From: Sasha Levin Date: Sun, 13 Oct 2024 20:03:30 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v5.10.227~59 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6751a7bf92036d761af2094487242f0ad9253187;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch b/queue-6.1/hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch new file mode 100644 index 00000000000..d4af6b118ad --- /dev/null +++ b/queue-6.1/hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch @@ -0,0 +1,62 @@ +From ca66a5a90398f04697057c171cc978c1e6db5cd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2024 10:56:05 +0800 +Subject: HID: multitouch: Add support for lenovo Y9000P Touchpad + +From: He Lugang + +[ Upstream commit 251efae73bd46b097deec4f9986d926813aed744 ] + +The 2024 Lenovo Y9000P which use GT7868Q chip also needs a fixup. +The information of the chip is as follows: +I2C HID v1.00 Mouse [GXTP5100:00 27C6:01E0] + +Signed-off-by: He Lugang +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 8 ++++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index ede3a052ead55..5f98c33ed67ba 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -506,6 +506,7 @@ + #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 + + #define I2C_VENDOR_ID_GOODIX 0x27c6 ++#define I2C_DEVICE_ID_GOODIX_01E0 0x01e0 + #define I2C_DEVICE_ID_GOODIX_01E8 0x01e8 + #define I2C_DEVICE_ID_GOODIX_01E9 0x01e9 + #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6d76463f5896f..e7199ae2e3d91 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1447,7 +1447,8 @@ static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc, + { + if (hdev->vendor == I2C_VENDOR_ID_GOODIX && + (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 || +- hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) { ++ hdev->product == I2C_DEVICE_ID_GOODIX_01E9 || ++ hdev->product == I2C_DEVICE_ID_GOODIX_01E0)) { + if (rdesc[607] == 0x15) { + rdesc[607] = 0x25; + dev_info( +@@ -2068,7 +2069,10 @@ static const struct hid_device_id mt_devices[] = { + I2C_DEVICE_ID_GOODIX_01E8) }, + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, + HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, +- I2C_DEVICE_ID_GOODIX_01E8) }, ++ I2C_DEVICE_ID_GOODIX_01E9) }, ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, ++ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX, ++ I2C_DEVICE_ID_GOODIX_01E0) }, + + /* GoodTouch panels */ + { .driver_data = MT_CLS_NSMU, +-- +2.43.0 + diff --git a/queue-6.1/hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch b/queue-6.1/hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch new file mode 100644 index 00000000000..1b62ca39d27 --- /dev/null +++ b/queue-6.1/hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch @@ -0,0 +1,36 @@ +From 808cc78ef04125c81fb498e513e683f68af369f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2024 03:08:08 +0200 +Subject: hwmon: (adm9240) Add missing dependency on REGMAP_I2C + +From: Javier Carrasco + +[ Upstream commit 14849a2ec175bb8a2280ce20efe002bb19f1e274 ] + +This driver requires REGMAP_I2C to be selected in order to get access to +regmap_config and devm_regmap_init_i2c. Add the missing dependency. + +Fixes: df885d912f67 ("hwmon: (adm9240) Convert to regmap") +Signed-off-by: Javier Carrasco +Message-ID: <20241002-hwmon-select-regmap-v1-1-548d03268934@gmail.com> +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 6d4c4003c1e46..054ceca18e20c 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -166,6 +166,7 @@ config SENSORS_ADM9240 + tristate "Analog Devices ADM9240 and compatibles" + depends on I2C + select HWMON_VID ++ select REGMAP_I2C + help + If you say yes here you get support for Analog Devices ADM9240, + Dallas DS1780, National Semiconductor LM81 sensor chips. +-- +2.43.0 + diff --git a/queue-6.1/hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch b/queue-6.1/hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch new file mode 100644 index 00000000000..37bbed826d8 --- /dev/null +++ b/queue-6.1/hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch @@ -0,0 +1,36 @@ +From 4bbc47fc2d4717fba11c25de9dfcea6ada653e5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2024 03:08:09 +0200 +Subject: hwmon: (adt7470) Add missing dependency on REGMAP_I2C + +From: Javier Carrasco + +[ Upstream commit b6abcc19566509ab4812bd5ae5df46515d0c1d70 ] + +This driver requires REGMAP_I2C to be selected in order to get access to +regmap_config and devm_regmap_init_i2c. Add the missing dependency. + +Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap") +Signed-off-by: Javier Carrasco +Message-ID: <20241002-hwmon-select-regmap-v1-2-548d03268934@gmail.com> +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 054ceca18e20c..7884fcb95c3e5 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -228,6 +228,7 @@ config SENSORS_ADT7462 + config SENSORS_ADT7470 + tristate "Analog Devices ADT7470" + depends on I2C ++ select REGMAP_I2C + help + If you say yes here you get support for the Analog Devices + ADT7470 temperature monitoring chips. +-- +2.43.0 + diff --git a/queue-6.1/hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch b/queue-6.1/hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch new file mode 100644 index 00000000000..20e98ee3f49 --- /dev/null +++ b/queue-6.1/hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch @@ -0,0 +1,45 @@ +From d4f6ea19c29c67db52fa4ba0cd5b5467472bcd40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2024 11:37:15 -0700 +Subject: hwmon: (tmp513) Add missing dependency on REGMAP_I2C + +From: Guenter Roeck + +[ Upstream commit 193bc02c664999581a1f38c152f379fce91afc0c ] + +0-day reports: + +drivers/hwmon/tmp513.c:162:21: error: + variable 'tmp51x_regmap_config' has initializer but incomplete type +162 | static const struct regmap_config tmp51x_regmap_config = { + | ^ + +struct regmap_config is only available if REGMAP is enabled. +Add the missing Kconfig dependency to fix the problem. + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202410020246.2cTDDx0X-lkp@intel.com/ +Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.") +Cc: Eric Tremblay +Reviewed-by: Javier Carrasco +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index a5143d01b95f8..6d4c4003c1e46 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -2101,6 +2101,7 @@ config SENSORS_TMP464 + config SENSORS_TMP513 + tristate "Texas Instruments TMP513 and compatibles" + depends on I2C ++ select REGMAP_I2C + help + If you say yes here you get support for Texas Instruments TMP512, + and TMP513 temperature and power supply sensor chips. +-- +2.43.0 + diff --git a/queue-6.1/net-mlx5-always-drain-health-in-shutdown-callback.patch b/queue-6.1/net-mlx5-always-drain-health-in-shutdown-callback.patch new file mode 100644 index 00000000000..ee1ea98f60e --- /dev/null +++ b/queue-6.1/net-mlx5-always-drain-health-in-shutdown-callback.patch @@ -0,0 +1,67 @@ +From 659a51c0ae7856d806f0d02df1615f9e7788e843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2024 15:01:07 +0800 +Subject: net/mlx5: Always drain health in shutdown callback + +From: Shay Drory + +[ Upstream commit 1b75da22ed1e6171e261bc9265370162553d5393 ] + +There is no point in recovery during device shutdown. if health +work started need to wait for it to avoid races and NULL pointer +access. + +Hence, drain health WQ on shutdown callback. + +Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver") +Fixes: d2aa060d40fa ("net/mlx5: Cancel health poll before sending panic teardown command") +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Tariq Toukan +Reviewed-by: Wojciech Drewek +Link: https://patch.msgid.link/20240730061638.1831002-2-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +[Xiangyu: Modified to apply on 6.1.y to fix CVE-2024-43866] +Signed-off-by: Xiangyu Chen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 