From: Sasha Levin Date: Sun, 2 Feb 2025 04:05:23 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v6.6.76~70 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=81acf6d4e459bc4458ba18877d27952e1b843235;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/afs-fix-directory-format-encoding-struct.patch b/queue-5.4/afs-fix-directory-format-encoding-struct.patch new file mode 100644 index 0000000000..ee3cc011d7 --- /dev/null +++ b/queue-5.4/afs-fix-directory-format-encoding-struct.patch @@ -0,0 +1,45 @@ +From adc06b9c6586b3986be8263a564d326aa0a85a9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Dec 2024 20:41:03 +0000 +Subject: afs: Fix directory format encoding struct + +From: David Howells + +[ Upstream commit 07a10767853adcbdbf436dc91393b729b52c4e81 ] + +The AFS directory format structure, union afs_xdr_dir_block::meta, has too +many alloc counter slots declared and so pushes the hash table along and +over the data. This doesn't cause a problem at the moment because I'm +currently ignoring the hash table and only using the correct number of +alloc_ctrs in the code anyway. In future, however, I should start using +the hash table to try and speed up afs_lookup(). + +Fix this by using the correct constant to declare the counter array. + +Fixes: 4ea219a839bf ("afs: Split the directory content defs into a header") +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20241216204124.3752367-14-dhowells@redhat.com +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/afs/xdr_fs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/afs/xdr_fs.h b/fs/afs/xdr_fs.h +index 94f1f398eefad..cccc8e74f49b0 100644 +--- a/fs/afs/xdr_fs.h ++++ b/fs/afs/xdr_fs.h +@@ -82,7 +82,7 @@ union afs_xdr_dir_block { + + struct { + struct afs_xdr_dir_hdr hdr; +- u8 alloc_ctrs[AFS_DIR_MAX_BLOCKS]; ++ u8 alloc_ctrs[AFS_DIR_BLOCKS_WITH_CTR]; + __be16 hashtable[AFS_DIR_HASHTBL_SIZE]; + } meta; + +-- +2.39.5 + diff --git a/queue-5.4/arm-dts-mediatek-mt7623-fix-ir-nodename.patch b/queue-5.4/arm-dts-mediatek-mt7623-fix-ir-nodename.patch new file mode 100644 index 0000000000..51679d7400 --- /dev/null +++ b/queue-5.4/arm-dts-mediatek-mt7623-fix-ir-nodename.patch @@ -0,0 +1,42 @@ +From 3e5148e281a367d8c892c23936204e0ff547ceff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2024 11:46:33 +0200 +Subject: ARM: dts: mediatek: mt7623: fix IR nodename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 90234cf9b37c57201a24b78c217a91a8af774109 ] + +Fix following validation error: +arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: cir@10013000: $nodename:0: 'cir@10013000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$' + from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml# + +Fixes: 91044f38dae7 ("arm: dts: mt7623: add ir nodes to the mt7623.dtsi file") +Cc: linux-media@vger.kernel.org +Signed-off-by: Rafał Miłecki +Link: https://lore.kernel.org/r/20240617094634.23173-1-zajec5@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/mt7623.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/mt7623.dtsi b/arch/arm/boot/dts/mt7623.dtsi +index a79f0b6c34293..2f9154c13ea89 100644 +--- a/arch/arm/boot/dts/mt7623.dtsi ++++ b/arch/arm/boot/dts/mt7623.dtsi +@@ -320,7 +320,7 @@ + clock-names = "spi", "wrap"; + }; + +- cir: cir@10013000 { ++ cir: ir-receiver@10013000 { + compatible = "mediatek,mt7623-cir"; + reg = <0 0x10013000 0 0x1000>; + interrupts = ; +-- +2.39.5 + diff --git a/queue-5.4/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch b/queue-5.4/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch new file mode 100644 index 0000000000..3b6c89c240 --- /dev/null +++ b/queue-5.4/arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch @@ -0,0 +1,214 @@ +From 0668dfb74526154f5b6b5bc41394f750105e9887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2024 13:24:20 +0800 +Subject: arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property + +From: Chen-Yu Tsai + +[ Upstream commit a6d5983e40f5d5b219337569cdd269727f5a3e2e ] + +The "regulator-compatible" property has been deprecated since 2012 in +commit 13511def87b9 ("regulator: deprecate regulator-compatible DT +property"), which is so old it's not even mentioned in the converted +regulator bindings YAML file. It is also not listed in the MT6397 +regulator bindings. Having them present produces a whole bunch of +validation errors: + + Unevaluated properties are not allowed ('regulator-compatible' was unexpected) + +Drop the "regulator-compatible" property from the board dts. The +property values are the same as the node name, so everything should +continue to work. + +Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20241211052427.4178367-3-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 23 --------------------- + 1 file changed, 23 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +index 2b66afcf026e1..66f0e5b24fda4 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +@@ -307,7 +307,6 @@ + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +- regulator-compatible = "buck_vpca15"; + regulator-name = "vpca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -316,7 +315,6 @@ + }; + + mt6397_vpca7_reg: buck_vpca7 { +- regulator-compatible = "buck_vpca7"; + regulator-name = "vpca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -325,7 +323,6 @@ + }; + + mt6397_vsramca15_reg: buck_vsramca15 { +- regulator-compatible = "buck_vsramca15"; + regulator-name = "vsramca15"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -334,7 +331,6 @@ + }; + + mt6397_vsramca7_reg: buck_vsramca7 { +- regulator-compatible = "buck_vsramca7"; + regulator-name = "vsramca7"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -343,7 +339,6 @@ + }; + + mt6397_vcore_reg: buck_vcore { +- regulator-compatible = "buck_vcore"; + regulator-name = "vcore"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -352,7 +347,6 @@ + }; + + mt6397_vgpu_reg: buck_vgpu { +- regulator-compatible = "buck_vgpu"; + regulator-name = "vgpu"; + regulator-min-microvolt = < 700000>; + regulator-max-microvolt = <1350000>; +@@ -361,7 +355,6 @@ + }; + + mt6397_vdrm_reg: buck_vdrm { +- regulator-compatible = "buck_vdrm"; + regulator-name = "vdrm"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1400000>; +@@ -370,7 +363,6 @@ + }; + + mt6397_vio18_reg: buck_vio18 { +- regulator-compatible = "buck_vio18"; + regulator-name = "vio18"; + regulator-min-microvolt = <1620000>; + regulator-max-microvolt = <1980000>; +@@ -379,19 +371,16 @@ + }; + + mt6397_vtcxo_reg: ldo_vtcxo { +- regulator-compatible = "ldo_vtcxo"; + regulator-name = "vtcxo"; + regulator-always-on; + }; + + mt6397_va28_reg: ldo_va28 { +- regulator-compatible = "ldo_va28"; + regulator-name = "va28"; + regulator-always-on; + }; + + mt6397_vcama_reg: ldo_vcama { +- regulator-compatible = "ldo_vcama"; + regulator-name = "vcama"; + regulator-min-microvolt = <1500000>; + regulator-max-microvolt = <2800000>; +@@ -399,18 +388,15 @@ + }; + + mt6397_vio28_reg: ldo_vio28 { +- regulator-compatible = "ldo_vio28"; + regulator-name = "vio28"; + regulator-always-on; + }; + + mt6397_vusb_reg: ldo_vusb { +- regulator-compatible = "ldo_vusb"; + regulator-name = "vusb"; + }; + + mt6397_vmc_reg: ldo_vmc { +- regulator-compatible = "ldo_vmc"; + regulator-name = "vmc"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; +@@ -418,7 +404,6 @@ + }; + + mt6397_vmch_reg: ldo_vmch { +- regulator-compatible = "ldo_vmch"; + regulator-name = "vmch"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -426,7 +411,6 @@ + }; + + mt6397_vemc_3v3_reg: ldo_vemc3v3 { +- regulator-compatible = "ldo_vemc3v3"; + regulator-name = "vemc_3v3"; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3300000>; +@@ -434,7 +418,6 @@ + }; + + mt6397_vgp1_reg: ldo_vgp1 { +- regulator-compatible = "ldo_vgp1"; + regulator-name = "vcamd"; + regulator-min-microvolt = <1220000>; + regulator-max-microvolt = <3300000>; +@@ -442,7 +425,6 @@ + }; + + mt6397_vgp2_reg: ldo_vgp2 { +- regulator-compatible = "ldo_vgp2"; + regulator-name = "vcamio"; + regulator-min-microvolt = <1000000>; + regulator-max-microvolt = <3300000>; +@@ -450,7 +432,6 @@ + }; + + mt6397_vgp3_reg: ldo_vgp3 { +- regulator-compatible = "ldo_vgp3"; + regulator-name = "vcamaf"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -458,7 +439,6 @@ + }; + + mt6397_vgp4_reg: ldo_vgp4 { +- regulator-compatible = "ldo_vgp4"; + regulator-name = "vgp4"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -466,7 +446,6 @@ + }; + + mt6397_vgp5_reg: ldo_vgp5 { +- regulator-compatible = "ldo_vgp5"; + regulator-name = "vgp5"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3000000>; +@@ -474,7 +453,6 @@ + }; + + mt6397_vgp6_reg: ldo_vgp6 { +- regulator-compatible = "ldo_vgp6"; + regulator-name = "vgp6"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <3300000>; +@@ -482,7 +460,6 @@ + }; + + mt6397_vibr_reg: ldo_vibr { +- regulator-compatible = "ldo_vibr"; + regulator-name = "vibr"; + regulator-min-microvolt = <1300000>; + regulator-max-microvolt = <3300000>; +-- +2.39.5 + diff --git a/queue-5.4/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch b/queue-5.4/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch new file mode 100644 index 0000000000..a553a9fe0b --- /dev/null +++ b/queue-5.4/arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch @@ -0,0 +1,40 @@ +From d7f05d25f7177868c8d6ecf2974343ce1c15203e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 17:26:13 +0800 +Subject: arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names + +From: Chen-Yu Tsai + +[ Upstream commit 9545ba142865b9099d43c972b9ebcf463606499a ] + +The MT6397 PMIC bindings specify exact names for its sub-nodes. The +names used in the current dts don't match, causing a validation error. + +Fix up the names. Also drop the label for the regulators node, since +any reference should be against the individual regulator sub-nodes. + +Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20241210092614.3951748-2-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +index 66f0e5b24fda4..1158bee050e13 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts +@@ -303,7 +303,7 @@ + interrupt-controller; + #interrupt-cells = <2>; + +- mt6397regulator: mt6397regulator { ++ regulators { + compatible = "mediatek,mt6397-regulator"; + + mt6397_vpca15_reg: buck_vpca15 { +-- +2.39.5 + diff --git a/queue-5.4/asoc-sun4i-spdif-add-clock-multiplier-settings.patch b/queue-5.4/asoc-sun4i-spdif-add-clock-multiplier-settings.patch new file mode 100644 index 0000000000..f1d0ade219 --- /dev/null +++ b/queue-5.4/asoc-sun4i-spdif-add-clock-multiplier-settings.patch @@ -0,0 +1,86 @@ +From 2c0590d6a5a7fe4d128e9e62f3ab0293ffdce55f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2024 17:55:29 +0100 +Subject: ASoC: sun4i-spdif: Add clock multiplier settings + +From: George Lander + +[ Upstream commit 0a2319308de88b9e819c0b43d0fccd857123eb31 ] + +There have been intermittent issues with the SPDIF output on H3 +and H2+ devices which has been fixed by setting the s_clk to 4 +times the audio pll. +Add a quirk for the clock multiplier as not every supported SoC +requires it. Without the multiplier, the audio at normal sampling +rates was distorted and did not play at higher sampling rates. + +Fixes: 1bd92af877ab ("ASoC: sun4i-spdif: Add support for the H3 SoC") +Signed-off-by: George Lander +Signed-off-by: Marcus Cooper +Link: https://patch.msgid.link/20241111165600.57219-2-codekipper@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-spdif.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c +index 680d64e0d69f4..82f3a3e37e910 100644 +--- a/sound/soc/sunxi/sun4i-spdif.c ++++ b/sound/soc/sunxi/sun4i-spdif.c +@@ -175,6 +175,7 @@ struct sun4i_spdif_quirks { + unsigned int reg_dac_txdata; + bool has_reset; + unsigned int val_fctl_ftx; ++ unsigned int mclk_multiplier; + }; + + struct sun4i_spdif_dev { +@@ -311,6 +312,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream, + default: + return -EINVAL; + } ++ mclk *= host->quirks->mclk_multiplier; + + ret = clk_set_rate(host->spdif_clk, mclk); + if (ret < 0) { +@@ -345,6 +347,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream, + default: + return -EINVAL; + } ++ mclk_div *= host->quirks->mclk_multiplier; + + reg_val = 0; + reg_val |= SUN4I_SPDIF_TXCFG_ASS; +@@ -427,24 +430,28 @@ static struct snd_soc_dai_driver sun4i_spdif_dai = { + static const struct sun4i_spdif_quirks sun4i_a10_spdif_quirks = { + .reg_dac_txdata = SUN4I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, ++ .mclk_multiplier = 1, + }; + + static const struct sun4i_spdif_quirks sun6i_a31_spdif_quirks = { + .reg_dac_txdata = SUN4I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 1, + }; + + static const struct sun4i_spdif_quirks sun8i_h3_spdif_quirks = { + .reg_dac_txdata = SUN8I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 4, + }; + + static const struct sun4i_spdif_quirks sun50i_h6_spdif_quirks = { + .reg_dac_txdata = SUN8I_SPDIF_TXFIFO, + .val_fctl_ftx = SUN50I_H6_SPDIF_FCTL_FTX, + .has_reset = true, ++ .mclk_multiplier = 1, + }; + + static const struct of_device_id sun4i_spdif_of_match[] = { +-- +2.39.5 + diff --git a/queue-5.4/bpf-send-signals-asynchronously-if-preemptible.patch b/queue-5.4/bpf-send-signals-asynchronously-if-preemptible.patch new file mode 100644 index 0000000000..e1b580488a --- /dev/null +++ b/queue-5.4/bpf-send-signals-asynchronously-if-preemptible.patch @@ -0,0 +1,42 @@ +From dc22efa8245fbbd48a91523f116aabbec737937d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 10:36:47 +0000 +Subject: bpf: Send signals asynchronously if !preemptible + +From: Puranjay Mohan + +[ Upstream commit 87c544108b612512b254c8f79aa5c0a8546e2cc4 ] + +BPF programs can execute in all kinds of contexts and when a program +running in a non-preemptible context uses the bpf_send_signal() kfunc, +it will cause issues because this kfunc can sleep. +Change `irqs_disabled()` to `!preemptible()`. + +Reported-by: syzbot+97da3d7e0112d59971de@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/67486b09.050a0220.253251.0084.GAE@google.com/ +Fixes: 1bc7896e9ef4 ("bpf: Fix deadlock with rq_lock in bpf_send_signal()") +Signed-off-by: Puranjay Mohan +Acked-by: Yonghong Song +Link: https://lore.kernel.org/r/20250115103647.38487-1-puranjay@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 4a31763a8c5d7..ac3125d0c73f1 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -653,7 +653,7 @@ BPF_CALL_1(bpf_send_signal, u32, sig) + if (unlikely(is_global_init(current))) + return -EPERM; + +- if (irqs_disabled()) { ++ if (!preemptible()) { + /* Do an early check on signal validity. Otherwise, + * the error is lost in deferred irq_work. + */ +-- +2.39.5 + diff --git a/queue-5.4/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch b/queue-5.4/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch new file mode 100644 index 0000000000..31d834c413 --- /dev/null +++ b/queue-5.4/clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch @@ -0,0 +1,41 @@ +From 77c901cbdbc4095ea232d95fe6ed39c591a4d72b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2024 23:16:39 -0700 +Subject: clk: analogbits: Fix incorrect calculation of vco rate delta + +From: Bo Gan + +[ Upstream commit d7f12857f095ef38523399d47e68787b357232f6 ] + +In wrpll_configure_for_rate() we try to determine the best PLL +configuration for a target rate. However, in the loop where we try +values of R, we should compare the derived `vco` with `target_vco_rate`. +However, we were in fact comparing it with `target_rate`, which is +actually after Q shift. This is incorrect, and sometimes can result in +suboptimal clock rates. Fix it. + +Fixes: 7b9487a9a5c4 ("clk: analogbits: add Wide-Range PLL library") +Signed-off-by: Bo Gan +Link: https://lore.kernel.org/r/20240830061639.2316-1-ganboing@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/analogbits/wrpll-cln28hpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/analogbits/wrpll-cln28hpc.c b/drivers/clk/analogbits/wrpll-cln28hpc.c +index 776ead319ae9c..9df572579afb4 100644 +--- a/drivers/clk/analogbits/wrpll-cln28hpc.c ++++ b/drivers/clk/analogbits/wrpll-cln28hpc.c +@@ -287,7 +287,7 @@ int wrpll_configure_for_rate(struct wrpll_cfg *c, u32 target_rate, + vco = vco_pre * f; + } + +- delta = abs(target_rate - vco); ++ delta = abs(target_vco_rate - vco); + if (delta < best_delta) { + best_delta = delta; + best_r = r; +-- +2.39.5 + diff --git a/queue-5.4/cpupower-fix-tsc-mhz-calculation.patch b/queue-5.4/cpupower-fix-tsc-mhz-calculation.patch new file mode 100644 index 0000000000..7328529e0c --- /dev/null +++ b/queue-5.4/cpupower-fix-tsc-mhz-calculation.patch @@ -0,0 +1,114 @@ +From ee746a77e11d7de0420959a893ab3fd5811e9d5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 10:14:59 +0800 +Subject: cpupower: fix TSC MHz calculation + +From: He Rongguang + +[ Upstream commit 9d6c0e58514f8b57cd9c2c755e41623d6a966025 ] + +Commit 'cpupower: Make TSC read per CPU for Mperf monitor' (c2adb1877b7) +changes TSC counter reads per cpu, but left time diff global (from start +of all cpus to end of all cpus), thus diff(time) is too large for a +cpu's tsc counting, resulting in far less than acutal TSC_Mhz and thus +`cpupower monitor` showing far less than actual cpu realtime frequency. + +/proc/cpuinfo shows frequency: +cat /proc/cpuinfo | egrep -e 'processor' -e 'MHz' +... +processor : 171 +cpu MHz : 4108.498 +... + +before fix (System 100% busy): + | Mperf || Idle_Stats + CPU| C0 | Cx | Freq || POLL | C1 | C2 + 171| 0.77| 99.23| 2279|| 0.00| 0.00| 0.00 + +after fix (System 100% busy): + | Mperf || Idle_Stats + CPU| C0 | Cx | Freq || POLL | C1 | C2 + 171| 0.46| 99.54| 4095|| 0.00| 0.00| 0.00 + +Fixes: c2adb1877b76 ("cpupower: Make TSC read per CPU for Mperf monitor") +Signed-off-by: He Rongguang +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../cpupower/utils/idle_monitor/mperf_monitor.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c +index 7a76d63003748..0e8c0b879d4b2 100644 +--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c ++++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c +@@ -29,7 +29,7 @@ static int mperf_get_count_percent(unsigned int self_id, double *percent, + unsigned int cpu); + static int mperf_get_count_freq(unsigned int id, unsigned long long *count, + unsigned int cpu); +-static struct timespec time_start, time_end; ++static struct timespec *time_start, *time_end; + + static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = { + { +@@ -135,7 +135,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent, + dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n", + mperf_cstates[id].name, mperf_diff, tsc_diff); + } else if (max_freq_mode == MAX_FREQ_SYSFS) { +- timediff = max_frequency * timespec_diff_us(time_start, time_end); ++ timediff = max_frequency * timespec_diff_us(time_start[cpu], time_end[cpu]); + *percent = 100.0 * mperf_diff / timediff; + dprint("%s: MAXFREQ - mperf_diff: %llu, time_diff: %llu\n", + mperf_cstates[id].name, mperf_diff, timediff); +@@ -168,7 +168,7 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count, + if (max_freq_mode == MAX_FREQ_TSC_REF) { + /* Calculate max_freq from TSC count */ + tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu]; +- time_diff = timespec_diff_us(time_start, time_end); ++ time_diff = timespec_diff_us(time_start[cpu], time_end[cpu]); + max_frequency = tsc_diff / time_diff; + } + +@@ -187,9 +187,8 @@ static int mperf_start(void) + { + int cpu; + +- clock_gettime(CLOCK_REALTIME, &time_start); +- + for (cpu = 0; cpu < cpu_count; cpu++) { ++ clock_gettime(CLOCK_REALTIME, &time_start[cpu]); + mperf_get_tsc(&tsc_at_measure_start[cpu]); + mperf_init_stats(cpu); + } +@@ -204,9 +203,9 @@ static int mperf_stop(void) + for (cpu = 0; cpu < cpu_count; cpu++) { + mperf_measure_stats(cpu); + mperf_get_tsc(&tsc_at_measure_end[cpu]); ++ clock_gettime(CLOCK_REALTIME, &time_end[cpu]); + } + +- clock_gettime(CLOCK_REALTIME, &time_end); + return 0; + } + +@@ -307,6 +306,8 @@ struct cpuidle_monitor *mperf_register(void) + aperf_current_count = calloc(cpu_count, sizeof(unsigned long long)); + tsc_at_measure_start = calloc(cpu_count, sizeof(unsigned long long)); + tsc_at_measure_end = calloc(cpu_count, sizeof(unsigned long long)); ++ time_start = calloc(cpu_count, sizeof(struct timespec)); ++ time_end = calloc(cpu_count, sizeof(struct timespec)); + mperf_monitor.name_len = strlen(mperf_monitor.name); + return &mperf_monitor; + } +@@ -319,6 +320,8 @@ void mperf_unregister(void) + free(aperf_current_count); + free(tsc_at_measure_start); + free(tsc_at_measure_end); ++ free(time_start); ++ free(time_end); + free(is_valid); + } + +-- +2.39.5 + diff --git a/queue-5.4/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch b/queue-5.4/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch new file mode 100644 index 0000000000..00267058a8 --- /dev/null +++ b/queue-5.4/dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch @@ -0,0 +1,55 @@ +From a2b02ecf9798f8f96514658ac69a3466f333de98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2024 11:05:07 +0900 +Subject: dmaengine: ti: edma: fix OF node reference leaks in edma_driver + +From: Joe Hattori + +[ Upstream commit e883c64778e5a9905fce955681f8ee38c7197e0f ] + +The .probe() of edma_driver calls of_parse_phandle_with_fixed_args() but +does not release the obtained OF nodes. Thus add a of_node_put() call. + +This bug was found by an experimental verification tool that I am +developing. + +Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding") +Signed-off-by: Joe Hattori +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/20241219020507.1983124-3-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/edma.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c +index b570f08888eeb..01089e5c565f3 100644 +--- a/drivers/dma/ti/edma.c ++++ b/drivers/dma/ti/edma.c +@@ -217,7 +217,6 @@ struct edma_desc { + struct edma_cc; + + struct edma_tc { +- struct device_node *node; + u16 id; + }; + +@@ -2414,13 +2413,13 @@ static int edma_probe(struct platform_device *pdev) + if (ret || i == ecc->num_tc) + break; + +- ecc->tc_list[i].node = tc_args.np; + ecc->tc_list[i].id = i; + queue_priority_mapping[i][1] = tc_args.args[0]; + if (queue_priority_mapping[i][1] > lowest_priority) { + lowest_priority = queue_priority_mapping[i][1]; + info->default_queue = i; + } ++ of_node_put(tc_args.np); + } + } + +-- +2.39.5 + diff --git a/queue-5.4/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch b/queue-5.4/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch new file mode 100644 index 0000000000..75dda2f38c --- /dev/null +++ b/queue-5.4/drm-amdgpu-fix-potential-null-pointer-dereference-in.patch @@ -0,0 +1,44 @@ +From 8404991baf1098a8f1a300acc043f9451b6f1900 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 11:00:43 +0300 +Subject: drm/amdgpu: Fix potential NULL pointer dereference in + atomctrl_get_smc_sclk_range_table + +From: Ivan Stepchenko + +[ Upstream commit 357445e28ff004d7f10967aa93ddb4bffa5c3688 ] + +The function atomctrl_get_smc_sclk_range_table() does not check the return +value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to +retrieve SMU_Info table, it returns NULL which is later dereferenced. