From: Greg Kroah-Hartman Date: Mon, 21 Oct 2024 07:40:26 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.10.228~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=65764e236a4f959ae173f30f20124237150b7959;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: blk-rq-qos-fix-crash-on-rq_qos_wait-vs.-rq_qos_wake_function-race.patch drm-amdgpu-prevent-bo_handles-error-from-being-overwritten.patch drm-amdgpu-swsmu-only-force-workload-setup-on-init.patch drm-radeon-fix-encoder-possible_clones.patch drm-vmwgfx-handle-surface-check-failure-correctly.patch iio-accel-kx022a-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch iio-adc-ti-ads124s08-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch iio-adc-ti-ads8688-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch iio-adc-ti-lmp92064-add-missing-select-regmap_spi-in-kconfig.patch iio-amplifiers-ada4250-add-missing-select-regmap_spi-in-kconfig.patch iio-dac-ad3552r-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch iio-dac-ad5766-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch iio-dac-ad5770r-add-missing-select-regmap_spi-in-kconfig.patch iio-dac-ltc1660-add-missing-select-regmap_spi-in-kconfig.patch iio-dac-stm32-dac-core-add-missing-select-regmap_mmio-in-kconfig.patch iio-frequency-adf4377-add-missing-select-remap_spi-in-kconfig.patch iio-hid-sensors-fix-an-error-handling-path-in-_hid_sensor_set_report_latency.patch iio-light-bu27008-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch iio-light-opt3001-add-missing-full-scale-range-value.patch iio-light-veml6030-fix-als-sensor-resolution.patch iio-light-veml6030-fix-iio-device-retrieval-from-embedded-device.patch iio-proximity-mb1232-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch input-xpad-add-support-for-msi-claw-a1m.patch io_uring-sqpoll-close-race-on-waiting-for-sqring-entries.patch scsi-ufs-core-fix-the-issue-of-icu-failure.patch scsi-ufs-core-set-sdev_offline-when-ufs-is-shut-down.patch selftest-hid-add-the-missing-tests-directory.patch ublk-don-t-allow-user-copy-for-unprivileged-device.patch --- diff --git a/queue-6.6/blk-rq-qos-fix-crash-on-rq_qos_wait-vs.-rq_qos_wake_function-race.patch b/queue-6.6/blk-rq-qos-fix-crash-on-rq_qos_wait-vs.-rq_qos_wake_function-race.patch new file mode 100644 index 00000000000..9c0d1bed8f1 --- /dev/null +++ b/queue-6.6/blk-rq-qos-fix-crash-on-rq_qos_wait-vs.-rq_qos_wake_function-race.patch @@ -0,0 +1,107 @@ +From e972b08b91ef48488bae9789f03cfedb148667fb Mon Sep 17 00:00:00 2001 +From: Omar Sandoval +Date: Tue, 15 Oct 2024 10:59:46 -0700 +Subject: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race + +From: Omar Sandoval + +commit e972b08b91ef48488bae9789f03cfedb148667fb upstream. + +We're seeing crashes from rq_qos_wake_function that look like this: + + BUG: unable to handle page fault for address: ffffafe180a40084 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD 100000067 P4D 100000067 PUD 10027c067 PMD 10115d067 PTE 0 + Oops: Oops: 0002 [#1] PREEMPT SMP PTI + CPU: 17 UID: 0 PID: 0 Comm: swapper/17 Not tainted 6.12.0-rc3-00013-geca631b8fe80 #11 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 + RIP: 0010:_raw_spin_lock_irqsave+0x1d/0x40 + Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 9c 41 5c fa 65 ff 05 62 97 30 4c 31 c0 ba 01 00 00 00 0f b1 17 75 0a 4c 89 e0 41 5c c3 cc cc cc cc 89 c6 e8 2c 0b 00 + RSP: 0018:ffffafe180580ca0 EFLAGS: 00010046 + RAX: 0000000000000000 RBX: ffffafe180a3f7a8 RCX: 0000000000000011 + RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffffafe180a40084 + RBP: 0000000000000000 R08: 00000000001e7240 R09: 0000000000000011 + R10: 0000000000000028 R11: 0000000000000888 R12: 0000000000000002 + R13: ffffafe180a40084 R14: 0000000000000000 R15: 0000000000000003 + FS: 0000000000000000(0000) GS:ffff9aaf1f280000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffafe180a40084 CR3: 000000010e428002 CR4: 0000000000770ef0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + PKRU: 55555554 + Call Trace: + + try_to_wake_up+0x5a/0x6a0 + rq_qos_wake_function+0x71/0x80 + __wake_up_common+0x75/0xa0 + __wake_up+0x36/0x60 + scale_up.part.0+0x50/0x110 + wb_timer_fn+0x227/0x450 + ... + +So rq_qos_wake_function() calls wake_up_process(data->task), which calls +try_to_wake_up(), which faults in raw_spin_lock_irqsave(&p->pi_lock). + +p comes from data->task, and data comes from the waitqueue entry, which +is stored on the waiter's stack in rq_qos_wait(). Analyzing the core +dump with drgn, I found that the waiter had already woken up and moved +on to a completely unrelated code path, clobbering what was previously +data->task. Meanwhile, the waker was passing the clobbered garbage in +data->task to wake_up_process(), leading to the crash. + +What's happening is that in between rq_qos_wake_function() deleting the +waitqueue entry and calling wake_up_process(), rq_qos_wait() is finding +that it already got a token and returning. The race looks like this: + +rq_qos_wait() rq_qos_wake_function() +============================================================== +prepare_to_wait_exclusive() + data->got_token = true; + list_del_init(&curr->entry); +if (data.got_token) + break; +finish_wait(&rqw->wait, &data.wq); + ^- returns immediately because + list_empty_careful(&wq_entry->entry) + is true +... return, go do something else ... + wake_up_process(data->task) + (NO LONGER VALID!)-^ + +Normally, finish_wait() is supposed to synchronize against the waker. +But, as noted above, it is returning immediately because the waitqueue +entry has already been removed from the waitqueue. + +The bug is that rq_qos_wake_function() is accessing the waitqueue entry +AFTER deleting it. Note that autoremove_wake_function() wakes the waiter +and THEN deletes the waitqueue entry, which is the proper order. + +Fix it by swapping the order. We also need to use +list_del_init_careful() to match the list_empty_careful() in +finish_wait(). + +Fixes: 38cfb5a45ee0 ("blk-wbt: improve waking of tasks") +Cc: stable@vger.kernel.org +Signed-off-by: Omar Sandoval +Acked-by: Tejun Heo +Reviewed-by: Johannes Thumshirn +Link: https://lore.kernel.org/r/d3bee2463a67b1ee597211823bf7ad3721c26e41.1729014591.git.osandov@fb.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-rq-qos.