From: Greg Kroah-Hartman Date: Tue, 7 Feb 2023 09:35:56 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v5.15.93~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3497d4fdeaf92e4fb8be2adff135586a81920b8a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: nvmem-core-fix-cell-removal-on-error.patch nvmem-core-fix-cleanup-after-dev_set_name.patch nvmem-core-fix-device-node-refcounting.patch nvmem-core-fix-registration-vs-use-race.patch nvmem-core-fix-return-value.patch nvmem-core-initialise-nvmem-id-early.patch nvmem-core-remove-nvmem_config-wp_gpio.patch --- diff --git a/queue-6.1/nvmem-core-fix-cell-removal-on-error.patch b/queue-6.1/nvmem-core-fix-cell-removal-on-error.patch new file mode 100644 index 00000000000..58b34c0625a --- /dev/null +++ b/queue-6.1/nvmem-core-fix-cell-removal-on-error.patch @@ -0,0 +1,42 @@ +From db3546d58b5a0fa581d9c9f2bdc2856fa6c5e43e Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Fri, 27 Jan 2023 10:40:13 +0000 +Subject: nvmem: core: fix cell removal on error + +From: Michael Walle + +commit db3546d58b5a0fa581d9c9f2bdc2856fa6c5e43e upstream. + +nvmem_add_cells() could return an error after some cells are already +added to the provider. In this case, the added cells are not removed. +Remove any registered cells if nvmem_add_cells() fails. + +Fixes: fa72d847d68d7 ("nvmem: check the return value of nvmem_add_cells()") +Cc: stable@vger.kernel.org +Signed-off-by: Michael Walle +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230127104015.23839-9-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -847,7 +847,7 @@ struct nvmem_device *nvmem_register(cons + if (config->cells) { + rval = nvmem_add_cells(nvmem, config->cells, config->ncells); + if (rval) +- goto err_teardown_compat; ++ goto err_remove_cells; + } + + rval = nvmem_add_cells_from_table(nvmem); +@@ -870,7 +870,6 @@ struct nvmem_device *nvmem_register(cons + + err_remove_cells: + nvmem_device_remove_all_cells(nvmem); +-err_teardown_compat: + if (config->compat) + nvmem_sysfs_remove_compat(nvmem, config); + err_put_device: diff --git a/queue-6.1/nvmem-core-fix-cleanup-after-dev_set_name.patch b/queue-6.1/nvmem-core-fix-cleanup-after-dev_set_name.patch new file mode 100644 index 00000000000..c3673494f97 --- /dev/null +++ b/queue-6.1/nvmem-core-fix-cleanup-after-dev_set_name.patch @@ -0,0 +1,95 @@ +From 560181d3ace61825f4ca9dd3481d6c0ee6709fa8 Mon Sep 17 00:00:00 2001 +From: "Russell King (Oracle)" +Date: Fri, 27 Jan 2023 10:40:10 +0000 +Subject: nvmem: core: fix cleanup after dev_set_name() + +From: Russell King (Oracle) + +commit 560181d3ace61825f4ca9dd3481d6c0ee6709fa8 upstream. + +If dev_set_name() fails, we leak nvmem->wp_gpio as the cleanup does not +put this. While a minimal fix for this would be to add the gpiod_put() +call, we can do better if we split device_register(), and use the +tested nvmem_release() cleanup code by initialising the device early, +and putting the device. + +This results in a slightly larger fix, but results in clear code. + +Note: this patch depends on "nvmem: core: initialise nvmem->id early" +and "nvmem: core: remove nvmem_config wp_gpio". + +Fixes: 5544e90c8126 ("nvmem: core: add error handling for dev_set_name") +Cc: stable@vger.kernel.org +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Russell King (Oracle) +[Srini: Fixed subject line and error code handing with wp_gpio while applying.] +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230127104015.23839-6-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 608f3ad2e2e4..ac77a019aed7 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -772,14 +772,18 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + + nvmem->id = rval; + ++ nvmem->dev.type = &nvmem_provider_type; ++ nvmem->dev.bus = &nvmem_bus_type; ++ nvmem->dev.parent = config->dev; ++ ++ device_initialize(&nvmem->dev); ++ + if (!config->ignore_wp) + nvmem->wp_gpio = gpiod_get_optional(config->dev, "wp", + GPIOD_OUT_HIGH); + if (IS_ERR(nvmem->wp_gpio)) { +- ida_free(&nvmem_ida, nvmem->id); + rval = PTR_ERR(nvmem->wp_gpio); +- kfree(nvmem); +- return ERR_PTR(rval); ++ goto err_put_device; + } + + kref_init(&nvmem->refcnt); +@@ -791,9 +795,6 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + nvmem->stride = config->stride ?: 1; + nvmem->word_size = config->word_size ?: 1; + nvmem->size = config->size; +- nvmem->dev.type = &nvmem_provider_type; +- nvmem->dev.bus = &nvmem_bus_type; +- nvmem->dev.parent = config->dev; + nvmem->root_only = config->root_only; + nvmem->priv = config->priv; + nvmem->type = config->type; +@@ -821,11 +822,8 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + break; + } + +- if (rval) { +- ida_free(&nvmem_ida, nvmem->id); +- kfree(nvmem); +- return ERR_PTR(rval); +- } ++ if (rval) ++ goto err_put_device; + + nvmem->read_only = device_property_present(config->dev, "read-only") || + config->read_only || !nvmem->reg_write; +@@ -836,7 +834,7 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config) + + dev_dbg(&nvmem->dev, "Registering nvmem device %s\n", config->name); + +- rval = device_register(&nvmem->dev); ++ rval = device_add(&nvmem->dev); + if (rval) + goto err_put_device; + +-- +2.39.1 + diff --git a/queue-6.1/nvmem-core-fix-device-node-refcounting.patch b/queue-6.1/nvmem-core-fix-device-node-refcounting.patch new file mode 100644 index 00000000000..0090cde0f62 --- /dev/null +++ b/queue-6.1/nvmem-core-fix-device-node-refcounting.patch @@ -0,0 +1,52 @@ +From edcf2fb660526b5ed29f93bd17328a2b4835c8b2 Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Fri, 27 Jan 2023 10:40:12 +0000 +Subject: nvmem: core: fix device node refcounting + +From: Michael Walle + +commit edcf2fb660526b5ed29f93bd17328a2b4835c8b2 upstream. + +In of_nvmem_cell_get(), of_get_next_parent() is used on cell_np. This +will decrement the refcount on cell_np, but cell_np is still used later +in the code. Use of_get_parent() instead and of_node_put() in the +appropriate places. + +Fixes: 69aba7948cbe ("nvmem: Add a simple NVMEM framework for consumers") +Fixes: 7ae6478b304b ("nvmem: core: rework nvmem cell instance creation") +Cc: stable@vger.kernel.org +Signed-off-by: Michael Walle +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230127104015.23839-8-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -1237,16 +1237,21 @@ struct nvmem_cell *of_nvmem_cell_get(str + if (!cell_np) + return ERR_PTR(-ENOENT); + +- nvmem_np = of_get_next_parent(cell_np); +- if (!nvmem_np) ++ nvmem_np = of_get_parent(cell_np); ++ if (!nvmem_np) { ++ of_node_put(cell_np); + return ERR_PTR(-EINVAL); ++ } + + nvmem = __nvmem_device_get(nvmem_np, device_match_of_node); + of_node_put(nvmem_np); +- if (IS_ERR(nvmem)) ++ if (IS_ERR(nvmem)) { ++ of_node_put(cell_np); + return ERR_CAST(nvmem); ++ } + + cell_entry = nvmem_find_cell_entry_by_node(nvmem, cell_np); ++ of_node_put(cell_np); + if (!cell_entry) { + __nvmem_device_put(nvmem); + return ERR_PTR(-ENOENT); diff --git a/queue-6.1/nvmem-core-fix-registration-vs-use-race.patch b/queue-6.1/nvmem-core-fix-registration-vs-use-race.patch new file mode 100644 index 00000000000..210f69d42af --- /dev/null +++ b/queue-6.1/nvmem-core-fix-registration-vs-use-race.patch @@ -0,0 +1,81 @@ +From ab3428cfd9aa2f3463ee4b2909b5bb2193bd0c4a Mon Sep 17 00:00:00 2001 +From: "Russell King (Oracle)" +Date: Fri, 27 Jan 2023 10:40:11 +0000 +Subject: nvmem: core: fix registration vs use race + +From: Russell King (Oracle) + +commit