From: Greg Kroah-Hartman Date: Sun, 2 Oct 2022 09:54:57 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.19.13~41 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=65315638c82a3b42d7f81ea6b712ba12f59c2e98;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: libata-add-ata_horkage_nolpm-for-pioneer-bdr-207m-and-bdr-205.patch mmc-moxart-fix-4-bit-bus-width-and-remove-8-bit-bus-width.patch ntfs-fix-bug_on-in-ntfs_lookup_inode_by_name.patch revert-net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs_lookup.patch --- diff --git a/queue-5.4/libata-add-ata_horkage_nolpm-for-pioneer-bdr-207m-and-bdr-205.patch b/queue-5.4/libata-add-ata_horkage_nolpm-for-pioneer-bdr-207m-and-bdr-205.patch new file mode 100644 index 00000000000..b986fe8da9d --- /dev/null +++ b/queue-5.4/libata-add-ata_horkage_nolpm-for-pioneer-bdr-207m-and-bdr-205.patch @@ -0,0 +1,58 @@ +From ea08aec7e77bfd6599489ec430f9f859ab84575a Mon Sep 17 00:00:00 2001 +From: Niklas Cassel +Date: Mon, 26 Sep 2022 18:38:09 +0000 +Subject: libata: add ATA_HORKAGE_NOLPM for Pioneer BDR-207M and BDR-205 + +From: Niklas Cassel + +commit ea08aec7e77bfd6599489ec430f9f859ab84575a upstream. + +Commit 1527f69204fe ("ata: ahci: Add Green Sardine vendor ID as +board_ahci_mobile") added an explicit entry for AMD Green Sardine +AHCI controller using the board_ahci_mobile configuration (this +configuration has later been renamed to board_ahci_low_power). + +The board_ahci_low_power configuration enables support for low power +modes. + +This explicit entry takes precedence over the generic AHCI controller +entry, which does not enable support for low power modes. + +Therefore, when commit 1527f69204fe ("ata: ahci: Add Green Sardine +vendor ID as board_ahci_mobile") was backported to stable kernels, +it make some Pioneer optical drives, which was working perfectly fine +before the commit was backported, stop working. + +The real problem is that the Pioneer optical drives do not handle low +power modes correctly. If these optical drives would have been tested +on another AHCI controller using the board_ahci_low_power configuration, +this issue would have been detected earlier. + +Unfortunately, the board_ahci_low_power configuration is only used in +less than 15% of the total AHCI controller entries, so many devices +have never been tested with an AHCI controller with low power modes. + +Fixes: 1527f69204fe ("ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile") +Cc: stable@vger.kernel.org +Reported-by: Jaap Berkhout +Signed-off-by: Niklas Cassel +Reviewed-by: Mario Limonciello +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4542,6 +4542,10 @@ static const struct ata_blacklist_entry + { "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER }, + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + ++ /* These specific Pioneer models have LPM issues */ ++ { "PIONEER BD-RW BDR-207M", NULL, ATA_HORKAGE_NOLPM }, ++ { "PIONEER BD-RW BDR-205", NULL, ATA_HORKAGE_NOLPM }, ++ + /* Crucial BX100 SSD 500GB has broken LPM support */ + { "CT500BX100SSD1", NULL, ATA_HORKAGE_NOLPM }, + diff --git a/queue-5.4/mmc-moxart-fix-4-bit-bus-width-and-remove-8-bit-bus-width.patch b/queue-5.4/mmc-moxart-fix-4-bit-bus-width-and-remove-8-bit-bus-width.patch new file mode 100644 index 00000000000..445177f829b --- /dev/null +++ b/queue-5.4/mmc-moxart-fix-4-bit-bus-width-and-remove-8-bit-bus-width.patch @@ -0,0 +1,75 @@ +From 35ca91d1338ae158f6dcc0de5d1e86197924ffda Mon Sep 17 00:00:00 2001 +From: Sergei Antonov +Date: Wed, 7 Sep 2022 23:57:53 +0300 +Subject: mmc: moxart: fix 4-bit bus width and remove 8-bit bus width + +From: Sergei Antonov + +commit 35ca91d1338ae158f6dcc0de5d1e86197924ffda upstream. + +According to the datasheet [1] at page 377, 4-bit bus width is turned on by +bit 2 of the Bus Width Register. Thus the current bitmask is wrong: define +BUS_WIDTH_4 BIT(1) + +BIT(1) does not work but BIT(2) works. This has been verified on