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/block/blk-rq-qos.c ++++ b/block/blk-rq-qos.c +@@ -219,8 +219,8 @@ static int rq_qos_wake_function(struct w + + data->got_token = true; + smp_wmb(); +- list_del_init(&curr->entry); + wake_up_process(data->task); ++ list_del_init_careful(&curr->entry); + return 1; + } + diff --git a/queue-6.6/drm-amdgpu-prevent-bo_handles-error-from-being-overwritten.patch b/queue-6.6/drm-amdgpu-prevent-bo_handles-error-from-being-overwritten.patch new file mode 100644 index 00000000000..4940c0d82c1 --- /dev/null +++ b/queue-6.6/drm-amdgpu-prevent-bo_handles-error-from-being-overwritten.patch @@ -0,0 +1,40 @@ +From c0ec082f10b7a1fd25e8c1e2a686440da913b7a3 Mon Sep 17 00:00:00 2001 +From: Mohammed Anees +Date: Wed, 9 Oct 2024 17:58:31 +0530 +Subject: drm/amdgpu: prevent BO_HANDLES error from being overwritten +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mohammed Anees + +commit c0ec082f10b7a1fd25e8c1e2a686440da913b7a3 upstream. + +Before this patch, if multiple BO_HANDLES chunks were submitted, +the error -EINVAL would be correctly set but could be overwritten +by the return value from amdgpu_cs_p1_bo_handles(). This patch +ensures that if there are multiple BO_HANDLES, we stop. + +Fixes: fec5f8e8c6bc ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") +Signed-off-by: Mohammed Anees +Reviewed-by: Christian König +Signed-off-by: Pierre-Eric Pelloux-Prayer +Signed-off-by: Alex Deucher +(cherry picked from commit 40f2cd98828f454bdc5006ad3d94330a5ea164b7) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -265,7 +265,7 @@ static int amdgpu_cs_pass1(struct amdgpu + + /* Only a single BO list is allowed to simplify handling. */ + if (p->bo_list) +- ret = -EINVAL; ++ goto free_partial_kdata; + + ret = amdgpu_cs_p1_bo_handles(p, p->chunks[i].kdata); + if (ret) diff --git a/queue-6.6/drm-amdgpu-swsmu-only-force-workload-setup-on-init.patch b/queue-6.6/drm-amdgpu-swsmu-only-force-workload-setup-on-init.patch new file mode 100644 index 00000000000..8bc3c913f40 --- /dev/null +++ b/queue-6.6/drm-amdgpu-swsmu-only-force-workload-setup-on-init.patch @@ -0,0 +1,53 @@ +From cb07c8338fc2b9d5f949a19d4a07ee4d5ecf8793 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 2 Oct 2024 10:22:30 -0400 +Subject: drm/amdgpu/swsmu: Only force workload setup on init + +From: Alex Deucher + +commit cb07c8338fc2b9d5f949a19d4a07ee4d5ecf8793 upstream. + +Needed to set the workload type at init time so that +we can apply the navi3x margin optimization. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3618 +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3131 +Fixes: c50fe289ed72 ("drm/amdgpu/swsmu: always force a state reprogram on init") +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +(cherry picked from commit 580ad7cbd4b7be8d2cb5ab5c1fca6bb76045eb0e) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -1843,7 +1843,7 @@ static int smu_bump_power_profile_mode(s + static int smu_adjust_power_state_dynamic(struct smu_context *smu, + enum amd_dpm_forced_level level, + bool skip_display_settings, +- bool force_update) ++ bool init) + { + int ret = 0; + int index = 0; +@@ -1872,7 +1872,7 @@ static int smu_adjust_power_state_dynami + } + } + +- if (force_update || smu_dpm_ctx->dpm_level != level) { ++ if (smu_dpm_ctx->dpm_level != level) { + ret = smu_asic_set_performance_level(smu, level); + if (ret) { + dev_err(smu->adev->dev, "Failed to set performance level!"); +@@ -1889,7 +1889,7 @@ static int smu_adjust_power_state_dynami + index = index > 0 && index <= WORKLOAD_POLICY_MAX ? index - 1 : 0; + workload[0] = smu->workload_setting[index]; + +- if (force_update || smu->power_profile_mode != workload[0]) ++ if (init || smu->power_profile_mode != workload[0]) + smu_bump_power_profile_mode(smu, workload, 0); + } + diff --git a/queue-6.6/drm-radeon-fix-encoder-possible_clones.patch b/queue-6.6/drm-radeon-fix-encoder-possible_clones.patch new file mode 100644 index 00000000000..d4fc178cc1c --- /dev/null +++ b/queue-6.6/drm-radeon-fix-encoder-possible_clones.patch @@ -0,0 +1,50 @@ +From 28127dba64d8ae1a0b737b973d6d029908599611 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Mon, 14 Oct 2024 19:09:36 +0300 +Subject: drm/radeon: Fix encoder->possible_clones +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 28127dba64d8ae1a0b737b973d6d029908599611 upstream. + +Include the encoder itself in its possible_clones bitmask. +In the past nothing validated that drivers were populating +possible_clones correctly, but that changed in commit +74d2aacbe840 ("drm: Validate encoder->possible_clones"). +Looks like radeon never got the memo and is still not +following the rules 100% correctly. + +This results in some warnings during driver initialization: +Bogus possible_clones: [ENCODER:46:TV-46] possible_clones=0x4 (full encoder mask=0x7) +WARNING: CPU: 0 PID: 170 at drivers/gpu/drm/drm_mode_config.c:615 drm_mode_config_validate+0x113/0x39c +... + +Cc: Alex Deucher +Cc: amd-gfx@lists.freedesktop.org +Fixes: 74d2aacbe840 ("drm: Validate encoder->possible_clones") +Reported-by: Erhard Furtner +Closes: https://lore.kernel.org/dri-devel/20241009000321.418e4294@yea/ +Tested-by: Erhard Furtner +Signed-off-by: Ville Syrjälä +Signed-off-by: Alex Deucher +(cherry picked from commit 3b6e7d40649c0d75572039aff9d0911864c689db) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_encoders.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_encoders.c ++++ b/drivers/gpu/drm/radeon/radeon_encoders.c +@@ -42,7 +42,7 @@ static uint32_t radeon_encoder_clones(st + struct radeon_device *rdev = dev->dev_private; + struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); + struct drm_encoder *clone_encoder; +- uint32_t index_mask = 0; ++ uint32_t index_mask = drm_encoder_mask(encoder); + int count; + + /* DIG routing gets problematic */ diff --git a/queue-6.6/drm-vmwgfx-handle-surface-check-failure-correctly.patch b/queue-6.6/drm-vmwgfx-handle-surface-check-failure-correctly.patch new file mode 100644 index 00000000000..f791ff2037d --- /dev/null +++ b/queue-6.6/drm-vmwgfx-handle-surface-check-failure-correctly.patch @@ -0,0 +1,37 @@ +From 26498b8d54373d31a621d7dec95c4bd842563b3b Mon Sep 17 00:00:00 2001 +From: Nikolay Kuratov +Date: Wed, 2 Oct 2024 15:24:29 +0300 +Subject: drm/vmwgfx: Handle surface check failure correctly + +From: Nikolay Kuratov + +commit 26498b8d54373d31a621d7dec95c4bd842563b3b upstream. + +Currently if condition (!bo and !vmw_kms_srf_ok()) was met +we go to err_out with ret == 0. +err_out dereferences vfb if ret == 0, but in our case vfb is still NULL. + +Fix this by assigning sensible error to ret. + +Found by Linux Verification Center (linuxtesting.org) with SVACE + +Signed-off-by: Nikolay Kuratov +Cc: stable@vger.kernel.org +Fixes: 810b3e1683d0 ("drm/vmwgfx: Support topology greater than texture size") +Signed-off-by: Zack Rusin +Link: https://patchwork.freedesktop.org/patch/msgid/20241002122429.1981822-1-kniv@yandex-team.ru +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -1659,6 +1659,7 @@ static struct drm_framebuffer *vmw_kms_f + DRM_ERROR("Surface size cannot exceed %dx%d\n", + dev_priv->texture_max_width, + dev_priv->texture_max_height); ++ ret = -EINVAL; + goto err_out; + } + diff --git