ab3428cfd9aa2f3463ee4b2909b5bb2193bd0c4a upstream. + +The i.MX6 CPU frequency driver sometimes fails to register at boot time +due to nvmem_cell_read_u32() sporadically returning -ENOENT. + +This happens because there is a window where __nvmem_device_get() in +of_nvmem_cell_get() is able to return the nvmem device, but as cells +have been setup, nvmem_find_cell_entry_by_node() returns NULL. + +The occurs because the nvmem core registration code violates one of the +fundamental principles of kernel programming: do not publish data +structures before their setup is complete. + +Fix this by making nvmem core code conform with this principle. + +Fixes: eace75cfdcf7 ("nvmem: Add a simple NVMEM framework for nvmem providers") +Cc: stable@vger.kernel.org +Signed-off-by: Russell King (Oracle) +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230127104015.23839-7-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -832,22 +832,16 @@ struct nvmem_device *nvmem_register(cons + nvmem->dev.groups = nvmem_dev_groups; + #endif + +- dev_dbg(&nvmem->dev, "Registering nvmem device %s\n", config->name); +- +- rval = device_add(&nvmem->dev); +- if (rval) +- goto err_put_device; +- + if (nvmem->nkeepout) { + rval = nvmem_validate_keepouts(nvmem); + if (rval) +- goto err_device_del; ++ goto err_put_device; + } + + if (config->compat) { + rval = nvmem_sysfs_setup_compat(nvmem, config); + if (rval) +- goto err_device_del; ++ goto err_put_device; + } + + if (config->cells) { +@@ -864,6 +858,12 @@ struct nvmem_device *nvmem_register(cons + if (rval) + goto err_remove_cells; + ++ dev_dbg(&nvmem->dev, "Registering nvmem device %s\n", config->name); ++ ++ rval = device_add(&nvmem->dev); ++ if (rval) ++ goto err_remove_cells; ++ + blocking_notifier_call_chain(&nvmem_notifier, NVMEM_ADD, nvmem); + + return nvmem; +@@ -873,8 +873,6 @@ err_remove_cells: + err_teardown_compat: + if (config->compat) + nvmem_sysfs_remove_compat(nvmem, config); +-err_device_del: +- device_del(&nvmem->dev); + err_put_device: + put_device(&nvmem->dev); + diff --git a/queue-6.1/nvmem-core-fix-return-value.patch b/queue-6.1/nvmem-core-fix-return-value.patch new file mode 100644 index 00000000000..926035adcc7 --- /dev/null +++ b/queue-6.1/nvmem-core-fix-return-value.patch @@ -0,0 +1,36 @@ +From 0c4862b1c1465e473bc961a02765490578bf5c20 Mon Sep 17 00:00:00 2001 +From: "Russell King (Oracle)" +Date: Fri, 27 Jan 2023 10:40:14 +0000 +Subject: nvmem: core: fix return value + +From: Russell King (Oracle) + +commit 0c4862b1c1465e473bc961a02765490578bf5c20 upstream. + +Dan Carpenter points out that the return code was not set in commit +60c8b4aebd8e ("nvmem: core: fix cleanup after dev_set_name()"), but +this is not the only issue - we also need to zero wp_gpio to prevent +gpiod_put() being called on an error value. + +Fixes: 560181d3ace6 ("nvmem: core: fix cleanup after dev_set_name()") +Cc: stable@vger.kernel.org +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Russell King (Oracle) +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230127104015.23839-10-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -783,6 +783,7 @@ struct nvmem_device *nvmem_register(cons + GPIOD_OUT_HIGH); + if (IS_ERR(nvmem->wp_gpio)) { + rval = PTR_ERR(nvmem->wp_gpio); ++ nvmem->wp_gpio = NULL; + goto err_put_device; + } + diff --git a/queue-6.1/nvmem-core-initialise-nvmem-id-early.patch b/queue-6.1/nvmem-core-initialise-nvmem-id-early.patch new file mode 100644 index 00000000000..2ed082b3480 --- /dev/null +++ b/queue-6.1/nvmem-core-initialise-nvmem-id-early.patch @@ -0,0 +1,43 @@ +From 3bd747c7ea13cb145f0d84444e00df928b0842d9 Mon Sep 17 00:00:00 2001 +From: "Russell King (Oracle)" +Date: Fri, 27 Jan 2023 10:40:08 +0000 +Subject: nvmem: core: initialise nvmem->id early + +From: Russell King (Oracle) + +commit 3bd747c7ea13cb145f0d84444e00df928b0842d9 upstream. + +The error path for wp_gpio attempts to free the IDA nvmem->id, but +this has yet to be assigned, so will always be zero - leaking the +ID allocated by ida_alloc(). Fix this by moving the initialisation +of nvmem->id earlier. + +Fixes: f7d8d7dcd978 ("nvmem: fix memory leak in error path") +Cc: stable@vger.kernel.org +Signed-off-by: Russell King (Oracle) +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230127104015.23839-4-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -770,6 +770,8 @@ struct nvmem_device *nvmem_register(cons + return ERR_PTR(rval); + } + ++ nvmem->id = rval; ++ + if (config->wp_gpio) + nvmem->wp_gpio = config->wp_gpio; + else if (!config->ignore_wp) +@@ -785,7 +787,6 @@ struct nvmem_device *nvmem_register(cons + kref_init(&nvmem->refcnt); + INIT_LIST_HEAD(&nvmem->cells); + +- nvmem->id = rval; + nvmem->owner = config->owner; + if (!nvmem->owner && config->dev->driver) + nvmem->owner = config->dev->driver->owner; diff --git a/queue-6.1/nvmem-core-remove-nvmem_config-wp_gpio.patch b/queue-6.1/nvmem-core-remove-nvmem_config-wp_gpio.patch new file mode 100644 index 00000000000..35b51c647dd --- /dev/null +++ b/queue-6.1/nvmem-core-remove-nvmem_config-wp_gpio.patch @@ -0,0 +1,53 @@ +From 569653f022a29a1a44ea9de5308b657228303fa5 Mon Sep 17 00:00:00 2001 +From: "Russell King (Oracle)" +Date: Fri, 27 Jan 2023 10:40:09 +0000 +Subject: nvmem: core: remove nvmem_config wp_gpio + +From: Russell King (Oracle) + +commit 569653f022a29a1a44ea9de5308b657228303fa5 upstream. + +No one provides wp_gpio, so let's remove it to avoid issues with +the nvmem core putting this gpio. + +Cc: stable@vger.kernel.org +Signed-off-by: Russell King (Oracle) +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230127104015.23839-5-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 4 +--- + include/linux/nvmem-provider.h | 2 -- + 2 files changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -772,9 +772,7 @@ struct nvmem_device *nvmem_register(cons + + nvmem->id = rval; + +- if (config->wp_gpio) +- nvmem->wp_gpio = config->wp_gpio; +- else if (!config->ignore_wp) ++ if (!config->ignore_wp) + nvmem->wp_gpio = gpiod_get_optional(config->dev, "wp", + GPIOD_OUT_HIGH); + if (IS_ERR(nvmem->wp_gpio)) { +--- a/include/linux/nvmem-provider.h ++++ b/include/linux/nvmem-provider.h +@@ -70,7 +70,6 @@ struct nvmem_keepout { + * @word_size: Minimum read/write access granularity. + * @stride: Minimum read/write access stride. + * @priv: User context passed to read/write callbacks. +- * @wp-gpio: Write protect pin + * @ignore_wp: Write Protect pin is managed by the provider. + * + * Note: A default "nvmem" name will be assigned to the device if +@@ -85,7 +84,6 @@ struct nvmem_config { + const char *name; + int id; + struct module *owner; +- struct gpio_desc *wp_gpio; + const struct nvmem_cell_info *cells; + int ncells; + const struct nvmem_keepout *keepout; diff --git a/queue-6.1/series b/queue-6.1/series index 4a68fbc7ed5..18be8fe3acd 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -181,3 +181,10 @@ drm-i915-fix-potential-bit_17-double-free.patch drm-amd-fix-initialization-for-nbio-4.3.0.patch drm-amd-pm-drop-unneeded-dpm-features-disablement-for-smu-13.0.4-11.patch drm-amdgpu-update-wave-data-type-to-3-for-gfx11.patch +nvmem-core-initialise-nvmem-id-early.patch +nvmem-core-remove-nvmem_config-wp_gpio.patch +nvmem-core-fix-cleanup-after-dev_set_name.patch +nvmem-core-fix-registration-vs-use-race.patch +nvmem-core-fix-device-node-refcounting.patch +nvmem-core-fix-cell-removal-on-error.patch +nvmem-core-fix-return-value.patch