76af59cfdd0e6..825ad7663fa45 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -1950,7 +1950,6 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev) + /* Panic tear down fw command will stop the PCI bus communication + * with the HCA, so the health poll is no longer needed. + */ +- mlx5_drain_health_wq(dev); + mlx5_stop_health_poll(dev, false); + + ret = mlx5_cmd_fast_teardown_hca(dev); +@@ -1985,6 +1984,7 @@ static void shutdown(struct pci_dev *pdev) + + mlx5_core_info(dev, "Shutdown was called\n"); + set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state); ++ mlx5_drain_health_wq(dev); + err = mlx5_try_fast_unload(dev); + if (err) + mlx5_unload_one(dev, false); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c +index 2424cdf9cca99..d6850eb0ed7f4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c +@@ -75,6 +75,7 @@ static void mlx5_sf_dev_shutdown(struct auxiliary_device *adev) + { + struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev); + ++ mlx5_drain_health_wq(sf_dev->mdev); + mlx5_unload_one(sf_dev->mdev, false); + } + +-- +2.43.0 + diff --git a/queue-6.1/revert-net-ibm-emac-allocate-dummy-net_device-dynami.patch b/queue-6.1/revert-net-ibm-emac-allocate-dummy-net_device-dynami.patch new file mode 100644 index 00000000000..b0f272a41d3 --- /dev/null +++ b/queue-6.1/revert-net-ibm-emac-allocate-dummy-net_device-dynami.patch @@ -0,0 +1,81 @@ +From 65d15142e3974a28a8fab7d9ad1a7ae4d5a2b26d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Oct 2024 12:39:55 -0400 +Subject: Revert "net: ibm/emac: allocate dummy net_device dynamically" + +This reverts commit b40eeedbbc0833716b5ccae64cf914f2604a3e5e, which was +upstream commit 2eb5e25d8495 ("net: ibm/emac: allocate dummy net_device +dynamically"). + +alloc_netdev_dummy(( does not exist in 6.1, so all this backport did was +break the build. + +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/emac/mal.c | 14 +++----------- + drivers/net/ethernet/ibm/emac/mal.h | 2 +- + 2 files changed, 4 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c +index 1ebe44804f9d0..f30a2b8a7c173 100644 +--- a/drivers/net/ethernet/ibm/emac/mal.c ++++ b/drivers/net/ethernet/ibm/emac/mal.c +@@ -603,13 +603,9 @@ static int mal_probe(struct platform_device *ofdev) + INIT_LIST_HEAD(&mal->list); + spin_lock_init(&mal->lock); + +- mal->dummy_dev = alloc_netdev_dummy(0); +- if (!mal->dummy_dev) { +- err = -ENOMEM; +- goto fail_unmap; +- } ++ init_dummy_netdev(&mal->dummy_dev); + +- netif_napi_add_weight(mal->dummy_dev, &mal->napi, mal_poll, ++ netif_napi_add_weight(&mal->dummy_dev, &mal->napi, mal_poll, + CONFIG_IBM_EMAC_POLL_WEIGHT); + + /* Load power-on reset defaults */ +@@ -639,7 +635,7 @@ static int mal_probe(struct platform_device *ofdev) + GFP_KERNEL); + if (mal->bd_virt == NULL) { + err = -ENOMEM; +- goto fail_dummy; ++ goto fail_unmap; + } + + for (i = 0; i < mal->num_tx_chans; ++i) +@@ -705,8 +701,6 @@ static int mal_probe(struct platform_device *ofdev) + free_irq(mal->serr_irq, mal); + fail2: + dma_free_coherent(&ofdev->dev, bd_size, mal->bd_virt, mal->bd_dma); +- fail_dummy: +- free_netdev(mal->dummy_dev); + fail_unmap: + dcr_unmap(mal->dcr_host, 0x100); + fail: +@@ -738,8 +732,6 @@ static int mal_remove(struct platform_device *ofdev) + + mal_reset(mal); + +- free_netdev(mal->dummy_dev); +- + dcr_unmap(mal->dcr_host, 0x100); + + dma_free_coherent(&ofdev->dev, +diff --git a/drivers/net/ethernet/ibm/emac/mal.h b/drivers/net/ethernet/ibm/emac/mal.h +index e0ddc41186a28..d212373a72e7c 100644 +--- a/drivers/net/ethernet/ibm/emac/mal.h ++++ b/drivers/net/ethernet/ibm/emac/mal.h +@@ -205,7 +205,7 @@ struct mal_instance { + int index; + spinlock_t lock; + +- struct net_device *dummy_dev; ++ struct net_device dummy_dev; + + unsigned int features; + }; +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 1661981a298..eab6561f0e3 