a/queue-6.6/iio-accel-kx022a-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch b/queue-6.6/iio-accel-kx022a-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch new file mode 100644 index 00000000000..c7ee66f2318 --- /dev/null +++ b/queue-6.6/iio-accel-kx022a-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch @@ -0,0 +1,36 @@ +From 96666f05d11acf0370cedca17a4c3ab6f9554b35 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 23:04:47 +0200 +Subject: iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig + +From: Javier Carrasco + +commit 96666f05d11acf0370cedca17a4c3ab6f9554b35 upstream. + +This driver makes use of triggered buffers, but does not select the +required modules. + +Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'. + +Fixes: 7c1d1677b322 ("iio: accel: Support Kionix/ROHM KX022A accelerometer") +Signed-off-by: Javier Carrasco +Acked-by: Matti Vaittinen +Link: https://patch.msgid.link/20241003-iio-select-v1-1-67c0385197cd@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/accel/Kconfig ++++ b/drivers/iio/accel/Kconfig +@@ -415,6 +415,8 @@ config IIO_ST_ACCEL_SPI_3AXIS + + config IIO_KX022A + tristate ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + + config IIO_KX022A_SPI + tristate "Kionix KX022A tri-axis digital accelerometer SPI interface" diff --git a/queue-6.6/iio-adc-ti-ads124s08-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch b/queue-6.6/iio-adc-ti-ads124s08-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch new file mode 100644 index 00000000000..edf5f68e756 --- /dev/null +++ b/queue-6.6/iio-adc-ti-ads124s08-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch @@ -0,0 +1,35 @@ +From eb143d05def52bc6d193e813018e5fa1a0e47c77 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 23:04:49 +0200 +Subject: iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig + +From: Javier Carrasco + +commit eb143d05def52bc6d193e813018e5fa1a0e47c77 upstream. + +This driver makes use of triggered buffers, but does not select the +required modules. + +Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'. + +Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-iio-select-v1-3-67c0385197cd@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -1298,6 +1298,8 @@ config TI_ADS8688 + config TI_ADS124S08 + tristate "Texas Instruments ADS124S08" + depends on SPI ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + help + If you say yes here you get support for Texas Instruments ADS124S08 + and ADS124S06 ADC chips diff --git a/queue-6.6/iio-adc-ti-ads8688-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch b/queue-6.6/iio-adc-ti-ads8688-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch new file mode 100644 index 00000000000..b391799116a --- /dev/null +++ b/queue-6.6/iio-adc-ti-ads8688-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch @@ -0,0 +1,36 @@ +From 4c4834fd8696a949d1b1f1c2c5b96e1ad2083b02 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 23:04:50 +0200 +Subject: iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig + +From: Javier Carrasco + +commit 4c4834fd8696a949d1b1f1c2c5b96e1ad2083b02 upstream. + +This driver makes use of triggered buffers, but does not select the +required modules. + +Fixes: 2a86487786b5 ("iio: adc: ti-ads8688: add trigger and buffer support") +Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'. + +Signed-off-by: Javier Carrasco +Reviewed-by: Sean Nyekjaer +Link: https://patch.msgid.link/20241003-iio-select-v1-4-67c0385197cd@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -1286,6 +1286,8 @@ config TI_ADS8344 + config TI_ADS8688 + tristate "Texas Instruments ADS8688" + depends on SPI ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + help + If you say yes here you get support for Texas Instruments ADS8684 and + and ADS8688 ADC chips diff --git a/queue-6.6/iio-adc-ti-lmp92064-add-missing-select-regmap_spi-in-kconfig.patch b/queue-6.6/iio-adc-ti-lmp92064-add-missing-select-regmap_spi-in-kconfig.patch new file mode 100644 index 00000000000..c569a1f73ec --- /dev/null +++ b/queue-6.6/iio-adc-ti-lmp92064-add-missing-select-regmap_spi-in-kconfig.patch @@ -0,0 +1,33 @@ +From f3fe8c52c580e99c6dc0c7859472ec48176af32d Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 23:04:51 +0200 +Subject: iio: adc: ti-lmp92064: add missing select REGMAP_SPI in Kconfig + +From: Javier Carrasco + +commit f3fe8c52c580e99c6dc0c7859472ec48176af32d upstream. + +This driver makes use of regmap_spi, but does not select the required +module. +Add the missing 'select REGMAP_SPI'. + +Fixes: 627198942641 ("iio: adc: add ADC driver for the TI LMP92064 controller") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-iio-select-v1-5-67c0385197cd@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -1332,6 +1332,7 @@ config TI_AM335X_ADC + config TI_LMP92064 + tristate "Texas Instruments LMP92064 ADC driver" + depends on SPI ++ select REGMAP_SPI + help + Say yes here to build support for the LMP92064 Precision Current and Voltage + sensor. diff --git a/queue-6.6/iio-amplifiers-ada4250-add-missing-select-regmap_spi-in-kconfig.patch b/queue-6.6/iio-amplifiers-ada4250-add-missing-select-regmap_spi-in-kconfig.patch new file mode 100644 index 00000000000..91d7fe2bb10 --- /dev/null +++ b/queue-6.6/iio-amplifiers-ada4250-add-missing-select-regmap_spi-in-kconfig.patch @@ -0,0 +1,33 @@ +From b7983033a10baa0d98784bb411b2679bfb207d9a Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 18:49:37 +0200 +Subject: iio: amplifiers: ada4250: add missing select REGMAP_SPI in Kconfig + +From: Javier Carrasco + +commit b7983033a10baa0d98784bb411b2679bfb207d9a upstream. + +This driver makes use of regmap_spi, but does not select the required +module. +Add the missing 'select REGMAP_SPI'. + +Fixes: 28b4c30bfa5f ("iio: amplifiers: ada4250: add support for ADA4250") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-ad2s1210-select-v1-5-4019453f8c33@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/amplifiers/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/amplifiers/Kconfig ++++ b/drivers/iio/amplifiers/Kconfig +@@ -27,6 +27,7 @@ config AD8366 + config ADA4250 + tristate "Analog Devices ADA4250 Instrumentation Amplifier" + depends on SPI ++ select REGMAP_SPI + help + Say yes here to build support for Analog Devices ADA4250 + SPI Amplifier's support. The driver provides direct access via diff --git a/queue-6.6/iio-dac-ad3552r-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch b/queue-6.6/iio-dac-ad3552r-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch new file mode 100644 index 00000000000..63c8116a419 --- /dev/null +++ b/queue-6.6/iio-dac-ad3552r-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch @@ -0,0 +1,35 @@ +From 5bede948670f447154df401458aef4e2fd446ba8 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 