From: Greg Kroah-Hartman Date: Tue, 5 Nov 2024 16:17:59 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.19.323~78 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6f0f12fa33c73f5beb40b3514cbe3700630ea93b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: nilfs2-fix-potential-deadlock-with-newly-created-symlinks.patch revert-driver-core-fix-uevent_show-vs-driver-detach-race.patch staging-iio-frequency-ad9832-fix-division-by-zero-in-ad9832_calc_freqreg.patch wifi-ath10k-fix-memory-leak-in-management-tx.patch wifi-iwlegacy-clear-stale-interrupts-before-resuming-device.patch wifi-mac80211-do-not-pass-a-stopped-vif-to-the-driver-in-.get_txpower.patch xhci-fix-link-trb-dma-in-command-ring-stopped-completion-event.patch --- diff --git a/queue-5.4/nilfs2-fix-potential-deadlock-with-newly-created-symlinks.patch b/queue-5.4/nilfs2-fix-potential-deadlock-with-newly-created-symlinks.patch new file mode 100644 index 00000000000..2efbc4b7e44 --- /dev/null +++ b/queue-5.4/nilfs2-fix-potential-deadlock-with-newly-created-symlinks.patch @@ -0,0 +1,57 @@ +From b3a033e3ecd3471248d474ef263aadc0059e516a Mon Sep 17 00:00:00 2001 +From: Ryusuke Konishi +Date: Sun, 20 Oct 2024 13:51:28 +0900 +Subject: nilfs2: fix potential deadlock with newly created symlinks + +From: Ryusuke Konishi + +commit b3a033e3ecd3471248d474ef263aadc0059e516a upstream. + +Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers +memory reclamation involving the filesystem layer, which can result in +circular lock dependencies among the reader/writer semaphore +nilfs->ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the +fs_reclaim pseudo lock. + +This is because after commit 21fc61c73c39 ("don't put symlink bodies in +pagecache into highmem"), the gfp flags of the page cache for symbolic +links are overwritten to GFP_KERNEL via inode_nohighmem(). + +This is not a problem for symlinks read from the backing device, because +the __GFP_FS flag is dropped after inode_nohighmem() is called. However, +when a new symlink is created with nilfs_symlink(), the gfp flags remain +overwritten to GFP_KERNEL. Then, memory allocation called from +page_symlink() etc. triggers memory reclamation including the FS layer, +which may call nilfs_evict_inode() or nilfs_dirty_inode(). And these can +cause a deadlock if they are called while nilfs->ns_segctor_sem is held: + +Fix this issue by dropping the __GFP_FS flag from the page cache GFP flags +of newly created symlinks in the same way that nilfs_new_inode() and +__nilfs_read_inode() do, as a workaround until we adopt nofs allocation +scope consistently or improve the locking constraints. + +Link: https://lkml.kernel.org/r/20241020050003.4308-1-konishi.ryusuke@gmail.com +Fixes: 21fc61c73c39 ("don't put symlink bodies in pagecache into highmem") +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+9ef37ac20608f4836256@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=9ef37ac20608f4836256 +Tested-by: syzbot+9ef37ac20608f4836256@syzkaller.appspotmail.com +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/namei.