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +In practice this should never happen as this code only gets called +on polaris chips and the vbios data table will always be present on +those chips. + +Fixes: a23eefa2f461 ("drm/amd/powerplay: enable dpm for baffin.") +Signed-off-by: Ivan Stepchenko +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c +index 01dc46dc9c8a0..ec680695ed03d 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c +@@ -1369,6 +1369,8 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctr + GetIndexIntoMasterTable(DATA, SMU_Info), + &size, &frev, &crev); + ++ if (!psmu_info) ++ return -EINVAL; + + for (i = 0; i < psmu_info->ucSclkEntryNum; i++) { + table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting; +-- +2.39.5 + diff --git a/queue-5.4/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch b/queue-5.4/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch new file mode 100644 index 0000000000..b5a1d24640 --- /dev/null +++ b/queue-5.4/drm-etnaviv-fix-page-property-being-used-for-non-wri.patch @@ -0,0 +1,60 @@ +From 42aa3dcecb90df9486916bcb6217da87a6374c2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2024 08:41:56 +0800 +Subject: drm/etnaviv: Fix page property being used for non writecombine + buffers + +From: Sui Jingfeng + +[ Upstream commit 834f304192834d6f0941954f3277ae0ba11a9a86 ] + +In the etnaviv_gem_vmap_impl() function, the driver vmap whatever buffers +with write combine(WC) page property, this is incorrect. Cached buffers +should be mapped with the cached page property and uncached buffers should +be mapped with the uncached page property. + +Fixes: a0a5ab3e99b8 ("drm/etnaviv: call correct function when trying to vmap a DMABUF") +Signed-off-by: Sui Jingfeng +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +index 2aabe8433cee2..3d04ac6d821df 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c +@@ -350,6 +350,7 @@ void *etnaviv_gem_vmap(struct drm_gem_object *obj) + static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + { + struct page **pages; ++ pgprot_t prot; + + lockdep_assert_held(&obj->lock); + +@@ -357,8 +358,19 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj) + if (IS_ERR(pages)) + return NULL; + +- return vmap(pages, obj->base.size >> PAGE_SHIFT, +- VM_MAP, pgprot_writecombine(PAGE_KERNEL)); ++ switch (obj->flags & ETNA_BO_CACHE_MASK) { ++ case ETNA_BO_CACHED: ++ prot = PAGE_KERNEL; ++ break; ++ case ETNA_BO_UNCACHED: ++ prot = pgprot_noncached(PAGE_KERNEL); ++ break; ++ case ETNA_BO_WC: ++ default: ++ prot = pgprot_writecombine(PAGE_KERNEL); ++ } ++ ++ return vmap(pages, obj->base.size >> PAGE_SHIFT, VM_MAP, prot); + } + + static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op) +-- +2.39.5 + diff --git a/queue-5.4/dt-bindings-mmc-controller-clarify-the-address-cells.patch b/queue-5.4/dt-bindings-mmc-controller-clarify-the-address-cells.patch new file mode 100644 index 0000000000..b968401751 --- /dev/null +++ b/queue-5.4/dt-bindings-mmc-controller-clarify-the-address-cells.patch @@ -0,0 +1,39 @@ +From 9bf05506628521224fa4f0d8cdc7e289a7ed8d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Nov 2024 16:16:41 +0100 +Subject: dt-bindings: mmc: controller: clarify the address-cells description + +From: Neil Armstrong + +[ Upstream commit b2b8e93ec00b8110cb37cbde5400d5abfdaed6a7 ] + +The term "slot ID" has nothing to do with the SDIO function number +which is specified in the reg property of the subnodes, rephrase +the description to be more accurate. + +Fixes: f9b7989859dd ("dt-bindings: mmc: Add YAML schemas for the generic MMC options") +Signed-off-by: Neil Armstrong +Acked-by: Rob Herring (Arm) +Message-ID: <20241128-topic-amlogic-arm32-upstream-bindings-fixes-convert-meson-mx-sdio-v4-1-11d9f9200a59@linaro.org> +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/mmc/mmc-controller.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml +index 080754e0ef352..ccb9df705fb1c 100644 +--- a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml ++++ b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml +@@ -21,7 +21,7 @@ properties: + "#address-cells": + const: 1 + description: | +- The cell is the slot ID if a function subnode is used. ++ The cell is the SDIO function number if a function subnode is used. + + "#size-cells": + const: 0 +-- +2.39.5 + diff --git a/queue-5.4/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch b/queue-5.4/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch new file mode 100644 index 0000000000..0b646c993d --- /dev/null +++ b/queue-5.4/fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch @@ -0,0 +1,42 @@ +From 829fbc23657b635c7da99c8f4d004ddd86561391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:15:37 +0900 +Subject: fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device() + +From: Joe Hattori + +[ Upstream commit de124b61e179e690277116e6be512e4f422b5dd8 ] + +dss_of_port_get_parent_device() leaks an OF node reference when i >= 2 +and struct device_node *np is present. Since of_get_next_parent() +obtains a reference of the returned OF node, call of_node_put() before +returning NULL. + +This was found by an experimental verifier that I am developing, and no +runtime test was able to be performed due to that lack of actual +devices. + +Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb") +Signed-off-by: Joe Hattori +Reviewed-by: Laurent Pinchart +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/omap2/omapfb/dss/dss-of.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c +index 0282d4eef139d..3b16c3342cb77 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c +@@ -102,6 +102,7 @@ struct device_node *dss_of_port_get_parent_device(struct device_node *port) + np = of_get_next_parent(np); + } + ++ of_node_put(np); + return NULL; + } + +-- +2.39.5 + diff --git a/queue-5.4/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch b/queue-5.4/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch new file mode 100644 index 0000000000..fc140ef22f --- /dev/null +++ b/queue-5.4/ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch @@ -0,0 +1,38 @@ +From d2f2a1debd8f67772563d029b7e6b711fae96c66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2024 17:44:19 +0800 +Subject: ipmi: ipmb: Add check devm_kasprintf() returned value + +From: Charles Han + +[ Upstream commit 2378bd0b264ad3a1f76bd957caf33ee0c7945351 ] + +devm_kasprintf() can return a NULL pointer on failure but this +returned value is not checked. + +Fixes: 51bd6f291583 ("Add support for IPMB driver") +Signed-off-by: Charles Han +Message-ID: <20240926094419.25900-1-hanchunchao@inspur.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmb_dev_int.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c +index 09e3e25562a89..f56b92880cdaf 100644 +--- a/drivers/char/ipmi/ipmb_dev_int.c ++++ b/drivers/char/ipmi/ipmb_dev_int.c +@@ -309,6 +309,9 @@ static int ipmb_probe(struct i2c_client *client, + ipmb_dev->miscdev.name = devm_kasprintf(&client->dev, GFP_KERNEL, + "%s%d", "ipmb-", + client->adapter->nr); ++ if (!ipmb_dev->miscdev.name) ++ return -ENOMEM; ++ + ipmb_dev->miscdev.fops = &ipmb_fops; + ipmb_dev->miscdev.parent = &client->dev; + ret = misc_register(&ipmb_dev->miscdev); +-- +2.39.5 + diff --git a/queue-5.4/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch b/queue-5.4/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch new file mode 100644 index 0000000000..941e3e469b --- /dev/null +++ b/queue-5.4/ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch @@ -0,0 +1,71 @@ +From af41c31504f62b82756809a7c8ff3d0d0d7a6984 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 18:12:41 +0000 +Subject: ipmr: do not call mr_mfc_uses_dev() for unres entries + +From: Eric Dumazet + +[ Upstream commit 15a901361ec3fb1c393f91880e1cbf24ec0a88bd ] + +syzbot found that calling mr_mfc_uses_dev() for unres entries +would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif +alias to "struct sk_buff_head unresolved", which contain two pointers. + +This code never worked, lets remove it. + +[1] +Unable to handle kernel paging request at virtual address ffff5fff2d536613 +KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f] +Modules linked in: +CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] + pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 + lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline] + lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334 +Call trace: + mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P) + mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P) + mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382 + ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648 + rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327 + rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791 + netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317 + netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973 + sock_recvmsg_nosec net/socket.c:1033 [inline] + sock_recvmsg net/socket.c:1055 [inline] + sock_read_iter+0x2d8/0x40c net/socket.c:1125 + new_sync_read fs/read_write.c:484 [inline] + vfs_read+0x740/0x970 fs/read_write.c:565 + ksys_read+0x15c/0x26c fs/read_write.c:708 + +Fixes: cb167893f41e ("net: Plumb support for filtering ipv4 and ipv6 multicast route dumps") +Reported-by: syzbot+5cfae50c0e5f2c500013@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/678fe2d1.050a0220.15cac.00b3.GAE@google.com/T/#u +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250121181241.841212-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ipmr_base.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c +index 4a1a90a135406..78ca019f0a32a 100644 +--- a/net/ipv4/ipmr_base.c ++++ b/net/ipv4/ipmr_base.c +@@ -321,9 +321,6 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb, + list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) { + if (e < s_e) + goto next_entry2; +- if (filter->dev && +- !mr_mfc_uses_dev(mrt, mfc, filter->dev)) +- goto next_entry2; + + err = fill(mrt, skb, NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, mfc, RTM_NEWROUTE, flags); +-- +2.39.5 + diff --git a/queue-5.4/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch b/queue-5.4/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch new file mode 100644 index 0000000000..ca536f8af1 --- /dev/null +++ b/queue-5.4/ktest.pl-remove-unused-declarations-in-run_bisect_te.patch @@ -0,0 +1,37 @@ +From 9052f338c0a2e3819e8aa2ea03df19d584d3cd9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2024 21:07:35 +0800 +Subject: ktest.pl: Remove unused declarations in run_bisect_test function + +From: Ba Jing + +[ Upstream commit 776735b954f49f85fd19e1198efa421fae2ad77c ] + +Since $output and $ret are not used in the subsequent code, the declarations +should be removed. + +Fixes: a75fececff3c ("ktest: Added sample.conf, new %default option format") +Link: https://lore.kernel.org/20240902130735.6034-1-bajing@cmss.chinamobile.com +Signed-off-by: Ba Jing +Signed-off-by: Steven Rostedt +Signed-off-by: Sasha Levin +--- + tools/testing/ktest/ktest.pl | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index e7adb429018b2..184af2fcc1597 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -2861,8 +2861,6 @@ sub run_bisect_test { + + my $failed = 0; + my $result; +- my $output; +- my $ret; + + $in_bisect = 1; + +-- +2.39.5 + diff --git a/queue-5.4/media-camif-core-add-check-for-clk_enable.patch b/queue-5.4/media-camif-core-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..095126d771 --- /dev/null +++ b/queue-5.4/media-camif-core-add-check-for-clk_enable.patch @@ -0,0 +1,50 @@ +From 3cd5d2fdd887fd0e9e858b212859d3ddca51aba2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 19:18:17 +0000 +Subject: media: camif-core: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit 77ed2470ac09c2b0a33cf3f98cc51d18ba9ed976 ] + +Add check for the return value of clk_enable() to gurantee the success. + +Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s3c-camif/camif-core.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c +index ee624804862e2..3c8c262e3c687 100644 +--- a/drivers/media/platform/s3c-camif/camif-core.c ++++ b/drivers/media/platform/s3c-camif/camif-core.c +@@ -529,10 +529,19 @@ static int s3c_camif_remove(struct platform_device *pdev) + static int s3c_camif_runtime_resume(struct device *dev) + { + struct camif_dev *camif = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_enable(camif->clock[CLK_GATE]); ++ if (ret) ++ return ret; + +- clk_enable(camif->clock[CLK_GATE]); + /* null op on s3c244x */ +- clk_enable(camif->clock[CLK_CAM]); ++ ret = clk_enable(camif->clock[CLK_CAM]); ++ if (ret) { ++ clk_disable(camif->clock[CLK_GATE]); ++ return ret; ++ } ++ + return 0; + } + +-- +2.39.5 + diff --git a/queue-5.4/media-lmedm04-handle-errors-for-lme2510_int_read.patch b/queue-5.4/media-lmedm04-handle-errors-for-lme2510_int_read.patch new file mode 100644 index 0000000000..7175bc9aa1 --- /dev/null +++ b/queue-5.4/media-lmedm04-handle-errors-for-lme2510_int_read.patch @@ -0,0 +1,58 @@ +From a18a82d8851b9dfdbfc624645107222121a2ec18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2024 17:10:42 +0800 +Subject: media: lmedm04: Handle errors for lme2510_int_read + +From: Chen Ni + +[ Upstream commit a2836d3fe220220ff8c495ca9722f89cea8a67e7 ] + +Add check for the return value of usb_pipe_endpoint() and +usb_submit_urb() in order to catch the errors. + +Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb") +Signed-off-by: Chen Ni +Link: https://lore.kernel.org/r/20240521091042.1769684-1-nichen@iscas.ac.cn +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/lmedm04.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c +index 2b3b780782a40..8c573c3a83d5e 100644 +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -372,6 +372,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + struct dvb_usb_device *d = adap_to_d(adap); + struct lme2510_state *lme_int = adap_to_priv(adap); + struct usb_host_endpoint *ep; ++ int ret; + + lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL); + +@@ -389,11 +390,20 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + + /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */ + ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe); ++ if (!ep) { ++ usb_free_urb(lme_int->lme_urb); ++ return -ENODEV; ++ } + + if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) + lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa); + +- usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); ++ ret = usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); ++ if (ret) { ++ usb_free_urb(lme_int->lme_urb); ++ return ret; ++ } ++ + info("INT Interrupt Service Started"); + + return 0; +-- +2.39.5 + diff --git a/queue-5.4/media-lmedm04-use-gfp_kernel-for-urb-allocation-subm.patch b/queue-5.4/media-lmedm04-use-gfp_kernel-for-urb-allocation-subm.patch new file mode 100644 index 0000000000..8a30089af5 --- /dev/null +++ b/queue-5.4/media-lmedm04-use-gfp_kernel-for-urb-allocation-subm.patch @@ -0,0 +1,47 @@ +From 29fa76c1c3f5e8b7e153927b160a3f9fed4bf722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Oct 2020 11:32:43 +0200 +Subject: media: lmedm04: Use GFP_KERNEL for URB allocation/submission. + +From: Malcolm Priestley + +[ Upstream commit add5861769f912af0181f5fbd79dbf19c8211c20 ] + +lme2510_int_read is not atomically called so use GFP_KERNEL for +usb_alloc_urb and usb_submit_urb which is the first in the chain +of interrupt submissions. + +Signed-off-by: Malcolm Priestley +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: a2836d3fe220 ("media: lmedm04: Handle errors for lme2510_int_read") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/lmedm04.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c +index 5ac1a6af87826..2b3b780782a40 100644 +--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c ++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c +@@ -373,7 +373,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + struct lme2510_state *lme_int = adap_to_priv(adap); + struct usb_host_endpoint *ep; + +- lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC); ++ lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL); + + if (lme_int->lme_urb == NULL) + return -ENOMEM; +@@ -393,7 +393,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap) + if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK) + lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa); + +- usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC); ++ usb_submit_urb(lme_int->lme_urb, GFP_KERNEL); + info("INT Interrupt Service Started"); + + return 0; +-- +2.39.5 + diff --git a/queue-5.4/media-mipi-csis-add-check-for-clk_enable.patch b/queue-5.4/media-mipi-csis-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..e184cda0a2 --- /dev/null +++ b/queue-5.4/media-mipi-csis-add-check-for-clk_enable.patch @@ -0,0 +1,50 @@ +From 1a8728c4922dccacd4f02149a8bcf7c96128bb9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Nov 2024 19:18:18 +0000 +Subject: media: mipi-csis: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit 125ad1aeec77eb55273b420be6894b284a01e4b6 ] + +Add check for the return value of clk_enable() to gurantee the success. + +Fixes: b5f1220d587d ("[media] v4l: Add v4l2 subdev driver for S5P/EXYNOS4 MIPI-CSI receivers") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/mipi-csis.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c +index 1aac167abb175..6a2a85cc3e5f9 100644 +--- a/drivers/media/platform/exynos4-is/mipi-csis.c ++++ b/drivers/media/platform/exynos4-is/mipi-csis.c +@@ -941,13 +941,19 @@ static int s5pcsis_pm_resume(struct device *dev, bool runtime) + state->supplies); + goto unlock; + } +- clk_enable(state->clock[CSIS_CLK_GATE]); ++ ret = clk_enable(state->clock[CSIS_CLK_GATE]); ++ if (ret) { ++ phy_power_off(state->phy); ++ regulator_bulk_disable(CSIS_NUM_SUPPLIES, ++ state->supplies); ++ goto unlock; ++ } + } + if (state->flags & ST_STREAMING) + s5pcsis_start_stream(state); + + state->flags &= ~ST_SUSPENDED; +- unlock: ++unlock: + mutex_unlock(&state->lock); + return ret ? -EAGAIN : 0; + } +-- +2.39.5 + diff --git a/queue-5.4/media-rc-iguanair-handle-timeouts.patch b/queue-5.4/media-rc-iguanair-handle-timeouts.patch new file mode 100644 index 0000000000..983527e6af --- /dev/null +++ b/queue-5.4/media-rc-iguanair-handle-timeouts.patch @@ -0,0 +1,48 @@ +From 5258259e0a76e93f688f089c7ddb3560415e766a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Nov 2024 14:17:22 +0100 +Subject: media: rc: iguanair: handle timeouts + +From: Oliver Neukum + +[ Upstream commit b98d5000c50544f14bacb248c34e5219fbe81287 ] + +In case of a timeout the IO must be cancelled or +the next IO using the URB will fail and/or overwrite +an operational URB. + +The automatic bisection fails because it arrives +at a commit that correctly lets the test case run +without an error. + +Signed-off-by: Oliver Neukum +Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses") +Reported-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@google.com/ +Tested-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/iguanair.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c +index a7deca1fefb73..f50362bb59f27 100644 +--- a/drivers/media/rc/iguanair.c ++++ b/drivers/media/rc/iguanair.c +@@ -200,8 +200,10 @@ static int iguanair_send(struct iguanair *ir, unsigned size) + if (rc) + return rc; + +- if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) ++ if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) { ++ usb_kill_urb(ir->urb_out); + return -ETIMEDOUT; ++ } + + return rc; + } +-- +2.39.5 + diff --git a/queue-5.4/media-uvcvideo-propagate-buf-error-to-userspace.patch b/queue-5.4/media-uvcvideo-propagate-buf-error-to-userspace.patch new file mode 100644 index 0000000000..3cf01993ac --- /dev/null +++ b/queue-5.4/media-uvcvideo-propagate-buf-error-to-userspace.patch @@ -0,0 +1,44 @@ +From b4c1ca67ad8b68e512978501a113fbf130e0cd7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 21:39:08 +0000 +Subject: media: uvcvideo: Propagate buf->error to userspace + +From: Ricardo Ribalda + +[ Upstream commit 87ce177654e388451850905a1d376658aebe8699 ] + +Now we return VB2_BUF_STATE_DONE for valid and invalid frames. Propagate +the correct value, so the user can know if the frame is valid or not via +struct v4l2_buffer->flags. + +Reported-by: Hans de Goede +Closes: https://lore.kernel.org/linux-media/84b0f212-cd88-46bb-8e6f-b94ec3eccba6@redhat.com +Fixes: 6998b6fb4b1c ("[media] uvcvideo: Use videobuf2-vmalloc") +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20241218-uvc-deprecate-v2-1-ab814139e983@chromium.org +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_queue.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c +index da72577c29986..d7c81e205e8bb 100644 +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -486,7 +486,8 @@ static void uvc_queue_buffer_complete(struct kref *ref) + + buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; + vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused); +- vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); ++ vb2_buffer_done(&buf->buf.vb2_buf, buf->error ? VB2_BUF_STATE_ERROR : ++ VB2_BUF_STATE_DONE); + } + + /* +-- +2.39.5 + diff --git a/queue-5.4/module-extend-the-preempt-disabled-section-in-derefe.patch b/queue-5.4/module-extend-the-preempt-disabled-section-in-derefe.patch new file mode 100644 index 0000000000..2a2aab38e9 --- /dev/null +++ b/queue-5.4/module-extend-the-preempt-disabled-section-in-derefe.patch @@ -0,0 +1,59 @@ +From 409d9af18088449d20c453f597f01d4b6ee8c541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:04:30 +0100 +Subject: module: Extend the preempt disabled section in + dereference_symbol_descriptor(). + +From: Sebastian Andrzej Siewior + +[ Upstream commit a145c848d69f9c6f32008d8319edaa133360dd74 ] + +dereference_symbol_descriptor() needs to obtain the module pointer +belonging to pointer in order to resolve that pointer. +The returned mod pointer is obtained under RCU-sched/ preempt_disable() +guarantees and needs to be used within this section to ensure that the +module is not removed in the meantime. + +Extend the preempt_disable() section to also cover +dereference_module_function_descriptor(). + +Fixes: 04b8eb7a4ccd9 ("symbol lookup: introduce dereference_symbol_descriptor()") +Cc: James E.J. Bottomley +Cc: Christophe Leroy +Cc: Helge Deller +Cc: Madhavan Srinivasan +Cc: Michael Ellerman +Cc: Naveen N Rao +Cc: Nicholas Piggin +Cc: Sergey Senozhatsky +Cc: linux-parisc@vger.kernel.org +Cc: linuxppc-dev@lists.ozlabs.org +Reviewed-by: Sergey Senozhatsky +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20250108090457.512198-2-bigeasy@linutronix.de +Signed-off-by: Petr Pavlu +Signed-off-by: Sasha Levin +--- + include/linux/kallsyms.