From: Greg Kroah-Hartman Date: Thu, 29 May 2025 06:37:20 +0000 (+0200) Subject: drop some patches on request X-Git-Tag: v6.12.31~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3ef5703524a0228673dd3b8dd1b9153cb8444ac1;p=thirdparty%2Fkernel%2Fstable-queue.git drop some patches on request --- diff --git a/queue-6.1/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch b/queue-6.1/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch deleted file mode 100644 index 78ef8db7f0..0000000000 --- a/queue-6.1/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch +++ /dev/null @@ -1,255 +0,0 @@ -From ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 Mon Sep 17 00:00:00 2001 -From: Dmitry Torokhov -Date: Mon, 5 May 2025 15:49:59 -0700 -Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Dmitry Torokhov - -commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 upstream. - -Sysfs interface for updating firmware for RMI devices is available even -when F34 probe fails. The code checks for presence of F34 "container" -pointer and then tries to use the function data attached to the -sub-device. F34 assigns the function data early, before it knows if -probe will succeed, leaving behind a stale pointer. - -Fix this by expanding checks to not only test for presence of F34 -"container" but also check if there is driver data assigned to the -sub-device, and call dev_set_drvdata() only after we are certain that -probe is successful. - -This is not a complete fix, since F34 will be freed during firmware -update, so there is still a race when fetching and accessing this -pointer. This race will be addressed in follow-up changes. - -Reported-by: Hanno Böck -Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com -Signed-off-by: Dmitry Torokhov -Signed-off-by: Greg Kroah-Hartman ---- - drivers/input/rmi4/rmi_f34.c | 133 ++++++++++++++++++++++++------------------- - 1 file changed, 75 insertions(+), 58 deletions(-) - ---- a/drivers/input/rmi4/rmi_f34.c -+++ b/drivers/input/rmi4/rmi_f34.c -@@ -4,6 +4,7 @@ - * Copyright (C) 2016 Zodiac Inflight Innovations - */ - -+#include "linux/device.h" - #include - #include - #include -@@ -298,39 +299,30 @@ out: - return ret; - } - --static int rmi_f34_status(struct rmi_function *fn) --{ -- struct f34_data *f34 = dev_get_drvdata(&fn->dev); -- -- /* -- * The status is the percentage complete, or once complete, -- * zero for success or a negative return code. -- */ -- return f34->update_status; --} -- - static ssize_t rmi_driver_bootloader_id_show(struct device *dev, - struct device_attribute *dattr, - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- struct rmi_function *fn = data->f34_container; -+ struct rmi_function *fn; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- if (f34->bl_version == 5) -- return sysfs_emit(buf, "%c%c\n", -- f34->bootloader_id[0], -- f34->bootloader_id[1]); -- else -- return sysfs_emit(buf, "V%d.%d\n", -- f34->bootloader_id[1], -- f34->bootloader_id[0]); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ if (f34->bl_version == 5) -+ return sysfs_emit(buf, "%c%c\n", -+ f34->bootloader_id[0], -+ f34->bootloader_id[1]); -+ else -+ return sysfs_emit(buf, "V%d.%d\n", -+ f34->bootloader_id[1], -+ f34->bootloader_id[0]); - } - - static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL); -@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_ - struct rmi_function *fn = data->f34_container; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- return sysfs_emit(buf, "%s\n", f34->configuration_id); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ -+ return sysfs_emit(buf, "%s\n", f34->configuration_id); - } - - static DEVICE_ATTR(configuration_id, 0444, -@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rm - - if (!data->f34_container) { - dev_warn(dev, "%s: No F34 present!\n", __func__); -- return -EINVAL; -+ return -ENODEV; - } - - f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (!f34) { -+ dev_warn(dev, "%s: No valid F34 present!\n", __func__); -+ return -ENODEV; -+ } - - if (f34->bl_version >= 7) { - if (data->pdt_props & HAS_BSR) { -@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_stat - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- int update_status = 0; -+ struct f34_data *f34; -+ int update_status = -ENODEV; - -- if (data->f34_container) -- update_status = rmi_f34_status(data->f34_container); -+ /* -+ * The status is the percentage complete, or once complete, -+ * zero for success or a negative return code. -+ */ -+ if (data->f34_container) { -+ f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (f34) -+ update_status = f34->update_status; -+ } - - return sysfs_emit(buf, "%d\n", update_status); - } -@@ -517,33 +524,21 @@ static const struct attribute_group rmi_ - .attrs = rmi_firmware_attrs, - }; - --static int rmi_f34_probe(struct rmi_function *fn) -+static int rmi_f34v5_probe(struct f34_data *f34) - { -- struct f34_data *f34; -- unsigned char f34_queries[9]; -+ struct rmi_function *fn = f34->fn; -+ u8 f34_queries[9]; - bool has_config_id; -- u8 version = fn->fd.function_version; -- int ret; -- -- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -- if (!f34) -- return -ENOMEM; -- -- f34->fn = fn; -- dev_set_drvdata(&fn->dev, f34); -- -- /* v5 code only supported version 0, try V7 probe */ -- if (version > 0) -- return rmi_f34v7_probe(f34); -+ int error; - - f34->bl_version = 5; - -- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "%s: Failed to query properties\n", - __func__); -- return ret; -+ return error; - } - - snprintf(f34->bootloader_id, sizeof(f34->bootloader_id), -@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_func - f34->v5.config_blocks); - - if (has_config_id) { -- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "Failed