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/nilfs2/namei.c ++++ b/fs/nilfs2/namei.c +@@ -156,6 +156,9 @@ static int nilfs_symlink(struct inode *d + /* slow symlink */ + inode->i_op = &nilfs_symlink_inode_operations; + inode_nohighmem(inode); ++ mapping_set_gfp_mask(inode->i_mapping, ++ mapping_gfp_constraint(inode->i_mapping, ++ ~__GFP_FS)); + inode->i_mapping->a_ops = &nilfs_aops; + err = page_symlink(inode, symname, l); + if (err) diff --git a/queue-5.4/revert-driver-core-fix-uevent_show-vs-driver-detach-race.patch b/queue-5.4/revert-driver-core-fix-uevent_show-vs-driver-detach-race.patch new file mode 100644 index 00000000000..a4c3f9c84af --- /dev/null +++ b/queue-5.4/revert-driver-core-fix-uevent_show-vs-driver-detach-race.patch @@ -0,0 +1,94 @@ +From 9a71892cbcdb9d1459c84f5a4c722b14354158a5 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Tue, 29 Oct 2024 01:23:04 +0100 +Subject: Revert "driver core: Fix uevent_show() vs driver detach race" + +From: Greg Kroah-Hartman + +commit 9a71892cbcdb9d1459c84f5a4c722b14354158a5 upstream. + +This reverts commit 15fffc6a5624b13b428bb1c6e9088e32a55eb82c. + +This commit causes a regression, so revert it for now until it can come +back in a way that works for everyone. + +Link: https://lore.kernel.org/all/172790598832.1168608.4519484276671503678.stgit@dwillia2-xfh.jf.intel.com/ +Fixes: 15fffc6a5624 ("driver core: Fix uevent_show() vs driver detach race") +Cc: stable +Cc: Ashish Sangwan +Cc: Namjae Jeon +Cc: Dirk Behme +Cc: Greg Kroah-Hartman +Cc: Rafael J. Wysocki +Cc: Dan Williams +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/core.c | 13 +++++-------- + drivers/base/module.c | 4 ---- + 2 files changed, 5 insertions(+), 12 deletions(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -25,7 +25,6 @@ + #include + #include + #include +-#include + #include + #include + +@@ -1175,7 +1174,6 @@ static int dev_uevent(struct kset *kset, + struct kobj_uevent_env *env) + { + struct device *dev = kobj_to_dev(kobj); +- struct device_driver *driver; + int retval = 0; + + /* add device node properties if present */ +@@ -1204,12 +1202,8 @@ static int dev_uevent(struct kset *kset, + if (dev->type && dev->type->name) + add_uevent_var(env, "DEVTYPE=%s", dev->type->name); + +- /* Synchronize with module_remove_driver() */ +- rcu_read_lock(); +- driver = READ_ONCE(dev->driver); +- if (driver) +- add_uevent_var(env, "DRIVER=%s", driver->name); +- rcu_read_unlock(); ++ if (dev->driver) ++ add_uevent_var(env, "DRIVER=%s", dev->driver->name); + + /* Add common DT information about the device */ + of_device_uevent(dev, env); +@@ -1279,8 +1273,11 @@ static ssize_t uevent_show(struct device + if (!env) + return -ENOMEM; + ++ /* Synchronize with really_probe() */ ++ device_lock(dev); + /* let the kset specific function add its keys */ + retval = kset->uevent_ops->uevent(kset, &dev->kobj, env); ++ device_unlock(dev); + if (retval) + goto out; + +--- a/drivers/base/module.c ++++ b/drivers/base/module.c +@@ -7,7 +7,6 @@ + #include + #include + #include +-#include + #include "base.h" + + static char *make_driver_name(struct device_driver *drv) +@@ -78,9 +77,6 @@ void module_remove_driver(struct device_ + if (!drv) + return; + +- /* Synchronize with dev_uevent() */ +- synchronize_rcu(); +- + sysfs_remove_link(&drv->p->kobj, "module"); + + if (drv->owner) diff --git a/queue-5.4/series b/queue-5.4/series index 5e424fb330e..c3f58ce2da1 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -446,3 +446,10 @@ misc-sgi-gru-don-t-disable-preemption-in-gru-driver.patch alsa-usb-audio-add-quirks-for-dell-wd19-dock.patch usbip-tools-fix-detach_port-invalid-port-error-path.patch usb-phy-fix-api-devm_usb_put_phy-can-not-release-the-phy.patch +xhci-fix-link-trb-dma-in-command-ring-stopped-completion-event.patch +revert-driver-core-fix-uevent_show-vs-driver-detach-race.patch +wifi-mac80211-do-not-pass-a-stopped-vif-to-the-driver-in-.get_txpower.patch +wifi-ath10k-fix-memory-leak-in-management-tx.patch +wifi-iwlegacy-clear-stale-interrupts-before-resuming-device.patch +staging-iio-frequency-ad9832-fix-division-by-zero-in-ad9832_calc_freqreg.patch +nilfs2-fix-potential-deadlock-with-newly-created-symlinks.patch diff --git a/queue-5.4/staging-iio-frequency-ad9832-fix-division-by-zero-in-ad9832_calc_freqreg.patch b/queue-5.4/staging-iio-frequency-ad9832-fix-division-by-zero-in-ad9832_calc_freqreg.patch new file mode 100644 index 00000000000..b51c7bff586 --- /dev/null +++ b/queue-5.4/staging-iio-frequency-ad9832-fix-division-by-zero-in-ad9832_calc_freqreg.patch @@ -0,0 +1,49 @@ +From 6bd301819f8f69331a55ae2336c8b111fc933f3d Mon Sep 17 00:00:00 2001 +From: Zicheng Qu +Date: Tue, 22 Oct 2024 13:43:54 +0000 +Subject: staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() + +From: Zicheng Qu + +commit 6bd301819f8f69331a55ae2336c8b111fc933f3d upstream. + +In the ad9832_write_frequency() function, clk_get_rate() might return 0. +This can lead to a division by zero when calling ad9832_calc_freqreg(). +The check if (fout > (clk_get_rate(st->mclk) / 2)) does not protect +against the case when fout is 0. The ad9832_write_frequency() function +is called from ad9832_write(), and fout is derived from a text buffer, +which can contain any value. + +Link: https://lore.kernel.org/all/2024100904-CVE-2024-47663-9bdc@gregkh/ +Fixes: ea707584bac1 ("Staging: IIO: DDS: AD9832 / AD9835 driver") +Cc: stable@vger.kernel.org +Signed-off-by: Zicheng Qu +Reviewed-by: Nuno Sa +Reviewed-by: Dan Carpenter +Link: https://patch.msgid.link/20241022134354.574614-1-quzicheng@huawei.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/iio/frequency/ad9832.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/staging/iio/frequency/ad9832.c ++++ b/drivers/staging/iio/frequency/ad9832.c +@@ -129,12 +129,15 @@ static unsigned long ad9832_calc_freqreg + static int ad9832_write_frequency(struct ad9832_state *st, + unsigned int addr, unsigned long fout) + { ++ unsigned long clk_freq; + unsigned long regval; + +- if (fout > (clk_get_rate(st->mclk) / 2)) ++ clk_freq = clk_get_rate(st->mclk); ++ ++ if (!clk_freq || fout > (clk_freq / 2)) + return -EINVAL; + +- regval = ad9832_calc_freqreg(clk_get_rate(st->mclk), fout); ++ regval = ad9832_calc_freqreg(clk_freq, fout); + + st->freq_data[0] = cpu_to_be16((AD9832_CMD_FRE8BITSW << CMD_SHIFT) | + (addr << ADD_SHIFT) | diff --git a/queue-5.4/wifi-ath10k-fix-memory-leak-in-management-tx.patch b/queue-5.4/wifi-ath10k-fix-memory-leak-in-management-tx.patch new file mode 100644 index 00000000000..9762f993807 --- /dev/null +++ b/queue-5.4/wifi-ath10k-fix-memory-leak-in-management-tx.patch @@ -0,0 +1,86 @@ +From e15d84b3bba187aa372dff7c58ce1fd5cb48a076 Mon Sep 17 00:00:00 2001 +From: Manikanta Pubbisetty +Date: Tue, 15 Oct 2024 12:11:03 +0530 +Subject: wifi: ath10k: Fix memory leak in management tx + +From: Manikanta Pubbisetty + +commit e15d84b3bba187aa372dff7c58ce1fd5cb48a076 upstream. + +In the current logic, memory is allocated for storing the MSDU context +during management packet TX but this memory is not being freed during +management TX completion. Similar leaks are seen in the management TX +cleanup logic. + +Kmemleak reports this problem as below, + +unreferenced object 0xffffff80b64ed250 (size 16): + comm "kworker/u16:7", pid 148, jiffies 4294687130 (age 714.199s) + hex dump (first 16 bytes): + 00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00 .