23:04:53 +0200 +Subject: iio: dac: ad3552r: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig + +From: Javier Carrasco + +commit 5bede948670f447154df401458aef4e2fd446ba8 upstream. + +This driver makes use of triggered buffers, but does not select the +required modules. + +Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'. + +Fixes: 8f2b54824b28 ("drivers:iio:dac: Add AD3552R driver support") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-iio-select-v1-7-67c0385197cd@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/dac/Kconfig ++++ b/drivers/iio/dac/Kconfig +@@ -9,6 +9,8 @@ menu "Digital to analog converters" + config AD3552R + tristate "Analog Devices AD3552R DAC driver" + depends on SPI_MASTER ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + help + Say yes here to build support for Analog Devices AD3552R + Digital to Analog Converter. diff --git a/queue-6.6/iio-dac-ad5766-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch b/queue-6.6/iio-dac-ad5766-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch new file mode 100644 index 00000000000..1833cf22833 --- /dev/null +++ b/queue-6.6/iio-dac-ad5766-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch @@ -0,0 +1,35 @@ +From 62ec3df342cca6a8eb7ed33fd4ac8d0fbfcb9391 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 23:04:54 +0200 +Subject: iio: dac: ad5766: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig + +From: Javier Carrasco + +commit 62ec3df342cca6a8eb7ed33fd4ac8d0fbfcb9391 upstream. + +This driver makes use of triggered buffers, but does not select the +required modules. + +Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'. + +Fixes: 885b9790c25a ("drivers:iio:dac:ad5766.c: Add trigger buffer") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-iio-select-v1-8-67c0385197cd@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/dac/Kconfig ++++ b/drivers/iio/dac/Kconfig +@@ -214,6 +214,8 @@ config AD5764 + config AD5766 + tristate "Analog Devices AD5766/AD5767 DAC driver" + depends on SPI_MASTER ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + help + Say yes here to build support for Analog Devices AD5766, AD5767 + Digital to Analog Converter. diff --git a/queue-6.6/iio-dac-ad5770r-add-missing-select-regmap_spi-in-kconfig.patch b/queue-6.6/iio-dac-ad5770r-add-missing-select-regmap_spi-in-kconfig.patch new file mode 100644 index 00000000000..f310a2d7b64 --- /dev/null +++ b/queue-6.6/iio-dac-ad5770r-add-missing-select-regmap_spi-in-kconfig.patch @@ -0,0 +1,33 @@ +From bcdab6f74c91cda19714354fd4e9e3ef3c9a78b3 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 18:49:38 +0200 +Subject: iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig + +From: Javier Carrasco + +commit bcdab6f74c91cda19714354fd4e9e3ef3c9a78b3 upstream. + +This driver makes use of regmap_spi, but does not select the required +module. +Add the missing 'select REGMAP_SPI'. + +Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-ad2s1210-select-v1-6-4019453f8c33@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/dac/Kconfig ++++ b/drivers/iio/dac/Kconfig +@@ -224,6 +224,7 @@ config AD5766 + config AD5770R + tristate "Analog Devices AD5770R IDAC driver" + depends on SPI_MASTER ++ select REGMAP_SPI + help + Say yes here to build support for Analog Devices AD5770R Digital to + Analog Converter. diff --git a/queue-6.6/iio-dac-ltc1660-add-missing-select-regmap_spi-in-kconfig.patch b/queue-6.6/iio-dac-ltc1660-add-missing-select-regmap_spi-in-kconfig.patch new file mode 100644 index 00000000000..6ebab96387e --- /dev/null +++ b/queue-6.6/iio-dac-ltc1660-add-missing-select-regmap_spi-in-kconfig.patch @@ -0,0 +1,33 @@ +From 252ff06a4cb4e572cb3c7fcfa697db96b08a7781 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 18:49:39 +0200 +Subject: iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig + +From: Javier Carrasco + +commit 252ff06a4cb4e572cb3c7fcfa697db96b08a7781 upstream. + +This driver makes use of regmap_spi, but does not select the required +module. +Add the missing 'select REGMAP_SPI'. + +Fixes: 8316cebd1e59 ("iio: dac: add support for ltc1660") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-ad2s1210-select-v1-7-4019453f8c33@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/dac/Kconfig ++++ b/drivers/iio/dac/Kconfig +@@ -316,6 +316,7 @@ config LPC18XX_DAC + config LTC1660 + tristate "Linear Technology LTC1660/LTC1665 DAC SPI driver" + depends on SPI ++ select REGMAP_SPI + help + Say yes here to build support for Linear Technology + LTC1660 and LTC1665 Digital to Analog Converters. diff --git a/queue-6.6/iio-dac-stm32-dac-core-add-missing-select-regmap_mmio-in-kconfig.patch b/queue-6.6/iio-dac-stm32-dac-core-add-missing-select-regmap_mmio-in-kconfig.patch new file mode 100644 index 00000000000..1f53d386402 --- /dev/null +++ b/queue-6.6/iio-dac-stm32-dac-core-add-missing-select-regmap_mmio-in-kconfig.patch @@ -0,0 +1,33 @@ +From 27b6aa68a68105086aef9f0cb541cd688e5edea8 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 18:49:40 +0200 +Subject: iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig + +From: Javier Carrasco + +commit 27b6aa68a68105086aef9f0cb541cd688e5edea8 upstream. + +This driver makes use of regmap_mmio, but does not select the required +module. +Add the missing 'select REGMAP_MMIO'. + +Fixes: 4d4b30526eb8 ("iio: dac: add support for stm32 DAC") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-ad2s1210-select-v1-8-4019453f8c33@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/dac/Kconfig ++++ b/drivers/iio/dac/Kconfig +@@ -426,6 +426,7 @@ config STM32_DAC + + config STM32_DAC_CORE + tristate ++ select REGMAP_MMIO + + config TI_DAC082S085 + tristate "Texas Instruments 8/10/12-bit 2/4-channel DAC driver" diff --git a/queue-6.6/iio-frequency-adf4377-add-missing-select-remap_spi-in-kconfig.patch b/queue-6.6/iio-frequency-adf4377-add-missing-select-remap_spi-in-kconfig.patch new file mode 100644 index 00000000000..9d13cf7020c --- /dev/null +++ b/queue-6.6/iio-frequency-adf4377-add-missing-select-remap_spi-in-kconfig.patch @@ -0,0 +1,33 @@ +From c64643ed4eaa5dfd0b3bab7ef1c50b84f3dbaba4 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 18:49:35 +0200 +Subject: iio: frequency: adf4377: add missing select REMAP_SPI in Kconfig + +From: Javier Carrasco + +commit c64643ed4eaa5dfd0b3bab7ef1c50b84f3dbaba4 upstream. + +This driver makes use of regmap_spi, but does not select the required +module. +Add the missing 'select REGMAP_SPI'. + +Fixes: eda549e2e524 ("iio: frequency: adf4377: add support for ADF4377") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-ad2s1210-select-v1-3-4019453f8c33@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/frequency/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/frequency/Kconfig ++++ b/drivers/iio/frequency/Kconfig +@@ -53,6 +53,7 @@ config ADF4371 + config ADF4377 + tristate "Analog Devices ADF4377 Microwave Wideband Synthesizer" + depends on SPI && COMMON_CLK ++ select REGMAP_SPI + help + Say yes here to build support for Analog Devices ADF4377 Microwave + Wideband Synthesizer. diff --git a/queue-6.6/iio-hid-sensors-fix-an-error-handling-path-in-_hid_sensor_set_report_latency.patch b/queue-6.6/iio-hid-sensors-fix-an-error-handling-path-in-_hid_sensor_set_report_latency.patch new file mode 100644 index 00000000000..18cc0ffa8ea --- /dev/null +++ b/queue-6.6/iio-hid-sensors-fix-an-error-handling-path-in-_hid_sensor_set_report_latency.patch @@ -0,0 +1,34 @@ +From 3a29b84cf7fbf912a6ab1b9c886746f02b74ea25 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Thu, 3 Oct 2024 20:41:12 +0200 +Subject: iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency() + +From: Christophe JAILLET + +commit 3a29b84cf7fbf912a6ab1b9c886746f02b74ea25 upstream. + +If hid_sensor_set_report_latency() fails, the error code should be returned +instead of a value likely to be interpreted as 'success'. + +Fixes: 138bc7969c24 ("iio: hid-sensor-hub: Implement batch mode") +Signed-off-by: Christophe JAILLET +Acked-by: Srinivas Pandruvada +Link: https://patch.msgid.link/c50640665f091a04086e5092cf50f73f2055107a.1727980825.git.christophe.jaillet@wanadoo.fr +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +@@ -32,7 +32,7 @@ static ssize_t _hid_sensor_set_report_la + latency = integer * 1000 + fract / 1000; + ret = hid_sensor_set_report_latency(attrb, latency); + if (ret < 0) +- return len; ++ return ret; + + attrb->latency_ms = hid_sensor_get_report_latency(attrb); + diff --git a/queue-6.6/iio-light-bu27008-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch b/queue-6.6/iio-light-bu27008-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch new file mode 100644 index 00000000000..4ffedc77c77 --- /dev/null +++ b/queue-6.6/iio-light-bu27008-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch @@ -0,0 +1,36 @@ +From aa99ef68eff5bc6df4959a372ae355b3b73f9930 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 23:04:56 +0200 +Subject: iio: light: bu27008: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig + +From: Javier Carrasco + +commit aa99ef68eff5bc6df4959a372ae355b3b73f9930 upstream. + +This driver makes use of triggered buffers, but does not select the +required modules. + +Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'. + +Fixes: 41ff93d14f78 ("iio: light: ROHM BU27008 color sensor") +Signed-off-by: Javier Carrasco +Acked-by: Matti Vaittinen +Link: https://patch.msgid.link/20241003-iio-select-v1-10-67c0385197cd@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/light/Kconfig ++++ b/drivers/iio/light/Kconfig +@@ -294,6 +294,8 @@ config ROHM_BU27008 + depends on I2C + select REGMAP_I2C + select IIO_GTS_HELPER ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + help + Enable support for the ROHM BU27008 color sensor. + The ROHM BU27008 is a sensor with 5 photodiodes (red, green, diff --git a/queue-6.6/iio-light-opt3001-add-missing-full-scale-range-value.patch b/queue-6.6/iio-light-opt3001-add-missing-full-scale-range-value.patch new file mode 100644 index 00000000000..d93bef2987b --- /dev/null +++ b/queue-6.6/iio-light-opt3001-add-missing-full-scale-range-value.patch @@ -0,0 +1,41 @@ +From 530688e39c644543b71bdd9cb45fdfb458a28eaa Mon Sep 17 00:00:00 2001 +From: Emil Gedenryd +Date: Fri, 13 Sep 2024 11:57:02 +0200 +Subject: iio: light: opt3001: add missing full-scale range value + +From: Emil Gedenryd + +commit 530688e39c644543b71bdd9cb45fdfb458a28eaa upstream. + +The opt3001 driver uses predetermined full-scale range values to +determine what exponent to use for event trigger threshold values. +The problem is that one of the values specified in the datasheet is +missing from the implementation. This causes larger values to be +scaled down to an incorrect exponent, effectively reducing the +maximum settable threshold value by a factor of 2. + +Add missing full-scale range array value. + +Fixes: 94a9b7b1809f ("iio: light: add support for TI's opt3001 light sensor") +Signed-off-by: Emil Gedenryd +Cc: +Link: https://patch.msgid.link/20240913-add_opt3002-v2-1-69e04f840360@axis.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/opt3001.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/iio/light/opt3001.c ++++ b/drivers/iio/light/opt3001.c +@@ -139,6 +139,10 @@ static const struct opt3001_scale opt300 + .val2 = 400000, + }, + { ++ .val = 41932, ++ .val2 = 800000, ++ }, ++ { + .val = 83865, + .val2 = 600000, + }, diff --git a/queue-6.6/iio-light-veml6030-fix-als-sensor-resolution.patch b/queue-6.6/iio-light-veml6030-fix-als-sensor-resolution.patch new file mode 100644 index 00000000000..e969fddff6a --- /dev/null +++ b/queue-6.6/iio-light-veml6030-fix-als-sensor-resolution.patch @@ -0,0 +1,41 @@ +From c9e9746f275c45108f2b0633a4855d65d9ae0736 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Mon, 23 Sep 2024 00:17:49 +0200 +Subject: iio: light: veml6030: fix ALS sensor resolution + +From: Javier Carrasco + +commit c9e9746f275c45108f2b0633a4855d65d9ae0736 upstream. + +The driver still uses the sensor resolution provided in the datasheet +until Rev. 1.6, 28-Apr-2022, which was updated with Rev 1.7, +28-Nov-2023. The original ambient light resolution has been updated from +0.0036 lx/ct to 0.0042 lx/ct, which is the value that can be found in +the current device datasheet. + +Update the default resolution for IT = 100 ms and GAIN = 1/8 from the +original 4608 mlux/cnt to the current value from the "Resolution and +maximum detection range" table (Application Note 84367, page 5), 5376 +mlux/cnt. + +Cc: +Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20240923-veml6035-v2-1-58c72a0df31c@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/veml6030.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/veml6030.c ++++ b/drivers/iio/light/veml6030.c +@@ -780,7 +780,7 @@ static int veml6030_hw_init(struct iio_d + + /* Cache currently active measurement parameters */ + data->cur_gain = 3; +- data->cur_resolution = 4608; ++ data->cur_resolution = 5376; + data->cur_integration_time = 3; + + return ret; diff --git a/queue-6.6/iio-light-veml6030-fix-iio-device-retrieval-from-embedded-device.patch b/queue-6.6/iio-light-veml6030-fix-iio-device-retrieval-from-embedded-device.patch new file mode 100644 index 00000000000..39668319df7 --- /dev/null +++ b/queue-6.6/iio-light-veml6030-fix-iio-device-retrieval-from-embedded-device.patch @@ -0,0 +1,45 @@ +From c7c44e57750c31de43906d97813273fdffcf7d02 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Fri, 13 Sep 2024 15:18:58 +0200 +Subject: iio: light: veml6030: fix IIO device retrieval from embedded device + +From: Javier Carrasco + +commit c7c44e57750c31de43906d97813273fdffcf7d02 upstream. + +The dev pointer that is received as an argument in the +in_illuminance_period_available_show function references the device +embedded in the IIO device, not in the i2c client. + +dev_to_iio_dev() must be used to accessthe right data. The current +implementation leads to a segmentation fault on every attempt to read +the attribute because indio_dev gets a NULL assignment. + +This bug has been present since the first appearance of the driver, +apparently since the last version (V6) before getting applied. A +constant attribute was used until then, and the last modifications might +have not been tested again. + +Cc: stable@vger.kernel.org +Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20240913-veml6035-v1-3-0b09c0c90418@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/veml6030.