real MOXA +hardware with FTSDC010 controller revision 1_6_0. + +The corrected value of BUS_WIDTH_4 mask collides with: define BUS_WIDTH_8 +BIT(2). Additionally, 8-bit bus width mode isn't supported according to the +datasheet, so let's remove the corresponding code. + +[1] +https://bitbucket.org/Kasreyn/mkrom-uc7112lx/src/master/documents/FIC8120_DS_v1.2.pdf + +Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver") +Signed-off-by: Sergei Antonov +Cc: Jonas Jensen +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220907205753.1577434-1-saproj@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/moxart-mmc.c | 17 +++-------------- + 1 file changed, 3 insertions(+), 14 deletions(-) + +--- a/drivers/mmc/host/moxart-mmc.c ++++ b/drivers/mmc/host/moxart-mmc.c +@@ -111,8 +111,8 @@ + #define CLK_DIV_MASK 0x7f + + /* REG_BUS_WIDTH */ +-#define BUS_WIDTH_8 BIT(2) +-#define BUS_WIDTH_4 BIT(1) ++#define BUS_WIDTH_4_SUPPORT BIT(3) ++#define BUS_WIDTH_4 BIT(2) + #define BUS_WIDTH_1 BIT(0) + + #define MMC_VDD_360 23 +@@ -527,9 +527,6 @@ static void moxart_set_ios(struct mmc_ho + case MMC_BUS_WIDTH_4: + writel(BUS_WIDTH_4, host->base + REG_BUS_WIDTH); + break; +- case MMC_BUS_WIDTH_8: +- writel(BUS_WIDTH_8, host->base + REG_BUS_WIDTH); +- break; + default: + writel(BUS_WIDTH_1, host->base + REG_BUS_WIDTH); + break; +@@ -646,16 +643,8 @@ static int moxart_probe(struct platform_ + dmaengine_slave_config(host->dma_chan_rx, &cfg); + } + +- switch ((readl(host->base + REG_BUS_WIDTH) >> 3) & 3) { +- case 1: ++ if (readl(host->base + REG_BUS_WIDTH) & BUS_WIDTH_4_SUPPORT) + mmc->caps |= MMC_CAP_4_BIT_DATA; +- break; +- case 2: +- mmc->caps |= MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA; +- break; +- default: +- break; +- } + + writel(0, host->base + REG_INTERRUPT_MASK); + diff --git a/queue-5.4/ntfs-fix-bug_on-in-ntfs_lookup_inode_by_name.patch b/queue-5.4/ntfs-fix-bug_on-in-ntfs_lookup_inode_by_name.patch new file mode 100644 index 00000000000..999ba3c5868 --- /dev/null +++ b/queue-5.4/ntfs-fix-bug_on-in-ntfs_lookup_inode_by_name.patch @@ -0,0 +1,81 @@ +From 1b513f613731e2afc05550e8070d79fac80c661e Mon Sep 17 00:00:00 2001 +From: ChenXiaoSong +Date: Tue, 9 Aug 2022 14:47:30 +0800 +Subject: ntfs: fix BUG_ON in ntfs_lookup_inode_by_name() + +From: ChenXiaoSong + +commit 1b513f613731e2afc05550e8070d79fac80c661e upstream. + +Syzkaller reported BUG_ON as follows: + +------------[ cut here ]------------ +kernel BUG at fs/ntfs/dir.c:86! +invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI +CPU: 3 PID: 758 Comm: a.out Not tainted 5.19.0-next-20220808 #5 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +RIP: 0010:ntfs_lookup_inode_by_name+0xd11/0x2d10 +Code: ff e9 b9 01 00 00 e8 1e fe d6 fe 48 8b 7d 98 49 8d 5d 07 e8 91 85 29 ff 48 c7 45 98 00 00 00 00 e9 5a fb ff ff e8 ff fd d6 fe <0f> 0b e8 f8 fd d6 fe 0f 0b e8 f1 fd d6 fe 48 8b b5 50 ff ff ff 4c +RSP: 0018:ffff888079607978 EFLAGS: 00010293 +RAX: 0000000000000000 RBX: 0000000000008000 RCX: 0000000000000000 +RDX: ffff88807cf10000 RSI: ffffffff82a4a081 RDI: 0000000000000003 +RBP: ffff888079607a70 R08: 0000000000000001 R09: ffff88807a6d01d7 +R10: ffffed100f4da03a R11: 0000000000000000 R12: ffff88800f0fb110 +R13: ffff88800f0ee000 R14: ffff88800f0fb000 R15: 0000000000000001 +FS: 00007f33b63c7540(0000) GS:ffff888108580000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f33b635c090 CR3: 000000000f39e005 CR4: 0000000000770ee0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + + load_system_files+0x1f7f/0x3620 + ntfs_fill_super+0xa01/0x1be0 + mount_bdev+0x36a/0x440 + ntfs_mount+0x3a/0x50 + legacy_get_tree+0xfb/0x210 + vfs_get_tree+0x8f/0x2f0 + do_new_mount+0x30a/0x760 + path_mount+0x4de/0x1880 + __x64_sys_mount+0x2b3/0x340 + do_syscall_64+0x38/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f33b62ff9ea +Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48 +RSP: 002b:00007ffd0c471aa8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f33b62ff9ea +RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffd0c471be0 +RBP: 00007ffd0c471c60 R08: 00007ffd0c471ae0 R09: 00007ffd0c471c24 +R10: 0000000000000000 R11: 0000000000000202 R12: 000055bac5afc160 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + +Modules linked in: +---[ end trace 0000000000000000 ]--- + +Fix this by adding sanity check on extended system files' directory inode +to ensure that it is directory, just like ntfs_extend_init() when mounting +ntfs3. + +Link: https://lkml.kernel.org/r/20220809064730.2316892-1-chenxiaosong2@huawei.com +Signed-off-by: ChenXiaoSong +Cc: Anton Altaparmakov +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/ntfs/super.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/ntfs/super.c ++++ b/fs/ntfs/super.c +@@ -2092,7 +2092,8 @@ get_ctx_vol_failed: + // TODO: Initialize security. + /* Get the extended system files' directory inode. */ + vol->extend_ino = ntfs_iget(sb, FILE_Extend); +- if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino)) { ++ if (IS_ERR(vol->extend_ino) || is_bad_inode(vol->extend_ino) || ++ !S_ISDIR(vol->extend_ino->i_mode)) { + if (!IS_ERR(vol->extend_ino)) + iput(vol->extend_ino); + ntfs_error(sb, "Failed to load $Extend."); diff --git a/queue-5.4/revert-net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs_lookup.patch b/queue-5.4/revert-net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs_lookup.patch new file mode 100644 index 00000000000..dd8f5b53713 --- /dev/null +++ b/queue-5.4/revert-net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs_lookup.patch @@ -0,0 +1,54 @@ +From 6052a4c11fd893234e085edf7bf2e00a33a79d4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Sep 2022 19:47:36 -0400 +Subject: Revert "net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()" + +From: Sasha Levin + +commit 6052a4c11fd893234e085edf7bf2e00a33a79d4e upstream. + +This reverts commit fe2c9c61f668cde28dac2b188028c5299cedcc1e. + +On Tue, Sep 13, 2022 at 05:48:58PM +0100, Russell King (Oracle) wrote: +>What happens if this is built as a module, and the module is loaded, +>binds (and creates the directory), then is removed, and then re- +>inserted? Nothing removes the old directory, so doesn't +>debugfs_create_dir() fail, resulting in subsequent failure to add +>any subsequent debugfs entries? +> +>I don't think this patch should be backported to stable trees until +>this point is addressed. + +Revert until a proper fix is available as the original behavior was +better. + +Cc: Marcin Wojtas +Cc: Eric Dumazet +Cc: Paolo Abeni +Cc: stable@kernel.org +Reported-by: Russell King +Fixes: fe2c9c61f668 ("net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()") +Signed-off-by: Sasha Levin +Reviewed-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20220923234736.657413-1-sashal@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +@@ -700,10 +700,10 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *p + + void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) + { +- static struct dentry *mvpp2_root; +- struct dentry *mvpp2_dir; ++ struct dentry *mvpp2_dir, *mvpp2_root; + int ret, i; + ++ mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL); + if (!mvpp2_root) + mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); + diff --git a/queue-5.4/series b/queue-5.4/series index 653fd694057..aad0a5717ab 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -4,3 +4,7 @@ uas-ignore-uas-for-thinkplus-chips.patch net-usb-qmi_wwan-add-new-usb-id-for-dell-branded-em7455.patch clk-ingenic-tcu-properly-enable-registers-before-accessing-timers.patch arm-dts-integrator-tag-pci-host-with-device_type.patch +ntfs-fix-bug_on-in-ntfs_lookup_inode_by_name.patch +revert-net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs_lookup.patch +libata-add-ata_horkage_nolpm-for-pioneer-bdr-207m-and-bdr-205.patch +mmc-moxart-fix-4-bit-bus-width-and-remove-8-bit-bus-width.patch