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h +index 1f96ce2b47df1..d84b677c728a9 100644 +--- a/include/linux/kallsyms.h ++++ b/include/linux/kallsyms.h +@@ -63,10 +63,10 @@ static inline void *dereference_symbol_descriptor(void *ptr) + + preempt_disable(); + mod = __module_address((unsigned long)ptr); +- preempt_enable(); + + if (mod) + ptr = dereference_module_function_descriptor(mod, ptr); ++ preempt_enable(); + #endif + return ptr; + } +-- +2.39.5 + diff --git a/queue-5.4/nbd-don-t-allow-reconnect-after-disconnect.patch b/queue-5.4/nbd-don-t-allow-reconnect-after-disconnect.patch new file mode 100644 index 0000000000..d2ebfd00d2 --- /dev/null +++ b/queue-5.4/nbd-don-t-allow-reconnect-after-disconnect.patch @@ -0,0 +1,75 @@ +From 4beb9c7f759097cff8ac4cef0f73f542711e034b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jan 2025 17:28:59 +0800 +Subject: nbd: don't allow reconnect after disconnect + +From: Yu Kuai + +[ Upstream commit 844b8cdc681612ff24df62cdefddeab5772fadf1 ] + +Following process can cause nbd_config UAF: + +1) grab nbd_config temporarily; + +2) nbd_genl_disconnect() flush all recv_work() and release the +initial reference: + + nbd_genl_disconnect + nbd_disconnect_and_put + nbd_disconnect + flush_workqueue(nbd->recv_workq) + if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) + nbd_config_put + -> due to step 1), reference is still not zero + +3) nbd_genl_reconfigure() queue recv_work() again; + + nbd_genl_reconfigure + config = nbd_get_config_unlocked(nbd) + if (!config) + -> succeed + if (!test_bit(NBD_RT_BOUND, ...)) + -> succeed + nbd_reconnect_socket + queue_work(nbd->recv_workq, &args->work) + +4) step 1) release the reference; + +5) Finially, recv_work() will trigger UAF: + + recv_work + nbd_config_put(nbd) + -> nbd_config is freed + atomic_dec(&config->recv_threads) + -> UAF + +Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so +that nbd_genl_reconfigure() will fail. + +Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command") +Reported-by: syzbot+6b0df248918b92c33e6a@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/ +Signed-off-by: Yu Kuai +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index f2d847ffcbc75..a3a0f09a4f47d 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -2039,6 +2039,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) + flush_workqueue(nbd->recv_workq); + nbd_clear_que(nbd); + nbd->task_setup = NULL; ++ clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); + mutex_unlock(&nbd->config_lock); + + if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, +-- +2.39.5 + diff --git a/queue-5.4/net-davicom-fix-uaf-in-dm9000_drv_remove.patch b/queue-5.4/net-davicom-fix-uaf-in-dm9000_drv_remove.patch new file mode 100644 index 0000000000..371711e106 --- /dev/null +++ b/queue-5.4/net-davicom-fix-uaf-in-dm9000_drv_remove.patch @@ -0,0 +1,52 @@ +From 0b52b54fb1a96333572bdafd27c8886bb70b888d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2025 15:42:13 -0600 +Subject: net: davicom: fix UAF in dm9000_drv_remove +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chenyuan Yang + +[ Upstream commit 19e65c45a1507a1a2926649d2db3583ed9d55fd9 ] + +dm is netdev private data and it cannot be +used after free_netdev() call. Using dm after free_netdev() +can cause UAF bug. Fix it by moving free_netdev() at the end of the +function. + +This is similar to the issue fixed in commit +ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove"). + +This bug is detected by our static analysis tool. + +Fixes: cf9e60aa69ae ("net: davicom: Fix regulator not turned off on driver removal") +Signed-off-by: Chenyuan Yang +CC: Uwe Kleine-König +Link: https://patch.msgid.link/20250123214213.623518-1-chenyuan0y@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/davicom/dm9000.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c +index 1d5d8984b49a3..fdf69fe78fbb6 100644 +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -1781,10 +1781,11 @@ dm9000_drv_remove(struct platform_device *pdev) + + unregister_netdev(ndev); + dm9000_release_board(pdev, dm); +- free_netdev(ndev); /* free device structure */ + if (dm->power_supply) + regulator_disable(dm->power_supply); + ++ free_netdev(ndev); /* free device structure */ ++ + dev_dbg(&pdev->dev, "released and freed device\n"); + return 0; + } +-- +2.39.5 + diff --git a/queue-5.4/net-fec-implement-tso-descriptor-cleanup.patch b/queue-5.4/net-fec-implement-tso-descriptor-cleanup.patch new file mode 100644 index 0000000000..255ca8d520 --- /dev/null +++ b/queue-5.4/net-fec-implement-tso-descriptor-cleanup.patch @@ -0,0 +1,78 @@ +From fcddb78a2d50ef958f495d3a4e9fc52a6322ee7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jan 2025 14:24:30 +0530 +Subject: net: fec: implement TSO descriptor cleanup + +From: Dheeraj Reddy Jonnalagadda + +[ Upstream commit 61dc1fd9205bc9d9918aa933a847b08e80b4dc20 ] + +Implement cleanup of descriptors in the TSO error path of +fec_enet_txq_submit_tso(). The cleanup + +- Unmaps DMA buffers for data descriptors skipping TSO header +- Clears all buffer descriptors +- Handles extended descriptors by clearing cbd_esc when enabled + +Fixes: 79f339125ea3 ("net: fec: Add software TSO support") +Signed-off-by: Dheeraj Reddy Jonnalagadda +Reviewed-by: Wei Fang +Link: https://patch.msgid.link/20250120085430.99318-1-dheeraj.linuxdev@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 31 ++++++++++++++++++++++- + 1 file changed, 30 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index f11824a078e9e..5660a83356eb0 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -732,6 +732,8 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq, + int hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb); + int total_len, data_left; + struct bufdesc *bdp = txq->bd.cur; ++ struct bufdesc *tmp_bdp; ++ struct bufdesc_ex *ebdp; + struct tso_t tso; + unsigned int index = 0; + int ret; +@@ -805,7 +807,34 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq, + return 0; + + err_release: +- /* TODO: Release all used data descriptors for TSO */ ++ /* Release all used data descriptors for TSO */ ++ tmp_bdp = txq->bd.cur; ++ ++ while (tmp_bdp != bdp) { ++ /* Unmap data buffers */ ++ if (tmp_bdp->cbd_bufaddr && ++ !IS_TSO_HEADER(txq, fec32_to_cpu(tmp_bdp->cbd_bufaddr))) ++ dma_unmap_single(&fep->pdev->dev, ++ fec32_to_cpu(tmp_bdp->cbd_bufaddr), ++ fec16_to_cpu(tmp_bdp->cbd_datlen), ++ DMA_TO_DEVICE); ++ ++ /* Clear standard buffer descriptor fields */ ++ tmp_bdp->cbd_sc = 0; ++ tmp_bdp->cbd_datlen = 0; ++ tmp_bdp->cbd_bufaddr = 0; ++ ++ /* Handle extended descriptor if enabled */ ++ if (fep->bufdesc_ex) { ++ ebdp = (struct bufdesc_ex *)tmp_bdp; ++ ebdp->cbd_esc = 0; ++ } ++ ++ tmp_bdp = fec_enet_get_nextdesc(tmp_bdp, &txq->bd); ++ } ++ ++ dev_kfree_skb_any(skb); ++ + return ret; + } + +-- +2.39.5 + diff --git a/queue-5.4/net-let-net.core.dev_weight-always-be-non-zero.patch b/queue-5.4/net-let-net.core.dev_weight-always-be-non-zero.patch new file mode 100644 index 0000000000..46fde5ffa7 --- /dev/null +++ b/queue-5.4/net-let-net.core.dev_weight-always-be-non-zero.patch @@ -0,0 +1,103 @@ +From 709e1d4e509f9e125c8ffcc57f86a6530985205c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 22:30:53 +0800 +Subject: net: let net.core.dev_weight always be non-zero + +From: Liu Jian + +[ Upstream commit d1f9f79fa2af8e3b45cffdeef66e05833480148a ] + +The following problem was encountered during stability test: + +(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ + returned 1, exceeding its budget of 0. +------------[ cut here ]------------ +list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ + next=ffff88905f746e40. +WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ + __list_add_valid_or_report+0xf3/0x130 +CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ +RIP: 0010:__list_add_valid_or_report+0xf3/0x130 +Call Trace: +? __warn+0xcd/0x250 +? __list_add_valid_or_report+0xf3/0x130 +enqueue_to_backlog+0x923/0x1070 +netif_rx_internal+0x92/0x2b0 +__netif_rx+0x15/0x170 +loopback_xmit+0x2ef/0x450 +dev_hard_start_xmit+0x103/0x490 +__dev_queue_xmit+0xeac/0x1950 +ip_finish_output2+0x6cc/0x1620 +ip_output+0x161/0x270 +ip_push_pending_frames+0x155/0x1a0 +raw_sendmsg+0xe13/0x1550 +__sys_sendto+0x3bf/0x4e0 +__x64_sys_sendto+0xdc/0x1b0 +do_syscall_64+0x5b/0x170 +entry_SYSCALL_64_after_hwframe+0x76/0x7e + +The reproduction command is as follows: + sysctl -w net.core.dev_weight=0 + ping 127.0.0.1 + +This is because when the napi's weight is set to 0, process_backlog() may +return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this +napi to be re-polled in net_rx_action() until __do_softirq() times out. +Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can +be retriggered in enqueue_to_backlog(), causing this issue. + +Making the napi's weight always non-zero solves this problem. + +Triggering this issue requires system-wide admin (setting is +not namespaced). + +Fixes: e38766054509 ("[NET]: Fix sysctl net.core.dev_weight") +Fixes: 3d48b53fb2ae ("net: dev_weight: TX/RX orthogonality") +Signed-off-by: Liu Jian +Link: https://patch.msgid.link/20250116143053.4146855-1-liujian56@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sysctl_net_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c +index 586598887095d..b3b39b0e0745b 100644 +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -242,7 +242,7 @@ static int proc_do_dev_weight(struct ctl_table *table, int write, + int ret, weight; + + mutex_lock(&dev_weight_mutex); +- ret = proc_dointvec(table, write, buffer, lenp, ppos); ++ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + if (!ret && write) { + weight = READ_ONCE(weight_p); + WRITE_ONCE(dev_rx_weight, weight * dev_weight_rx_bias); +@@ -356,6 +356,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "dev_weight_rx_bias", +@@ -363,6 +364,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "dev_weight_tx_bias", +@@ -370,6 +372,7 @@ static struct ctl_table net_core_table[] = { + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_do_dev_weight, ++ .extra1 = SYSCTL_ONE, + }, + { + .procname = "netdev_max_backlog", +-- +2.39.5 + diff --git a/queue-5.4/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch b/queue-5.4/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch new file mode 100644 index 0000000000..ea8ee726ce --- /dev/null +++ b/queue-5.4/net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch @@ -0,0 +1,53 @@ +From cae7d3524ac5e2379f7b93cbd634554a938cb9f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2025 14:33:16 +0200 +Subject: net/mlxfw: Drop hard coded max FW flash image size + +From: Maher Sanalla + +[ Upstream commit 70d81f25cc92cc4e914516c9935ae752f27d78ad ] + +Currently, mlxfw kernel module limits FW flash image size to be +10MB at most, preventing the ability to burn recent BlueField-3 +FW that exceeds the said size limit. + +Thus, drop the hard coded limit. Instead, rely on FW's +max_component_size threshold that is reported in MCQI register +as the size limit for FW image. + +Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process") +Signed-off-by: Maher Sanalla +Signed-off-by: Moshe Shemesh +Reviewed-by: Ido Schimmel +Tested-by: Ido Schimmel +Reviewed-by: Michal Swiatkowski +Link: https://patch.msgid.link/1737030796-1441634-1-git-send-email-moshe@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c +index 29e95d0a6ad13..5fa1b7c33c54f 100644 +--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c ++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c +@@ -14,7 +14,6 @@ + #define MLXFW_FSM_STATE_WAIT_TIMEOUT_MS 30000 + #define MLXFW_FSM_STATE_WAIT_ROUNDS \ + (MLXFW_FSM_STATE_WAIT_TIMEOUT_MS / MLXFW_FSM_STATE_WAIT_CYCLE_MS) +-#define MLXFW_FSM_MAX_COMPONENT_SIZE (10 * (1 << 20)) + + static const char * const mlxfw_fsm_state_err_str[] = { + [MLXFW_FSM_STATE_ERR_ERROR] = +@@ -111,7 +110,6 @@ static int mlxfw_flash_component(struct mlxfw_dev *mlxfw_dev, + if (err) + return err; + +- comp_max_size = min_t(u32, comp_max_size, MLXFW_FSM_MAX_COMPONENT_SIZE); + if (comp->data_size > comp_max_size) { + pr_err("Component %d is of size %d which is bigger than limit %d\n", + comp->index, comp->data_size, comp_max_size); +-- +2.39.5 + diff --git a/queue-5.4/net-rose-fix-timer-races-against-user-threads.patch b/queue-5.4/net-rose-fix-timer-races-against-user-threads.patch new file mode 100644 index 0000000000..b5cef4555c --- /dev/null +++ b/queue-5.4/net-rose-fix-timer-races-against-user-threads.patch @@ -0,0 +1,116 @@ +From 472fe592a96fe51217793d415240888bd5aaa11d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jan 2025 18:02:44 +0000 +Subject: net: rose: fix timer races against user threads + +From: Eric Dumazet + +[ Upstream commit 5de7665e0a0746b5ad7943554b34db8f8614a196 ] + +Rose timers only acquire the socket spinlock, without +checking if the socket is owned by one user thread. + +Add a check and rearm the timers if needed. + +BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 +Read of size 2 at addr ffff88802f09b82a by task swapper/0/0 + +CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 +Call Trace: + + __dump_stack lib/dump_stack.c:94 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 + print_address_description mm/kasan/report.c:378 [inline] + print_report+0x169/0x550 mm/kasan/report.c:489 + kasan_report+0x143/0x180 mm/kasan/report.c:602 + rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174 + call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 + expire_timers kernel/time/timer.c:1844 [inline] + __run_timers kernel/time/timer.c:2418 [inline] + __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430 + run_timer_base kernel/time/timer.c:2439 [inline] + run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 + handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 + __do_softirq kernel/softirq.c:595 [inline] + invoke_softirq kernel/softirq.c:435 [inline] + __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 + irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 + instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] + sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 + + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Link: https://patch.msgid.link/20250122180244.1861468-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/rose/rose_timer.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c +index f06ddbed3fed6..1525773e94aa1 100644 +--- a/net/rose/rose_timer.c ++++ b/net/rose/rose_timer.c +@@ -122,6 +122,10 @@ static void rose_heartbeat_expiry(struct timer_list *t) + struct rose_sock *rose = rose_sk(sk); + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ/20); ++ goto out; ++ } + switch (rose->state) { + case ROSE_STATE_0: + /* Magic here: If we listen() and a new link dies before it +@@ -152,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t) + } + + rose_start_heartbeat(sk); ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +@@ -162,6 +167,10 @@ static void rose_timer_expiry(struct timer_list *t) + struct sock *sk = &rose->sock; + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &rose->timer, jiffies + HZ/20); ++ goto out; ++ } + switch (rose->state) { + case ROSE_STATE_1: /* T1 */ + case ROSE_STATE_4: /* T2 */ +@@ -182,6 +191,7 @@ static void rose_timer_expiry(struct timer_list *t) + } + break; + } ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +@@ -192,6 +202,10 @@ static void rose_idletimer_expiry(struct timer_list *t) + struct sock *sk = &rose->sock; + + bh_lock_sock(sk); ++ if (sock_owned_by_user(sk)) { ++ sk_reset_timer(sk, &rose->idletimer, jiffies + HZ/20); ++ goto out; ++ } + rose_clear_queues(sk); + + rose_write_internal(sk, ROSE_CLEAR_REQUEST); +@@ -207,6 +221,7 @@ static void rose_idletimer_expiry(struct timer_list *t) + sk->sk_state_change(sk); + sock_set_flag(sk, SOCK_DEAD); + } ++out: + bh_unlock_sock(sk); + sock_put(sk); + } +-- +2.39.5 + diff --git a/queue-5.4/net-sched-disallow-replacing-of-child-qdisc-from-one.patch b/queue-5.4/net-sched-disallow-replacing-of-child-qdisc-from-one.patch new file mode 100644 index 0000000000..e40cf9c137 --- /dev/null +++ b/queue-5.4/net-sched-disallow-replacing-of-child-qdisc-from-one.patch @@ -0,0 +1,115 @@ +From 5e5e8420168fd2de0a956efe5355362c27e4dd40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2025 17:37:13 -0800 +Subject: net: sched: Disallow replacing of child qdisc from one parent to + another + +From: Jamal Hadi Salim + +[ Upstream commit bc50835e83f60f56e9bec2b392fb5544f250fb6f ] + +Lion Ackermann was able to create a UAF which can be abused for privilege +escalation with the following script + +Step 1. create root qdisc +tc qdisc add dev lo root handle 1:0 drr + +step2. a class for packet aggregation do demonstrate uaf +tc class add dev lo classid 1:1 drr + +step3. a class for nesting +tc class add dev lo classid 1:2 drr + +step4. a class to graft qdisc to +tc class add dev lo classid 1:3 drr + +step5. +tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 + +step6. +tc qdisc add dev lo parent 1:2 handle 3:0 drr + +step7. +tc class add dev lo classid 3:1 drr + +step 8. +tc qdisc add dev lo parent 3:1 handle 4:0 pfifo + +step 9. Display the class/qdisc layout + +tc class ls dev lo + class drr 1:1 root leaf 2: quantum 64Kb + class drr 1:2 root leaf 3: quantum 64Kb + class drr 3:1 root leaf 4: quantum 64Kb + +tc qdisc ls + qdisc drr 1: dev lo root refcnt 2 + qdisc plug 2: dev lo parent 1:1 + qdisc pfifo 4: dev lo parent 3:1 limit 1000p + qdisc drr 3: dev lo parent 1:2 + +step10. trigger the bug <=== prevented by this patch +tc qdisc replace dev lo parent 1:3 handle 4:0 + +step 11. Redisplay again the qdiscs/classes + +tc class ls dev lo + class drr 1:1 root leaf 2: quantum 64Kb + class drr 1:2 root leaf 3: quantum 64Kb + class drr 1:3 root leaf 4: quantum 64Kb + class drr 3:1 root leaf 4: quantum 64Kb + +tc qdisc ls + qdisc drr 1: dev lo root refcnt 2 + qdisc plug 2: dev lo parent 1:1 + qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p + qdisc drr 3: dev lo parent 1:2 + +Observe that a) parent for 4:0 does not change despite the replace request. +There can only be one parent. b) refcount has gone up by two for 4:0 and +c) both class 1:3 and 3:1 are pointing to it. + +Step 12. send one packet to plug +echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) +step13. send one packet to the grafted fifo +echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) + +step14. lets trigger the uaf +tc class delete dev lo classid 1:3 +tc class delete dev lo classid 1:1 + +The semantics of "replace" is for a del/add _on the same node_ and not +a delete from one node(3:1) and add to another node (1:3) as in step10. +While we could "fix" with a more complex approach there could be +consequences to expectations so the patch takes the preventive approach of +"disallow such config". + +Joint work with Lion Ackermann +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jamal Hadi Salim +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_api.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index b8dc03a7487e3..178044a845dfd 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -1593,6 +1593,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, + q = qdisc_lookup(dev, tcm->tcm_handle); + if (!q) + goto create_n_graft; ++ if (q->parent != tcm->tcm_parent) { ++ NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent"); ++ return -EINVAL; ++ } + if (n->nlmsg_flags & NLM_F_EXCL) { + NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override"); + return -EEXIST; +-- +2.39.5 + diff --git a/queue-5.4/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch b/queue-5.4/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch new file mode 100644 index 0000000000..5b508c347d --- /dev/null +++ b/queue-5.4/net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch @@ -0,0 +1,60 @@ +From 7fbac4f7cfedea8e346044ef183b641151f84c6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2025 10:50:47 +0100 +Subject: net: sh_eth: Fix missing rtnl lock in suspend/resume path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kory Maincent + +[ Upstream commit b95102215a8d0987789715ce11c0d4ec031cbfbe ] + +Fix the suspend/resume path by ensuring the rtnl lock is held where +required. Calls to sh_eth_close, sh_eth_open and wol operations must be +performed under the rtnl lock to prevent conflicts with ongoing ndo +operations. + +Fixes: b71af04676e9 ("sh_eth: add more PM methods") +Tested-by: Niklas Söderlund +Reviewed-by: Sergey Shtylyov +Signed-off-by: Kory Maincent +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/sh_eth.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 50d85d0372302..f808e60b4ee4f 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -3496,10 +3496,12 @@ static int sh_eth_suspend(struct device *dev) + + netif_device_detach(ndev); + ++ rtnl_lock(); + if (mdp->wol_enabled) + ret = sh_eth_wol_setup(ndev); + else + ret = sh_eth_close(ndev); ++ rtnl_unlock(); + + return ret; + } +@@ -3513,10 +3515,12 @@ static int sh_eth_resume(struct device *dev) + if (!netif_running(ndev)) + return 0; + ++ rtnl_lock(); + if (mdp->wol_enabled) + ret = sh_eth_wol_restore(ndev); + else + ret = sh_eth_open(ndev); ++ rtnl_unlock(); + + if (ret < 0) + return ret; +-- +2.39.5 + diff --git a/queue-5.4/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch b/queue-5.4/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch new file mode 100644 index 0000000000..07a2dd6330 --- /dev/null +++ b/queue-5.4/ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch @@ -0,0 +1,68 @@ +From 5945b110dd004fcbcecbd497e97bc7d646acac07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jan 2025 22:06:53 +0800 +Subject: ocfs2: mark dquot as inactive if failed to start trans while + releasing dquot + +From: Su Yue + +[ Upstream commit 276c61385f6bc3223a5ecd307cf4aba2dfbb9a31 ] + +While running fstests generic/329, the kernel workqueue +quota_release_workfn is dead looping in calling ocfs2_release_dquot(). +The ocfs2 state is already readonly but ocfs2_release_dquot wants to +start a transaction but fails and returns. + +===================================================================== +[ 2918.123602 ][ T275 ] On-disk corruption discovered. Please run +fsck.ocfs2 once the filesystem is unmounted. +[ 2918.124034 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:765 +ERROR: status = -30 +[ 2918.124452 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:795 +ERROR: status = -30 +[ 2918.124883 ][ T275 ] (kworker/u135:1,275,11):ocfs2_start_trans:357 +ERROR: status = -30 +[ 2918.125276 ][ T275 ] OCFS2: abort (device dm-0): ocfs2_start_trans: +Detected aborted journal +[ 2918.125710 ][ T275 ] On-disk corruption discovered. Please run +fsck.ocfs2 once the filesystem is unmounted. +===================================================================== + +ocfs2_release_dquot() is much like dquot_release(), which is called by +ext4 to handle similar situation. So here fix it by marking the dquot as +inactive like what dquot_release() does. + +Link: https://lkml.kernel.org/r/20250106140653.92292-1-glass.su@suse.com +Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling") +Signed-off-by: Su Yue +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/quota_global.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index 1ce3780e8b499..742bf103d2eb2 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -749,6 +749,11 @@ static int ocfs2_release_dquot(struct dquot *dquot) + handle = ocfs2_start_trans(osb, + ocfs2_calc_qdel_credits(dquot->dq_sb, dquot->dq_id.type)); + if (IS_ERR(handle)) { ++ /* ++ * Mark dquot as inactive to avoid endless cycle in ++ * quota_release_workfn(). ++ */ ++ clear_bit(DQ_ACTIVE_B, &dquot->dq_flags); + status = PTR_ERR(handle); + mlog_errno(status); + goto out_ilock; +-- +2.39.5 + diff --git a/queue-5.4/padata-fix-sysfs-store-callback-check.patch b/queue-5.4/padata-fix-sysfs-store-callback-check.patch new file mode 100644 index 0000000000..63d1de608d --- /dev/null +++ b/queue-5.4/padata-fix-sysfs-store-callback-check.patch @@ -0,0 +1,40 @@ +From b25b45ebfcf69b66392e13369774889670312b38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Dec 2024 23:32:01 +0100 +Subject: padata: fix sysfs store callback check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit 9ff6e943bce67d125781fe4780a5d6f072dc44c0 ] + +padata_sysfs_store() was copied from padata_sysfs_show() but this check +was not adapted. Today there is no attribute which can fail this +check, but if there is one it may as well be correct. + +Fixes: 5e017dc3f8bc ("padata: Added sysfs primitives to padata subsystem") +Signed-off-by: Thomas Weißschuh +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + kernel/padata.