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/iio/light/veml6030.c ++++ b/drivers/iio/light/veml6030.c +@@ -99,9 +99,8 @@ static const char * const period_values[ + static ssize_t in_illuminance_period_available_show(struct device *dev, + struct device_attribute *attr, char *buf) + { ++ struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev)); + int ret, reg, x; +- struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev)); +- struct veml6030_data *data = iio_priv(indio_dev); + + ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, ®); + if (ret) { diff --git a/queue-6.6/iio-proximity-mb1232-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch b/queue-6.6/iio-proximity-mb1232-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch new file mode 100644 index 00000000000..5069a86a76f --- /dev/null +++ b/queue-6.6/iio-proximity-mb1232-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch @@ -0,0 +1,35 @@ +From 75461a0b15d7c026924d0001abce0476bbc7eda8 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 3 Oct 2024 23:04:59 +0200 +Subject: iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig + +From: Javier Carrasco + +commit 75461a0b15d7c026924d0001abce0476bbc7eda8 upstream. + +This driver makes use of triggered buffers, but does not select the +required modules. + +Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'. + +Fixes: 16b05261537e ("mb1232.c: add distance iio sensor with i2c") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241003-iio-select-v1-13-67c0385197cd@gmail.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/proximity/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/proximity/Kconfig ++++ b/drivers/iio/proximity/Kconfig +@@ -72,6 +72,8 @@ config LIDAR_LITE_V2 + config MB1232 + tristate "MaxSonar I2CXL family ultrasonic sensors" + depends on I2C ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + help + Say Y to build a driver for the ultrasonic sensors I2CXL of + MaxBotix which have an i2c interface. It can be used to measure diff --git a/queue-6.6/input-xpad-add-support-for-msi-claw-a1m.patch b/queue-6.6/input-xpad-add-support-for-msi-claw-a1m.patch new file mode 100644 index 00000000000..4aac053d5c2 --- /dev/null +++ b/queue-6.6/input-xpad-add-support-for-msi-claw-a1m.patch @@ -0,0 +1,41 @@ +From 22a18935d7d96bbb1a28076f843c1926d0ba189e Mon Sep 17 00:00:00 2001 +From: John Edwards +Date: Thu, 10 Oct 2024 23:09:23 +0000 +Subject: Input: xpad - add support for MSI Claw A1M + +From: John Edwards + +commit 22a18935d7d96bbb1a28076f843c1926d0ba189e upstream. + +Add MSI Claw A1M controller to xpad_device match table when in xinput mode. +Add MSI VID as XPAD_XBOX360_VENDOR. + +Signed-off-by: John Edwards +Reviewed-by: Derek J. Clark +Reviewed-by: Christopher Snowhill +Link: https://lore.kernel.org/r/20241010232020.3292284-4-uejji@uejji.net +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -217,6 +217,7 @@ static const struct xpad_device { + { 0x0c12, 0x8810, "Zeroplus Xbox Controller", 0, XTYPE_XBOX }, + { 0x0c12, 0x9902, "HAMA VibraX - *FAULTY HARDWARE*", 0, XTYPE_XBOX }, + { 0x0d2f, 0x0002, "Andamiro Pump It Up pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, ++ { 0x0db0, 0x1901, "Micro Star International Xbox360 Controller for Windows", 0, XTYPE_XBOX360 }, + { 0x0e4c, 0x1097, "Radica Gamester Controller", 0, XTYPE_XBOX }, + { 0x0e4c, 0x1103, "Radica Gamester Reflex", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX }, + { 0x0e4c, 0x2390, "Radica Games Jtech Controller", 0, XTYPE_XBOX }, +@@ -486,6 +487,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz Gamepad */ + XPAD_XBOXONE_VENDOR(0x0b05), /* ASUS controllers */ + XPAD_XBOX360_VENDOR(0x0c12), /* Zeroplus X-Box 360 controllers */ ++ XPAD_XBOX360_VENDOR(0x0db0), /* Micro Star International X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f Xbox 360 controllers */ + XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f Xbox One controllers */ + XPAD_XBOX360_VENDOR(0x0f0d), /* Hori controllers */ diff --git a/queue-6.6/io_uring-sqpoll-close-race-on-waiting-for-sqring-entries.patch b/queue-6.6/io_uring-sqpoll-close-race-on-waiting-for-sqring-entries.patch new file mode 100644 index 00000000000..2cd599940cf --- /dev/null +++ b/queue-6.6/io_uring-sqpoll-close-race-on-waiting-for-sqring-entries.patch @@ -0,0 +1,54 @@ +From 28aabffae6be54284869a91cd8bccd3720041129 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Tue, 15 Oct 2024 08:58:25 -0600 +Subject: io_uring/sqpoll: close race on waiting for sqring entries + +From: Jens Axboe + +commit 28aabffae6be54284869a91cd8bccd3720041129 upstream. + +When an application uses SQPOLL, it must wait for the SQPOLL thread to +consume SQE entries, if it fails to get an sqe when calling +io_uring_get_sqe(). It can do so by calling io_uring_enter(2) with the +flag value of IORING_ENTER_SQ_WAIT. In liburing, this is generally done +with io_uring_sqring_wait(). There's a natural expectation that once +this call returns, a new SQE entry can be retrieved, filled out, and +submitted. However, the kernel uses the cached sq head to determine if +the SQRING is full or not. If the SQPOLL thread is currently in the +process of submitting SQE entries, it may have updated the cached sq +head, but not yet committed it to the SQ ring. Hence the kernel may find +that there are SQE entries ready to be consumed, and return successfully +to the application. If the SQPOLL thread hasn't yet committed the SQ +ring entries by the time the application returns to userspace and +attempts to get a new SQE, it will fail getting a new SQE. + +Fix this by having io_sqring_full() always use the user visible SQ ring +head entry, rather than the internally cached one. + +Cc: stable@vger.kernel.org # 5.10+ +Link: https://github.com/axboe/liburing/discussions/1267 +Reported-by: Benedek Thaler +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/io_uring.h | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/io_uring/io_uring.h ++++ b/io_uring/io_uring.h +@@ -262,7 +262,14 @@ static inline bool io_sqring_full(struct + { + struct io_rings *r = ctx->rings; + +- return READ_ONCE(r->sq.tail) - ctx->cached_sq_head == ctx->sq_entries; ++ /* ++ * SQPOLL must use the actual sqring head, as using the cached_sq_head ++ * is race prone if the SQPOLL thread has grabbed entries but not yet ++ * committed them to the ring. For !SQPOLL, this doesn't matter, but ++ * since this helper is just used for SQPOLL sqring waits (or POLLOUT), ++ * just read the actual sqring head unconditionally. ++ */ ++ return READ_ONCE(r->sq.tail) - READ_ONCE(r->sq.head) == ctx->sq_entries; + } + + static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx) diff --git a/queue-6.6/scsi-ufs-core-fix-the-issue-of-icu-failure.patch b/queue-6.6/scsi-ufs-core-fix-the-issue-of-icu-failure.patch new file mode 100644 index 00000000000..8d4b3cf6030 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-fix-the-issue-of-icu-failure.patch @@ -0,0 +1,64 @@ +From bf0c6cc73f7f91ec70307f7c72343f6cb7d65d01 Mon Sep 17 00:00:00 2001 +From: Peter Wang +Date: Tue, 1 Oct 2024 17:19:16 +0800 +Subject: scsi: ufs: core: Fix the issue of ICU failure + +From: Peter Wang + +commit bf0c6cc73f7f91ec70307f7c72343f6cb7d65d01 upstream. + +When setting the ICU bit without using read-modify-write, SQRTCy will +restart SQ again and receive an RTC return error code 2 (Failure - SQ +not stopped). + +Additionally, the error log has been modified so that this type of error +can be observed. + +Fixes: ab248643d3d6 ("scsi: ufs: core: Add error handling for MCQ mode") +Cc: stable@vger.kernel.org +Signed-off-by: Peter Wang +Link: https://lore.kernel.org/r/20241001091917.6917-2-peter.wang@mediatek.com +Reviewed-by: Bao D. Nguyen +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ufs/core/ufs-mcq.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/ufs/core/ufs-mcq.c ++++ b/drivers/ufs/core/ufs-mcq.c +@@ -498,7 +498,7 @@ int ufshcd_mcq_sq_cleanup(struct ufs_hba + struct scsi_cmnd *cmd = lrbp->cmd; + struct ufs_hw_queue *hwq; + void __iomem *reg, *opr_sqd_base; +- u32 nexus, id, val; ++ u32 nexus, id, val, rtc; + int err; + + if (hba->quirks & UFSHCD_QUIRK_MCQ_BROKEN_RTC) +@@ -528,17 +528,18 @@ int ufshcd_mcq_sq_cleanup(struct ufs_hba + opr_sqd_base = mcq_opr_base(hba, OPR_SQD, id); + writel(nexus, opr_sqd_base + REG_SQCTI); + +- /* SQRTCy.ICU = 1 */ +- writel(SQ_ICU, opr_sqd_base + REG_SQRTC); ++ /* Initiate Cleanup */ ++ writel(readl(opr_sqd_base + REG_SQRTC) | SQ_ICU, ++ opr_sqd_base + REG_SQRTC); + + /* Poll SQRTSy.CUS = 1. Return result from SQRTSy.RTC */ + reg = opr_sqd_base + REG_SQRTS; + err = read_poll_timeout(readl, val, val & SQ_CUS, 20, + MCQ_POLL_US, false, reg); +- if (err) +- dev_err(hba->dev, "%s: failed. hwq=%d, tag=%d err=%ld\n", +- __func__, id, task_tag, +- FIELD_GET(SQ_ICU_ERR_CODE_MASK, readl(reg))); ++ rtc = FIELD_GET(SQ_ICU_ERR_CODE_MASK, readl(reg)); ++ if (err || rtc) ++ dev_err(hba->dev, "%s: failed. hwq=%d, tag=%d err=%d RTC=%d\n", ++ __func__, id, task_tag, err, rtc); + + if (ufshcd_mcq_sq_start(hba, hwq)) + err = -ETIMEDOUT; diff --git a/queue-6.6/scsi-ufs-core-set-sdev_offline-when-ufs-is-shut-down.patch b/queue-6.6/scsi-ufs-core-set-sdev_offline-when-ufs-is-shut-down.patch new file mode 100644 index 00000000000..86aadb26879 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-set-sdev_offline-when-ufs-is-shut-down.patch @@ -0,0 +1,71 @@ +From 19a198b67767d952c8f3d0cf24eb3100522a8223 Mon Sep 17 00:00:00 2001 +From: Seunghwan Baek +Date: Thu, 29 Aug 2024 18:39:13 +0900 +Subject: scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down + +From: Seunghwan Baek + +commit 19a198b67767d952c8f3d0cf24eb3100522a8223 upstream. + +There is a history of deadlock if reboot is performed at the beginning +of booting. SDEV_QUIESCE was set for all LU's scsi_devices by UFS +shutdown, and at that time the audio driver was waiting on +blk_mq_submit_bio() holding a mutex_lock while reading the fw binary. +After that, a deadlock issue occurred while audio driver shutdown was +waiting for mutex_unlock of blk_mq_submit_bio(). To solve this, set +SDEV_OFFLINE for all LUs except WLUN, so that any I/O that comes down +after a UFS shutdown will return an error. + +[ 31.907781]I[0: swapper/0: 0] 1 130705007 1651079834 11289729804 0 D( 2) 3 ffffff882e208000 * init [device_shutdown] +[ 31.907793]I[0: swapper/0: 0] Mutex: 0xffffff8849a2b8b0: owner[0xffffff882e28cb00 kworker/6:0 :49] +[ 31.907806]I[0: swapper/0: 0] Call trace: +[ 31.907810]I[0: swapper/0: 0] __switch_to+0x174/0x338 +[ 31.907819]I[0: swapper/0: 0] __schedule+0x5ec/0x9cc +[ 31.907826]I[0: swapper/0: 0] schedule+0x7c/0xe8 +[ 31.907834]I[0: swapper/0: 0] schedule_preempt_disabled+0x24/0x40 +[ 31.907842]I[0: swapper/0: 0] __mutex_lock+0x408/0xdac +[ 31.907849]I[0: swapper/0: 0] __mutex_lock_slowpath+0x14/0x24 +[ 31.907858]I[0: swapper/0: 0] mutex_lock+0x40/0xec +[ 31.907866]I[0: swapper/0: 0] device_shutdown+0x108/0x280 +[ 31.907875]I[0: swapper/0: 0] kernel_restart+0x4c/0x11c +[ 31.907883]I[0: swapper/0: 0] __arm64_sys_reboot+0x15c/0x280 +[ 31.907890]I[0: swapper/0: 0] invoke_syscall+0x70/0x158 +[ 31.907899]I[0: swapper/0: 0] el0_svc_common+0xb4/0xf4 +[ 31.907909]I[0: swapper/0: 0] do_el0_svc+0x2c/0xb0 +[ 31.907918]I[0: swapper/0: 0] el0_svc+0x34/0xe0 +[ 31.907928]I[0: swapper/0: 0] el0t_64_sync_handler+0x68/0xb4 +[ 31.907937]I[0: swapper/0: 0] el0t_64_sync+0x1a0/0x1a4 + +[ 31.908774]I[0: swapper/0: 0] 49 0 11960702 11236868007 0 D( 2) 6 ffffff882e28cb00 * kworker/6:0 [__bio_queue_enter] +[ 31.908783]I[0: swapper/0: 0] Call trace: +[ 31.908788]I[0: swapper/0: 0] __switch_to+0x174/0x338 +[ 31.908796]I[0: swapper/0: 0] __schedule+0x5ec/0x9cc +[ 31.908803]I[0: swapper/0: 0] schedule+0x7c/0xe8 +[ 31.908811]I[0: swapper/0: 0] __bio_queue_enter+0xb8/0x178 +[ 31.908818]I[0: swapper/0: 0] blk_mq_submit_bio+0x194/0x67c +[ 31.908827]I[0: swapper/0: 0] __submit_bio+0xb8/0x19c + +Fixes: b294ff3e3449 ("scsi: ufs: core: Enable power management for wlun") +Cc: stable@vger.kernel.org +Signed-off-by: Seunghwan Baek +Link: https://lore.kernel.org/r/20240829093913.6282-2-sh8267.baek@samsung.