to read F34 config ID\n"); -- return ret; -+ return error; - } - - snprintf(f34->configuration_id, sizeof(f34->configuration_id), -@@ -582,11 +577,33 @@ static int rmi_f34_probe(struct rmi_func - f34_queries[2], f34_queries[3]); - - rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n", -- f34->configuration_id); -+ f34->configuration_id); - } - - return 0; - } -+ -+static int rmi_f34_probe(struct rmi_function *fn) -+{ -+ struct f34_data *f34; -+ u8 version = fn->fd.function_version; -+ int error; -+ -+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -+ if (!f34) -+ return -ENOMEM; -+ -+ f34->fn = fn; -+ -+ /* v5 code only supported version 0 */ -+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34); -+ if (error) -+ return error; -+ -+ dev_set_drvdata(&fn->dev, f34); -+ -+ return 0; -+} - - int rmi_f34_create_sysfs(struct rmi_device *rmi_dev) - { diff --git a/queue-6.1/series b/queue-6.1/series index 96c8b212da..f6a8ed74da 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -260,7 +260,6 @@ drm-edid-fixed-the-bug-that-hdr-metadata-was-not-reset.patch smb-client-fix-use-after-free-in-cifs_fill_dirent.patch smb-client-reset-all-search-buffer-pointers-when-releasing-buffer.patch revert-drm-amd-keep-display-off-while-going-into-s4.patch -input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch memcg-always-call-cond_resched-after-fn.patch mm-page_alloc.c-avoid-infinite-retries-caused-by-cpuset-race.patch revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch diff --git a/queue-6.12/dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch b/queue-6.12/dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch deleted file mode 100644 index b8ea79e54a..0000000000 --- a/queue-6.12/dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch +++ /dev/null @@ -1,208 +0,0 @@ -From ac663217ac4eeab508db348a67511d45ccd9846f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 31 Jan 2025 21:18:05 -0500 -Subject: dm vdo vio-pool: allow variable-sized metadata vios - -From: Ken Raeburn - -[ Upstream commit f979da512553a41a657f2c1198277e84d66f8ce3 ] - -With larger-sized metadata vio pools, vdo will sometimes need to -issue I/O with a smaller size than the allocated size. Since -vio_reset_bio is where the bvec array and I/O size are initialized, -this reset interface must now specify what I/O size to use. - -Signed-off-by: Ken Raeburn -Signed-off-by: Matthew Sakai -Signed-off-by: Mikulas Patocka -Signed-off-by: Sasha Levin ---- - drivers/md/dm-vdo/io-submitter.c | 6 ++++-- - drivers/md/dm-vdo/io-submitter.h | 18 +++++++++++++--- - drivers/md/dm-vdo/types.h | 3 +++ - drivers/md/dm-vdo/vio.c | 36 +++++++++++++++++++------------- - drivers/md/dm-vdo/vio.h | 2 ++ - 5 files changed, 46 insertions(+), 19 deletions(-) - -diff --git a/drivers/md/dm-vdo/io-submitter.c b/drivers/md/dm-vdo/io-submitter.c -index ab62abe18827b..a664be89c15d7 100644 ---- a/drivers/md/dm-vdo/io-submitter.c -+++ b/drivers/md/dm-vdo/io-submitter.c -@@ -327,6 +327,7 @@ void vdo_submit_data_vio(struct data_vio *data_vio) - * @error_handler: the handler for submission or I/O errors (may be NULL) - * @operation: the type of I/O to perform - * @data: the buffer to read or write (may be NULL) -+ * @size: the I/O amount in bytes - * - * The vio is enqueued on a vdo bio queue so that bio submission (which may block) does not block - * other vdo threads. -@@ -338,7 +339,7 @@ void vdo_submit_data_vio(struct data_vio *data_vio) - */ - void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical, - bio_end_io_t callback, vdo_action_fn error_handler, -- blk_opf_t operation, char *data) -+ blk_opf_t operation, char *data, int size) - { - int result; - struct vdo_completion *completion = &vio->completion; -@@ -349,7 +350,8 @@ void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical, - - vdo_reset_completion(completion); - completion->error_handler = error_handler; -- result = vio_reset_bio(vio, data, callback, operation | REQ_META, physical); -+ result = vio_reset_bio_with_size(vio, data, size, callback, operation | REQ_META, -+ physical); - if (result != VDO_SUCCESS) { - continue_vio(vio, result); - return; -diff --git a/drivers/md/dm-vdo/io-submitter.h b/drivers/md/dm-vdo/io-submitter.h -index 80748699496f2..3088f11055fdd 100644 ---- a/drivers/md/dm-vdo/io-submitter.h -+++ b/drivers/md/dm-vdo/io-submitter.h -@@ -8,6 +8,7 @@ - - #include - -+#include "constants.h" - #include "types.h" - - struct io_submitter; -@@ -26,14 +27,25 @@ void vdo_submit_data_vio(struct data_vio *data_vio); - - void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical, - bio_end_io_t callback, vdo_action_fn error_handler, -- blk_opf_t operation, char *data); -+ blk_opf_t operation, char *data, int size); - - static inline void vdo_submit_metadata_vio(struct vio *vio, physical_block_number_t physical, - bio_end_io_t callback, vdo_action_fn error_handler, - blk_opf_t operation) - { - __submit_metadata_vio(vio, physical, callback, error_handler, -- operation, vio->data); -+ operation, vio->data, vio->block_count * VDO_BLOCK_SIZE); -+} -+ -+static inline void vdo_submit_metadata_vio_with_size(struct vio *vio, -+ physical_block_number_t physical, -+ bio_end_io_t callback, -+ vdo_action_fn error_handler, -+ blk_opf_t operation, -+ int size) -+{ -+ __submit_metadata_vio(vio, physical, callback, error_handler, -+ operation, vio->data, size); - } - - static inline void vdo_submit_flush_vio(struct vio *vio, bio_end_io_t callback, -@@ -41,7 +53,7 @@ static inline void vdo_submit_flush_vio(struct vio *vio, bio_end_io_t callback, - { - /* FIXME: Can we just use REQ_OP_FLUSH? */ - __submit_metadata_vio(vio, 0, callback, error_handler, -- REQ_OP_WRITE | REQ_PREFLUSH, NULL); -+ REQ_OP_WRITE | REQ_PREFLUSH, NULL, 0); - } - - #endif /* VDO_IO_SUBMITTER_H */ -diff --git a/drivers/md/dm-vdo/types.h b/drivers/md/dm-vdo/types.h -index dbe892b10f265..cdf36e7d77021 100644 ---- a/drivers/md/dm-vdo/types.h -+++ b/drivers/md/dm-vdo/types.h -@@ -376,6 +376,9 @@ struct vio { - /* The size of this vio in blocks */ - unsigned int block_count; - -+ /* The amount of data to be read or written, in bytes */ -+ unsigned int io_size; -+ - /* The data being read or written. */ - char *data; - -diff --git a/drivers/md/dm-vdo/vio.c b/drivers/md/dm-vdo/vio.c -index b291578f726f5..7c417c1af4516 100644 ---- a/drivers/md/dm-vdo/vio.c -+++ b/drivers/md/dm-vdo/vio.c -@@ -188,14 +188,23 @@ void vdo_set_bio_properties(struct bio *bio, struct vio *vio, bio_end_io_t callb - - /* - * Prepares the bio to perform IO with the specified buffer. May only be used on a VDO-allocated -- * bio, as it assumes the bio wraps a 4k buffer that is 4k aligned, but there does not have to be a -- * vio associated with the bio. -+ * bio, as it assumes the bio wraps a 4k-multiple buffer that is 4k aligned, but there does not -+ * have to be a vio associated with the bio. - */ - int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback, - blk_opf_t bi_opf, physical_block_number_t pbn) - { -- int bvec_count, offset, len, i; -+ return vio_reset_bio_with_size(vio, data, vio->block_count * VDO_BLOCK_SIZE, -+ callback, bi_opf, pbn); -+} -+ -+int vio_reset_bio_with_size(struct vio *vio, char *data, int size, bio_end_io_t callback, -+ blk_opf_t bi_opf, physical_block_number_t pbn) -+{ -+ int bvec_count, offset, i; - struct bio *bio = vio->bio; -+ int vio_size = vio->block_count * VDO_BLOCK_SIZE; -+ int remaining; - - bio_reset(bio, bio->bi_bdev, bi_opf); - vdo_set_bio_properties(bio, vio, callback, bi_opf, pbn); -@@ -204,22 +213,21 @@ int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback, - - bio->bi_io_vec = bio->bi_inline_vecs; - bio->bi_max_vecs = vio->block_count + 1; -- len = VDO_BLOCK_SIZE * vio->block_count; -+ if (VDO_ASSERT(size <= vio_size, "specified size %d is not greater than allocated %d", -+ size, vio_size) != VDO_SUCCESS) -+ size = vio_size; -+ vio->io_size = size; - offset = offset_in_page(data); -- bvec_count = DIV_ROUND_UP(offset + len, PAGE_SIZE); -+ bvec_count = DIV_ROUND_UP(offset + size, PAGE_SIZE); -+ remaining = size; - -- /* -- * If we knew that data was always on one page, or contiguous pages, we wouldn't need the -- * loop. But if we're using vmalloc, it's not impossible that the data is in different -- * pages that can't be merged in bio_add_page... -- */ -- for (i = 0; (i < bvec_count) && (len > 0); i++) { -+ for (i = 0; (i < bvec_count) && (remaining > 0); i++) { - struct page *page; - int bytes_added; - int bytes = PAGE_SIZE - offset; - -- if (bytes > len) -- bytes = len; -+ if (bytes > remaining) -+ bytes = remaining; - - page = is_vmalloc_addr(data) ? vmalloc_to_page(data) : virt_to_page(data); - bytes_added = bio_add_page(bio, page, bytes, offset); -@@ -231,7 +239,7 @@ int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback, - } - - data += bytes; -- len -= bytes; -+ remaining -= bytes; - offset = 0; - } - -diff --git a/drivers/md/dm-vdo/vio.h b/drivers/md/dm-vdo/vio.h -index 3490e9f59b04a..74e8fd7c8c029 100644 ---- a/drivers/md/dm-vdo/vio.h -+++ b/drivers/md/dm-vdo/vio.h -@@ -123,6 +123,8 @@ void vdo_set_bio_properties(struct bio *bio, struct vio *vio, bio_end_io_t callb - - int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback, - blk_opf_t bi_opf, physical_block_number_t pbn); -+int vio_reset_bio_with_size(struct vio *vio, char *data, int size, bio_end_io_t callback, -+ blk_opf_t bi_opf, physical_block_number_t pbn); - - void update_vio_error_stats(struct vio *vio, const char *format, ...) - __printf(2, 3); --- -2.39.5 - diff --git a/queue-6.12/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch b/queue-6.12/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch deleted file mode 100644 index 78ef8db7f0..0000000000 --- a/queue-6.12/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch +++ /dev/null @@ -1,255 +0,0 @@ -From ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 Mon Sep 17 00:00:00 2001 -From: Dmitry Torokhov -Date: Mon, 5 May 2025 15:49:59 -0700 -Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Dmitry Torokhov - -commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 upstream. - -Sysfs interface for updating firmware for RMI devices is available even -when F34 probe fails. The code checks for presence of F34 "container" -pointer and then tries to use the function data attached to the -sub-device. F34 assigns the function data early, before it knows if -probe will succeed, leaving behind a stale pointer. - -Fix this by expanding checks to not only test for presence of F34 -"container" but also check if there is driver data assigned to the -sub-device, and call dev_set_drvdata() only after we are certain that -probe is successful. - -This is not a complete fix, since F34 will be freed during firmware -update, so there is still a race when fetching and accessing this -pointer. This race will be addressed in follow-up changes. - -Reported-by: Hanno Böck -Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com -Signed-off-by: Dmitry Torokhov -Signed-off-by: Greg Kroah-Hartman ---- - drivers/input/rmi4/rmi_f34.c | 133 ++++++++++++++++++++++++------------------- - 1 file changed, 75 insertions(+), 58 deletions(-) - ---- a/drivers/input/rmi4/rmi_f34.c -+++ b/drivers/input/rmi4/rmi_f34.c -@@ -4,6 +4,7 @@ - * Copyright (C) 2016 Zodiac Inflight Innovations - */ - -+#include "linux/device.h" - #include - #include - #include -@@ -298,39 +299,30 @@ out: - return ret; - } - --static int rmi_f34_status(struct rmi_function *fn) --{ -- struct f34_data *f34 = dev_get_drvdata(&fn->dev); -- -- /* -- * The status is the percentage complete, or once complete, -- * zero for success or a negative return code. -- */ -- return f34->update_status; --} -- - static ssize_t rmi_driver_bootloader_id_show(struct device *dev, - struct device_attribute *dattr, - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- struct rmi_function *fn = data->f34_container; -+ struct rmi_function *fn; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- if (f34->bl_version == 5) -- return sysfs_emit(buf, "%c%c\n", -- f34->bootloader_id[0], -- f34->bootloader_id[1]); -- else -- return sysfs_emit(buf, "V%d.