but appears to behave more like 1.0 + +Inspired by this email thread: https://markmail.org/thread/7vzqbe7t6du6qsw3 + +Cc: stable@vger.kernel.org +Signed-off-by: Jens Glathe +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20221024142720.4122053-2-mathias.nyman@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -239,8 +239,14 @@ static void xhci_pci_quirks(struct devic + xhci->quirks |= XHCI_BROKEN_STREAMS; + + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && +- pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) ++ pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) { ++ /* ++ * try to tame the ASMedia 1042 controller which reports 0.96 ++ * but appears to behave more like 1.0 ++ */ ++ xhci->quirks |= XHCI_SPURIOUS_SUCCESS; + xhci->quirks |= XHCI_BROKEN_STREAMS; ++ } + if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && + pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI) { + xhci->quirks |= XHCI_TRUST_TX_LENGTH; diff --git a/queue-4.14/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch b/queue-4.14/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch new file mode 100644 index 00000000000..93fb6f2268d --- /dev/null +++ b/queue-4.14/xhci-remove-device-endpoints-from-bandwidth-list-when-freeing-the-device.patch @@ -0,0 +1,69 @@ +From 5aed5b7c2430ce318a8e62f752f181e66f0d1053 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Mon, 24 Oct 2022 17:27:20 +0300 +Subject: xhci: Remove device endpoints from bandwidth list when freeing the device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mathias Nyman + +commit 5aed5b7c2430ce318a8e62f752f181e66f0d1053 upstream. + +Endpoints are normally deleted from the bandwidth list when they are +dropped, before the virt device is freed. + +If xHC host is dying or being removed then the endpoints aren't dropped +cleanly due to functions returning early to avoid interacting with a +non-accessible host controller. + +So check and delete endpoints that are still on the bandwidth list when +freeing the virt device. + +Solves a list_del corruption kernel crash when unbinding xhci-pci, +caused by xhci_mem_cleanup() when it later tried to delete already freed +endpoints from the bandwidth list. + +This only affects hosts that use software bandwidth checking, which +currenty is only the xHC in intel Panther Point PCH (Ivy Bridge) + +Cc: stable@vger.kernel.org +Reported-by: Marek Marczykowski-Górecki +Tested-by: Marek Marczykowski-Górecki +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20221024142720.4122053-5-mathias.nyman@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-mem.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -911,15 +911,19 @@ void xhci_free_virt_device(struct xhci_h + if (dev->eps[i].stream_info) + xhci_free_stream_info(xhci, + dev->eps[i].stream_info); +- /* Endpoints on the TT/root port lists should have been removed +- * when usb_disable_device() was called for the device. +- * We can't drop them anyway, because the udev might have gone +- * away by this point, and we can't tell what speed it was. ++ /* ++ * Endpoints are normally deleted from the bandwidth list when ++ * endpoints are dropped, before device is freed. ++ * If host is dying or being removed then endpoints aren't ++ * dropped cleanly, so delete the endpoint from list here. ++ * Only applicable for hosts with software bandwidth checking. + */ +- if (!list_empty(&dev->eps[i].bw_endpoint_list)) +- xhci_warn(xhci, "Slot %u endpoint %u " +- "not removed from BW list!\n", +- slot_id, i); ++ ++ if (!list_empty(&dev->eps[i].bw_endpoint_list)) { ++ list_del_init(&dev->eps[i].bw_endpoint_list); ++ xhci_dbg(xhci, "Slot %u endpoint %u not removed from BW list!\n", ++ slot_id, i); ++ } + } + /* If this is a hub, free the TT(s) from the TT list */ + xhci_free_tt_info(xhci, dev, slot_id);