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ufs/core/ufshcd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -10100,7 +10100,9 @@ static void ufshcd_wl_shutdown(struct de + shost_for_each_device(sdev, hba->host) { + if (sdev == hba->ufs_device_wlun) + continue; +- scsi_device_quiesce(sdev); ++ mutex_lock(&sdev->state_mutex); ++ scsi_device_set_state(sdev, SDEV_OFFLINE); ++ mutex_unlock(&sdev->state_mutex); + } + __ufshcd_wl_suspend(hba, UFS_SHUTDOWN_PM); + diff --git a/queue-6.6/selftest-hid-add-the-missing-tests-directory.patch b/queue-6.6/selftest-hid-add-the-missing-tests-directory.patch new file mode 100644 index 00000000000..716868e4234 --- /dev/null +++ b/queue-6.6/selftest-hid-add-the-missing-tests-directory.patch @@ -0,0 +1,57 @@ +From fe05c40ca9c18cfdb003f639a30fc78a7ab49519 Mon Sep 17 00:00:00 2001 +From: Yun Lu +Date: Tue, 15 Oct 2024 17:15:20 +0800 +Subject: selftest: hid: add the missing tests directory + +From: Yun Lu + +commit fe05c40ca9c18cfdb003f639a30fc78a7ab49519 upstream. + +Commit 160c826b4dd0 ("selftest: hid: add missing run-hid-tools-tests.sh") +has added the run-hid-tools-tests.sh script for it to be installed, but +I forgot to add the tests directory together. + +If running the test case without the tests directory, will results in +the following error message: + + make -C tools/testing/selftests/ TARGETS=hid install \ + INSTALL_PATH=$KSFT_INSTALL_PATH + cd $KSFT_INSTALL_PATH + ./run_kselftest.sh -t hid:hid-core.sh + + /usr/lib/python3.11/site-packages/_pytest/config/__init__.py:331: PluggyTeardownRaisedWarning: A plugin raised an exception during an old-style hookwrapper teardown. + Plugin: helpconfig, Hook: pytest_cmdline_parse + UsageError: usage: __main__.py [options] [file_or_dir] [file_or_dir] [...] + __main__.py: error: unrecognized arguments: --udevd + inifile: None + rootdir: /root/linux/kselftest_install/hid + +In fact, the run-hid-tools-tests.sh script uses the scripts in the tests +directory to run tests. The tests directory also needs to be added to be +installed. + +Fixes: ffb85d5c9e80 ("selftests: hid: import hid-tools hid-core tests") +Cc: stable@vger.kernel.org +Signed-off-by: Yun Lu +Acked-by: Benjamin Tissoires +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/hid/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/hid/Makefile b/tools/testing/selftests/hid/Makefile +index 38ae31bb07b5..662209f5fabc 100644 +--- a/tools/testing/selftests/hid/Makefile ++++ b/tools/testing/selftests/hid/Makefile +@@ -18,6 +18,7 @@ TEST_PROGS += hid-usb_crash.sh + TEST_PROGS += hid-wacom.sh + + TEST_FILES := run-hid-tools-tests.sh ++TEST_FILES += tests + + CXX ?= $(CROSS_COMPILE)g++ + +-- +2.47.0 + diff --git a/queue-6.6/series b/queue-6.6/series index 9c6be1ebe48..ca22299a439 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -56,3 +56,31 @@ x86-cpufeatures-add-a-ibpb_no_ret-bug-flag.patch x86-entry-have-entry_ibpb-invalidate-return-predictions.patch x86-bugs-skip-rsb-fill-at-vmexit.patch x86-bugs-do-not-use-untrain_ret-with-ibpb-on-entry.patch +blk-rq-qos-fix-crash-on-rq_qos_wait-vs.-rq_qos_wake_function-race.patch +io_uring-sqpoll-close-race-on-waiting-for-sqring-entries.patch +ublk-don-t-allow-user-copy-for-unprivileged-device.patch +selftest-hid-add-the-missing-tests-directory.patch +input-xpad-add-support-for-msi-claw-a1m.patch +scsi-ufs-core-set-sdev_offline-when-ufs-is-shut-down.patch +scsi-ufs-core-fix-the-issue-of-icu-failure.patch +drm-radeon-fix-encoder-possible_clones.patch +drm-vmwgfx-handle-surface-check-failure-correctly.patch +drm-amdgpu-swsmu-only-force-workload-setup-on-init.patch +drm-amdgpu-prevent-bo_handles-error-from-being-overwritten.patch +iio-dac-ad5770r-add-missing-select-regmap_spi-in-kconfig.patch +iio-dac-ltc1660-add-missing-select-regmap_spi-in-kconfig.patch +iio-dac-stm32-dac-core-add-missing-select-regmap_mmio-in-kconfig.patch +iio-adc-ti-ads8688-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch +iio-hid-sensors-fix-an-error-handling-path-in-_hid_sensor_set_report_latency.patch +iio-light-veml6030-fix-als-sensor-resolution.patch +iio-light-veml6030-fix-iio-device-retrieval-from-embedded-device.patch +iio-light-opt3001-add-missing-full-scale-range-value.patch +iio-amplifiers-ada4250-add-missing-select-regmap_spi-in-kconfig.patch +iio-frequency-adf4377-add-missing-select-remap_spi-in-kconfig.patch +iio-light-bu27008-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch +iio-dac-ad5766-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch +iio-proximity-mb1232-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch +iio-dac-ad3552r-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch +iio-adc-ti-lmp92064-add-missing-select-regmap_spi-in-kconfig.patch +iio-adc-ti-ads124s08-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch +iio-accel-kx022a-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch diff --git a/queue-6.6/ublk-don-t-allow-user-copy-for-unprivileged-device.patch b/queue-6.6/ublk-don-t-allow-user-copy-for-unprivileged-device.patch new file mode 100644 index 00000000000..bbfea33a65f --- /dev/null +++ b/queue-6.6/ublk-don-t-allow-user-copy-for-unprivileged-device.patch @@ -0,0 +1,66 @@ +From 42aafd8b48adac1c3b20fe5892b1b91b80c1a1e6 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Wed, 16 Oct 2024 21:48:47 +0800 +Subject: ublk: don't allow user copy for unprivileged device + +From: Ming Lei + +commit 42aafd8b48adac1c3b20fe5892b1b91b80c1a1e6 upstream. + +UBLK_F_USER_COPY requires userspace to call write() on ublk char +device for filling request buffer, and unprivileged device can't +be trusted. + +So don't allow user copy for unprivileged device. + +Cc: stable@vger.kernel.org +Fixes: 1172d5b8beca ("ublk: support user copy") +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20241016134847.2911721-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/ublk_drv.c | 11 ++++++++++- + include/uapi/linux/ublk_cmd.h | 8 +++++++- + 2 files changed, 17 insertions(+), 2 deletions(-) + +--- a/drivers/block/ublk_drv.c ++++ b/drivers/block/ublk_drv.c +@@ -2327,10 +2327,19 @@ static int ublk_ctrl_add_dev(struct io_u + * TODO: provide forward progress for RECOVERY handler, so that + * unprivileged device can benefit from it + */ +- if (info.flags & UBLK_F_UNPRIVILEGED_DEV) ++ if (info.flags & UBLK_F_UNPRIVILEGED_DEV) { + info.flags &= ~(UBLK_F_USER_RECOVERY_REISSUE | + UBLK_F_USER_RECOVERY); + ++ /* ++ * For USER_COPY, we depends on userspace to fill request ++ * buffer by pwrite() to ublk char device, which can't be ++ * used for unprivileged device ++ */ ++ if (info.flags & UBLK_F_USER_COPY) ++ return -EINVAL; ++ } ++ + /* the created device is always owned by current user */ + ublk_store_owner_uid_gid(&info.owner_uid, &info.owner_gid); + +--- a/include/uapi/linux/ublk_cmd.h ++++ b/include/uapi/linux/ublk_cmd.h +@@ -173,7 +173,13 @@ + /* use ioctl encoding for uring command */ + #define UBLK_F_CMD_IOCTL_ENCODE (1UL << 6) + +-/* Copy between request and user buffer by pread()/pwrite() */ ++/* ++ * Copy between request and user buffer by pread()/pwrite() ++ * ++ * Not available for UBLK_F_UNPRIVILEGED_DEV, otherwise userspace may ++ * deceive us by not filling request buffer, then kernel uninitialized ++ * data may be leaked. ++ */ + #define UBLK_F_USER_COPY (1UL << 7) + + /*