%d\n", -- f34->bootloader_id[1], -- f34->bootloader_id[0]); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ if (f34->bl_version == 5) -+ return sysfs_emit(buf, "%c%c\n", -+ f34->bootloader_id[0], -+ f34->bootloader_id[1]); -+ else -+ return sysfs_emit(buf, "V%d.%d\n", -+ f34->bootloader_id[1], -+ f34->bootloader_id[0]); - } - - static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL); -@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_ - struct rmi_function *fn = data->f34_container; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- return sysfs_emit(buf, "%s\n", f34->configuration_id); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ -+ return sysfs_emit(buf, "%s\n", f34->configuration_id); - } - - static DEVICE_ATTR(configuration_id, 0444, -@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rm - - if (!data->f34_container) { - dev_warn(dev, "%s: No F34 present!\n", __func__); -- return -EINVAL; -+ return -ENODEV; - } - - f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (!f34) { -+ dev_warn(dev, "%s: No valid F34 present!\n", __func__); -+ return -ENODEV; -+ } - - if (f34->bl_version >= 7) { - if (data->pdt_props & HAS_BSR) { -@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_stat - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- int update_status = 0; -+ struct f34_data *f34; -+ int update_status = -ENODEV; - -- if (data->f34_container) -- update_status = rmi_f34_status(data->f34_container); -+ /* -+ * The status is the percentage complete, or once complete, -+ * zero for success or a negative return code. -+ */ -+ if (data->f34_container) { -+ f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (f34) -+ update_status = f34->update_status; -+ } - - return sysfs_emit(buf, "%d\n", update_status); - } -@@ -517,33 +524,21 @@ static const struct attribute_group rmi_ - .attrs = rmi_firmware_attrs, - }; - --static int rmi_f34_probe(struct rmi_function *fn) -+static int rmi_f34v5_probe(struct f34_data *f34) - { -- struct f34_data *f34; -- unsigned char f34_queries[9]; -+ struct rmi_function *fn = f34->fn; -+ u8 f34_queries[9]; - bool has_config_id; -- u8 version = fn->fd.function_version; -- int ret; -- -- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -- if (!f34) -- return -ENOMEM; -- -- f34->fn = fn; -- dev_set_drvdata(&fn->dev, f34); -- -- /* v5 code only supported version 0, try V7 probe */ -- if (version > 0) -- return rmi_f34v7_probe(f34); -+ int error; - - f34->bl_version = 5; - -- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "%s: Failed to query properties\n", - __func__); -- return ret; -+ return error; - } - - snprintf(f34->bootloader_id, sizeof(f34->bootloader_id), -@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_func - f34->v5.config_blocks); - - if (has_config_id) { -- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "Failed to read F34 config ID\n"); -- return ret; -+ return error; - } - - snprintf(f34->configuration_id, sizeof(f34->configuration_id), -@@ -582,11 +577,33 @@ static int rmi_f34_probe(struct rmi_func - f34_queries[2], f34_queries[3]); - - rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n", -- f34->configuration_id); -+ f34->configuration_id); - } - - return 0; - } -+ -+static int rmi_f34_probe(struct rmi_function *fn) -+{ -+ struct f34_data *f34; -+ u8 version = fn->fd.function_version; -+ int error; -+ -+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -+ if (!f34) -+ return -ENOMEM; -+ -+ f34->fn = fn; -+ -+ /* v5 code only supported version 0 */ -+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34); -+ if (error) -+ return error; -+ -+ dev_set_drvdata(&fn->dev, f34); -+ -+ return 0; -+} - - int rmi_f34_create_sysfs(struct rmi_device *rmi_dev) - { diff --git a/queue-6.12/series b/queue-6.12/series index b63ae5147e..9789447e77 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -469,7 +469,6 @@ arm64-zynqmp-add-clock-output-names-property-in-cloc.patch asoc-codecs-pcm3168a-allow-for-24-bit-in-provider-mo.patch asoc-rt722-sdca-add-some-missing-readable-registers.patch irqchip-riscv-aplic-add-support-for-hart-indexes.patch -dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch dm-vdo-indexer-prevent-unterminated-string-warning.patch dm-vdo-use-a-short-static-string-for-thread-name-pre.patch drm-ast-find-vbios-mode-from-regular-display-size.patch @@ -593,7 +592,6 @@ arm64-dts-marvell-udpu-define-pinctrl-state-for-alarm-leds.patch smb-client-reset-all-search-buffer-pointers-when-releasing-buffer.patch revert-drm-amd-keep-display-off-while-going-into-s4.patch input-xpad-add-more-controllers.patch -input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch highmem-add-folio_test_partial_kmap.patch memcg-always-call-cond_resched-after-fn.patch mm-page_alloc.c-avoid-infinite-retries-caused-by-cpuset-race.patch diff --git a/queue-6.14/dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch b/queue-6.14/dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch deleted file mode 100644 index 0d641519b1..0000000000 --- a/queue-6.14/dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch +++ /dev/null @@ -1,208 +0,0 @@ -From 921200c5e2f6a07ad93419d800d6a1a2fbf7abc7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 31 Jan 2025 21:18:05 -0500 -Subject: dm vdo vio-pool: allow variable-sized metadata vios - -From: Ken Raeburn - -[ Upstream commit f979da512553a41a657f2c1198277e84d66f8ce3 ] - -With larger-sized metadata vio pools, vdo will sometimes need to -issue I/O with a smaller size than the allocated size. Since -vio_reset_bio is where the bvec array and I/O size are initialized, -this reset interface must now specify what I/O size to use. - -Signed-off-by: Ken Raeburn -Signed-off-by: Matthew Sakai -Signed-off-by: Mikulas Patocka -Signed-off-by: Sasha Levin ---- - drivers/md/dm-vdo/io-submitter.c | 6 ++++-- - drivers/md/dm-vdo/io-submitter.h | 18 +++++++++++++--- - drivers/md/dm-vdo/types.h | 3 +++ - drivers/md/dm-vdo/vio.c | 36 +++++++++++++++++++------------- - drivers/md/dm-vdo/vio.h | 2 ++ - 5 files changed, 46 insertions(+), 19 deletions(-) - -diff --git a/drivers/md/dm-vdo/io-submitter.c b/drivers/md/dm-vdo/io-submitter.c -index 421e5436c32c9..11d47770b54d2 100644 ---- a/drivers/md/dm-vdo/io-submitter.c -+++ b/drivers/md/dm-vdo/io-submitter.c -@@ -327,6 +327,7 @@ void vdo_submit_data_vio(struct data_vio *data_vio) - * @error_handler: the handler for submission or I/O errors (may be NULL) - * @operation: the type of I/O to perform - * @data: the buffer to read or write (may be NULL) -+ * @size: the I/O amount in bytes - * - * The vio is enqueued on a vdo bio queue so that bio submission (which may block) does not block - * other vdo threads. -@@ -338,7 +339,7 @@ void vdo_submit_data_vio(struct data_vio *data_vio) - */ - void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical, - bio_end_io_t callback, vdo_action_fn error_handler, -- blk_opf_t operation, char *data) -+ blk_opf_t operation, char *data, int size) - { - int result; - struct vdo_completion *completion = &vio->completion; -@@ -349,7 +350,8 @@ void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical, - - vdo_reset_completion(completion); - completion->error_handler = error_handler; -- result = vio_reset_bio(vio, data, callback, operation | REQ_META, physical); -+ result = vio_reset_bio_with_size(vio, data, size, callback, operation | REQ_META, -+ physical); - if (result != VDO_SUCCESS) { - continue_vio(vio, result); - return; -diff --git a/drivers/md/dm-vdo/io-submitter.h b/drivers/md/dm-vdo/io-submitter.h -index 80748699496f2..3088f11055fdd 100644 ---- a/drivers/md/dm-vdo/io-submitter.h -+++ b/drivers/md/dm-vdo/io-submitter.h -@@ -8,6 +8,7 @@ - - #include - -+#include "constants.h" - #include "types.h" - - struct io_submitter; -@@ -26,14 +27,25 @@ void vdo_submit_data_vio(struct data_vio *data_vio); - - void __submit_metadata_vio(struct vio *vio, physical_block_number_t physical, - bio_end_io_t callback, vdo_action_fn error_handler, -- blk_opf_t operation, char *data); -+ blk_opf_t operation, char *data, int size); - - static inline void vdo_submit_metadata_vio(struct vio *vio, physical_block_number_t physical, - bio_end_io_t callback, vdo_action_fn error_handler, - blk_opf_t operation) - { - __submit_metadata_vio(vio, physical, callback, error_handler, -- operation, vio->data); -+ operation, vio->data, vio->block_count * VDO_BLOCK_SIZE); -+} -+ -+static inline void vdo_submit_metadata_vio_with_size(struct vio *vio, -+ physical_block_number_t physical, -+ bio_end_io_t callback, -+ vdo_action_fn error_handler, -+ blk_opf_t operation, -+ int size) -+{ -+ __submit_metadata_vio(vio, physical, callback, error_handler, -+ operation, vio->data, size); - } - - static inline void vdo_submit_flush_vio(struct vio *vio, bio_end_io_t callback, -@@ -41,7 +53,7 @@ static inline void vdo_submit_flush_vio(struct vio *vio, bio_end_io_t callback, - { - /* FIXME: Can we just use REQ_OP_FLUSH? */ - __submit_metadata_vio(vio, 0, callback, error_handler, -- REQ_OP_WRITE | REQ_PREFLUSH, NULL); -+ REQ_OP_WRITE | REQ_PREFLUSH, NULL, 0); - } - - #endif /* VDO_IO_SUBMITTER_H */ -diff --git a/drivers/md/dm-vdo/types.h b/drivers/md/dm-vdo/types.h -index dbe892b10f265..cdf36e7d77021 100644 ---- a/drivers/md/dm-vdo/types.h -+++ b/drivers/md/dm-vdo/types.h -@@ -376,6 +376,9 @@ struct vio { - /* The size of this vio in blocks */ - unsigned int block_count; - -+ /* The amount of data to be read or written, in bytes */ -+ unsigned int io_size; -+ - /* The data being read or written. */ - char *data; - -diff --git a/drivers/md/dm-vdo/vio.c b/drivers/md/dm-vdo/vio.c -index e710f3c5a972d..725d87ecf2150 100644 ---- a/drivers/md/dm-vdo/vio.c -+++ b/drivers/md/dm-vdo/vio.c -@@ -188,14 +188,23 @@ void vdo_set_bio_properties(struct bio *bio, struct vio *vio, bio_end_io_t callb - - /* - * Prepares the bio to perform IO with the specified buffer. May only be used on a VDO-allocated -- * bio, as it assumes the bio wraps a 4k buffer that is 4k aligned, but there does not have to be a -- * vio associated with the bio. -+ * bio, as it assumes the bio wraps a 4k-multiple buffer that is 4k aligned, but there does not -+ * have to be a vio associated with the bio. - */ - int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback, - blk_opf_t bi_opf, physical_block_number_t pbn) - { -- int bvec_count, offset, len, i; -+ return vio_reset_bio_with_size(vio, data, vio->block_count * VDO_BLOCK_SIZE, -+ callback, bi_opf, pbn); -+} -+ -+int vio_reset_bio_with_size(struct vio *vio, char *data, int size, bio_end_io_t callback, -+ blk_opf_t bi_opf, physical_block_number_t pbn) -+{ -+ int bvec_count, offset, i; - struct bio *bio = vio->bio; -+ int vio_size = vio->block_count * VDO_BLOCK_SIZE; -+ int remaining; - - bio_reset(bio, bio->bi_bdev, bi_opf); - vdo_set_bio_properties(bio, vio, callback, bi_opf, pbn); -@@ -205,22 +214,21 @@ int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback, - bio->bi_ioprio = 0; - bio->bi_io_vec = bio->bi_inline_vecs; - bio->bi_max_vecs = vio->block_count + 1; -- len = VDO_BLOCK_SIZE * vio->block_count; -+ if (VDO_ASSERT(size <= vio_size, "specified size %d is not greater than allocated %d", -+ size, vio_size) != VDO_SUCCESS) -+ size = vio_size; -+ vio->io_size = size; - offset = offset_in_page(data); -- bvec_count = DIV_ROUND_UP(offset + len, PAGE_SIZE); -+ bvec_count = DIV_ROUND_UP(offset + size, PAGE_SIZE); -+ remaining = size; - -- /* -- * If we knew that data was always on one page, or contiguous pages, we wouldn't need the -- * loop. But if we're using vmalloc, it's not impossible that the data is in different -- * pages that can't be merged in bio_add_page... -- */ -- for (i = 0; (i < bvec_count) && (len > 0); i++) { -+ for (i = 0; (i < bvec_count) && (remaining > 0); i++) { - struct page *page; - int bytes_added; - int bytes = PAGE_SIZE - offset; - -- if (bytes > len) -- bytes = len; -+ if (bytes > remaining) -+ bytes = remaining; - - page = is_vmalloc_addr(data) ? vmalloc_to_page(data) : virt_to_page(data); - bytes_added = bio_add_page(bio, page, bytes, offset); -@@ -232,7 +240,7 @@ int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback, - } - - data += bytes; -- len -= bytes; -+ remaining -= bytes; - offset = 0; - } - -diff --git a/drivers/md/dm-vdo/vio.h b/drivers/md/dm-vdo/vio.h -index 3490e9f59b04a..74e8fd7c8c029 100644 ---- a/drivers/md/dm-vdo/vio.h -+++ b/drivers/md/dm-vdo/vio.h -@@ -123,6 +123,8 @@ void vdo_set_bio_properties(struct bio *bio, struct vio *vio, bio_end_io_t callb - - int vio_reset_bio(struct vio *vio, char *data, bio_end_io_t callback, - blk_opf_t bi_opf, physical_block_number_t pbn); -+int vio_reset_bio_with_size(struct vio *vio, char *data, int size, bio_end_io_t callback, -+ blk_opf_t bi_opf, physical_block_number_t pbn); - - void update_vio_error_stats(struct vio *vio, const char *format, ...) - __printf(2, 3); --- -2.39.5 - diff --git a/queue-6.14/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch b/queue-6.14/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch deleted file mode 100644 index 2d4e811d97..0000000000 --- a/queue-6.14/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch +++ /dev/null @@ -1,255 +0,0 @@ -From ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 Mon Sep 17 00:00:00 2001 -From: Dmitry Torokhov -Date: Mon, 5 May 2025 15:49:59 -0700 -Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Dmitry Torokhov - -commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 upstream. - -Sysfs interface for updating firmware for RMI devices is available even -when F34 probe fails. The code checks for presence of F34 "container" -pointer and then tries to use the function data attached to the -sub-device. F34 assigns the function data early, before it knows if -probe will succeed, leaving behind a stale pointer. - -Fix this by expanding checks to not only test for presence of F34 -"container" but also check if there is driver data assigned to the -sub-device, and call dev_set_drvdata() only after we are certain that -probe is successful. - -This is not a complete fix, since F34 will be freed during firmware -update, so there is still a race when fetching and accessing this -pointer. This race will be addressed in follow-up changes. - -Reported-by: Hanno Böck -Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com -Signed-off-by: Dmitry Torokhov -Signed-off-by: Greg Kroah-Hartman ---- - drivers/input/rmi4/rmi_f34.c | 133 ++++++++++++++++++++++++------------------- - 1 file changed, 75 insertions(+), 58 deletions(-) - ---- a/drivers/input/rmi4/rmi_f34.c -+++ b/drivers/input/rmi4/rmi_f34.c -@@ -4,6 +4,7 @@ - * Copyright (C) 2016 Zodiac Inflight Innovations - */ - -+#include "linux/device.h" - #include - #include - #include -@@ -289,39 +290,30 @@ static int rmi_f34_update_firmware(struc - return rmi_f34_flash_firmware(f34, syn_fw); - } - --static int rmi_f34_status(struct rmi_function *fn) --{ -- struct f34_data *f34 = dev_get_drvdata(&fn->dev); -- -- /* -- * The status is the percentage complete, or once complete, -- * zero for success or a negative return code. -- */ -- return f34->update_status; --} -- - static ssize_t rmi_driver_bootloader_id_show(struct device *dev, - struct device_attribute *dattr, - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- struct rmi_function *fn = data->f34_container; -+ struct rmi_function *fn; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- if (f34->bl_version == 5) -- return sysfs_emit(buf, "%c%c\n", -- f34->bootloader_id[0], -- f34->bootloader_id[1]); -- else -- return sysfs_emit(buf, "V%d.%d\n", -- f34->bootloader_id[1], -- f34->bootloader_id[0]); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ if (f34->bl_version == 5) -+ return sysfs_emit(buf, "%c%c\n", -+ f34->bootloader_id[0], -+ f34->bootloader_id[1]); -+ else -+ return sysfs_emit(buf, "V%d.%d\n", -+ f34->bootloader_id[1], -+ f34->bootloader_id[0]); - } - - static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL); -@@ -334,13 +326,16 @@ static ssize_t rmi_driver_configuration_ - struct rmi_function *fn = data->f34_container; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- return sysfs_emit(buf, "%s\n", f34->configuration_id); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ -+ return sysfs_emit(buf, "%s\n", f34->configuration_id); - } - - static DEVICE_ATTR(configuration_id, 0444, -@@ -356,10 +351,14 @@ static int rmi_firmware_update(struct rm - - if (!data->f34_container) { - dev_warn(dev, "%s: No F34 present!