+.......t...... + backtrace: + [] __kmem_cache_alloc_node+0x1e4/0x2d8 + [] kmalloc_trace+0x48/0x110 + [] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core] + [] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core] + [] process_scheduled_works+0x1ac/0x400 + [] worker_thread+0x208/0x328 + [] kthread+0x100/0x1c0 + [] ret_from_fork+0x10/0x20 + +Free the memory during completion and cleanup to fix the leak. + +Protect the mgmt_pending_tx idr_remove() operation in +ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar->data_lock similar to +other instances. + +Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 + +Fixes: dc405152bb64 ("ath10k: handle mgmt tx completion event") +Fixes: c730c477176a ("ath10k: Remove msdu from idr when management pkt send fails") +Cc: stable@vger.kernel.org +Signed-off-by: Manikanta Pubbisetty +Link: https://patch.msgid.link/20241015064103.6060-1-quic_mpubbise@quicinc.com +Signed-off-by: Jeff Johnson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 7 ++++++- + drivers/net/wireless/ath/ath10k/wmi.c | 2 ++ + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -2854,9 +2854,14 @@ ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(s + struct sk_buff *msdu) + { + struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu); ++ struct ath10k_mgmt_tx_pkt_addr *pkt_addr; + struct ath10k_wmi *wmi = &ar->wmi; + +- idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); ++ spin_lock_bh(&ar->data_lock); ++ pkt_addr = idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); ++ spin_unlock_bh(&ar->data_lock); ++ ++ kfree(pkt_addr); + + return 0; + } +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -2385,6 +2385,7 @@ wmi_process_mgmt_tx_comp(struct ath10k * + dma_unmap_single(ar->dev, pkt_addr->paddr, + msdu->len, DMA_TO_DEVICE); + info = IEEE80211_SKB_CB(msdu); ++ kfree(pkt_addr); + + if (param->status) { + info->flags &= ~IEEE80211_TX_STAT_ACK; +@@ -9466,6 +9467,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_p + dma_unmap_single(ar->dev, pkt_addr->paddr, + msdu->len, DMA_TO_DEVICE); + ieee80211_free_txskb(ar->hw, msdu); ++ kfree(pkt_addr); + + return 0; + } diff --git a/queue-5.4/wifi-iwlegacy-clear-stale-interrupts-before-resuming-device.patch b/queue-5.4/wifi-iwlegacy-clear-stale-interrupts-before-resuming-device.patch new file mode 100644 index 00000000000..f91b9977f13 --- /dev/null +++ b/queue-5.4/wifi-iwlegacy-clear-stale-interrupts-before-resuming-device.patch @@ -0,0 +1,174 @@ +From 07c90acb071b9954e1fecb1e4f4f13d12c544b34 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Tue, 1 Oct 2024 23:07:45 +0300 +Subject: wifi: iwlegacy: Clear stale interrupts before resuming device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 07c90acb071b9954e1fecb1e4f4f13d12c544b34 upstream. + +iwl4965 fails upon resume from hibernation on my laptop. The reason +seems to be a stale interrupt which isn't being cleared out before +interrupts are enabled. We end up with a race beween the resume +trying to bring things back up, and the restart work (queued form +the interrupt handler) trying to bring things down. Eventually +the whole thing blows up. + +Fix the problem by clearing out any stale interrupts before +interrupts get