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -764,3 +764,10 @@ mctp-handle-error-of-rtnl_register_module.patch ppp-fix-ppp_async_encode-illegal-access.patch slip-make-slhc_remember-more-robust-against-maliciou.patch rust-macros-provide-correct-provenance-when-construc.patch +hid-multitouch-add-support-for-lenovo-y9000p-touchpa.patch +net-mlx5-always-drain-health-in-shutdown-callback.patch +wifi-mac80211-avoid-address-calculations-via-out-of-.patch +hwmon-tmp513-add-missing-dependency-on-regmap_i2c.patch +hwmon-adm9240-add-missing-dependency-on-regmap_i2c.patch +hwmon-adt7470-add-missing-dependency-on-regmap_i2c.patch +revert-net-ibm-emac-allocate-dummy-net_device-dynami.patch diff --git a/queue-6.1/wifi-mac80211-avoid-address-calculations-via-out-of-.patch b/queue-6.1/wifi-mac80211-avoid-address-calculations-via-out-of-.patch new file mode 100644 index 00000000000..425150684da --- /dev/null +++ b/queue-6.1/wifi-mac80211-avoid-address-calculations-via-out-of-.patch @@ -0,0 +1,101 @@ +From f576013175680dfea282be15ec34c81e78d93e89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2024 14:50:09 +0800 +Subject: wifi: mac80211: Avoid address calculations via out of bounds array + indexing + +From: Kenton Groombridge + +[ Upstream commit 2663d0462eb32ae7c9b035300ab6b1523886c718 ] + +req->n_channels must be set before req->channels[] can be used. + +This patch fixes one of the issues encountered in [1]. + +[ 83.964255] UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:364:4 +[ 83.964258] index 0 is out of range for type 'struct ieee80211_channel *[]' +[...] +[ 83.964264] Call Trace: +[ 83.964267] +[ 83.964269] dump_stack_lvl+0x3f/0xc0 +[ 83.964274] __ubsan_handle_out_of_bounds+0xec/0x110 +[ 83.964278] ieee80211_prep_hw_scan+0x2db/0x4b0 +[ 83.964281] __ieee80211_start_scan+0x601/0x990 +[ 83.964291] nl80211_trigger_scan+0x874/0x980 +[ 83.964295] genl_family_rcv_msg_doit+0xe8/0x160 +[ 83.964298] genl_rcv_msg+0x240/0x270 +[...] + +[1] https://bugzilla.kernel.org/show_bug.cgi?id=218810 + +Co-authored-by: Kees Cook +Signed-off-by: Kees Cook +Signed-off-by: Kenton Groombridge +Link: https://msgid.link/20240605152218.236061-1-concord@gentoo.org +Signed-off-by: Johannes Berg +[Xiangyu: Modified to apply on 6.1.y and 6.6.y] +Signed-off-by: Xiangyu Chen +Signed-off-by: Sasha Levin +--- + net/mac80211/scan.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c +index 0a6e40bd42f62..edbf468e0bea3 100644 +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -357,7 +357,8 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) + struct cfg80211_scan_request *req; + struct cfg80211_chan_def chandef; + u8 bands_used = 0; +- int i, ielen, n_chans; ++ int i, ielen; ++ u32 *n_chans; + u32 flags = 0; + + req = rcu_dereference_protected(local->scan_req, +@@ -367,34 +368,34 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_sub_if_data *sdata) + return false; + + if (ieee80211_hw_check(&local->hw, SINGLE_SCAN_ON_ALL_BANDS)) { ++ local->hw_scan_req->req.n_channels = req->n_channels; ++ + for (i = 0; i < req->n_channels; i++) { + local->hw_scan_req->req.channels[i] = req->channels[i]; + bands_used |= BIT(req->channels[i]->band); + } +- +- n_chans = req->n_channels; + } else { + do { + if (local->hw_scan_band == NUM_NL80211_BANDS) + return false; + +- n_chans = 0; ++ n_chans = &local->hw_scan_req->req.n_channels; ++ *n_chans = 0; + + for (i = 0; i < req->n_channels; i++) { + if (req->channels[i]->band != + local->hw_scan_band) + continue; +- local->hw_scan_req->req.channels[n_chans] = ++ local->hw_scan_req->req.channels[(*n_chans)++] = + req->channels[i]; +- n_chans++; ++ + bands_used |= BIT(req->channels[i]->band); + } + + local->hw_scan_band++; +- } while (!n_chans); ++ } while (!*n_chans); + } + +- local->hw_scan_req->req.n_channels = n_chans; + ieee80211_prepare_scan_chandef(&chandef, req->scan_width); + + if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT) +-- +2.43.0 +