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/padata.c b/kernel/padata.c +index a544da60014c0..47aebcda65d5d 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -940,7 +940,7 @@ static ssize_t padata_sysfs_store(struct kobject *kobj, struct attribute *attr, + + pinst = kobj2pinst(kobj); + pentry = attr2pentry(attr); +- if (pentry->show) ++ if (pentry->store) + ret = pentry->store(pinst, attr, buf, count); + + return ret; +-- +2.39.5 + diff --git a/queue-5.4/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch b/queue-5.4/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch new file mode 100644 index 0000000000..8e0f4a46f8 --- /dev/null +++ b/queue-5.4/partitions-ldm-remove-the-initial-kernel-doc-notatio.patch @@ -0,0 +1,41 @@ +From 1288e988231e74fdd188ded740d89cf91b8ca2ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jan 2025 22:27:58 -0800 +Subject: partitions: ldm: remove the initial kernel-doc notation + +From: Randy Dunlap + +[ Upstream commit e494e451611a3de6ae95f99e8339210c157d70fb ] + +Remove the file's first comment describing what the file is. +This comment is not in kernel-doc format so it causes a kernel-doc +warning. + +ldm.h:13: warning: expecting prototype for ldm(). Prototype was for _FS_PT_LDM_H_() instead + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Cc: Richard Russon (FlatCap) +Cc: linux-ntfs-dev@lists.sourceforge.net +Cc: Jens Axboe +Link: https://lore.kernel.org/r/20250111062758.910458-1-rdunlap@infradead.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/partitions/ldm.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/partitions/ldm.h b/block/partitions/ldm.h +index 1ca63e97bcccf..05705ead955ec 100644 +--- a/block/partitions/ldm.h ++++ b/block/partitions/ldm.h +@@ -1,5 +1,5 @@ + // SPDX-License-Identifier: GPL-2.0-or-later +-/** ++/* + * ldm - Part of the Linux-NTFS project. + * + * Copyright (C) 2001,2002 Richard Russon +-- +2.39.5 + diff --git a/queue-5.4/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch b/queue-5.4/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch new file mode 100644 index 0000000000..45cd00ff3f --- /dev/null +++ b/queue-5.4/pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch @@ -0,0 +1,43 @@ +From 0b16a945c5f9dc5b638ee723fcd6bb2cfab4a469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 22:00:18 +0800 +Subject: PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy() + +From: Zijun Hu + +[ Upstream commit d4929755e4d02bd3de3ae5569dab69cb9502c54f ] + +The devm_pci_epc_destroy() comment says destroys the EPC device, but it +does not actually do that since devres_destroy() does not call +devm_pci_epc_release(), and it also can not fully undo what the API +devm_pci_epc_create() does, so it is faulty. + +Fortunately, the faulty API has not been used by current kernel tree. Use +devres_release() instead of devres_destroy() so the EPC device will be +released. + +Link: https://lore.kernel.org/r/20241210-pci-epc-core_fix-v3-1-4d86dd573e4b@quicinc.com +Fixes: 5e8cb4033807 ("PCI: endpoint: Add EP core layer to enable EP controller and EP functions") +Signed-off-by: Zijun Hu +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/pci-epc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/pci-epc-core.c b/drivers/pci/endpoint/pci-epc-core.c +index 2091508c16204..3c08c2c7d339c 100644 +--- a/drivers/pci/endpoint/pci-epc-core.c ++++ b/drivers/pci/endpoint/pci-epc-core.c +@@ -578,7 +578,7 @@ void devm_pci_epc_destroy(struct device *dev, struct pci_epc *epc) + { + int r; + +- r = devres_destroy(dev, devm_pci_epc_release, devm_pci_epc_match, ++ r = devres_release(dev, devm_pci_epc_release, devm_pci_epc_match, + epc); + dev_WARN_ONCE(dev, r, "couldn't find PCI EPC resource\n"); + } +-- +2.39.5 + diff --git a/queue-5.4/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch b/queue-5.4/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch new file mode 100644 index 0000000000..dda284a6f0 --- /dev/null +++ b/queue-5.4/perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch @@ -0,0 +1,51 @@ +From acb31a70b4a2476001934eebff4a709d4bdc4307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:44:58 +0800 +Subject: perf header: Fix one memory leakage in process_bpf_btf() + +From: Zhongqiu Han + +[ Upstream commit 875d22980a062521beed7b5df71fb13a1af15d83 ] + +If __perf_env__insert_btf() returns false due to a duplicate btf node +insertion, the temporary node will leak. Add a check to ensure the memory +is freed if the function returns false. + +Fixes: a70a1123174ab592 ("perf bpf: Save BTF information as headers to perf.data") +Reviewed-by: Namhyung Kim +Signed-off-by: Zhongqiu Han +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20241205084500.823660-2-quic_zhonhan@quicinc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/header.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index a68feeb3eb00d..6dc99378b191b 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -2777,7 +2777,8 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused) + if (__do_read(ff, node->data, data_size)) + goto out; + +- __perf_env__insert_btf(env, node); ++ if (!__perf_env__insert_btf(env, node)) ++ free(node); + node = NULL; + } + +-- +2.39.5 + diff --git a/queue-5.4/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch b/queue-5.4/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch new file mode 100644 index 0000000000..29ebb5e108 --- /dev/null +++ b/queue-5.4/perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch @@ -0,0 +1,99 @@ +From 054d48098942ba409849d7761c1134dd3ee32288 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2024 16:44:59 +0800 +Subject: perf header: Fix one memory leakage in process_bpf_prog_info() + +From: Zhongqiu Han + +[ Upstream commit a7da6c7030e1aec32f0a41c7b4fa70ec96042019 ] + +Function __perf_env__insert_bpf_prog_info() will return without inserting +bpf prog info node into perf env again due to a duplicate bpf prog info +node insertion, causing the temporary info_linear and info_node memory to +leak. Modify the return type of this function to bool and add a check to +ensure the memory is freed if the function returns false. + +Fixes: 606f972b1361f477 ("perf bpf: Save bpf_prog_info information as headers to perf.data") +Reviewed-by: Namhyung Kim +Signed-off-by: Zhongqiu Han +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Yicong Yang +Link: https://lore.kernel.org/r/20241205084500.823660-3-quic_zhonhan@quicinc.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/env.c | 5 +++-- + tools/perf/util/env.h | 2 +- + tools/perf/util/header.c | 5 ++++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c +index 953db9dd25eb0..f8239fbe6b09d 100644 +--- a/tools/perf/util/env.c ++++ b/tools/perf/util/env.c +@@ -21,7 +21,7 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env, + up_write(&env->bpf_progs.lock); + } + +-void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) ++bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node) + { + __u32 prog_id = info_node->info_linear->info.id; + struct bpf_prog_info_node *node; +@@ -39,13 +39,14 @@ void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info + p = &(*p)->rb_right; + } else { + pr_debug("duplicated bpf prog info %u\n", prog_id); +- return; ++ return false; + } + } + + rb_link_node(&info_node->rb_node, parent, p); + rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos); + env->bpf_progs.infos_cnt++; ++ return true; + } + + struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, +diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h +index b0778483fa04b..9c5777a2ea7e0 100644 +--- a/tools/perf/util/env.h ++++ b/tools/perf/util/env.h +@@ -117,7 +117,7 @@ const char *perf_env__raw_arch(struct perf_env *env); + int perf_env__nr_cpus_avail(struct perf_env *env); + + void perf_env__init(struct perf_env *env); +-void __perf_env__insert_bpf_prog_info(struct perf_env *env, ++bool __perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); + void perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 6dc99378b191b..a66a05091a974 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -2724,7 +2724,10 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused) + /* after reading from file, translate offset to address */ + bpf_program__bpil_offs_to_addr(info_linear); + info_node->info_linear = info_linear; +- __perf_env__insert_bpf_prog_info(env, info_node); ++ if (!__perf_env__insert_bpf_prog_info(env, info_node)) { ++ free(info_linear); ++ free(info_node); ++ } + } + + up_write(&env->bpf_progs.lock); +-- +2.39.5 + diff --git a/queue-5.4/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch b/queue-5.4/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch new file mode 100644 index 0000000000..8793592295 --- /dev/null +++ b/queue-5.4/perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch @@ -0,0 +1,68 @@ +From d731ccd4e854ada2366083734c02715de329bf3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 10:15:24 +0100 +Subject: perf machine: Don't ignore _etext when not a text symbol + +From: Christophe Leroy + +[ Upstream commit 7a93786c306296f15e728b1dbd949a319e4e3d19 ] + +Depending on how vmlinux.lds is written, _etext might be the very first +data symbol instead of the very last text symbol. + +Don't require it to be a text symbol, accept any symbol type. + +Comitter notes: + +See the first Link for further discussion, but it all boils down to +this: + + --- + # grep -e _stext -e _etext -e _edata /proc/kallsyms + c0000000 T _stext + c08b8000 D _etext + + So there is no _edata and _etext is not text + + $ ppc-linux-objdump -x vmlinux | grep -e _stext -e _etext -e _edata + c0000000 g .head.text 00000000 _stext + c08b8000 g .rodata 00000000 _etext + c1378000 g .sbss 00000000 _edata + --- + +Fixes: ed9adb2035b5be58 ("perf machine: Read also the end of the kernel") +Signed-off-by: Christophe Leroy +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: linuxppc-dev@lists.ozlabs.org +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Link: https://lore.kernel.org/r/b3ee1994d95257cb7f2de037c5030ba7d1bed404.1736327613.git.christophe.leroy@csgroup.eu +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/machine.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index e7f970681efce..f27fd5e1b6f3f 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -952,7 +952,7 @@ static int machine__get_running_kernel_start(struct machine *machine, + + err = kallsyms__get_symbol_start(filename, "_edata", &addr); + if (err) +- err = kallsyms__get_function_start(filename, "_etext", &addr); ++ err = kallsyms__get_symbol_start(filename, "_etext", &addr); + if (!err) + *end = addr; + +-- +2.39.5 + diff --git a/queue-5.4/perf-machine-include-data-symbols-in-the-kernel-map.patch b/queue-5.4/perf-machine-include-data-symbols-in-the-kernel-map.patch new file mode 100644 index 0000000000..8015791ff4 --- /dev/null +++ b/queue-5.4/perf-machine-include-data-symbols-in-the-kernel-map.patch @@ -0,0 +1,77 @@ +From d9b0d9f13d180a904a07c9bfea4ecad3ab4d7d12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jul 2023 17:19:29 -0700 +Subject: perf machine: Include data symbols in the kernel map + +From: Namhyung Kim + +[ Upstream commit 69a87a32f5cd8b262cb2195b045f96c63aede734 ] + +When 'perf record -d' is used, it needs data mmaps to symbolize global +data. But it missed to collect kernel data maps so it cannot symbolize +them. Instead of having a separate map, just increase the kernel map +size to include the data section. + +Probably we can have a separate kernel map for data, but the current +code assumes a single kernel map. So it'd require more changes in other +places and looks error-prone. I decided not to go that way for now. + +Also it seems the kernel module size already includes the data section. + +For example, my system has the following. + + $ grep -e _stext -e _etext -e _edata /proc/kallsyms + ffffffff99800000 T _stext + ffffffff9a601ac8 T _etext + ffffffff9b446a00 D _edata + +Size of the text section is (0x9a601ac8 - 0x99800000 = 0xe01ac8) and +size including data section is (0x9b446a00 - 0x99800000 = 0x1c46a00). + +Before: + $ perf record -d true + + $ perf report -D | grep MMAP | head -1 + 0 0 0x460 [0x60]: PERF_RECORD_MMAP -1/0: [0xffffffff99800000(0xe01ac8) @ 0xffffffff99800000]: x [kernel.kallsyms]_text + ^^^^^^^^ + here +After: + $ perf report -D | grep MMAP | head -1 + 0 0 0x460 [0x60]: PERF_RECORD_MMAP -1/0: [0xffffffff99800000(0x1c46a00) @ 0xffffffff99800000]: x [kernel.kallsyms]_text + ^^^^^^^^^ + +Instead of just replacing it to _edata, try _edata first and then fall +back to _etext just in case. + +Signed-off-by: Namhyung Kim +Acked-by: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20230725001929.368041-2-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 7a93786c3062 ("perf machine: Don't ignore _etext when not a text symbol") +Signed-off-by: Sasha Levin +--- + tools/perf/util/machine.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index 8c3addc2e9e1e..e7f970681efce 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -950,7 +950,9 @@ static int machine__get_running_kernel_start(struct machine *machine, + + *start = addr; + +- err = kallsyms__get_function_start(filename, "_etext", &addr); ++ err = kallsyms__get_symbol_start(filename, "_edata", &addr); ++ if (err) ++ err = kallsyms__get_function_start(filename, "_etext", &addr); + if (!err) + *end = addr; + +-- +2.39.5 + diff --git a/queue-5.4/perf-report-fix-misleading-help-message-about-demang.patch b/queue-5.4/perf-report-fix-misleading-help-message-about-demang.patch new file mode 100644 index 0000000000..d17ee8561a --- /dev/null +++ b/queue-5.4/perf-report-fix-misleading-help-message-about-demang.patch @@ -0,0 +1,46 @@ +From de3980c677dcb15eec90bf6cc3a126bc4c2516b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jan 2025 23:22:19 +0800 +Subject: perf report: Fix misleading help message about --demangle + +From: Jiachen Zhang + +[ Upstream commit ac0ac75189a4d6a29a2765a7adbb62bc6cc650c7 ] + +The wrong help message may mislead users. This commit fixes it. + +Fixes: 328ccdace8855289 ("perf report: Add --no-demangle option") +Reviewed-by: Namhyung Kim +Signed-off-by: Jiachen Zhang +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20250109152220.1869581-1-me@jcix.top +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-report.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index dc228bdf2bbc2..2f0917dbadcf4 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -1175,7 +1175,7 @@ int cmd_report(int argc, const char **argv) + OPT_STRING(0, "objdump", &report.annotation_opts.objdump_path, "path", + "objdump binary to use for disassembly and annotations"), + OPT_BOOLEAN(0, "demangle", &symbol_conf.demangle, +- "Disable symbol demangling"), ++ "Symbol demangling. Enabled by default, use --no-demangle to disable."), + OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel, + "Enable kernel symbol demangling"), + OPT_BOOLEAN(0, "mem-mode", &report.mem_mode, "mem access profile"), +-- +2.39.5 + diff --git a/queue-5.4/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch b/queue-5.4/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch new file mode 100644 index 0000000000..f93d5267d9 --- /dev/null +++ b/queue-5.4/perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch @@ -0,0 +1,64 @@ +From 68b8b646daffd0233cdc5fd2b62d92ed0c969773 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jan 2025 16:50:39 -0300 +Subject: perf top: Don't complain about lack of vmlinux when not resolving + some kernel samples + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 058b38ccd2af9e5c95590b018e8425fa148d7aca ] + +Recently we got a case where a kernel sample wasn't being resolved due +to a bug that was not setting the end address on kernel functions +implemented in assembly (see Link: tag), and then those were not being +found by machine__resolve() -> map__find_symbol(). + +So we ended up with: + + # perf top --stdio + PerfTop: 0 irqs/s kernel: 0% exact: 0% lost: 0/0 drop: 0/0 [cycles/P] + ----------------------------------------------------------------------- + + Warning: + A vmlinux file was not found. + Kernel samples will not be resolved. + ^Z + [1]+ Stopped perf top --stdio + # + +But then resolving all other kernel symbols. + +So just fixup the logic to only print that warning when there are no +symbols in the kernel map. + +Fixes: d88205db9caa0e9d ("perf dso: Add dso__has_symbols() method") +Reviewed-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Christophe Leroy +Cc: James Clark +Cc: Jiri Olsa +Cc: Kan Liang +Link: https://lore.kernel.org/lkml/Z3buKhcCsZi3_aGb@x1 +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-top.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index b8fab267e8556..5631d44a3f6bc 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -796,7 +796,7 @@ static void perf_event__process_sample(struct perf_tool *tool, + * invalid --vmlinux ;-) + */ + if (!machine->kptr_restrict_warned && !top->vmlinux_warned && +- __map__is_kernel(al.map) && map__has_symbols(al.map)) { ++ __map__is_kernel(al.map) && !map__has_symbols(al.map)) { + if (symbol_conf.vmlinux_name) { + char serr[256]; + dso__strerror_load(al.map->dso, serr, sizeof(serr)); +-- +2.39.5 + diff --git a/queue-5.4/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch b/queue-5.4/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch new file mode 100644 index 0000000000..9978c4fa9f --- /dev/null +++ b/queue-5.4/perf-trace-fix-runtime-error-of-index-out-of-bounds.patch @@ -0,0 +1,63 @@ +From 3fad0825b70b0520545c5d69ecd8ae2413ff4707 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jan 2025 18:55:19 -0800 +Subject: perf trace: Fix runtime error of index out of bounds + +From: Howard Chu + +[ Upstream commit c7b87ce0dd10b64b68a0b22cb83bbd556e28fe81 ] + +libtraceevent parses and returns an array of argument fields, sometimes +larger than RAW_SYSCALL_ARGS_NUM (6) because it includes "__syscall_nr", +idx will traverse to index 6 (7th element) whereas sc->fmt->arg holds 6 +elements max, creating an out-of-bounds access. This runtime error is +found by UBsan. The error message: + + $ sudo UBSAN_OPTIONS=print_stacktrace=1 ./perf trace -a --max-events=1 + builtin-trace.c:1966:35: runtime error: index 6 out of bounds for type 'syscall_arg_fmt [6]' + #0 0x5c04956be5fe in syscall__alloc_arg_fmts /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:1966 + #1 0x5c04956c0510 in trace__read_syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2110 + #2 0x5c04956c372b in trace__syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2436 + #3 0x5c04956d2f39 in trace__init_syscalls_bpf_prog_array_maps /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:3897 + #4 0x5c04956d6d25 in trace__run /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:4335 + #5 0x5c04956e112e in cmd_trace /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:5502 + #6 0x5c04956eda7d in run_builtin /home/howard/hw/linux-perf/tools/perf/perf.c:351 + #7 0x5c04956ee0a8 in handle_internal_command /home/howard/hw/linux-perf/tools/perf/perf.c:404 + #8 0x5c04956ee37f in run_argv /home/howard/hw/linux-perf/tools/perf/perf.c:448 + #9 0x5c04956ee8e9 in main /home/howard/hw/linux-perf/tools/perf/perf.c:556 + #10 0x79eb3622a3b7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 + #11 0x79eb3622a47a in __libc_start_main_impl ../csu/libc-start.c:360 + #12 0x5c04955422d4 in _start (/home/howard/hw/linux-perf/tools/perf/perf+0x4e02d4) (BuildId: 5b6cab2d59e96a4341741765ad6914a4d784dbc6) + + 0.000 ( 0.014 ms): Chrome_ChildIO/117244 write(fd: 238, buf: !, count: 1) = 1 + +Fixes: 5e58fcfaf4c6 ("perf trace: Allow allocating sc->arg_fmt even without the syscall tracepoint") +Signed-off-by: Howard Chu +Link: https://lore.kernel.org/r/20250122025519.361873-1-howardchu95@gmail.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-trace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index c8c01e706118e..6a444123a0954 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -1582,8 +1582,12 @@ static int trace__read_syscall_info(struct trace *trace, int id) + return PTR_ERR(sc->tp_format); + } + ++ /* ++ * The tracepoint format contains __syscall_nr field, so it's one more ++ * than the actual number of syscall arguments. ++ */ + if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ? +- RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields)) ++ RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields - 1)) + return -ENOMEM; + + sc->args = sc->tp_format->format.fields; +-- +2.39.5 + diff --git a/queue-5.4/pm-hibernate-add-error-handling-for-syscore_suspend.patch b/queue-5.4/pm-hibernate-add-error-handling-for-syscore_suspend.patch new file mode 100644 index 0000000000..2b5995653e --- /dev/null +++ b/queue-5.4/pm-hibernate-add-error-handling-for-syscore_suspend.patch @@ -0,0 +1,58 @@ +From c947e96eb96620e9ede7a73b762802a86e0d1ca2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jan 2025 22:32:05 +0800 +Subject: PM: hibernate: Add error handling for syscore_suspend() + +From: Wentao Liang + +[ Upstream commit e20a70c572539a486dbd91b225fa6a194a5e2122 ] + +In hibernation_platform_enter(), the code did not check the +return value of syscore_suspend(), potentially leading to a +situation where syscore_resume() would be called even if +syscore_suspend() failed. This could cause unpredictable +behavior or system instability. + +Modify the code sequence in question to properly handle errors returned +by syscore_suspend(). If an error occurs in the suspend path, the code +now jumps to label 'Enable_irqs' skipping the syscore_resume() call and +only enabling interrupts after setting the system state to SYSTEM_RUNNING. + +Fixes: 40dc166cb5dd ("PM / Core: Introduce struct syscore_ops for core subsystems PM") +Signed-off-by: Wentao Liang +Link: https://patch.msgid.link/20250119143205.2103-1-vulab@iscas.ac.cn +[ rjw: Changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index f8934f9746e66..78d913a082bee 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -578,7 +578,11 @@ int hibernation_platform_enter(void) + + local_irq_disable(); + system_state = SYSTEM_SUSPEND; +- syscore_suspend(); ++ ++ error = syscore_suspend(); ++ if (error) ++ goto Enable_irqs; ++ + if (pm_wakeup_pending()) { + error = -EAGAIN; + goto Power_up; +@@ -590,6 +594,7 @@ int hibernation_platform_enter(void) + + Power_up: + syscore_resume(); ++ Enable_irqs: + system_state = SYSTEM_RUNNING; + local_irq_enable(); + +-- +2.39.5 + diff --git a/queue-5.4/pwm-stm32-lp-add-check-for-clk_enable.patch b/queue-5.4/pwm-stm32-lp-add-check-for-clk_enable.patch new file mode 100644 index 0000000000..7889160986 --- /dev/null +++ b/queue-5.4/pwm-stm32-lp-add-check-for-clk_enable.patch @@ -0,0 +1,48 @@ +From 8873787bf20051b878e24ef43eaf1a98d7829ee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 16:53:18 -0500 +Subject: pwm: stm32-lp: Add check for clk_enable() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mingwei Zheng + +[ Upstream commit cce16e7f6216227964cda25f5f23634bce2c500f ] + +Add check for the return value of clk_enable() to catch the potential +error. +We used APP-Miner to find it. + +Fixes: e70a540b4e02 ("pwm: Add STM32 LPTimer PWM driver") +Signed-off-by: Mingwei Zheng +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20241206215318.3402860-1-zmw12306@gmail.com +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32-lp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c +index 20657c649c65e..f03dd7799f864 100644 +--- a/drivers/pwm/pwm-stm32-lp.c ++++ b/drivers/pwm/pwm-stm32-lp.c +@@ -169,8 +169,12 @@ static void stm32_pwm_lp_get_state(struct pwm_chip *chip, + regmap_read(priv->regmap, STM32_LPTIM_CR, &val); + state->enabled = !!FIELD_GET(STM32_LPTIM_ENABLE, val); + /* Keep PWM counter clock refcount in sync with PWM initial state */ +- if (state->enabled) +- clk_enable(priv->clk); ++ if (state->enabled) { ++ int ret = clk_enable(priv->clk); ++ ++ if (ret) ++ return ret; ++ } + + regmap_read(priv->regmap, STM32_LPTIM_CFGR, &val); + presc = FIELD_GET(STM32_LPTIM_PRESC, val); +-- +2.39.5 + diff --git a/queue-5.4/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch b/queue-5.4/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch new file mode 100644 index 0000000000..dc7bb699e8 --- /dev/null +++ b/queue-5.4/rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch @@ -0,0 +1,43 @@ +From e09039486ed08b57bb18ace12b5e584d8e51c66e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Nov 2024 13:01:37 +0300 +Subject: rdma/cxgb4: Prevent potential integer overflow on 32bit + +From: Dan Carpenter + +[ Upstream commit bd96a3935e89486304461a21752f824fc25e0f0b ] + +The "gl->tot_len" variable is controlled by the user. It comes from +process_responses(). On 32bit systems, the "gl->tot_len + sizeof(struct +cpl_pass_accept_req) + sizeof(struct rss_header)" addition could have an +integer wrapping bug. Use size_add() to prevent this. + +Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection") +Link: https://patch.msgid.link/r/86b404e1-4a75-4a35-a34e-e3054fa554c7@stanley.mountain +Signed-off-by: Dan Carpenter +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/device.