enabled during resume. + +Here's a debug log of the indicent: +[ 12.042589] ieee80211 phy0: il_isr ISR inta 0x00000080, enabled 0xaa00008b, fh 0x00000000 +[ 12.042625] ieee80211 phy0: il4965_irq_tasklet inta 0x00000080, enabled 0x00000000, fh 0x00000000 +[ 12.042651] iwl4965 0000:10:00.0: RF_KILL bit toggled to enable radio. +[ 12.042653] iwl4965 0000:10:00.0: On demand firmware reload +[ 12.042690] ieee80211 phy0: il4965_irq_tasklet End inta 0x00000000, enabled 0xaa00008b, fh 0x00000000, flags 0x00000282 +[ 12.052207] ieee80211 phy0: il4965_mac_start enter +[ 12.052212] ieee80211 phy0: il_prep_station Add STA to driver ID 31: ff:ff:ff:ff:ff:ff +[ 12.052244] ieee80211 phy0: il4965_set_hw_ready hardware ready +[ 12.052324] ieee80211 phy0: il_apm_init Init card's basic functions +[ 12.052348] ieee80211 phy0: il_apm_init L1 Enabled; Disabling L0S +[ 12.055727] ieee80211 phy0: il4965_load_bsm Begin load bsm +[ 12.056140] ieee80211 phy0: il4965_verify_bsm Begin verify bsm +[ 12.058642] ieee80211 phy0: il4965_verify_bsm BSM bootstrap uCode image OK +[ 12.058721] ieee80211 phy0: il4965_load_bsm BSM write complete, poll 1 iterations +[ 12.058734] ieee80211 phy0: __il4965_up iwl4965 is coming up +[ 12.058737] ieee80211 phy0: il4965_mac_start Start UP work done. +[ 12.058757] ieee80211 phy0: __il4965_down iwl4965 is going down +[ 12.058761] ieee80211 phy0: il_scan_cancel_timeout Scan cancel timeout +[ 12.058762] ieee80211 phy0: il_do_scan_abort Not performing scan to abort +[ 12.058765] ieee80211 phy0: il_clear_ucode_stations Clearing ucode stations in driver +[ 12.058767] ieee80211 phy0: il_clear_ucode_stations No active stations found to be cleared +[ 12.058819] ieee80211 phy0: _il_apm_stop Stop card, put in low power state +[ 12.058827] ieee80211 phy0: _il_apm_stop_master stop master +[ 12.058864] ieee80211 phy0: il4965_clear_free_frames 0 frames on pre-allocated heap on clear. +[ 12.058869] ieee80211 phy0: Hardware restart was requested +[ 16.132299] iwl4965 0000:10:00.0: START_ALIVE timeout after 4000ms. +[ 16.132303] ------------[ cut here ]------------ +[ 16.132304] Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue. +[ 16.132338] WARNING: CPU: 0 PID: 181 at net/mac80211/util.c:1826 ieee80211_reconfig+0x8f/0x14b0 [mac80211] +[ 16.132390] Modules linked in: ctr ccm sch_fq_codel xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc joydev mousedev btusb btrtl btintel btbcm bluetooth ecdh_generic ecc iTCO_wdt i2c_dev iwl4965 iwlegacy coretemp snd_hda_codec_analog pcspkr psmouse mac80211 snd_hda_codec_generic libarc4 sdhci_pci cqhci sha256_generic sdhci libsha256 firewire_ohci snd_hda_intel snd_intel_dspcfg mmc_core snd_hda_codec snd_hwdep firewire_core led_class iosf_mbi snd_hda_core uhci_hcd lpc_ich crc_itu_t cfg80211 ehci_pci ehci_hcd snd_pcm usbcore mfd_core rfkill snd_timer snd usb_common soundcore video parport_pc parport intel_agp wmi intel_gtt backlight e1000e agpgart evdev +[ 16.132456] CPU: 0 UID: 0 PID: 181 Comm: kworker/u8:6 Not tainted 6.11.0-cl+ #143 +[ 16.132460] Hardware name: Hewlett-Packard HP Compaq 6910p/30BE, BIOS 68MCU Ver. F.19 07/06/2010 +[ 16.132463] Workqueue: async async_run_entry_fn +[ 16.132469] RIP: 0010:ieee80211_reconfig+0x8f/0x14b0 [mac80211] +[ 16.132501] Code: da 02 00 00 c6 83 ad 05 00 00 00 48 89 df e8 98 1b fc ff 85 c0 41 89 c7 0f 84 e9 02 00 00 48 c7 c7 a0 e6 48 a0 e8 d1 77 c4 e0 <0f> 0b eb 2d 84 c0 0f 85 8b 01 00 00 c6 87 ad 05 00 00 00 e8 69 1b +[ 16.132504] RSP: 0018:ffffc9000029fcf0 EFLAGS: 00010282 +[ 16.132507] RAX: 0000000000000000 RBX: ffff8880072008e0 RCX: 0000000000000001 +[ 16.132509] RDX: ffffffff81f21a18 RSI: 0000000000000086 RDI: 0000000000000001 +[ 16.132510] RBP: ffff8880072003c0 R08: 0000000000000000 R09: 0000000000000003 +[ 16.132512] R10: 0000000000000000 R11: ffff88807e5b0000 R12: 0000000000000001 +[ 16.132514] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000ffffff92 +[ 16.132515] FS: 0000000000000000(0000) GS:ffff88807c200000(0000) knlGS:0000000000000000 +[ 16.132517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 16.132519] CR2: 000055dd43786c08 CR3: 000000000978f000 CR4: 00000000000006f0 +[ 16.132521] Call Trace: +[ 16.132525] +[ 16.132526] ? __warn+0x77/0x120 +[ 16.132532] ? ieee80211_reconfig+0x8f/0x14b0 [mac80211] +[ 16.132564] ? report_bug+0x15c/0x190 +[ 16.132568] ? handle_bug+0x36/0x70 +[ 16.132571] ? exc_invalid_op+0x13/0x60 +[ 16.132573] ? asm_exc_invalid_op+0x16/0x20 +[ 16.132579] ? ieee80211_reconfig+0x8f/0x14b0 [mac80211] +[ 16.132611] ? snd_hdac_bus_init_cmd_io+0x24/0x200 [snd_hda_core] +[ 16.132617] ? pick_eevdf+0x133/0x1c0 +[ 16.132622] ? check_preempt_wakeup_fair+0x70/0x90 +[ 16.132626] ? wakeup_preempt+0x4a/0x60 +[ 16.132628] ? ttwu_do_activate.isra.0+0x5a/0x190 +[ 16.132632] wiphy_resume+0x79/0x1a0 [cfg80211] +[ 16.132675] ? wiphy_suspend+0x2a0/0x2a0 [cfg80211] +[ 16.132697] dpm_run_callback+0x75/0x1b0 +[ 16.132703] device_resume+0x97/0x200 +[ 16.132707] async_resume+0x14/0x20 +[ 16.132711] async_run_entry_fn+0x1b/0xa0 +[ 16.132714] process_one_work+0x13d/0x350 +[ 16.132718] worker_thread+0x2be/0x3d0 +[ 16.132722] ? cancel_delayed_work_sync+0x70/0x70 +[ 16.132725] kthread+0xc0/0xf0 +[ 16.132729] ? kthread_park+0x80/0x80 +[ 16.132732] ret_from_fork+0x28/0x40 +[ 16.132735] ? kthread_park+0x80/0x80 +[ 16.132738] ret_from_fork_asm+0x11/0x20 +[ 16.132741] +[ 16.132742] ---[ end trace 0000000000000000 ]--- +[ 16.132930] ------------[ cut here ]------------ +[ 16.132932] WARNING: CPU: 0 PID: 181 at net/mac80211/driver-ops.c:41 drv_stop+0xe7/0xf0 [mac80211] +[ 16.132957] Modules linked in: ctr ccm sch_fq_codel xt_tcpudp xt_multiport xt_state iptable_filter iptable_nat nf_nat nf_conntrack nf_defrag_ipv4 ip_tables x_tables binfmt_misc joydev mousedev btusb btrtl btintel btbcm bluetooth ecdh_generic ecc iTCO_wdt i2c_dev iwl4965 iwlegacy coretemp snd_hda_codec_analog pcspkr psmouse mac80211 snd_hda_codec_generic libarc4 sdhci_pci cqhci sha256_generic sdhci libsha256 firewire_ohci snd_hda_intel snd_intel_dspcfg mmc_core snd_hda_codec snd_hwdep firewire_core led_class iosf_mbi snd_hda_core uhci_hcd lpc_ich crc_itu_t cfg80211 ehci_pci ehci_hcd snd_pcm usbcore mfd_core rfkill snd_timer snd usb_common soundcore video parport_pc parport intel_agp wmi intel_gtt backlight e1000e agpgart evdev +[ 16.133014] CPU: 0 UID: 0 PID: 181 Comm: kworker/u8:6 Tainted: G W 6.11.0-cl+ #143 +[ 16.133018] Tainted: [W]=WARN +[ 16.133019] Hardware name: Hewlett-Packard HP Compaq 6910p/30BE, BIOS 68MCU Ver. F.19 07/06/2010 +[ 16.133021] Workqueue: async async_run_entry_fn +[ 16.133025] RIP: 0010:drv_stop+0xe7/0xf0 [mac80211] +[ 16.133048] Code: 48 85 c0 74 0e 48 8b 78 08 89 ea 48 89 de e8 e0 87 04 00 65 ff 0d d1 de c4 5f 0f 85 42 ff ff ff e8 be 52 c2 e0 e9 38 ff ff ff <0f> 0b 5b 5d c3 0f 1f 40 00 41 54 49 89 fc 55 53 48 89 f3 2e 2e 2e +[ 16.133050] RSP: 0018:ffffc9000029fc50 EFLAGS: 00010246 +[ 16.133053] RAX: 0000000000000000 RBX: ffff8880072008e0 RCX: ffff88800377f6c0 +[ 16.133054] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8880072008e0 +[ 16.133056] RBP: 0000000000000000 R08: ffffffff81f238d8 R09: 0000000000000000 +[ 16.133058] R10: ffff8880080520f0 R11: 0000000000000000 R12: ffff888008051c60 +[ 16.133060] R13: ffff8880072008e0 R14: 0000000000000000 R15: ffff8880072011d8 +[ 16.133061] FS: 0000000000000000(0000) GS:ffff88807c200000(0000) knlGS:0000000000000000 +[ 16.133063] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 16.133065] CR2: 000055dd43786c08 CR3: 000000000978f000 CR4: 00000000000006f0 +[ 16.133067] Call Trace: +[ 16.133069] +[ 16.133070] ? __warn+0x77/0x120 +[ 16.133075] ? drv_stop+0xe7/0xf0 [mac80211] +[ 16.133098] ? report_bug+0x15c/0x190 +[ 16.133100] ? handle_bug+0x36/0x70 +[ 16.133103] ? exc_invalid_op+0x13/0x60 +[ 16.133105] ? asm_exc_invalid_op+0x16/0x20 +[ 16.133109] ? drv_stop+0xe7/0xf0 [mac80211] +[ 16.133132] ieee80211_do_stop+0x55a/0x810 [mac80211] +[ 16.133161] ? fq_codel_reset+0xa5/0xc0 [sch_fq_codel] +[ 16.133164] ieee80211_stop+0x4f/0x180 [mac80211] +[ 16.133192] __dev_close_many+0xa2/0x120 +[ 16.133195] dev_close_many+0x90/0x150 +[ 16.133198] dev_close+0x5d/0x80 +[ 16.133200] cfg80211_shutdown_all_interfaces+0x40/0xe0 [cfg80211] +[ 16.133223] wiphy_resume+0xb2/0x1a0 [cfg80211] +[ 16.133247] ? wiphy_suspend+0x2a0/0x2a0 [cfg80211] +[ 16.133269] dpm_run_callback+0x75/0x1b0 +[ 16.133273] device_resume+0x97/0x200 +[ 16.133277] async_resume+0x14/0x20 +[ 16.133280] async_run_entry_fn+0x1b/0xa0 +[ 16.133283] process_one_work+0x13d/0x350 +[ 16.133287] worker_thread+0x2be/0x3d0 +[ 16.133290] ? cancel_delayed_work_sync+0x70/0x70 +[ 16.133294] kthread+0xc0/0xf0 +[ 16.133296] ? kthread_park+0x80/0x80 +[ 16.133299] ret_from_fork+0x28/0x40 +[ 16.133302] ? kthread_park+0x80/0x80 +[ 16.133304] ret_from_fork_asm+0x11/0x20 +[ 16.133307] +[ 16.133308] ---[ end trace 0000000000000000 ]--- +[ 16.133335] ieee80211 phy0: PM: dpm_run_callback(): wiphy_resume [cfg80211] returns -110 +[ 16.133360] ieee80211 phy0: PM: failed to restore async: error -110 + +Cc: stable@vger.kernel.org +Cc: Stanislaw Gruszka +Cc: Kalle Valo +Cc: linux-wireless@vger.kernel.org +Signed-off-by: Ville Syrjälä +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20241001200745.8276-1-ville.syrjala@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlegacy/common.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/intel/iwlegacy/common.c ++++ b/drivers/net/wireless/intel/iwlegacy/common.c +@@ -4969,6 +4969,8 @@ il_pci_resume(struct device *device) + */ + pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00); + ++ _il_wr(il, CSR_INT, 0xffffffff); ++ _il_wr(il, CSR_FH_INT_STATUS, 0xffffffff); + il_enable_interrupts(il); + + if (!(_il_rd(il, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)) diff --git a/queue-5.4/wifi-mac80211-do-not-pass-a-stopped-vif-to-the-driver-in-.get_txpower.patch b/queue-5.4/wifi-mac80211-do-not-pass-a-stopped-vif-to-the-driver-in-.get_txpower.patch new file mode 100644 index 00000000000..bd0ae2de8db --- /dev/null +++ b/queue-5.4/wifi-mac80211-do-not-pass-a-stopped-vif-to-the-driver-in-.get_txpower.patch @@ -0,0 +1,33 @@ +From 393b6bc174b0dd21bb2a36c13b36e62fc3474a23 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Wed, 2 Oct 2024 11:56:30 +0200 +Subject: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower + +From: Felix Fietkau + +commit 393b6bc174b0dd21bb2a36c13b36e62fc3474a23 upstream. + +Avoid potentially crashing in the driver because of uninitialized private data + +Fixes: 5b3dc42b1b0d ("mac80211: add support for driver tx power reporting") +Cc: stable@vger.kernel.org +Signed-off-by: Felix Fietkau +Link: https://patch.msgid.link/20241002095630.22431-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/cfg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2575,7 +2575,8 @@ static int ieee80211_get_tx_power(struct + struct ieee80211_local *local = wiphy_priv(wiphy); + struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); + +- if (local->ops->get_txpower) ++ if (local->ops->get_txpower && ++ (sdata->flags & IEEE80211_SDATA_IN_DRIVER)) + return drv_get_txpower(local, sdata, dbm); + + if (!local->use_chanctx) diff --git a/queue-5.4/xhci-fix-link-trb-dma-in-command-ring-stopped-completion-event.patch b/queue-5.4/xhci-fix-link-trb-dma-in-command-ring-stopped-completion-event.patch new file mode 100644 index 00000000000..3e612d8186f --- /dev/null +++ b/queue-5.4/xhci-fix-link-trb-dma-in-command-ring-stopped-completion-event.patch @@ -0,0 +1,64 @@ +From 075919f6df5dd82ad0b1894898b315fbb3c29b84 Mon Sep 17 00:00:00 2001 +From: Faisal Hassan +Date: Tue, 22 Oct 2024 21:26:31 +0530 +Subject: xhci: Fix Link TRB DMA in command ring stopped completion event + +From: Faisal Hassan + +commit 075919f6df5dd82ad0b1894898b315fbb3c29b84 upstream. + +During the aborting of a command, the software receives a command +completion event for the command ring stopped, with the TRB pointing +to the next TRB after the aborted command. + +If the command we abort is located just before the Link TRB in the +command ring, then during the 'command ring stopped' completion event, +the xHC gives the Link TRB in the event's cmd DMA, which causes a +mismatch in handling command completion event. + +To address this situation, move the 'command ring stopped' completion +event check slightly earlier, since the specific command it stopped +on isn't of significant concern. + +Fixes: 7f84eef0dafb ("USB: xhci: No-op command queueing and irq handler.") +Cc: stable@vger.kernel.org +Signed-off-by: Faisal Hassan +Acked-by: Mathias Nyman +Link: https://lore.kernel.org/r/20241022155631.1185-1-quic_faisalh@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-ring.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1456,6 +1456,14 @@ static void handle_cmd_completion(struct + + trace_xhci_handle_command(xhci->cmd_ring, &cmd_trb->generic); + ++ cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status)); ++ ++ /* If CMD ring stopped we own the trbs between enqueue and dequeue */ ++ if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) { ++ complete_all(&xhci->cmd_ring_stop_completion); ++ return; ++ } ++ + cmd_dequeue_dma = xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg, + cmd_trb); + /* +@@ -1472,14 +1480,6 @@ static void handle_cmd_completion(struct + + cancel_delayed_work(&xhci->cmd_timer); + +- cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status)); +- +- /* If CMD ring stopped we own the trbs between enqueue and dequeue */ +- if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) { +- complete_all(&xhci->cmd_ring_stop_completion); +- return; +- } +- + if (cmd->command_trb != xhci->cmd_ring->dequeue) { + xhci_err(xhci, + "Command completion event does not match command\n");