From: Greg Kroah-Hartman Date: Fri, 20 Jun 2025 10:44:34 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.4.295~137 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=432d5d57ce14ad16c06d29aeb2aae5a2bbdce4e7;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: iio-adc-ad7606_spi-fix-reg-write-value-mask.patch iio-imu-inv_icm42600-fix-temperature-calculation.patch mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch --- diff --git a/queue-6.6/iio-adc-ad7606_spi-fix-reg-write-value-mask.patch b/queue-6.6/iio-adc-ad7606_spi-fix-reg-write-value-mask.patch new file mode 100644 index 0000000000..b9bb7e6e0c --- /dev/null +++ b/queue-6.6/iio-adc-ad7606_spi-fix-reg-write-value-mask.patch @@ -0,0 +1,35 @@ +From 89944d88f8795c6c89b9514cb365998145511cd4 Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Mon, 28 Apr 2025 20:55:34 -0500 +Subject: iio: adc: ad7606_spi: fix reg write value mask + +From: David Lechner + +commit 89944d88f8795c6c89b9514cb365998145511cd4 upstream. + +Fix incorrect value mask for register write. Register values are 8-bit, +not 9. If this function was called with a value > 0xFF and an even addr, +it would cause writing to the next register. + +Fixes: f2a22e1e172f ("iio: adc: ad7606: Add support for software mode for ad7616") +Signed-off-by: David Lechner +Reviewed-by: Angelo Dureghello +Link: https://patch.msgid.link/20250428-iio-adc-ad7606_spi-fix-write-value-mask-v1-1-a2d5e85a809f@baylibre.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7606_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7606_spi.c ++++ b/drivers/iio/adc/ad7606_spi.c +@@ -151,7 +151,7 @@ static int ad7606_spi_reg_write(struct a + struct spi_device *spi = to_spi_device(st->dev); + + st->d16[0] = cpu_to_be16((st->bops->rd_wr_cmd(addr, 1) << 8) | +- (val & 0x1FF)); ++ (val & 0xFF)); + + return spi_write(spi, &st->d16[0], sizeof(st->d16[0])); + } diff --git a/queue-6.6/iio-imu-inv_icm42600-fix-temperature-calculation.patch b/queue-6.6/iio-imu-inv_icm42600-fix-temperature-calculation.patch new file mode 100644 index 0000000000..f7475695dc --- /dev/null +++ b/queue-6.6/iio-imu-inv_icm42600-fix-temperature-calculation.patch @@ -0,0 +1,49 @@ +From e2f820014239df9360064079ae93f838ff3b7f8c Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Fri, 2 May 2025 11:37:26 +0200 +Subject: iio: imu: inv_icm42600: Fix temperature calculation + +From: Sean Nyekjaer + +commit e2f820014239df9360064079ae93f838ff3b7f8c upstream. + +>From the documentation: +"offset to be added to [Y]_raw prior toscaling by [Y]_scale" +Offset should be applied before multiplying scale, so divide offset by +scale to make this correct. + +Fixes: bc3eb0207fb5 ("iio: imu: inv_icm42600: add temperature sensor support") +Signed-off-by: Sean Nyekjaer +Acked-by: Jean-Baptiste Maneyrol +Link: https://patch.msgid.link/20250502-imu-v1-1-129b8391a4e3@geanix.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_temp.c +@@ -67,16 +67,18 @@ int inv_icm42600_temp_read_raw(struct ii + return IIO_VAL_INT; + /* + * T°C = (temp / 132.48) + 25 +- * Tm°C = 1000 * ((temp * 100 / 13248) + 25) ++ * Tm°C = 1000 * ((temp / 132.48) + 25) ++ * Tm°C = 7.548309 * temp + 25000 ++ * Tm°C = (temp + 3312) * 7.548309 + * scale: 100000 / 13248 ~= 7.548309 +- * offset: 25000 ++ * offset: 3312 + */ + case IIO_CHAN_INFO_SCALE: + *val = 7; + *val2 = 548309; + return IIO_VAL_INT_PLUS_MICRO; + case IIO_CHAN_INFO_OFFSET: +- *val = 25000; ++ *val = 3312; + return IIO_VAL_INT; + default: + return -EINVAL; diff --git a/queue-6.6/mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch b/queue-6.6/mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch new file mode 100644 index 0000000000..91c4e1ab69 --- /dev/null +++ b/queue-6.6/mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch @@ -0,0 +1,55 @@ +From 1013af4f585fccc4d3e5c5824d174de2257f7d6d Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Tue, 27 May 2025 23:23:54 +0200 +Subject: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race + +From: Jann Horn + +commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d upstream. + +huge_pmd_unshare() drops a reference on a page table that may have +previously been shared across processes, potentially turning it into a +normal page table used in another process in which unrelated VMAs can +afterwards be installed. + +If this happens in the middle of a concurrent gup_fast(), gup_fast() could +end up walking the page tables of another process. While I don't see any +way in which that immediately leads to kernel memory corruption, it is +really weird and unexpected. + +Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), +just like we do in khugepaged when removing page tables for a THP +collapse. + +Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-2-1329349bad1a@google.com +Link: https://lkml.kernel.org/r/20250527-hugetlb-fixes-splitrace-v1-2-f4136f5ec58a@google.com +Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") +Signed-off-by: Jann Horn +Reviewed-by: Lorenzo Stoakes +Cc: Liam Howlett +Cc: Muchun Song +Cc: Oscar Salvador +Cc: Vlastimil Babka +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/hugetlb.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -7062,6 +7062,13 @@ int huge_pmd_unshare(struct mm_struct *m + return 0; + + pud_clear(pud); ++ /* ++ * Once our caller drops the rmap lock, some other process might be ++ * using this page table as a normal, non-hugetlb page table. ++ * Wait for pending gup_fast() in other threads to finish before letting ++ * that happen. ++ */ ++ tlb_remove_table_sync_one(); + ptdesc_pmd_pts_dec(virt_to_ptdesc(ptep)); + mm_dec_nr_pmds(mm); + return 1; diff --git a/queue-6.6/series b/queue-6.6/series index 47097a92d9..5b2406d703 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -110,3 +110,6 @@ pci-add-acs-quirk-for-loongson-pcie.patch pci-fix-lock-symmetry-in-pci_slot_unlock.patch pci-dw-rockchip-fix-phy-function-call-sequence-in-rockchip_pcie_phy_deinit.patch iio-accel-fxls8962af-fix-temperature-scan-element-sign.patch +mm-hugetlb-fix-huge_pmd_unshare-vs-gup-fast-race.patch +iio-imu-inv_icm42600-fix-temperature-calculation.patch +iio-adc-ad7606_spi-fix-reg-write-value-mask.patch