\n", __func__); -- return -EINVAL; -+ return -ENODEV; - } - - f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (!f34) { -+ dev_warn(dev, "%s: No valid F34 present!\n", __func__); -+ return -ENODEV; -+ } - - if (f34->bl_version >= 7) { - if (data->pdt_props & HAS_BSR) { -@@ -485,10 +484,18 @@ static ssize_t rmi_driver_update_fw_stat - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- int update_status = 0; -+ struct f34_data *f34; -+ int update_status = -ENODEV; - -- if (data->f34_container) -- update_status = rmi_f34_status(data->f34_container); -+ /* -+ * The status is the percentage complete, or once complete, -+ * zero for success or a negative return code. -+ */ -+ if (data->f34_container) { -+ f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (f34) -+ update_status = f34->update_status; -+ } - - return sysfs_emit(buf, "%d\n", update_status); - } -@@ -508,33 +515,21 @@ static const struct attribute_group rmi_ - .attrs = rmi_firmware_attrs, - }; - --static int rmi_f34_probe(struct rmi_function *fn) -+static int rmi_f34v5_probe(struct f34_data *f34) - { -- struct f34_data *f34; -- unsigned char f34_queries[9]; -+ struct rmi_function *fn = f34->fn; -+ u8 f34_queries[9]; - bool has_config_id; -- u8 version = fn->fd.function_version; -- int ret; -- -- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -- if (!f34) -- return -ENOMEM; -- -- f34->fn = fn; -- dev_set_drvdata(&fn->dev, f34); -- -- /* v5 code only supported version 0, try V7 probe */ -- if (version > 0) -- return rmi_f34v7_probe(f34); -+ int error; - - f34->bl_version = 5; - -- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "%s: Failed to query properties\n", - __func__); -- return ret; -+ return error; - } - - snprintf(f34->bootloader_id, sizeof(f34->bootloader_id), -@@ -560,11 +555,11 @@ static int rmi_f34_probe(struct rmi_func - f34->v5.config_blocks); - - if (has_config_id) { -- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "Failed to read F34 config ID\n"); -- return ret; -+ return error; - } - - snprintf(f34->configuration_id, sizeof(f34->configuration_id), -@@ -573,11 +568,33 @@ static int rmi_f34_probe(struct rmi_func - f34_queries[2], f34_queries[3]); - - rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n", -- f34->configuration_id); -+ f34->configuration_id); - } - - return 0; - } -+ -+static int rmi_f34_probe(struct rmi_function *fn) -+{ -+ struct f34_data *f34; -+ u8 version = fn->fd.function_version; -+ int error; -+ -+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -+ if (!f34) -+ return -ENOMEM; -+ -+ f34->fn = fn; -+ -+ /* v5 code only supported version 0 */ -+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34); -+ if (error) -+ return error; -+ -+ dev_set_drvdata(&fn->dev, f34); -+ -+ return 0; -+} - - int rmi_f34_create_sysfs(struct rmi_device *rmi_dev) - { diff --git a/queue-6.14/series b/queue-6.14/series index 7d2f116a75..22aa379e60 100644 --- a/queue-6.14/series +++ b/queue-6.14/series @@ -584,7 +584,6 @@ arm64-zynqmp-add-clock-output-names-property-in-cloc.patch asoc-codecs-pcm3168a-allow-for-24-bit-in-provider-mo.patch asoc-rt722-sdca-add-some-missing-readable-registers.patch irqchip-riscv-aplic-add-support-for-hart-indexes.patch -dm-vdo-vio-pool-allow-variable-sized-metadata-vios.patch dm-vdo-indexer-prevent-unterminated-string-warning.patch dm-vdo-use-a-short-static-string-for-thread-name-pre.patch drm-ast-find-vbios-mode-from-regular-display-size.patch @@ -746,7 +745,6 @@ arm64-dts-marvell-udpu-define-pinctrl-state-for-alarm-leds.patch smb-client-reset-all-search-buffer-pointers-when-releasing-buffer.patch revert-drm-amd-keep-display-off-while-going-into-s4.patch input-xpad-add-more-controllers.patch -input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch alloc_tag-allocate-percpu-counters-for-module-tags-dynamically.patch highmem-add-folio_test_partial_kmap.patch kasan-avoid-sleepable-page-allocation-from-atomic-context.patch diff --git a/queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch b/queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch deleted file mode 100644 index 78ef8db7f0..0000000000 --- a/queue-6.6/input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch +++ /dev/null @@ -1,255 +0,0 @@ -From ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 Mon Sep 17 00:00:00 2001 -From: Dmitry Torokhov -Date: Mon, 5 May 2025 15:49:59 -0700 -Subject: Input: synaptics-rmi - fix crash with unsupported versions of F34 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Dmitry Torokhov - -commit ca39500f6af9cfe6823dc5aa8fbaed788d6e35b2 upstream. - -Sysfs interface for updating firmware for RMI devices is available even -when F34 probe fails. The code checks for presence of F34 "container" -pointer and then tries to use the function data attached to the -sub-device. F34 assigns the function data early, before it knows if -probe will succeed, leaving behind a stale pointer. - -Fix this by expanding checks to not only test for presence of F34 -"container" but also check if there is driver data assigned to the -sub-device, and call dev_set_drvdata() only after we are certain that -probe is successful. - -This is not a complete fix, since F34 will be freed during firmware -update, so there is still a race when fetching and accessing this -pointer. This race will be addressed in follow-up changes. - -Reported-by: Hanno Böck -Fixes: 29fd0ec2bdbe ("Input: synaptics-rmi4 - add support for F34 device reflash") -Cc: stable@vger.kernel.org -Link: https://lore.kernel.org/r/aBlAl6sGulam-Qcx@google.com -Signed-off-by: Dmitry Torokhov -Signed-off-by: Greg Kroah-Hartman ---- - drivers/input/rmi4/rmi_f34.c | 133 ++++++++++++++++++++++++------------------- - 1 file changed, 75 insertions(+), 58 deletions(-) - ---- a/drivers/input/rmi4/rmi_f34.c -+++ b/drivers/input/rmi4/rmi_f34.c -@@ -4,6 +4,7 @@ - * Copyright (C) 2016 Zodiac Inflight Innovations - */ - -+#include "linux/device.h" - #include - #include - #include -@@ -298,39 +299,30 @@ out: - return ret; - } - --static int rmi_f34_status(struct rmi_function *fn) --{ -- struct f34_data *f34 = dev_get_drvdata(&fn->dev); -- -- /* -- * The status is the percentage complete, or once complete, -- * zero for success or a negative return code. -- */ -- return f34->update_status; --} -- - static ssize_t rmi_driver_bootloader_id_show(struct device *dev, - struct device_attribute *dattr, - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- struct rmi_function *fn = data->f34_container; -+ struct rmi_function *fn; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- if (f34->bl_version == 5) -- return sysfs_emit(buf, "%c%c\n", -- f34->bootloader_id[0], -- f34->bootloader_id[1]); -- else -- return sysfs_emit(buf, "V%d.%d\n", -- f34->bootloader_id[1], -- f34->bootloader_id[0]); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ if (f34->bl_version == 5) -+ return sysfs_emit(buf, "%c%c\n", -+ f34->bootloader_id[0], -+ f34->bootloader_id[1]); -+ else -+ return sysfs_emit(buf, "V%d.%d\n", -+ f34->bootloader_id[1], -+ f34->bootloader_id[0]); - } - - static DEVICE_ATTR(bootloader_id, 0444, rmi_driver_bootloader_id_show, NULL); -@@ -343,13 +335,16 @@ static ssize_t rmi_driver_configuration_ - struct rmi_function *fn = data->f34_container; - struct f34_data *f34; - -- if (fn) { -- f34 = dev_get_drvdata(&fn->dev); -+ fn = data->f34_container; -+ if (!fn) -+ return -ENODEV; - -- return sysfs_emit(buf, "%s\n", f34->configuration_id); -- } -+ f34 = dev_get_drvdata(&fn->dev); -+ if (!f34) -+ return -ENODEV; - -- return 0; -+ -+ return sysfs_emit(buf, "%s\n", f34->configuration_id); - } - - static DEVICE_ATTR(configuration_id, 0444, -@@ -365,10 +360,14 @@ static int rmi_firmware_update(struct rm - - if (!data->f34_container) { - dev_warn(dev, "%s: No F34 present!\n", __func__); -- return -EINVAL; -+ return -ENODEV; - } - - f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (!f34) { -+ dev_warn(dev, "%s: No valid F34 present!\n", __func__); -+ return -ENODEV; -+ } - - if (f34->bl_version >= 7) { - if (data->pdt_props & HAS_BSR) { -@@ -494,10 +493,18 @@ static ssize_t rmi_driver_update_fw_stat - char *buf) - { - struct rmi_driver_data *data = dev_get_drvdata(dev); -- int update_status = 0; -+ struct f34_data *f34; -+ int update_status = -ENODEV; - -- if (data->f34_container) -- update_status = rmi_f34_status(data->f34_container); -+ /* -+ * The status is the percentage complete, or once complete, -+ * zero for success or a negative return code. -+ */ -+ if (data->f34_container) { -+ f34 = dev_get_drvdata(&data->f34_container->dev); -+ if (f34) -+ update_status = f34->update_status; -+ } - - return sysfs_emit(buf, "%d\n", update_status); - } -@@ -517,33 +524,21 @@ static const struct attribute_group rmi_ - .attrs = rmi_firmware_attrs, - }; - --static int rmi_f34_probe(struct rmi_function *fn) -+static int rmi_f34v5_probe(struct f34_data *f34) - { -- struct f34_data *f34; -- unsigned char f34_queries[9]; -+ struct rmi_function *fn = f34->fn; -+ u8 f34_queries[9]; - bool has_config_id; -- u8 version = fn->fd.function_version; -- int ret; -- -- f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -- if (!f34) -- return -ENOMEM; -- -- f34->fn = fn; -- dev_set_drvdata(&fn->dev, f34); -- -- /* v5 code only supported version 0, try V7 probe */ -- if (version > 0) -- return rmi_f34v7_probe(f34); -+ int error; - - f34->bl_version = 5; - -- ret = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.query_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "%s: Failed to query properties\n", - __func__); -- return ret; -+ return error; - } - - snprintf(f34->bootloader_id, sizeof(f34->bootloader_id), -@@ -569,11 +564,11 @@ static int rmi_f34_probe(struct rmi_func - f34->v5.config_blocks); - - if (has_config_id) { -- ret = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -- f34_queries, sizeof(f34_queries)); -- if (ret) { -+ error = rmi_read_block(fn->rmi_dev, fn->fd.control_base_addr, -+ f34_queries, sizeof(f34_queries)); -+ if (error) { - dev_err(&fn->dev, "Failed to read F34 config ID\n"); -- return ret; -+ return error; - } - - snprintf(f34->configuration_id, sizeof(f34->configuration_id), -@@ -582,11 +577,33 @@ static int rmi_f34_probe(struct rmi_func - f34_queries[2], f34_queries[3]); - - rmi_dbg(RMI_DEBUG_FN, &fn->dev, "Configuration ID: %s\n", -- f34->configuration_id); -+ f34->configuration_id); - } - - return 0; - } -+ -+static int rmi_f34_probe(struct rmi_function *fn) -+{ -+ struct f34_data *f34; -+ u8 version = fn->fd.function_version; -+ int error; -+ -+ f34 = devm_kzalloc(&fn->dev, sizeof(struct f34_data), GFP_KERNEL); -+ if (!f34) -+ return -ENOMEM; -+ -+ f34->fn = fn; -+ -+ /* v5 code only supported version 0 */ -+ error = version == 0 ? rmi_f34v5_probe(f34) : rmi_f34v7_probe(f34); -+ if (error) -+ return error; -+ -+ dev_set_drvdata(&fn->dev, f34); -+ -+ return 0; -+} - - int rmi_f34_create_sysfs(struct rmi_device *rmi_dev) - { diff --git a/queue-6.6/series b/queue-6.6/series index 3367fb4c90..07a569d762 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -373,7 +373,6 @@ arm64-dts-marvell-udpu-define-pinctrl-state-for-alarm-leds.patch smb-client-reset-all-search-buffer-pointers-when-releasing-buffer.patch revert-drm-amd-keep-display-off-while-going-into-s4.patch input-xpad-add-more-controllers.patch -input-synaptics-rmi-fix-crash-with-unsupported-versions-of-f34.patch memcg-always-call-cond_resched-after-fn.patch mm-page_alloc.c-avoid-infinite-retries-caused-by-cpuset-race.patch revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch