From: Greg Kroah-Hartman Date: Mon, 3 Apr 2023 08:47:37 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.14.312~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=773d9ebf68bbc406593461c9da26905c8c5171b7;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch pinctrl-at91-pio4-fix-domain-name-assignment.patch xen-netback-don-t-do-grant-copy-across-page-boundary.patch --- diff --git a/queue-4.19/alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch b/queue-4.19/alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch new file mode 100644 index 00000000000..52dfb8ae7eb --- /dev/null +++ b/queue-4.19/alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch @@ -0,0 +1,59 @@ +From b871cb971c683f7f212e7ca3c9a6709a75785116 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 20 Mar 2023 15:09:54 +0100 +Subject: ALSA: hda/conexant: Partial revert of a quirk for Lenovo + +From: Takashi Iwai + +commit b871cb971c683f7f212e7ca3c9a6709a75785116 upstream. + +The recent commit f83bb2592482 ("ALSA: hda/conexant: Add quirk for +LENOVO 20149 Notebook model") introduced a quirk for the device with +17aa:3977, but this caused a regression on another model (Lenovo +Ideadpad U31) with the very same PCI SSID. And, through skimming over +the net, it seems that this PCI SSID is used for multiple different +models, so it's no good idea to apply the quirk with the SSID. + +Although we may take a different ID check (e.g. the codec SSID instead +of the PCI SSID), unfortunately, the original patch author couldn't +identify the hardware details any longer as the machine was returned, +and we can't develop the further proper fix. + +In this patch, instead, we partially revert the change so that the +quirk won't be applied as default for addressing the regression. +Meanwhile, the quirk function itself is kept, and it's now made to be +applicable via the explicit model=lenovo-20149 option. + +Fixes: f83bb2592482 ("ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model") +Reported-by: Jetro Jormalainen +Link: https://lore.kernel.org/r/20230308215009.4d3e58a6@mopti +Cc: +Link: https://lore.kernel.org/r/20230320140954.31154-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_conexant.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -952,7 +952,10 @@ static const struct snd_pci_quirk cxt506 + SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), +- SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NOTEBOOK), ++ /* NOTE: we'd need to extend the quirk for 17aa:3977 as the same ++ * PCI SSID is used on multiple Lenovo models ++ */ ++ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), +@@ -974,6 +977,7 @@ static const struct hda_model_fixup cxt5 + { .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" }, + { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" }, + { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" }, ++ { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, + {} + }; + diff --git a/queue-4.19/alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch b/queue-4.19/alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch new file mode 100644 index 00000000000..0fa0f7f36d4 --- /dev/null +++ b/queue-4.19/alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch @@ -0,0 +1,46 @@ +From fa4e7a6fa12b1132340785e14bd439cbe95b7a5a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 24 Mar 2023 08:50:05 +0100 +Subject: ALSA: usb-audio: Fix regression on detection of Roland VS-100 + +From: Takashi Iwai + +commit fa4e7a6fa12b1132340785e14bd439cbe95b7a5a upstream. + +It's been reported that the recent kernel can't probe the PCM devices +on Roland VS-100 properly, and it turned out to be a regression by the +recent addition of the bit shift range check for the format bits. +In the old code, we just did bit-shift and it resulted in zero, which +is then corrected to the standard PCM format, while the new code +explicitly returns an error in such a case. + +For addressing the regression, relax the check and fallback to the +standard PCM type (with the info output). + +Fixes: 43d5ca88dfcd ("ALSA: usb-audio: Fix potential out-of-bounds shift") +Cc: +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217084 +Link: https://lore.kernel.org/r/20230324075005.19403-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/format.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/usb/format.c ++++ b/sound/usb/format.c +@@ -53,8 +53,12 @@ static u64 parse_audio_format_i_type(str + case UAC_VERSION_1: + default: { + struct uac_format_type_i_discrete_descriptor *fmt = _fmt; +- if (format >= 64) +- return 0; /* invalid format */ ++ if (format >= 64) { ++ usb_audio_info(chip, ++ "%u:%d: invalid format type 0x%llx is detected, processed as PCM\n", ++ fp->iface, fp->altsetting, format); ++ format = UAC_FORMAT_TYPE_I_PCM; ++ } + sample_width = fmt->bBitResolution; + sample_bytes = fmt->bSubframeSize; + format = 1ULL << format; diff --git a/queue-4.19/drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch b/queue-4.19/drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch new file mode 100644 index 00000000000..272a86953bf --- /dev/null +++ b/queue-4.19/drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch @@ -0,0 +1,41 @@ +From 963b2e8c428f79489ceeb058e8314554ec9cbe6f Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Fri, 24 Feb 2023 18:21:54 +0100 +Subject: drm/etnaviv: fix reference leak when mmaping imported buffer + +From: Lucas Stach + +commit 963b2e8c428f79489ceeb058e8314554ec9cbe6f upstream. + +drm_gem_prime_mmap() takes a reference on the GEM object, but before that +drm_gem_mmap_obj() already takes a reference, which will be leaked as only +one reference is dropped when the mapping is closed. Drop the extra +reference when dma_buf_mmap() succeeds. + +Cc: stable@vger.kernel.org +Signed-off-by: Lucas Stach +Reviewed-by: Christian Gmeiner +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c +@@ -91,7 +91,15 @@ static void *etnaviv_gem_prime_vmap_impl + static int etnaviv_gem_prime_mmap_obj(struct etnaviv_gem_object *etnaviv_obj, + struct vm_area_struct *vma) + { +- return dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); ++ int ret; ++ ++ ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0); ++ if (!ret) { ++ /* Drop the reference acquired by drm_gem_mmap_obj(). */ ++ drm_gem_object_put(&etnaviv_obj->base); ++ } ++ ++ return ret; + } + + static const struct etnaviv_gem_ops etnaviv_gem_prime_ops = { diff --git a/queue-4.19/pinctrl-at91-pio4-fix-domain-name-assignment.patch b/queue-4.19/pinctrl-at91-pio4-fix-domain-name-assignment.patch new file mode 100644 index 00000000000..7ea4b35b8f6 --- /dev/null +++ b/queue-4.19/pinctrl-at91-pio4-fix-domain-name-assignment.patch @@ -0,0 +1,39 @@ +From 7bb97e360acdd38b68ad0a1defb89c6e89c85596 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 24 Feb 2023 14:08:28 +0100 +Subject: pinctrl: at91-pio4: fix domain name assignment + +From: Johan Hovold + +commit 7bb97e360acdd38b68ad0a1defb89c6e89c85596 upstream. + +Since commit d59f6617eef0 ("genirq: Allow fwnode to carry name +information only") an IRQ domain is always given a name during +allocation (e.g. used for the debugfs entry). + +Drop the no longer valid name assignment, which would lead to an attempt +to free a string constant when removing the domain on late probe +failures (e.g. probe deferral). + +Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only") +Cc: stable@vger.kernel.org # 4.13 +Signed-off-by: Johan Hovold +Reviewed-by: Claudiu Beznea +Tested-by: Claudiu Beznea # on SAMA7G5 +Link: https://lore.kernel.org/r/20230224130828.27985-1-johan+linaro@kernel.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -1080,7 +1080,6 @@ static int atmel_pinctrl_probe(struct pl + dev_err(dev, "can't add the irq domain\n"); + return -ENODEV; + } +- atmel_pioctrl->irq_domain->name = "atmel gpio"; + + for (i = 0; i < atmel_pioctrl->npins; i++) { + int irq = irq_create_mapping(atmel_pioctrl->irq_domain, i); diff --git a/queue-4.19/series b/queue-4.19/series index 68811760df8..372682b5830 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -70,3 +70,8 @@ input-alps-fix-compatibility-with-funsigned-char.patch input-focaltech-use-explicitly-signed-char-type.patch cifs-prevent-infinite-recursion-in-cifsgetdfsrefer.patch cifs-fix-dfs-traversal-oops-without-config_cifs_dfs_upcall.patch +xen-netback-don-t-do-grant-copy-across-page-boundary.patch +pinctrl-at91-pio4-fix-domain-name-assignment.patch +alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch +alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch +drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch diff --git a/queue-4.19/xen-netback-don-t-do-grant-copy-across-page-boundary.patch b/queue-4.19/xen-netback-don-t-do-grant-copy-across-page-boundary.patch new file mode 100644 index 00000000000..171069d6417 --- /dev/null +++ b/queue-4.19/xen-netback-don-t-do-grant-copy-across-page-boundary.patch @@ -0,0 +1,118 @@ +From 05310f31ca74673a96567fb14637b7d5d6c82ea5 Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Mon, 27 Mar 2023 10:36:45 +0200 +Subject: xen/netback: don't do grant copy across page boundary + +From: Juergen Gross + +commit 05310f31ca74673a96567fb14637b7d5d6c82ea5 upstream. + +Fix xenvif_get_requests() not to do grant copy operations across local +page boundaries. This requires to double the maximum number of copy +operations per queue, as each copy could now be split into 2. + +Make sure that struct xenvif_tx_cb doesn't grow too large. + +Cc: stable@vger.kernel.org +Fixes: ad7f402ae4f4 ("xen/netback: Ensure protocol headers don't fall in the non-linear area") +Signed-off-by: Juergen Gross +Reviewed-by: Paul Durrant +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netback/common.h | 2 +- + drivers/net/xen-netback/netback.c | 25 +++++++++++++++++++++++-- + 2 files changed, 24 insertions(+), 3 deletions(-) + +--- a/drivers/net/xen-netback/common.h ++++ b/drivers/net/xen-netback/common.h +@@ -166,7 +166,7 @@ struct xenvif_queue { /* Per-queue data + struct pending_tx_info pending_tx_info[MAX_PENDING_REQS]; + grant_handle_t grant_tx_handle[MAX_PENDING_REQS]; + +- struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS]; ++ struct gnttab_copy tx_copy_ops[2 * MAX_PENDING_REQS]; + struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS]; + struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS]; + /* passed to gnttab_[un]map_refs with pages under (un)mapping */ +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -327,6 +327,7 @@ static int xenvif_count_requests(struct + struct xenvif_tx_cb { + u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1]; + u8 copy_count; ++ u32 split_mask; + }; + + #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb) +@@ -354,6 +355,8 @@ static inline struct sk_buff *xenvif_all + struct sk_buff *skb = + alloc_skb(size + NET_SKB_PAD + NET_IP_ALIGN, + GFP_ATOMIC | __GFP_NOWARN); ++ ++ BUILD_BUG_ON(sizeof(*XENVIF_TX_CB(skb)) > sizeof(skb->cb)); + if (unlikely(skb == NULL)) + return NULL; + +@@ -389,11 +392,13 @@ static void xenvif_get_requests(struct x + nr_slots = shinfo->nr_frags + 1; + + copy_count(skb) = 0; ++ XENVIF_TX_CB(skb)->split_mask = 0; + + /* Create copy ops for exactly data_len bytes into the skb head. */ + __skb_put(skb, data_len); + while (data_len > 0) { + int amount = data_len > txp->size ? txp->size : data_len; ++ bool split = false; + + cop->source.u.ref = txp->gref; + cop->source.domid = queue->vif->domid; +@@ -406,6 +411,13 @@ static void xenvif_get_requests(struct x + cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb) + - data_len); + ++ /* Don't cross local page boundary! */ ++ if (cop->dest.offset + amount > XEN_PAGE_SIZE) { ++ amount = XEN_PAGE_SIZE - cop->dest.offset; ++ XENVIF_TX_CB(skb)->split_mask |= 1U << copy_count(skb); ++ split = true; ++ } ++ + cop->len = amount; + cop->flags = GNTCOPY_source_gref; + +@@ -413,7 +425,8 @@ static void xenvif_get_requests(struct x + pending_idx = queue->pending_ring[index]; + callback_param(queue, pending_idx).ctx = NULL; + copy_pending_idx(skb, copy_count(skb)) = pending_idx; +- copy_count(skb)++; ++ if (!split) ++ copy_count(skb)++; + + cop++; + data_len -= amount; +@@ -434,7 +447,8 @@ static void xenvif_get_requests(struct x + nr_slots--; + } else { + /* The copy op partially covered the tx_request. +- * The remainder will be mapped. ++ * The remainder will be mapped or copied in the next ++ * iteration. + */ + txp->offset += amount; + txp->size -= amount; +@@ -532,6 +546,13 @@ static int xenvif_tx_check_gop(struct xe + pending_idx = copy_pending_idx(skb, i); + + newerr = (*gopp_copy)->status; ++ ++ /* Split copies need to be handled together. */ ++ if (XENVIF_TX_CB(skb)->split_mask & (1U << i)) { ++ (*gopp_copy)++; ++ if (!newerr) ++ newerr = (*gopp_copy)->status; ++ } + if (likely(!newerr)) { + /* The first frag might still have this slot mapped */ + if (i < copy_count(skb) - 1 || !sharedslot)