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c +index 541dbcf22d0eb..13e4b2c40d835 100644 +--- a/drivers/infiniband/hw/cxgb4/device.c ++++ b/drivers/infiniband/hw/cxgb4/device.c +@@ -1114,8 +1114,10 @@ static inline struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl, + * The math here assumes sizeof cpl_pass_accept_req >= sizeof + * cpl_rx_pkt. + */ +- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req) + +- sizeof(struct rss_header) - pktshift, GFP_ATOMIC); ++ skb = alloc_skb(size_add(gl->tot_len, ++ sizeof(struct cpl_pass_accept_req) + ++ sizeof(struct rss_header)) - pktshift, ++ GFP_ATOMIC); + if (unlikely(!skb)) + return NULL; + +-- +2.39.5 + diff --git a/queue-5.4/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch b/queue-5.4/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch new file mode 100644 index 0000000000..7dc05d4d26 --- /dev/null +++ b/queue-5.4/rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch @@ -0,0 +1,45 @@ +From e0c469b7f5d27c22555ec7a50b29a0f39bbeeb04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Dec 2024 15:44:25 +0200 +Subject: RDMA/mlx4: Avoid false error about access to uninitialized gids array + +From: Leon Romanovsky + +[ Upstream commit 1f53d88cbb0dcc7df235bf6611ae632b254fccd8 ] + +Smatch generates the following false error report: +drivers/infiniband/hw/mlx4/main.c:393 mlx4_ib_del_gid() error: uninitialized symbol 'gids'. + +Traditionally, we are not changing kernel code and asking people to fix +the tools. However in this case, the fix can be done by simply rearranging +the code to be more clear. + +Fixes: e26be1bfef81 ("IB/mlx4: Implement ib_device callbacks") +Link: https://patch.msgid.link/6a3a1577463da16962463fcf62883a87506e9b62.1733233426.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index baa129a6c9127..20335542a81ae 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -384,10 +384,10 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context) + } + spin_unlock_bh(&iboe->lock); + +- if (!ret && hw_update) { ++ if (gids) + ret = mlx4_ib_update_gids(gids, ibdev, attr->port_num); +- kfree(gids); +- } ++ ++ kfree(gids); + return ret; + } + +-- +2.39.5 + diff --git a/queue-5.4/regulator-of-implement-the-unwind-path-of-of_regulat.patch b/queue-5.4/regulator-of-implement-the-unwind-path-of-of_regulat.patch new file mode 100644 index 0000000000..2469028d35 --- /dev/null +++ b/queue-5.4/regulator-of-implement-the-unwind-path-of-of_regulat.patch @@ -0,0 +1,66 @@ +From 28ad8e119f3138f10e45f2b9d2da134d9aa71122 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 17:04:53 +0900 +Subject: regulator: of: Implement the unwind path of of_regulator_match() + +From: Joe Hattori + +[ Upstream commit dddca3b2fc676113c58b04aaefe84bfb958ac83e ] + +of_regulator_match() does not release the OF node reference in the error +path, resulting in an OF node leak. Therefore, call of_node_put() on the +obtained nodes before returning the EINVAL error. + +Since it is possible that some drivers call this function and do not +exit on failure, such as s2mps11_pmic_driver, clear the init_data and +of_node in the error path. + +This was reported by an experimental verification tool that I am +developing. As I do not have access to actual devices nor the QEMU board +configuration to test drivers that call this function, no runtime test +was able to be performed. + +Fixes: 1c8fa58f4750 ("regulator: Add generic DT parsing for regulators") +Signed-off-by: Joe Hattori +Link: https://patch.msgid.link/20250104080453.2153592-1-joe@pf.is.s.u-tokyo.ac.jp +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/of_regulator.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c +index 7a0a235e44658..c4b72fa8ad815 100644 +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -377,7 +377,7 @@ int of_regulator_match(struct device *dev, struct device_node *node, + "failed to parse DT for regulator %pOFn\n", + child); + of_node_put(child); +- return -EINVAL; ++ goto err_put; + } + match->of_node = of_node_get(child); + count++; +@@ -386,6 +386,18 @@ int of_regulator_match(struct device *dev, struct device_node *node, + } + + return count; ++ ++err_put: ++ for (i = 0; i < num_matches; i++) { ++ struct of_regulator_match *match = &matches[i]; ++ ++ match->init_data = NULL; ++ if (match->of_node) { ++ of_node_put(match->of_node); ++ match->of_node = NULL; ++ } ++ } ++ return -EINVAL; + } + EXPORT_SYMBOL_GPL(of_regulator_match); + +-- +2.39.5 + diff --git a/queue-5.4/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch b/queue-5.4/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch new file mode 100644 index 0000000000..8cf4c0a17c --- /dev/null +++ b/queue-5.4/rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch @@ -0,0 +1,51 @@ +From 0000e6da28502e1ddaddd7d92de514b5d74492a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 20:34:58 +0100 +Subject: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read + +From: Oleksij Rempel + +[ Upstream commit 3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c ] + +The nvmem interface supports variable buffer sizes, while the regmap +interface operates with fixed-size storage. If an nvmem client uses a +buffer size less than 4 bytes, regmap_read will write out of bounds +as it expects the buffer to point at an unsigned int. + +Fix this by using an intermediary unsigned int to hold the value. + +Fixes: fadfd092ee91 ("rtc: pcf85063: add nvram support") +Signed-off-by: Oleksij Rempel +Signed-off-by: Ahmad Fatoum +Link: https://lore.kernel.org/r/20241218-rtc-pcf85063-stack-corruption-v1-1-12fd0ee0f046@pengutronix.de +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf85063.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c +index 3e7ea5244562e..5251b6cc2def0 100644 +--- a/drivers/rtc/rtc-pcf85063.c ++++ b/drivers/rtc/rtc-pcf85063.c +@@ -332,7 +332,16 @@ static const struct rtc_class_ops pcf85063_rtc_ops_alarm = { + static int pcf85063_nvmem_read(void *priv, unsigned int offset, + void *val, size_t bytes) + { +- return regmap_read(priv, PCF85063_REG_RAM, val); ++ unsigned int tmp; ++ int ret; ++ ++ ret = regmap_read(priv, PCF85063_REG_RAM, &tmp); ++ if (ret < 0) ++ return ret; ++ ++ *(u8 *)val = tmp; ++ ++ return 0; + } + + static int pcf85063_nvmem_write(void *priv, unsigned int offset, +-- +2.39.5 + diff --git a/queue-5.4/rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch b/queue-5.4/rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch new file mode 100644 index 0000000000..15bbaed7ba --- /dev/null +++ b/queue-5.4/rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch @@ -0,0 +1,119 @@ +From 3f19d9745be2e70242b615d3cf262aa153179931 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 08:21:24 +0100 +Subject: rtlwifi: replace usage of found with dedicated list iterator variable + +From: Jakob Koschel + +[ Upstream commit a0ff2a87194a968b9547fd4d824a09092171d1ea ] + +To move the list iterator variable into the list_for_each_entry_*() +macro in the future it should be avoided to use the list iterator +variable after the loop body. + +To *never* use the list iterator variable after the loop it was +concluded to use a separate iterator variable instead of a +found boolean [1]. + +This removes the need to use a found variable and simply checking if +the variable was set, can determine if the break/goto was hit. + +Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ +Signed-off-by: Jakob Koschel +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220324072124.62458-1-jakobkoschel@gmail.com +Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 13 ++++++------- + drivers/net/wireless/realtek/rtlwifi/pci.c | 15 +++++++-------- + 2 files changed, 13 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 8fb0b54738ca9..5898109b1c3e8 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -1995,8 +1995,7 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + unsigned long flags; + +- struct rtl_bssid_entry *entry; +- bool entry_found = false; ++ struct rtl_bssid_entry *entry = NULL, *iter; + + /* check if it is scanning */ + if (!mac->act_scanning) +@@ -2009,10 +2008,10 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + + spin_lock_irqsave(&rtlpriv->locks.scan_list_lock, flags); + +- list_for_each_entry(entry, &rtlpriv->scan_list.list, list) { +- if (memcmp(entry->bssid, hdr->addr3, ETH_ALEN) == 0) { +- list_del_init(&entry->list); +- entry_found = true; ++ list_for_each_entry(iter, &rtlpriv->scan_list.list, list) { ++ if (memcmp(iter->bssid, hdr->addr3, ETH_ALEN) == 0) { ++ list_del_init(&iter->list); ++ entry = iter; + rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, + "Update BSSID=%pM to scan list (total=%d)\n", + hdr->addr3, rtlpriv->scan_list.num); +@@ -2020,7 +2019,7 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + } + } + +- if (!entry_found) { ++ if (!entry) { + entry = kmalloc(sizeof(*entry), GFP_ATOMIC); + + if (!entry) +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index a31d013d8815a..f8e34ae09a800 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -300,14 +300,13 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); +- bool find_buddy_priv = false; +- struct rtl_priv *tpriv; ++ struct rtl_priv *tpriv = NULL, *iter; + struct rtl_pci_priv *tpcipriv = NULL; + + if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) { +- list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list, ++ list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list, + list) { +- tpcipriv = (struct rtl_pci_priv *)tpriv->priv; ++ tpcipriv = (struct rtl_pci_priv *)iter->priv; + rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, + "pcipriv->ndis_adapter.funcnumber %x\n", + pcipriv->ndis_adapter.funcnumber); +@@ -321,19 +320,19 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, + tpcipriv->ndis_adapter.devnumber && + pcipriv->ndis_adapter.funcnumber != + tpcipriv->ndis_adapter.funcnumber) { +- find_buddy_priv = true; ++ tpriv = iter; + break; + } + } + } + + rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "find_buddy_priv %d\n", find_buddy_priv); ++ "find_buddy_priv %d\n", tpriv != NULL); + +- if (find_buddy_priv) ++ if (tpriv) + *buddy_priv = tpriv; + +- return find_buddy_priv; ++ return tpriv != NULL; + } + + static void rtl_pci_parse_configuration(struct pci_dev *pdev, +-- +2.39.5 + diff --git a/queue-5.4/rtlwifi-rtl8192se-rename-rt_trace-to-rtl_dbg.patch b/queue-5.4/rtlwifi-rtl8192se-rename-rt_trace-to-rtl_dbg.patch new file mode 100644 index 0000000000..c49c1d7d11 --- /dev/null +++ b/queue-5.4/rtlwifi-rtl8192se-rename-rt_trace-to-rtl_dbg.patch @@ -0,0 +1,1292 @@ +From e3d7aeca98ae3683c49bcdd9072ab3e64479e90c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 15:42:39 -0500 +Subject: rtlwifi: rtl8192se Rename RT_TRACE to rtl_dbg + +From: Larry Finger + +[ Upstream commit fca8218d33f3f425aed1ca5d3e796ceb9cdfd0ee ] + +Change the misleading macro name to one that is more descriptive for +rtl8192se. Changes suggested by ckeckpatch.pl have been made. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200723204244.24457-11-Larry.Finger@lwfinger.net +Stable-dep-of: 8559a9e0c457 ("wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step") +Signed-off-by: Sasha Levin +--- + .../wireless/realtek/rtlwifi/rtl8192se/dm.c | 42 ++-- + .../wireless/realtek/rtlwifi/rtl8192se/fw.c | 40 ++-- + .../wireless/realtek/rtlwifi/rtl8192se/hw.c | 157 +++++++------ + .../wireless/realtek/rtlwifi/rtl8192se/led.c | 10 +- + .../wireless/realtek/rtlwifi/rtl8192se/phy.c | 211 +++++++++--------- + .../wireless/realtek/rtlwifi/rtl8192se/rf.c | 70 +++--- + .../wireless/realtek/rtlwifi/rtl8192se/sw.c | 4 +- + .../wireless/realtek/rtlwifi/rtl8192se/trx.c | 10 +- + 8 files changed, 271 insertions(+), 273 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/dm.c +index a6e4384ceea1d..5fce3db52cd9a 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/dm.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/dm.c +@@ -144,10 +144,10 @@ static void _rtl92s_dm_txpowertracking_callback_thermalmeter( + + thermalvalue = (u8)rtl_get_rfreg(hw, RF90_PATH_A, RF_T_METER, 0x1f); + +- RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, +- "Readback Thermal Meter = 0x%x pre thermal meter 0x%x eeprom_thermal meter 0x%x\n", +- thermalvalue, +- rtlpriv->dm.thermalvalue, rtlefuse->eeprom_thermalmeter); ++ rtl_dbg(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, ++ "Readback Thermal Meter = 0x%x pre thermal meter 0x%x eeprom_thermal meter 0x%x\n", ++ thermalvalue, ++ rtlpriv->dm.thermalvalue, rtlefuse->eeprom_thermalmeter); + + if (thermalvalue) { + rtlpriv->dm.thermalvalue = thermalvalue; +@@ -158,8 +158,8 @@ static void _rtl92s_dm_txpowertracking_callback_thermalmeter( + (rtlpriv->efuse.thermalmeter[0] << 8) | + (thermalvalue << 16)); + +- RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, +- "Write to FW Thermal Val = 0x%x\n", fw_cmd); ++ rtl_dbg(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, ++ "Write to FW Thermal Val = 0x%x\n", fw_cmd); + + rtl_write_dword(rtlpriv, WFM5, fw_cmd); + rtl92s_phy_chk_fwcmd_iodone(hw); +@@ -264,10 +264,10 @@ static void _rtl92s_dm_refresh_rateadaptive_mask(struct ieee80211_hw *hw) + } + + if (ra->pre_ratr_state != ra->ratr_state) { +- RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD, +- "RSSI = %ld RSSI_LEVEL = %d PreState = %d, CurState = %d\n", +- rtlpriv->dm.undec_sm_pwdb, ra->ratr_state, +- ra->pre_ratr_state, ra->ratr_state); ++ rtl_dbg(rtlpriv, COMP_RATE, DBG_LOUD, ++ "RSSI = %ld RSSI_LEVEL = %d PreState = %d, CurState = %d\n", ++ rtlpriv->dm.undec_sm_pwdb, ra->ratr_state, ++ ra->pre_ratr_state, ra->ratr_state); + + rcu_read_lock(); + sta = rtl_find_sta(hw, mac->bssid); +@@ -576,8 +576,8 @@ static void _rtl92s_dm_dynamic_txpower(struct ieee80211_hw *hw) + + if ((mac->link_state < MAC80211_LINKED) && + (rtlpriv->dm.entry_min_undec_sm_pwdb == 0)) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE, +- "Not connected to any\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE, ++ "Not connected to any\n"); + + rtlpriv->dm.dynamic_txhighpower_lvl = TX_HIGHPWR_LEVEL_NORMAL; + +@@ -588,21 +588,21 @@ static void _rtl92s_dm_dynamic_txpower(struct ieee80211_hw *hw) + if (mac->link_state >= MAC80211_LINKED) { + if (mac->opmode == NL80211_IFTYPE_ADHOC) { + undec_sm_pwdb = rtlpriv->dm.entry_min_undec_sm_pwdb; +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "AP Client PWDB = 0x%lx\n", +- undec_sm_pwdb); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "AP Client PWDB = 0x%lx\n", ++ undec_sm_pwdb); + } else { + undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb; +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "STA Default Port PWDB = 0x%lx\n", +- undec_sm_pwdb); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "STA Default Port PWDB = 0x%lx\n", ++ undec_sm_pwdb); + } + } else { + undec_sm_pwdb = rtlpriv->dm.entry_min_undec_sm_pwdb; + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "AP Ext Port PWDB = 0x%lx\n", +- undec_sm_pwdb); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "AP Ext Port PWDB = 0x%lx\n", ++ undec_sm_pwdb); + } + + txpwr_threshold_lv2 = TX_POWER_NEAR_FIELD_THRESH_LVL2; +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/fw.c +index 541b7881735e8..61bc3a384fdac 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/fw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/fw.c +@@ -39,8 +39,8 @@ static bool _rtl92s_firmware_enable_cpu(struct ieee80211_hw *hw) + do { + cpustatus = rtl_read_byte(rtlpriv, TCR); + if (cpustatus & IMEM_RDY) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "IMEM Ready after CPU has refilled\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "IMEM Ready after CPU has refilled\n"); + break; + } + +@@ -195,8 +195,8 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw, + short pollingcnt = 1000; + bool rtstatus = true; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "LoadStaus(%d)\n", loadfw_status); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "LoadStaus(%d)\n", loadfw_status); + + firmware->fwstatus = (enum fw_status)loadfw_status; + +@@ -256,9 +256,9 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw, + goto status_check_fail; + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "DMEM code download success, cpustatus(%#x)\n", +- cpustatus); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "DMEM code download success, cpustatus(%#x)\n", ++ cpustatus); + + /* Prevent Delay too much and being scheduled out */ + /* Polling Load Firmware ready */ +@@ -270,9 +270,9 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw, + udelay(40); + } while (pollingcnt--); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Polling Load Firmware ready, cpustatus(%x)\n", +- cpustatus); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Polling Load Firmware ready, cpustatus(%x)\n", ++ cpustatus); + + if (((cpustatus & LOAD_FW_READY) != LOAD_FW_READY) || + (pollingcnt <= 0)) { +@@ -290,8 +290,8 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw, + rtl_write_dword(rtlpriv, RCR, (tmpu4b | RCR_APPFCS | + RCR_APP_ICV | RCR_APP_MIC)); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Current RCR settings(%#x)\n", tmpu4b); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Current RCR settings(%#x)\n", tmpu4b); + + /* Set to normal mode. */ + rtl_write_byte(rtlpriv, LBKMD_SEL, LBK_NORMAL); +@@ -304,9 +304,9 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw, + } + + status_check_fail: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "loadfw_status(%d), rtstatus(%x)\n", +- loadfw_status, rtstatus); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "loadfw_status(%d), rtstatus(%x)\n", ++ loadfw_status, rtstatus); + return rtstatus; + } + +@@ -337,11 +337,11 @@ int rtl92s_download_fw(struct ieee80211_hw *hw) + firmware->firmwareversion = byte(pfwheader->version, 0); + firmware->pfwheader->fwpriv.hci_sel = 1;/* pcie */ + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "signature:%x, version:%x, size:%x, imemsize:%x, sram size:%x\n", +- pfwheader->signature, +- pfwheader->version, pfwheader->dmem_size, +- pfwheader->img_imem_size, pfwheader->img_sram_size); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "signature:%x, version:%x, size:%x, imemsize:%x, sram size:%x\n", ++ pfwheader->signature, ++ pfwheader->version, pfwheader->dmem_size, ++ pfwheader->img_imem_size, pfwheader->img_sram_size); + + /* 2. Retrieve IMEM image. */ + if ((pfwheader->img_imem_size == 0) || (pfwheader->img_imem_size > +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/hw.c +index 6d6e8994460d9..b04f5595414a1 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/hw.c +@@ -111,8 +111,8 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val) + case HW_VAR_SLOT_TIME:{ + u8 e_aci; + +- RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD, +- "HW_VAR_SLOT_TIME %x\n", val[0]); ++ rtl_dbg(rtlpriv, COMP_MLME, DBG_LOUD, ++ "HW_VAR_SLOT_TIME %x\n", val[0]); + + rtl_write_byte(rtlpriv, SLOT_TIME, val[0]); + +@@ -156,9 +156,9 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val) + + *val = min_spacing_to_set; + +- RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD, +- "Set HW_VAR_AMPDU_MIN_SPACE: %#x\n", +- mac->min_space_cfg); ++ rtl_dbg(rtlpriv, COMP_MLME, DBG_LOUD, ++ "Set HW_VAR_AMPDU_MIN_SPACE: %#x\n", ++ mac->min_space_cfg); + + rtl_write_byte(rtlpriv, AMPDU_MIN_SPACE, + mac->min_space_cfg); +@@ -172,9 +172,9 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val) + mac->min_space_cfg = rtlpriv->rtlhal.minspace_cfg; + mac->min_space_cfg |= (density_to_set << 3); + +- RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD, +- "Set HW_VAR_SHORTGI_DENSITY: %#x\n", +- mac->min_space_cfg); ++ rtl_dbg(rtlpriv, COMP_MLME, DBG_LOUD, ++ "Set HW_VAR_SHORTGI_DENSITY: %#x\n", ++ mac->min_space_cfg); + + rtl_write_byte(rtlpriv, AMPDU_MIN_SPACE, + mac->min_space_cfg); +@@ -215,9 +215,9 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val) + (factorlevel[17] << 4)); + rtl_write_byte(rtlpriv, AGGLEN_LMT_H, regtoset); + +- RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD, +- "Set HW_VAR_AMPDU_FACTOR: %#x\n", +- factor_toset); ++ rtl_dbg(rtlpriv, COMP_MLME, DBG_LOUD, ++ "Set HW_VAR_AMPDU_FACTOR: %#x\n", ++ factor_toset); + } + break; + } +@@ -253,9 +253,9 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val) + acm_ctrl |= ACMHW_VOQEN; + break; + default: +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "HW_VAR_ACM_CTRL acm set failed: eACI is %d\n", +- acm); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "HW_VAR_ACM_CTRL acm set failed: eACI is %d\n", ++ acm); + break; + } + } else { +@@ -276,8 +276,8 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val) + } + } + +- RT_TRACE(rtlpriv, COMP_QOS, DBG_TRACE, +- "HW_VAR_ACM_CTRL Write 0x%X\n", acm_ctrl); ++ rtl_dbg(rtlpriv, COMP_QOS, DBG_TRACE, ++ "HW_VAR_ACM_CTRL Write 0x%X\n", acm_ctrl); + rtl_write_byte(rtlpriv, ACMHWCTRL, acm_ctrl); + break; + } +@@ -417,14 +417,14 @@ void rtl92se_enable_hw_security_config(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + u8 sec_reg_value = 0x0; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "PairwiseEncAlgorithm = %d GroupEncAlgorithm = %d\n", +- rtlpriv->sec.pairwise_enc_algorithm, +- rtlpriv->sec.group_enc_algorithm); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "PairwiseEncAlgorithm = %d GroupEncAlgorithm = %d\n", ++ rtlpriv->sec.pairwise_enc_algorithm, ++ rtlpriv->sec.group_enc_algorithm); + + if (rtlpriv->cfg->mod_params->sw_crypto || rtlpriv->sec.use_sw_sec) { +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "not open hw encryption\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "not open hw encryption\n"); + return; + } + +@@ -435,8 +435,8 @@ void rtl92se_enable_hw_security_config(struct ieee80211_hw *hw) + sec_reg_value |= SCR_RXUSEDK; + } + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, "The SECR-value %x\n", +- sec_reg_value); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, "The SECR-value %x\n", ++ sec_reg_value); + + rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value); + +@@ -870,10 +870,10 @@ static void _rtl92se_macconfig_after_fwdownload(struct ieee80211_hw *hw) + + /* Change Program timing */ + rtl_write_byte(rtlpriv, REG_EFUSE_CTRL + 3, 0x72); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "EFUSE CONFIG OK\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "EFUSE CONFIG OK\n"); + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "OK\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "OK\n"); + + } + +@@ -960,9 +960,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + /* 2. download firmware */ + rtstatus = rtl92s_download_fw(hw); + if (!rtstatus) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "Failed to download FW. Init HW without FW now... " +- "Please copy FW into /lib/firmware/rtlwifi\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "Failed to download FW. Init HW without FW now... Please copy FW into /lib/firmware/rtlwifi\n"); + err = 1; + goto exit; + } +@@ -1014,7 +1013,7 @@ int rtl92se_hw_init(struct ieee80211_hw *hw) + rtl_write_byte(rtlpriv, RF_CTRL, 0x07); + + if (!rtl92s_phy_rf_config(hw)) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "RF Config failed\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "RF Config failed\n"); + err = rtstatus; + goto exit; + } +@@ -1147,23 +1146,23 @@ static int _rtl92se_set_media_status(struct ieee80211_hw *hw, + switch (type) { + case NL80211_IFTYPE_UNSPECIFIED: + bt_msr |= (MSR_LINK_NONE << MSR_LINK_SHIFT); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "Set Network type to NO LINK!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "Set Network type to NO LINK!\n"); + break; + case NL80211_IFTYPE_ADHOC: + bt_msr |= (MSR_LINK_ADHOC << MSR_LINK_SHIFT); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "Set Network type to Ad Hoc!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "Set Network type to Ad Hoc!\n"); + break; + case NL80211_IFTYPE_STATION: + bt_msr |= (MSR_LINK_MANAGED << MSR_LINK_SHIFT); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "Set Network type to STA!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "Set Network type to STA!\n"); + break; + case NL80211_IFTYPE_AP: + bt_msr |= (MSR_LINK_MASTER << MSR_LINK_SHIFT); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "Set Network type to AP!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "Set Network type to AP!\n"); + break; + default: + pr_err("Network type %d not supported!\n", type); +@@ -1606,8 +1605,8 @@ void rtl92se_update_interrupt_mask(struct ieee80211_hw *hw, + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_LOUD, "add_msr:%x, rm_msr:%x\n", +- add_msr, rm_msr); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_LOUD, "add_msr:%x, rm_msr:%x\n", ++ add_msr, rm_msr); + + if (add_msr) + rtlpci->irq_mask[0] |= add_msr; +@@ -1671,11 +1670,11 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw) + + eeprom_id = *((u16 *)&hwinfo[0]); + if (eeprom_id != RTL8190_EEPROM_ID) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "EEPROM ID(%#x) is invalid!!\n", eeprom_id); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "EEPROM ID(%#x) is invalid!!\n", eeprom_id); + rtlefuse->autoload_failflag = true; + } else { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n"); + rtlefuse->autoload_failflag = false; + } + +@@ -1692,16 +1691,16 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw) + rtlefuse->eeprom_smid = *(u16 *)&hwinfo[EEPROM_SMID]; + rtlefuse->eeprom_version = *(u16 *)&hwinfo[EEPROM_VERSION]; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROMId = 0x%4x\n", eeprom_id); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROMId = 0x%4x\n", eeprom_id); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid); + + for (i = 0; i < 6; i += 2) { + usvalue = *(u16 *)&hwinfo[EEPROM_MAC_ADDR + i]; +@@ -1711,7 +1710,7 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw) + for (i = 0; i < 6; i++) + rtl_write_byte(rtlpriv, MACIDR0 + i, rtlefuse->dev_addr[i]); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr); + + /* Get Tx Power Level by Channel */ + /* Read Tx power of Channel 1 ~ 14 from EEPROM. */ +@@ -1964,15 +1963,15 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw) + tempval = rtl_read_byte(rtlpriv, 0x07); + if (!(tempval & BIT(0))) { + rtlefuse->b1x1_recvcombine = true; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "RF_TYPE=1T2R but only 1SS\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "RF_TYPE=1T2R but only 1SS\n"); + } + } + rtlefuse->b1ss_support = rtlefuse->b1x1_recvcombine; + rtlefuse->eeprom_oemid = *&hwinfo[EEPROM_CUSTOMID]; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "EEPROM Customer ID: 0x%2x\n", +- rtlefuse->eeprom_oemid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "EEPROM Customer ID: 0x%2x\n", ++ rtlefuse->eeprom_oemid); + + /* set channel paln to world wide 13 */ + rtlefuse->channel_plan = COUNTRY_CODE_WORLD_WIDE_13; +@@ -1987,15 +1986,15 @@ void rtl92se_read_eeprom_info(struct ieee80211_hw *hw) + tmp_u1b = rtl_read_byte(rtlpriv, EPROM_CMD); + + if (tmp_u1b & BIT(4)) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EEPROM\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EEPROM\n"); + rtlefuse->epromtype = EEPROM_93C46; + } else { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EFUSE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EFUSE\n"); + rtlefuse->epromtype = EEPROM_BOOT_EFUSE; + } + + if (tmp_u1b & BIT(5)) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n"); + rtlefuse->autoload_failflag = false; + _rtl92se_read_adapter_info(hw); + } else { +@@ -2101,8 +2100,8 @@ static void rtl92se_update_hal_rate_table(struct ieee80211_hw *hw, + else + rtl92s_phy_set_fw_cmd(hw, FW_CMD_RA_REFRESH_BG); + +- RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n", +- rtl_read_dword(rtlpriv, ARFR0)); ++ rtl_dbg(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n", ++ rtl_read_dword(rtlpriv, ARFR0)); + } + + static void rtl92se_update_hal_rate_mask(struct ieee80211_hw *hw, +@@ -2256,8 +2255,8 @@ static void rtl92se_update_hal_rate_mask(struct ieee80211_hw *hw, + + mask |= (bmulticast ? 1 : 0) << 9 | (macid & 0x1f) << 4 | (band & 0xf); + +- RT_TRACE(rtlpriv, COMP_RATR, DBG_TRACE, "mask = %x, bitmap = %x\n", +- mask, ratr_bitmap); ++ rtl_dbg(rtlpriv, COMP_RATR, DBG_TRACE, "mask = %x, bitmap = %x\n", ++ mask, ratr_bitmap); + rtl_write_dword(rtlpriv, 0x2c4, ratr_bitmap); + rtl_write_dword(rtlpriv, WFM5, (FW_RA_UPDATE_MASK | (mask << 8))); + +@@ -2332,15 +2331,15 @@ bool rtl92se_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 *valid) + rfpwr_toset = _rtl92se_rf_onoff_detect(hw); + + if ((ppsc->hwradiooff) && (rfpwr_toset == ERFON)) { +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "RFKILL-HW Radio ON, RF ON\n"); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "RFKILL-HW Radio ON, RF ON\n"); + + rfpwr_toset = ERFON; + ppsc->hwradiooff = false; + actuallyset = true; + } else if ((!ppsc->hwradiooff) && (rfpwr_toset == ERFOFF)) { +- RT_TRACE(rtlpriv, COMP_RF, +- DBG_DMESG, "RFKILL-HW Radio OFF, RF OFF\n"); ++ rtl_dbg(rtlpriv, COMP_RF, ++ DBG_DMESG, "RFKILL-HW Radio OFF, RF OFF\n"); + + rfpwr_toset = ERFOFF; + ppsc->hwradiooff = true; +@@ -2404,7 +2403,7 @@ void rtl92se_set_key(struct ieee80211_hw *hw, u32 key_index, u8 *p_macaddr, + u8 cam_offset = 0; + u8 clear_number = 5; + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "clear_all\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "clear_all\n"); + + for (idx = 0; idx < clear_number; idx++) { + rtl_cam_mark_invalid(hw, cam_offset + idx); +@@ -2463,26 +2462,26 @@ void rtl92se_set_key(struct ieee80211_hw *hw, u32 key_index, u8 *p_macaddr, + } + + if (rtlpriv->sec.key_len[key_index] == 0) { +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "delete one entry, entry_id is %d\n", +- entry_id); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "delete one entry, entry_id is %d\n", ++ entry_id); + if (mac->opmode == NL80211_IFTYPE_AP) + rtl_cam_del_entry(hw, p_macaddr); + rtl_cam_delete_one_entry(hw, p_macaddr, entry_id); + } else { +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "add one entry\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "add one entry\n"); + if (is_pairwise) { +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set Pairwise key\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set Pairwise key\n"); + + rtl_cam_add_one_entry(hw, macaddr, key_index, + entry_id, enc_algo, + CAM_CONFIG_NO_USEDK, + rtlpriv->sec.key_buf[key_index]); + } else { +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set group key\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set group key\n"); + + if (mac->opmode == NL80211_IFTYPE_ADHOC) { + rtl_cam_add_one_entry(hw, +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/led.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/led.c +index 2d18bc1ee4803..ecbf425f679f8 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/led.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/led.c +@@ -27,8 +27,8 @@ void rtl92se_sw_led_on(struct ieee80211_hw *hw, struct rtl_led *pled) + u8 ledcfg; + struct rtl_priv *rtlpriv = rtl_priv(hw); + +- RT_TRACE(rtlpriv, COMP_LED, DBG_LOUD, "LedAddr:%X ledpin=%d\n", +- LEDCFG, pled->ledpin); ++ rtl_dbg(rtlpriv, COMP_LED, DBG_LOUD, "LedAddr:%X ledpin=%d\n", ++ LEDCFG, pled->ledpin); + + ledcfg = rtl_read_byte(rtlpriv, LEDCFG); + +@@ -57,8 +57,8 @@ void rtl92se_sw_led_off(struct ieee80211_hw *hw, struct rtl_led *pled) + rtlpriv = rtl_priv(hw); + if (!rtlpriv || rtlpriv->max_fw_size) + return; +- RT_TRACE(rtlpriv, COMP_LED, DBG_LOUD, "LedAddr:%X ledpin=%d\n", +- LEDCFG, pled->ledpin); ++ rtl_dbg(rtlpriv, COMP_LED, DBG_LOUD, "LedAddr:%X ledpin=%d\n", ++ LEDCFG, pled->ledpin); + + ledcfg = rtl_read_byte(rtlpriv, LEDCFG); + +@@ -119,7 +119,7 @@ void rtl92se_led_control(struct ieee80211_hw *hw, enum led_ctl_mode ledaction) + ledaction == LED_CTL_POWER_ON)) { + return; + } +- RT_TRACE(rtlpriv, COMP_LED, DBG_LOUD, "ledaction %d\n", ledaction); ++ rtl_dbg(rtlpriv, COMP_LED, DBG_LOUD, "ledaction %d\n", ledaction); + + _rtl92se_sw_led_control(hw, ledaction); + } +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c +index f377531bc2bd3..cd735d61f6304 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c +@@ -19,15 +19,15 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) + struct rtl_priv *rtlpriv = rtl_priv(hw); + u32 returnvalue = 0, originalvalue, bitshift; + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n", +- regaddr, bitmask); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n", ++ regaddr, bitmask); + + originalvalue = rtl_read_dword(rtlpriv, regaddr); + bitshift = calculate_bit_shift(bitmask); + returnvalue = (originalvalue & bitmask) >> bitshift; + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n", +- bitmask, regaddr, originalvalue); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n", ++ bitmask, regaddr, originalvalue); + + return returnvalue; + +@@ -39,9 +39,9 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask, + struct rtl_priv *rtlpriv = rtl_priv(hw); + u32 originalvalue, bitshift; + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, +- "regaddr(%#x), bitmask(%#x), data(%#x)\n", +- regaddr, bitmask, data); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, ++ "regaddr(%#x), bitmask(%#x), data(%#x)\n", ++ regaddr, bitmask, data); + + if (bitmask != MASKDWORD) { + originalvalue = rtl_read_dword(rtlpriv, regaddr); +@@ -51,9 +51,9 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask, + + rtl_write_dword(rtlpriv, regaddr, data); + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, +- "regaddr(%#x), bitmask(%#x), data(%#x)\n", +- regaddr, bitmask, data); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, ++ "regaddr(%#x), bitmask(%#x), data(%#x)\n", ++ regaddr, bitmask, data); + + } + +@@ -111,8 +111,8 @@ static u32 _rtl92s_phy_rf_serial_read(struct ieee80211_hw *hw, + retvalue = rtl_get_bbreg(hw, pphyreg->rf_rb, + BLSSI_READBACK_DATA); + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "RFR-%d Addr[0x%x]=0x%x\n", +- rfpath, pphyreg->rf_rb, retvalue); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "RFR-%d Addr[0x%x]=0x%x\n", ++ rfpath, pphyreg->rf_rb, retvalue); + + return retvalue; + +@@ -134,8 +134,8 @@ static void _rtl92s_phy_rf_serial_write(struct ieee80211_hw *hw, + data_and_addr = ((newoffset << 20) | (data & 0x000fffff)) & 0x0fffffff; + rtl_set_bbreg(hw, pphyreg->rf3wire_offset, MASKDWORD, data_and_addr); + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "RFW-%d Addr[0x%x]=0x%x\n", +- rfpath, pphyreg->rf3wire_offset, data_and_addr); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "RFW-%d Addr[0x%x]=0x%x\n", ++ rfpath, pphyreg->rf3wire_offset, data_and_addr); + } + + +@@ -145,8 +145,8 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, + struct rtl_priv *rtlpriv = rtl_priv(hw); + u32 original_value, readback_value, bitshift; + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, +- "regaddr(%#x), rfpath(%#x), bitmask(%#x)\n", ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, ++ "regaddr(%#x), rfpath(%#x), bitmask(%#x)\n", + regaddr, rfpath, bitmask); + + spin_lock(&rtlpriv->locks.rf_lock); +@@ -158,9 +158,9 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, + + spin_unlock(&rtlpriv->locks.rf_lock); + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, +- "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n", +- regaddr, rfpath, bitmask, original_value); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, ++ "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n", ++ regaddr, rfpath, bitmask, original_value); + + return readback_value; + } +@@ -175,9 +175,9 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, + if (!((rtlphy->rf_pathmap >> rfpath) & 0x1)) + return; + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, +- "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n", +- regaddr, bitmask, data, rfpath); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, ++ "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n", ++ regaddr, bitmask, data, rfpath); + + spin_lock(&rtlpriv->locks.rf_lock); + +@@ -192,9 +192,9 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, + + spin_unlock(&rtlpriv->locks.rf_lock); + +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, +- "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n", +- regaddr, bitmask, data, rfpath); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, ++ "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n", ++ regaddr, bitmask, data, rfpath); + + } + +@@ -227,9 +227,9 @@ void rtl92s_phy_set_bw_mode(struct ieee80211_hw *hw, + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + u8 reg_bw_opmode; + +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "Switch to %s bandwidth\n", +- rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20 ? +- "20MHz" : "40MHz"); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_TRACE, "Switch to %s bandwidth\n", ++ rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20 ? ++ "20MHz" : "40MHz"); + + if (rtlphy->set_bwmode_inprogress) + return; +@@ -284,7 +284,7 @@ void rtl92s_phy_set_bw_mode(struct ieee80211_hw *hw, + + rtl92s_phy_rf6052_set_bandwidth(hw, rtlphy->current_chan_bw); + rtlphy->set_bwmode_inprogress = false; +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "<==\n"); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_TRACE, "<==\n"); + } + + static bool _rtl92s_phy_set_sw_chnl_cmdarray(struct swchnlcmd *cmdtable, +@@ -422,8 +422,8 @@ u8 rtl92s_phy_sw_chnl(struct ieee80211_hw *hw) + u32 delay; + bool ret; + +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "switch to channel%d\n", +- rtlphy->current_channel); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_TRACE, "switch to channel%d\n", ++ rtlphy->current_channel); + + if (rtlphy->sw_chnl_inprogress) + return 0; +@@ -459,7 +459,7 @@ u8 rtl92s_phy_sw_chnl(struct ieee80211_hw *hw) + + rtlphy->sw_chnl_inprogress = false; + +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "<==\n"); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_TRACE, "<==\n"); + + return 1; + } +@@ -518,20 +518,19 @@ bool rtl92s_phy_set_rf_power_state(struct ieee80211_hw *hw, + u32 initializecount = 0; + do { + initializecount++; +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "IPS Set eRf nic enable\n"); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "IPS Set eRf nic enable\n"); + rtstatus = rtl_ps_enable_nic(hw); + } while (!rtstatus && (initializecount < 10)); + + RT_CLEAR_PS_LEVEL(ppsc, + RT_RF_OFF_LEVL_HALT_NIC); + } else { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, +- "awake, sleeped:%d ms state_inap:%x\n", +- jiffies_to_msecs(jiffies - +- ppsc-> +- last_sleep_jiffies), +- rtlpriv->psc.state_inap); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, ++ "awake, slept:%d ms state_inap:%x\n", ++ jiffies_to_msecs(jiffies - ++ ppsc->last_sleep_jiffies), ++ rtlpriv->psc.state_inap); + ppsc->last_awake_jiffies = jiffies; + rtl_write_word(rtlpriv, CMDR, 0x37FC); + rtl_write_byte(rtlpriv, TXPAUSE, 0x00); +@@ -548,8 +547,8 @@ bool rtl92s_phy_set_rf_power_state(struct ieee80211_hw *hw, + } + case ERFOFF:{ + if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_HALT_NIC) { +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "IPS Set eRf nic disable\n"); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "IPS Set eRf nic disable\n"); + rtl_ps_disable_nic(hw); + RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC); + } else { +@@ -574,34 +573,34 @@ bool rtl92s_phy_set_rf_power_state(struct ieee80211_hw *hw, + queue_id++; + continue; + } else { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "eRf Off/Sleep: %d times TcbBusyQueue[%d] = %d before doze!\n", +- i + 1, queue_id, +- skb_queue_len(&ring->queue)); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "eRf Off/Sleep: %d times TcbBusyQueue[%d] = %d before doze!\n", ++ i + 1, queue_id, ++ skb_queue_len(&ring->queue)); + + udelay(10); + i++; + } + + if (i >= MAX_DOZE_WAITING_TIMES_9x) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "ERFOFF: %d times TcbBusyQueue[%d] = %d !\n", +- MAX_DOZE_WAITING_TIMES_9x, +- queue_id, +- skb_queue_len(&ring->queue)); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "ERFOFF: %d times TcbBusyQueue[%d] = %d !\n", ++ MAX_DOZE_WAITING_TIMES_9x, ++ queue_id, ++ skb_queue_len(&ring->queue)); + break; + } + } + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, +- "Set ERFSLEEP awaked:%d ms\n", +- jiffies_to_msecs(jiffies - +- ppsc->last_awake_jiffies)); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, ++ "Set ERFSLEEP awaked:%d ms\n", ++ jiffies_to_msecs(jiffies - ++ ppsc->last_awake_jiffies)); + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, +- "sleep awaked:%d ms state_inap:%x\n", +- jiffies_to_msecs(jiffies - +- ppsc->last_awake_jiffies), ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, ++ "sleep awaked:%d ms state_inap:%x\n", ++ jiffies_to_msecs(jiffies - ++ ppsc->last_awake_jiffies), + rtlpriv->psc.state_inap); + ppsc->last_sleep_jiffies = jiffies; + _rtl92se_phy_set_rf_sleep(hw); +@@ -956,7 +955,7 @@ u8 rtl92s_phy_config_rf(struct ieee80211_hw *hw, enum radio_path rfpath) + radio_b_tblen = RADIOB_ARRAYLENGTH; + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Radio No %x\n", rfpath); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Radio No %x\n", rfpath); + rtstatus = true; + + switch (rfpath) { +@@ -1076,20 +1075,20 @@ void rtl92s_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw) + ROFDM0_XCAGCCORE1, MASKBYTE0); + rtlphy->default_initialgain[3] = rtl_get_bbreg(hw, + ROFDM0_XDAGCCORE1, MASKBYTE0); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Default initial gain (c50=0x%x, c58=0x%x, c60=0x%x, c68=0x%x)\n", +- rtlphy->default_initialgain[0], +- rtlphy->default_initialgain[1], +- rtlphy->default_initialgain[2], +- rtlphy->default_initialgain[3]); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Default initial gain (c50=0x%x, c58=0x%x, c60=0x%x, c68=0x%x)\n", ++ rtlphy->default_initialgain[0], ++ rtlphy->default_initialgain[1], ++ rtlphy->default_initialgain[2], ++ rtlphy->default_initialgain[3]); + + /* read framesync */ + rtlphy->framesync = rtl_get_bbreg(hw, ROFDM0_RXDETECTOR3, MASKBYTE0); + rtlphy->framesync_c34 = rtl_get_bbreg(hw, ROFDM0_RXDETECTOR2, + MASKDWORD); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Default framesync (0x%x) = 0x%x\n", +- ROFDM0_RXDETECTOR3, rtlphy->framesync); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Default framesync (0x%x) = 0x%x\n", ++ ROFDM0_RXDETECTOR3, rtlphy->framesync); + + } + +@@ -1151,10 +1150,10 @@ void rtl92s_phy_set_txpower(struct ieee80211_hw *hw, u8 channel) + _rtl92s_phy_get_txpower_index(hw, channel, &cckpowerlevel[0], + &ofdmpowerlevel[0]); + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Channel-%d, cckPowerLevel (A / B) = 0x%x / 0x%x, ofdmPowerLevel (A / B) = 0x%x / 0x%x\n", +- channel, cckpowerlevel[0], cckpowerlevel[1], +- ofdmpowerlevel[0], ofdmpowerlevel[1]); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Channel-%d, cckPowerLevel (A / B) = 0x%x / 0x%x, ofdmPowerLevel (A / B) = 0x%x / 0x%x\n", ++ channel, cckpowerlevel[0], cckpowerlevel[1], ++ ofdmpowerlevel[0], ofdmpowerlevel[1]); + + _rtl92s_phy_ccxpower_indexcheck(hw, channel, &cckpowerlevel[0], + &ofdmpowerlevel[0]); +@@ -1212,17 +1211,17 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw) + skip: + switch (rtlhal->current_fwcmd_io) { + case FW_CMD_RA_RESET: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_RESET\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_RESET\n"); + rtl_write_dword(rtlpriv, WFM5, FW_RA_RESET); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; + case FW_CMD_RA_ACTIVE: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_ACTIVE\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_ACTIVE\n"); + rtl_write_dword(rtlpriv, WFM5, FW_RA_ACTIVE); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; + case FW_CMD_RA_REFRESH_N: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_REFRESH_N\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_REFRESH_N\n"); + input = FW_RA_REFRESH; + rtl_write_dword(rtlpriv, WFM5, input); + rtl92s_phy_chk_fwcmd_iodone(hw); +@@ -1230,29 +1229,29 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw) + rtl92s_phy_chk_fwcmd_iodone(hw); + break; + case FW_CMD_RA_REFRESH_BG: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, +- "FW_CMD_RA_REFRESH_BG\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, ++ "FW_CMD_RA_REFRESH_BG\n"); + rtl_write_dword(rtlpriv, WFM5, FW_RA_REFRESH); + rtl92s_phy_chk_fwcmd_iodone(hw); + rtl_write_dword(rtlpriv, WFM5, FW_RA_DISABLE_RSSI_MASK); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; + case FW_CMD_RA_REFRESH_N_COMB: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, +- "FW_CMD_RA_REFRESH_N_COMB\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, ++ "FW_CMD_RA_REFRESH_N_COMB\n"); + input = FW_RA_IOT_N_COMB; + rtl_write_dword(rtlpriv, WFM5, input); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; + case FW_CMD_RA_REFRESH_BG_COMB: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, +- "FW_CMD_RA_REFRESH_BG_COMB\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, ++ "FW_CMD_RA_REFRESH_BG_COMB\n"); + input = FW_RA_IOT_BG_COMB; + rtl_write_dword(rtlpriv, WFM5, input); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; + case FW_CMD_IQK_ENABLE: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_IQK_ENABLE\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_IQK_ENABLE\n"); + rtl_write_dword(rtlpriv, WFM5, FW_IQK_ENABLE); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; +@@ -1287,7 +1286,7 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw) + rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2, 0xcd); + break; + case FW_CMD_LPS_ENTER: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_LPS_ENTER\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_LPS_ENTER\n"); + current_aid = rtlpriv->mac80211.assoc_id; + rtl_write_dword(rtlpriv, WFM5, (FW_LPS_ENTER | + ((current_aid | 0xc000) << 8))); +@@ -1296,18 +1295,18 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw) + * turbo mode until driver leave LPS */ + break; + case FW_CMD_LPS_LEAVE: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_LPS_LEAVE\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_LPS_LEAVE\n"); + rtl_write_dword(rtlpriv, WFM5, FW_LPS_LEAVE); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; + case FW_CMD_ADD_A2_ENTRY: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_ADD_A2_ENTRY\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_ADD_A2_ENTRY\n"); + rtl_write_dword(rtlpriv, WFM5, FW_ADD_A2_ENTRY); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; + case FW_CMD_CTRL_DM_BY_DRIVER: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, +- "FW_CMD_CTRL_DM_BY_DRIVER\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, ++ "FW_CMD_CTRL_DM_BY_DRIVER\n"); + rtl_write_dword(rtlpriv, WFM5, FW_CTRL_DM_BY_DRIVER); + rtl92s_phy_chk_fwcmd_iodone(hw); + break; +@@ -1332,9 +1331,9 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio) + u16 fw_cmdmap = FW_CMD_IO_QUERY(rtlpriv); + bool postprocessing = false; + +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, +- "Set FW Cmd(%#x), set_fwcmd_inprogress(%d)\n", +- fw_cmdio, rtlhal->set_fwcmd_inprogress); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, ++ "Set FW Cmd(%#x), set_fwcmd_inprogress(%d)\n", ++ fw_cmdio, rtlhal->set_fwcmd_inprogress); + + do { + /* We re-map to combined FW CMD ones if firmware version */ +@@ -1371,30 +1370,30 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio) + * DM map table in the future. */ + switch (fw_cmdio) { + case FW_CMD_RA_INIT: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, "RA init!!\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, "RA init!!\n"); + fw_cmdmap |= FW_RA_INIT_CTL; + FW_CMD_IO_SET(rtlpriv, fw_cmdmap); + /* Clear control flag to sync with FW. */ + FW_CMD_IO_CLR(rtlpriv, FW_RA_INIT_CTL); + break; + case FW_CMD_DIG_DISABLE: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, +- "Set DIG disable!!\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, ++ "Set DIG disable!!\n"); + fw_cmdmap &= ~FW_DIG_ENABLE_CTL; + FW_CMD_IO_SET(rtlpriv, fw_cmdmap); + break; + case FW_CMD_DIG_ENABLE: + case FW_CMD_DIG_RESUME: + if (!(rtlpriv->dm.dm_flag & HAL_DM_DIG_DISABLE)) { +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, +- "Set DIG enable or resume!!\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, ++ "Set DIG enable or resume!!\n"); + fw_cmdmap |= (FW_DIG_ENABLE_CTL | FW_SS_CTL); + FW_CMD_IO_SET(rtlpriv, fw_cmdmap); + } + break; + case FW_CMD_DIG_HALT: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, +- "Set DIG halt!!\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, ++ "Set DIG halt!!\n"); + fw_cmdmap &= ~(FW_DIG_ENABLE_CTL | FW_SS_CTL); + FW_CMD_IO_SET(rtlpriv, fw_cmdmap); + break; +@@ -1409,9 +1408,9 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio) + fw_param |= ((thermalval << 24) | + (rtlefuse->thermalmeter[0] << 16)); + +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, +- "Set TxPwr tracking!! FwCmdMap(%#x), FwParam(%#x)\n", +- fw_cmdmap, fw_param); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, ++ "Set TxPwr tracking!! FwCmdMap(%#x), FwParam(%#x)\n", ++ fw_cmdmap, fw_param); + + FW_CMD_PARA_SET(rtlpriv, fw_param); + FW_CMD_IO_SET(rtlpriv, fw_cmdmap); +@@ -1431,9 +1430,9 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio) + /* Clear FW parameter in terms of RA parts. */ + fw_param &= FW_RA_PARAM_CLR; + +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, +- "[FW CMD] [New Version] Set RA/IOT Comb in n mode!! FwCmdMap(%#x), FwParam(%#x)\n", +- fw_cmdmap, fw_param); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, ++ "[FW CMD] [New Version] Set RA/IOT Comb in n mode!! FwCmdMap(%#x), FwParam(%#x)\n", ++ fw_cmdmap, fw_param); + + FW_CMD_PARA_SET(rtlpriv, fw_param); + FW_CMD_IO_SET(rtlpriv, fw_cmdmap); +@@ -1519,8 +1518,8 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio) + FW_CMD_IO_SET(rtlpriv, fw_cmdmap); + break; + case FW_CMD_PAPE_CONTROL: +- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, +- "[FW CMD] Set PAPE Control\n"); ++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, ++ "[FW CMD] Set PAPE Control\n"); + fw_cmdmap &= ~FW_PAPE_CTL_BY_SW_HW; + + FW_CMD_IO_SET(rtlpriv, fw_cmdmap); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rf.c +index a37855f57e76f..85f6d0d4dd799 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rf.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rf.c +@@ -95,13 +95,13 @@ static void _rtl92s_get_powerbase(struct ieee80211_hw *hw, u8 *p_pwrlevel, + } + + if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "40MHz finalpwr_idx (A / B) = 0x%x / 0x%x\n", +- p_final_pwridx[0], p_final_pwridx[1]); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "40MHz finalpwr_idx (A / B) = 0x%x / 0x%x\n", ++ p_final_pwridx[0], p_final_pwridx[1]); + } else { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "20MHz finalpwr_idx (A / B) = 0x%x / 0x%x\n", +- p_final_pwridx[0], p_final_pwridx[1]); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "20MHz finalpwr_idx (A / B) = 0x%x / 0x%x\n", ++ p_final_pwridx[0], p_final_pwridx[1]); + } + } + +@@ -124,9 +124,9 @@ static void _rtl92s_set_antennadiff(struct ieee80211_hw *hw, + if (ant_pwr_diff < -8) + ant_pwr_diff = -8; + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Antenna Diff from RF-B to RF-A = %d (0x%x)\n", +- ant_pwr_diff, ant_pwr_diff & 0xf); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Antenna Diff from RF-B to RF-A = %d (0x%x)\n", ++ ant_pwr_diff, ant_pwr_diff & 0xf); + + ant_pwr_diff &= 0xf; + } +@@ -143,8 +143,8 @@ static void _rtl92s_set_antennadiff(struct ieee80211_hw *hw, + rtl_set_bbreg(hw, RFPGA0_TXGAINSTAGE, (BXBTXAGC | BXCTXAGC | BXDTXAGC), + u4reg_val); + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, "Write BCD-Diff(0x%x) = 0x%x\n", +- RFPGA0_TXGAINSTAGE, u4reg_val); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, "Write BCD-Diff(0x%x) = 0x%x\n", ++ RFPGA0_TXGAINSTAGE, u4reg_val); + } + + static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw, +@@ -169,8 +169,8 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw, + writeval = rtlphy->mcs_offset[chnlgroup][index] + + ((index < 2) ? pwrbase0 : pwrbase1); + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "RTK better performance, writeval = 0x%x\n", writeval); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "RTK better performance, writeval = 0x%x\n", writeval); + break; + case 1: + /* Realtek regulatory increase power diff defined +@@ -178,9 +178,9 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw, + if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40) { + writeval = ((index < 2) ? pwrbase0 : pwrbase1); + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Realtek regulatory, 40MHz, writeval = 0x%x\n", +- writeval); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Realtek regulatory, 40MHz, writeval = 0x%x\n", ++ writeval); + } else { + chnlgroup = 0; + +@@ -199,16 +199,16 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw, + + ((index < 2) ? + pwrbase0 : pwrbase1); + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Realtek regulatory, 20MHz, writeval = 0x%x\n", +- writeval); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Realtek regulatory, 20MHz, writeval = 0x%x\n", ++ writeval); + } + break; + case 2: + /* Better regulatory don't increase any power diff */ + writeval = ((index < 2) ? pwrbase0 : pwrbase1); +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Better regulatory, writeval = 0x%x\n", writeval); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Better regulatory, writeval = 0x%x\n", writeval); + break; + case 3: + /* Customer defined power diff. increase power diff +@@ -216,15 +216,15 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw, + chnlgroup = 0; + + if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "customer's limit, 40MHz = 0x%x\n", +- rtlefuse->pwrgroup_ht40 +- [RF90_PATH_A][chnl - 1]); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "customer's limit, 40MHz = 0x%x\n", ++ rtlefuse->pwrgroup_ht40 ++ [RF90_PATH_A][chnl - 1]); + } else { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "customer's limit, 20MHz = 0x%x\n", +- rtlefuse->pwrgroup_ht20 +- [RF90_PATH_A][chnl - 1]); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "customer's limit, 20MHz = 0x%x\n", ++ rtlefuse->pwrgroup_ht20 ++ [RF90_PATH_A][chnl - 1]); + } + + for (i = 0; i < 4; i++) { +@@ -256,20 +256,20 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw, + (pwrdiff_limit[2] << 16) | + (pwrdiff_limit[1] << 8) | + (pwrdiff_limit[0]); +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Customer's limit = 0x%x\n", customer_limit); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Customer's limit = 0x%x\n", customer_limit); + + writeval = customer_limit + ((index < 2) ? + pwrbase0 : pwrbase1); +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Customer, writeval = 0x%x\n", writeval); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Customer, writeval = 0x%x\n", writeval); + break; + default: + chnlgroup = 0; + writeval = rtlphy->mcs_offset[chnlgroup][index] + + ((index < 2) ? pwrbase0 : pwrbase1); +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "RTK better performance, writeval = 0x%x\n", writeval); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "RTK better performance, writeval = 0x%x\n", writeval); + break; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c +index 1c7ee569f4bf9..4c4a1201d420f 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c +@@ -66,8 +66,8 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) + struct rt_firmware *pfirmware = NULL; + char *fw_name = "rtlwifi/rtl8192sefw.bin"; + +- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD, +- "Firmware callback routine entered!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, ++ "Firmware callback routine entered!\n"); + complete(&rtlpriv->firmware_loading_complete); + if (!firmware) { + pr_err("Firmware %s not available\n", fw_name); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/trx.c +index efb432c6d7858..4ec8c93620601 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/trx.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/trx.c +@@ -333,8 +333,8 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw, + u8 bw_40 = 0; + + if (pci_dma_mapping_error(rtlpci->pdev, mapping)) { +- RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE, +- "DMA mapping error\n"); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_TRACE, ++ "DMA mapping error\n"); + return; + } + if (mac->opmode == NL80211_IFTYPE_STATION) { +@@ -487,7 +487,7 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw, + /* DOWRD 8 */ + SET_TX_DESC_TX_BUFFER_ADDRESS(pdesc, mapping); + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE, "\n"); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_TRACE, "\n"); + } + + void rtl92se_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc, +@@ -502,8 +502,8 @@ void rtl92se_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc, + PCI_DMA_TODEVICE); + + if (pci_dma_mapping_error(rtlpci->pdev, mapping)) { +- RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE, +- "DMA mapping error\n"); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_TRACE, ++ "DMA mapping error\n"); + return; + } + /* Clear all status */ +-- +2.39.5 + diff --git a/queue-5.4/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch b/queue-5.4/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch new file mode 100644 index 0000000000..95d7efb581 --- /dev/null +++ b/queue-5.4/scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch @@ -0,0 +1,46 @@ +From 36634085bde6624189954a18ed6e59a43e00d4d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Dec 2024 23:18:12 +0100 +Subject: scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1 + +From: Paul Menzel + +[ Upstream commit ad7c3c0cb8f61d6d5a48b83e62ca4a9fd2f26153 ] + +Currently, the code does: + + if (x == 0) { + x &= ~0x3; + x |= 0x1; + } + +Zeroing bits 0 and 1 of a variable that is 0 is not necessary. So directly +set the variable to 1. + +Cc: Sreekanth Reddy +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Paul Menzel +Link: https://lore.kernel.org/r/20241212221817.78940-2-pmenzel@molgen.mpg.de +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 69023ddceb59f..7df4e8cfeb923 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -4627,8 +4627,7 @@ _base_static_config_pages(struct MPT3SAS_ADAPTER *ioc) + if (!ioc->is_gen35_ioc && ioc->manu_pg11.EEDPTagMode == 0) { + pr_err("%s: overriding NVDATA EEDPTagMode setting\n", + ioc->name); +- ioc->manu_pg11.EEDPTagMode &= ~0x3; +- ioc->manu_pg11.EEDPTagMode |= 0x1; ++ ioc->manu_pg11.EEDPTagMode = 0x1; + mpt3sas_config_set_manufacturing_pg11(ioc, &mpi_reply, + &ioc->manu_pg11); + } +-- +2.39.5 + diff --git a/queue-5.4/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch b/queue-5.4/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch new file mode 100644 index 0000000000..c59ad3df52 --- /dev/null +++ b/queue-5.4/scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch @@ -0,0 +1,37 @@ +From ca4d1a662ba87060fb04f1df8a6b0b51ee0fc0a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Dec 2024 09:42:13 +0800 +Subject: scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails + +From: Guixin Liu + +[ Upstream commit fcf247deb3c3e1c6be5774e3fa03bbd018eff1a9 ] + +We should remove the bsg device when bsg_setup_queue() fails to release the +resources. + +Fixes: df032bf27a41 ("scsi: ufs: Add a bsg endpoint that supports UPIUs") +Signed-off-by: Guixin Liu +Link: https://lore.kernel.org/r/20241218014214.64533-2-kanie@linux.alibaba.com +Reviewed-by: Avri Altman +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs_bsg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/ufs/ufs_bsg.c b/drivers/scsi/ufs/ufs_bsg.c +index bad366e491591..78e72a1aec9b1 100644 +--- a/drivers/scsi/ufs/ufs_bsg.c ++++ b/drivers/scsi/ufs/ufs_bsg.c +@@ -213,6 +213,7 @@ int ufs_bsg_probe(struct ufs_hba *hba) + q = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), ufs_bsg_request, NULL, 0); + if (IS_ERR(q)) { + ret = PTR_ERR(q); ++ device_del(bsg_dev); + goto out; + } + +-- +2.39.5 + diff --git a/queue-5.4/selftests-harness-display-signed-values-correctly.patch b/queue-5.4/selftests-harness-display-signed-values-correctly.patch new file mode 100644 index 0000000000..a385fd395a --- /dev/null +++ b/queue-5.4/selftests-harness-display-signed-values-correctly.patch @@ -0,0 +1,84 @@ +From c057170bd9035110fa34ae0adeb5b38260f56181 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jun 2020 11:16:50 -0700 +Subject: selftests/harness: Display signed values correctly + +From: Kees Cook + +[ Upstream commit d088c92802549fc1cf77a12a4e3986160d63662a ] + +Since forever the harness output for signed value tests have reported +unsigned values to avoid casting. Instead, actually test the variable +types and perform the correct casts and choose the correct format +specifiers. + +Signed-off-by: Kees Cook +Signed-off-by: Shuah Khan +Stable-dep-of: 02bc220dc6dc ("selftests: harness: fix printing of mismatch values in __EXPECT()") +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kselftest_harness.h | 42 ++++++++++++++++++--- + 1 file changed, 37 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h +index 5336b26506ab2..f393fe8cf3725 100644 +--- a/tools/testing/selftests/kselftest_harness.h ++++ b/tools/testing/selftests/kselftest_harness.h +@@ -603,17 +603,49 @@ + if (_metadata->passed && _metadata->step < 255) \ + _metadata->step++; + ++#define is_signed_type(var) (!!(((__typeof__(var))(-1)) < (__typeof__(var))1)) ++ + #define __EXPECT(_expected, _expected_str, _seen, _seen_str, _t, _assert) do { \ + /* Avoid multiple evaluation of the cases */ \ + __typeof__(_expected) __exp = (_expected); \ + __typeof__(_seen) __seen = (_seen); \ + if (_assert) __INC_STEP(_metadata); \ + if (!(__exp _t __seen)) { \ +- unsigned long long __exp_print = (uintptr_t)__exp; \ +- unsigned long long __seen_print = (uintptr_t)__seen; \ +- __TH_LOG("Expected %s (%llu) %s %s (%llu)", \ +- _expected_str, __exp_print, #_t, \ +- _seen_str, __seen_print); \ ++ /* Report with actual signedness to avoid weird output. */ \ ++ switch (is_signed_type(__exp) * 2 + is_signed_type(__seen)) { \ ++ case 0: { \ ++ unsigned long long __exp_print = (uintptr_t)__exp; \ ++ unsigned long long __seen_print = (uintptr_t)__seen; \ ++ __TH_LOG("Expected %s (%llu) %s %s (%llu)", \ ++ _expected_str, __exp_print, #_t, \ ++ _seen_str, __seen_print); \ ++ break; \ ++ } \ ++ case 1: { \ ++ unsigned long long __exp_print = (uintptr_t)__exp; \ ++ long long __seen_print = (intptr_t)__seen; \ ++ __TH_LOG("Expected %s (%llu) %s %s (%lld)", \ ++ _expected_str, __exp_print, #_t, \ ++ _seen_str, __seen_print); \ ++ break; \ ++ } \ ++ case 2: { \ ++ long long __exp_print = (intptr_t)__exp; \ ++ unsigned long long __seen_print = (uintptr_t)__seen; \ ++ __TH_LOG("Expected %s (%lld) %s %s (%llu)", \ ++ _expected_str, __exp_print, #_t, \ ++ _seen_str, __seen_print); \ ++ break; \ ++ } \ ++ case 3: { \ ++ long long __exp_print = (intptr_t)__exp; \ ++ long long __seen_print = (intptr_t)__seen; \ ++ __TH_LOG("Expected %s (%lld) %s %s (%lld)", \ ++ _expected_str, __exp_print, #_t, \ ++ _seen_str, __seen_print); \ ++ break; \ ++ } \ ++ } \ + _metadata->passed = 0; \ + /* Ensure the optional handler is triggered */ \ + _metadata->trigger = 1; \ +-- +2.39.5 + diff --git a/queue-5.4/selftests-harness-fix-printing-of-mismatch-values-in.patch b/queue-5.4/selftests-harness-fix-printing-of-mismatch-values-in.patch new file mode 100644 index 0000000000..11144c34a8 --- /dev/null +++ b/queue-5.4/selftests-harness-fix-printing-of-mismatch-values-in.patch @@ -0,0 +1,83 @@ +From 6beab5e8950c9702fee4eacb3c8ba4de0c55b733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 19:07:57 +0200 +Subject: selftests: harness: fix printing of mismatch values in __EXPECT() + +From: Dmitry V. Levin + +[ Upstream commit 02bc220dc6dc7c56edc4859bc5dd2c08b95d5fb5 ] + +intptr_t and uintptr_t are not big enough types on 32-bit architectures +when printing 64-bit values, resulting to the following incorrect +diagnostic output: + + # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (3134324433) + +Replace intptr_t and uintptr_t with intmax_t and uintmax_t, respectively. +With this fix, the same test produces more usable diagnostic output: + + # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (18446744072548908753) + +Link: https://lore.kernel.org/r/20250108170757.GA6723@strace.io +Fixes: b5bb6d3068ea ("selftests/seccomp: fix 32-bit build warnings") +Signed-off-by: Dmitry V. Levin +Reviewed-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kselftest_harness.h | 24 ++++++++++----------- + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h +index f393fe8cf3725..9465f1aca2af6 100644 +--- a/tools/testing/selftests/kselftest_harness.h ++++ b/tools/testing/selftests/kselftest_harness.h +@@ -614,33 +614,33 @@ + /* Report with actual signedness to avoid weird output. */ \ + switch (is_signed_type(__exp) * 2 + is_signed_type(__seen)) { \ + case 0: { \ +- unsigned long long __exp_print = (uintptr_t)__exp; \ +- unsigned long long __seen_print = (uintptr_t)__seen; \ +- __TH_LOG("Expected %s (%llu) %s %s (%llu)", \ ++ uintmax_t __exp_print = (uintmax_t)__exp; \ ++ uintmax_t __seen_print = (uintmax_t)__seen; \ ++ __TH_LOG("Expected %s (%ju) %s %s (%ju)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 1: { \ +- unsigned long long __exp_print = (uintptr_t)__exp; \ +- long long __seen_print = (intptr_t)__seen; \ +- __TH_LOG("Expected %s (%llu) %s %s (%lld)", \ ++ uintmax_t __exp_print = (uintmax_t)__exp; \ ++ intmax_t __seen_print = (intmax_t)__seen; \ ++ __TH_LOG("Expected %s (%ju) %s %s (%jd)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 2: { \ +- long long __exp_print = (intptr_t)__exp; \ +- unsigned long long __seen_print = (uintptr_t)__seen; \ +- __TH_LOG("Expected %s (%lld) %s %s (%llu)", \ ++ intmax_t __exp_print = (intmax_t)__exp; \ ++ uintmax_t __seen_print = (uintmax_t)__seen; \ ++ __TH_LOG("Expected %s (%jd) %s %s (%ju)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ + } \ + case 3: { \ +- long long __exp_print = (intptr_t)__exp; \ +- long long __seen_print = (intptr_t)__seen; \ +- __TH_LOG("Expected %s (%lld) %s %s (%lld)", \ ++ intmax_t __exp_print = (intmax_t)__exp; \ ++ intmax_t __seen_print = (intmax_t)__seen; \ ++ __TH_LOG("Expected %s (%jd) %s %s (%jd)", \ + _expected_str, __exp_print, #_t, \ + _seen_str, __seen_print); \ + break; \ +-- +2.39.5 + diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 0000000000..c35fa9f13d --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,69 @@ +afs-fix-directory-format-encoding-struct.patch +nbd-don-t-allow-reconnect-after-disconnect.patch +partitions-ldm-remove-the-initial-kernel-doc-notatio.patch +drm-etnaviv-fix-page-property-being-used-for-non-wri.patch +drm-amdgpu-fix-potential-null-pointer-dereference-in.patch +ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch +wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch +rtlwifi-rtl8192se-rename-rt_trace-to-rtl_dbg.patch +wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch +wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch +dt-bindings-mmc-controller-clarify-the-address-cells.patch +rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch +wifi-rtlwifi-remove-unused-timer-and-related-code.patch +wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch +wifi-rtlwifi-remove-unused-check_buddy_priv.patch +wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch +wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch +cpupower-fix-tsc-mhz-calculation.patch +pwm-stm32-lp-add-check-for-clk_enable.patch +team-prevent-adding-a-device-which-is-already-a-team.patch +regulator-of-implement-the-unwind-path-of-of_regulat.patch +wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch +selftests-harness-display-signed-values-correctly.patch +selftests-harness-fix-printing-of-mismatch-values-in.patch +clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch +net-let-net.core.dev_weight-always-be-non-zero.patch +net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch +net-sched-disallow-replacing-of-child-qdisc-from-one.patch +tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch +asoc-sun4i-spdif-add-clock-multiplier-settings.patch +perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch +perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch +ktest.pl-remove-unused-declarations-in-run_bisect_te.patch +padata-fix-sysfs-store-callback-check.patch +perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch +perf-machine-include-data-symbols-in-the-kernel-map.patch +perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch +perf-report-fix-misleading-help-message-about-demang.patch +bpf-send-signals-asynchronously-if-preemptible.patch +soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch +rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch +rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch +arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch +arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch +arm-dts-mediatek-mt7623-fix-ir-nodename.patch +fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch +media-rc-iguanair-handle-timeouts.patch +media-lmedm04-use-gfp_kernel-for-urb-allocation-subm.patch +media-lmedm04-handle-errors-for-lme2510_int_read.patch +pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch +media-mipi-csis-add-check-for-clk_enable.patch +media-camif-core-add-check-for-clk_enable.patch +media-uvcvideo-propagate-buf-error-to-userspace.patch +staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch +scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch +scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch +ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch +module-extend-the-preempt-disabled-section-in-derefe.patch +dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch +rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch +ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch +net-fec-implement-tso-descriptor-cleanup.patch +ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch +pm-hibernate-add-error-handling-for-syscore_suspend.patch +net-rose-fix-timer-races-against-user-threads.patch +net-davicom-fix-uaf-in-dm9000_drv_remove.patch +perf-trace-fix-runtime-error-of-index-out-of-bounds.patch +vsock-allow-retrying-on-connect-failure.patch +net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch diff --git a/queue-5.4/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch b/queue-5.4/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch new file mode 100644 index 0000000000..d92d246668 --- /dev/null +++ b/queue-5.4/soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch @@ -0,0 +1,43 @@ +From f7738b4dba8712d5b3cc7e04b0ae81fd973837c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2024 13:33:36 +0100 +Subject: soc: atmel: fix device_node release in atmel_soc_device_init() + +From: Javier Carrasco + +[ Upstream commit d3455ab798100f40af77123e7c2443ec979c546b ] + +A device_node acquired via of_find_node_by_path() requires explicit +calls to of_node_put() when it is no longer needed to avoid leaking the +resource. + +Instead of adding the missing calls to of_node_put() in all execution +paths, use the cleanup attribute for 'np' by means of the __free() +macro, which automatically calls of_node_put() when the variable goes +out of scope. + +Fixes: 960ddf70cc11 ("drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs") +Signed-off-by: Javier Carrasco +Link: https://lore.kernel.org/r/20241031-soc-atmel-soc-cleanup-v2-1-73f2d235fd98@gmail.com +Signed-off-by: Claudiu Beznea +Signed-off-by: Sasha Levin +--- + drivers/soc/atmel/soc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c +index 4b4174597150d..eed42bc9ea89d 100644 +--- a/drivers/soc/atmel/soc.c ++++ b/drivers/soc/atmel/soc.c +@@ -274,7 +274,7 @@ static const struct of_device_id at91_soc_allowed_list[] __initconst = { + + static int __init atmel_soc_device_init(void) + { +- struct device_node *np = of_find_node_by_path("/"); ++ struct device_node *np __free(device_node) = of_find_node_by_path("/"); + + if (!of_match_node(at91_soc_allowed_list, np)) + return 0; +-- +2.39.5 + diff --git a/queue-5.4/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch b/queue-5.4/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch new file mode 100644 index 0000000000..ce9e1831d7 --- /dev/null +++ b/queue-5.4/staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch @@ -0,0 +1,59 @@ +From b9ab8b576949b3a2dbe8d7b980a25cc45167d65d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:54:11 +0900 +Subject: staging: media: imx: fix OF node leak in imx_media_add_of_subdevs() + +From: Joe Hattori + +[ Upstream commit 094f5c315f756b19198e6c401aa821ac0e868750 ] + +imx_media_add_of_subdevs() calls of_parse_phandle() and passes the +obtained node to imx_media_of_add_csi(). The passed node is used in +v4l2_async_nf_add_fwnode(), which increments the refcount of the node. +Therefore, while the current implementation only releases the node when +imx_media_of_add_csi() fails, but should always release it. Call +of_node_put() right after imx_media_of_add_csi(). + +Fixes: dee747f88167 ("media: imx: Don't register IPU subdevs/links if CSI port missing") +Signed-off-by: Joe Hattori +Reviewed-by: Vladimir Zapolskiy +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/imx/imx-media-of.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c +index 2d3efd2a6dde0..d9b34605ff9bc 100644 +--- a/drivers/staging/media/imx/imx-media-of.c ++++ b/drivers/staging/media/imx/imx-media-of.c +@@ -55,23 +55,19 @@ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd, + break; + + ret = imx_media_of_add_csi(imxmd, csi_np); ++ of_node_put(csi_np); + if (ret) { + /* unavailable or already added is not an error */ + if (ret == -ENODEV || ret == -EEXIST) { +- of_node_put(csi_np); + continue; + } + + /* other error, can't continue */ +- goto err_out; ++ return ret; + } + } + + return 0; +- +-err_out: +- of_node_put(csi_np); +- return ret; + } + EXPORT_SYMBOL_GPL(imx_media_add_of_subdevs); + +-- +2.39.5 + diff --git a/queue-5.4/team-prevent-adding-a-device-which-is-already-a-team.patch b/queue-5.4/team-prevent-adding-a-device-which-is-already-a-team.patch new file mode 100644 index 0000000000..f604052b58 --- /dev/null +++ b/queue-5.4/team-prevent-adding-a-device-which-is-already-a-team.patch @@ -0,0 +1,118 @@ +From 7c15e2b737d9b03c307d2a7081a2396e1f07c249 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Dec 2024 12:56:47 -0800 +Subject: team: prevent adding a device which is already a team device lower + +From: Octavian Purdila + +[ Upstream commit 3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50 ] + +Prevent adding a device which is already a team device lower, +e.g. adding veth0 if vlan1 was already added and veth0 is a lower of +vlan1. + +This is not useful in practice and can lead to recursive locking: + +$ ip link add veth0 type veth peer name veth1 +$ ip link set veth0 up +$ ip link set veth1 up +$ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1 +$ ip link add team0 type team +$ ip link set veth0.1 down +$ ip link set veth0.1 master team0 +team0: Port device veth0.1 added +$ ip link set veth0 down +$ ip link set veth0 master team0 + +============================================ +WARNING: possible recursive locking detected +6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted +-------------------------------------------- +ip/7684 is trying to acquire lock: +ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) + +but task is already holding lock: +ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977) + +other info that might help us debug this: +Possible unsafe locking scenario: + +CPU0 +---- +lock(team->team_lock_key); +lock(team->team_lock_key); + +*** DEADLOCK *** + +May be due to missing lock nesting notation + +2 locks held by ip/7684: + +stack backtrace: +CPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 +Call Trace: + +dump_stack_lvl (lib/dump_stack.c:122) +print_deadlock_bug.cold (kernel/locking/lockdep.c:3040) +__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226) +? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548) +lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2)) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? lock_acquire (kernel/locking/lockdep.c:5822) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +? fib_sync_up (net/ipv4/fib_semantics.c:2167) +? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) +notifier_call_chain (kernel/notifier.c:85) +call_netdevice_notifiers_info (net/core/dev.c:1996) +__dev_notify_flags (net/core/dev.c:8993) +? __dev_change_flags (net/core/dev.c:8975) +dev_change_flags (net/core/dev.c:9027) +vlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470) +? br_device_event (net/bridge/br.c:143) +notifier_call_chain (kernel/notifier.c:85) +call_netdevice_notifiers_info (net/core/dev.c:1996) +dev_open (net/core/dev.c:1519 net/core/dev.c:1505) +team_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977) +? __pfx_team_add_slave (drivers/net/team/team_core.c:1972) +do_set_master (net/core/rtnetlink.c:2917) +do_setlink.isra.0 (net/core/rtnetlink.c:3117) + +Reported-by: syzbot+3c47b5843403a45aef57@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=3c47b5843403a45aef57 +Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device") +Signed-off-by: Octavian Purdila +Reviewed-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/team/team.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 56caff2d01c45..b0a9dd33a0196 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1165,6 +1165,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev, + return -EBUSY; + } + ++ if (netdev_has_upper_dev(port_dev, dev)) { ++ NL_SET_ERR_MSG(extack, "Device is already a lower device of the team interface"); ++ netdev_err(dev, "Device %s is already a lower device of the team interface\n", ++ portname); ++ return -EBUSY; ++ } ++ + if (port_dev->features & NETIF_F_VLAN_CHALLENGED && + vlan_uses_dev(dev)) { + NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up"); +-- +2.39.5 + diff --git a/queue-5.4/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch b/queue-5.4/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch new file mode 100644 index 0000000000..72e4c5fccc --- /dev/null +++ b/queue-5.4/tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch @@ -0,0 +1,43 @@ +From 9e2686ed8688394dbc77066a6c7a9e8926762d92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Dec 2024 12:45:30 -0800 +Subject: tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server + bind + +From: Marco Leogrande + +[ Upstream commit e2f0791124a1b6ca8d570110cbd487969d9d41ef ] + +Commit f803bcf9208a ("selftests/bpf: Prevent client connect before +server bind in test_tc_tunnel.sh") added code that waits for the +netcat server to start before the netcat client attempts to connect to +it. However, not all calls to 'server_listen' were guarded. + +This patch adds the existing 'wait_for_port' guard after the remaining +call to 'server_listen'. + +Fixes: f803bcf9208a ("selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh") +Signed-off-by: Marco Leogrande +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/r/20241202204530.1143448-1-leogrande@google.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_tc_tunnel.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh +index 21bde60c95230..e42d8959cbf1c 100755 +--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh ++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh +@@ -286,6 +286,7 @@ else + client_connect + verify_data + server_listen ++ wait_for_port ${port} ${netcat_opt} + fi + + # bpf_skb_net_shrink does not take tunnel flags yet, cannot update L3. +-- +2.39.5 + diff --git a/queue-5.4/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch b/queue-5.4/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch new file mode 100644 index 0000000000..65806bfdf5 --- /dev/null +++ b/queue-5.4/ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch @@ -0,0 +1,60 @@ +From 2d31eafdfaad096c363f505800524e4fb4cf519f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 16:18:23 +0800 +Subject: ubifs: skip dumping tnc tree when zroot is null + +From: pangliyuan + +[ Upstream commit bdb0ca39e0acccf6771db49c3f94ed787d05f2d7 ] + +Clearing slab cache will free all znode in memory and make +c->zroot.znode = NULL, then dumping tnc tree will access +c->zroot.znode which cause null pointer dereference. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=219624#c0 +Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") +Signed-off-by: pangliyuan +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/debug.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c +index 992b74f9c9414..b5efbaf7eac2b 100644 +--- a/fs/ubifs/debug.c ++++ b/fs/ubifs/debug.c +@@ -925,16 +925,20 @@ void ubifs_dump_tnc(struct ubifs_info *c) + + pr_err("\n"); + pr_err("(pid %d) start dumping TNC tree\n", current->pid); +- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); +- level = znode->level; +- pr_err("== Level %d ==\n", level); +- while (znode) { +- if (level != znode->level) { +- level = znode->level; +- pr_err("== Level %d ==\n", level); ++ if (c->zroot.znode) { ++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL); ++ level = znode->level; ++ pr_err("== Level %d ==\n", level); ++ while (znode) { ++ if (level != znode->level) { ++ level = znode->level; ++ pr_err("== Level %d ==\n", level); ++ } ++ ubifs_dump_znode(c, znode); ++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); + } +- ubifs_dump_znode(c, znode); +- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode); ++ } else { ++ pr_err("empty TNC tree in memory\n"); + } + pr_err("(pid %d) finish dumping TNC tree\n", current->pid); + } +-- +2.39.5 + diff --git a/queue-5.4/vsock-allow-retrying-on-connect-failure.patch b/queue-5.4/vsock-allow-retrying-on-connect-failure.patch new file mode 100644 index 0000000000..401c6817e2 --- /dev/null +++ b/queue-5.4/vsock-allow-retrying-on-connect-failure.patch @@ -0,0 +1,45 @@ +From 9fdf794348d20559fcbc2c5dd8cd3ba4bccdc6aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jan 2025 14:15:28 +0100 +Subject: vsock: Allow retrying on connect() failure + +From: Michal Luczaj + +[ Upstream commit aa388c72113b7458127b709bdd7d3628af26e9b4 ] + +sk_err is set when a (connectible) connect() fails. Effectively, this makes +an otherwise still healthy SS_UNCONNECTED socket impossible to use for any +subsequent connection attempts. + +Clear sk_err upon trying to establish a connection. + +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Reviewed-by: Stefano Garzarella +Reviewed-by: Luigi Leonardi +Signed-off-by: Michal Luczaj +Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-2-1cf57065b770@rbox.co +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/af_vsock.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index 4cd65a1a07f97..5d490633a7f11 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -1185,6 +1185,11 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, + if (err < 0) + goto out; + ++ /* sk_err might have been set as a result of an earlier ++ * (failed) connect attempt. ++ */ ++ sk->sk_err = 0; ++ + /* Mark sock as connecting and set the error code to in + * progress in case this is a non-blocking connect. + */ +-- +2.39.5 + diff --git a/queue-5.4/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch b/queue-5.4/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch new file mode 100644 index 0000000000..eb28363066 --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch @@ -0,0 +1,50 @@ +From 1d538fc0b3733ce833b11f958ed50044664d0a4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:18 -0300 +Subject: wifi: rtlwifi: do not complete firmware loading needlessly + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit e73e11d303940119e41850a0452a0deda2cc4eb5 ] + +The only code waiting for completion is driver removal, which will not be +called when probe returns a failure. So this completion is unnecessary. + +Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load") +Signed-off-by: Thadeu Lima de Souza Cascardo +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-2-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 - + drivers/net/wireless/realtek/rtlwifi/usb.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 1c77b3b2173c8..a31d013d8815a 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2282,7 +2282,6 @@ int rtl_pci_probe(struct pci_dev *pdev, + pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); + + pci_release_regions(pdev); +- complete(&rtlpriv->firmware_loading_complete); + + fail1: + if (hw) +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index fc1548ad434f6..b5b95ec1231e0 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1083,7 +1083,6 @@ int rtl_usb_probe(struct usb_interface *intf, + error_out2: + _rtl_usb_io_handler_release(hw); + usb_put_dev(udev); +- complete(&rtlpriv->firmware_loading_complete); + kfree(rtlpriv->usb_data); + return -ENODEV; + } +-- +2.39.5 + diff --git a/queue-5.4/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch b/queue-5.4/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch new file mode 100644 index 0000000000..d2b2462d4f --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch @@ -0,0 +1,80 @@ +From ce68a255d111f8f56ea34ce99d4cf534a46d0e47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:12 -0300 +Subject: wifi: rtlwifi: fix memory leaks and invalid access at probe error + path + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit e7ceefbfd8d447abc8aca8ab993a942803522c06 ] + +Deinitialize at reverse order when probe fails. + +When init_sw_vars fails, rtl_deinit_core should not be called, specially +now that it destroys the rtl_wq workqueue. + +And call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be +leaked. + +Remove pci_set_drvdata call as it will already be cleaned up by the core +driver code and could lead to memory leaks too. cf. commit 8d450935ae7f +("wireless: rtlwifi: remove unnecessary pci_set_drvdata()") and +commit 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory"). + +Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-4-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index c4abfc0cab53c..4d01996c9df5e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2177,7 +2177,7 @@ int rtl_pci_probe(struct pci_dev *pdev, + if (rtlpriv->cfg->ops->init_sw_vars(hw)) { + pr_err("Can't init_sw_vars\n"); + err = -ENODEV; +- goto fail3; ++ goto fail2; + } + rtlpriv->cfg->ops->init_sw_leds(hw); + +@@ -2195,14 +2195,14 @@ int rtl_pci_probe(struct pci_dev *pdev, + err = rtl_pci_init(hw, pdev); + if (err) { + pr_err("Failed to init PCI\n"); +- goto fail3; ++ goto fail4; + } + + err = ieee80211_register_hw(hw); + if (err) { + pr_err("Can't register mac80211 hw.\n"); + err = -ENODEV; +- goto fail3; ++ goto fail5; + } + rtlpriv->mac80211.mac80211_registered = 1; + +@@ -2225,9 +2225,12 @@ int rtl_pci_probe(struct pci_dev *pdev, + set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status); + return 0; + +-fail3: +- pci_set_drvdata(pdev, NULL); ++fail5: ++ rtl_pci_deinit(hw); ++fail4: + rtl_deinit_core(hw); ++fail3: ++ rtlpriv->cfg->ops->deinit_sw_vars(hw); + + fail2: + if (rtlpriv->io.pci_mem_start != 0) +-- +2.39.5 + diff --git a/queue-5.4/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch b/queue-5.4/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch new file mode 100644 index 0000000000..9e9c3888e6 --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch @@ -0,0 +1,38 @@ +From 0798cd753398b2905e49db7cdfa07d6bf1bfd63f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:13 -0300 +Subject: wifi: rtlwifi: pci: wait for firmware loading before releasing memory + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit b59b86c5d08be7d761c04affcbcec8184738c200 ] + +At probe error path, the firmware loading work may have already been +queued. In such a case, it will try to access memory allocated by the probe +function, which is about to be released. In such paths, wait for the +firmware worker to finish before releasing memory. + +Fixes: 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-5-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 4d01996c9df5e..b16b1f1fb1e05 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2230,6 +2230,7 @@ int rtl_pci_probe(struct pci_dev *pdev, + fail4: + rtl_deinit_core(hw); + fail3: ++ wait_for_completion(&rtlpriv->firmware_loading_complete); + rtlpriv->cfg->ops->deinit_sw_vars(hw); + + fail2: +-- +2.39.5 + diff --git a/queue-5.4/wifi-rtlwifi-remove-unused-check_buddy_priv.patch b/queue-5.4/wifi-rtlwifi-remove-unused-check_buddy_priv.patch new file mode 100644 index 0000000000..ecba2a9894 --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-remove-unused-check_buddy_priv.patch @@ -0,0 +1,200 @@ +From 9de8438f546ab5f852d2819ca5150f4536f8afd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Dec 2024 14:37:10 -0300 +Subject: wifi: rtlwifi: remove unused check_buddy_priv + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 2fdac64c3c35858aa8ac5caa70b232e03456e120 ] + +Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global +list of private data structures. + +Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match +vendor version 2013.02.07") started adding the private data to that list at +probe time and added a hook, check_buddy_priv to find the private data from +a similar device. + +However, that function was never used. + +Besides, though there is a lock for that list, it is never used. And when +the probe fails, the private data is never removed from the list. This +would cause a second probe to access freed memory. + +Remove the unused hook, structures and members, which will prevent the +potential race condition on the list and its corruption during a second +probe when probe fails. + +Fixes: 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241206173713.3222187-2-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 7 ---- + drivers/net/wireless/realtek/rtlwifi/base.h | 1 - + drivers/net/wireless/realtek/rtlwifi/pci.c | 44 --------------------- + drivers/net/wireless/realtek/rtlwifi/wifi.h | 12 ------ + 4 files changed, 64 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 3c844d7ba2bef..c98aeb1b824d1 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -2722,9 +2722,6 @@ MODULE_AUTHOR("Larry Finger "); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core"); + +-struct rtl_global_var rtl_global_var = {}; +-EXPORT_SYMBOL_GPL(rtl_global_var); +- + static int __init rtl_core_module_init(void) + { + BUILD_BUG_ON(TX_PWR_BY_RATE_NUM_RATE < TX_PWR_BY_RATE_NUM_SECTION); +@@ -2738,10 +2735,6 @@ static int __init rtl_core_module_init(void) + /* add debugfs */ + rtl_debugfs_add_topdir(); + +- /* init some global vars */ +- INIT_LIST_HEAD(&rtl_global_var.glb_priv_list); +- spin_lock_init(&rtl_global_var.glb_list_lock); +- + return 0; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h +index 1eccdf9d62a66..f24908642ea9c 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.h ++++ b/drivers/net/wireless/realtek/rtlwifi/base.h +@@ -127,7 +127,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw, + u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie); + void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len); + u8 rtl_tid_to_ac(u8 tid); +-extern struct rtl_global_var rtl_global_var; + void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation); + + #endif +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 9ddd7bd6ee150..c4abfc0cab53c 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -295,46 +295,6 @@ static bool rtl_pci_get_amd_l1_patch(struct ieee80211_hw *hw) + return status; + } + +-static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, +- struct rtl_priv **buddy_priv) +-{ +- struct rtl_priv *rtlpriv = rtl_priv(hw); +- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw); +- struct rtl_priv *tpriv = NULL, *iter; +- struct rtl_pci_priv *tpcipriv = NULL; +- +- if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) { +- list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list, +- list) { +- tpcipriv = (struct rtl_pci_priv *)iter->priv; +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "pcipriv->ndis_adapter.funcnumber %x\n", +- pcipriv->ndis_adapter.funcnumber); +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "tpcipriv->ndis_adapter.funcnumber %x\n", +- tpcipriv->ndis_adapter.funcnumber); +- +- if (pcipriv->ndis_adapter.busnumber == +- tpcipriv->ndis_adapter.busnumber && +- pcipriv->ndis_adapter.devnumber == +- tpcipriv->ndis_adapter.devnumber && +- pcipriv->ndis_adapter.funcnumber != +- tpcipriv->ndis_adapter.funcnumber) { +- tpriv = iter; +- break; +- } +- } +- } +- +- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, +- "find_buddy_priv %d\n", tpriv != NULL); +- +- if (tpriv) +- *buddy_priv = tpriv; +- +- return tpriv != NULL; +-} +- + static void rtl_pci_parse_configuration(struct pci_dev *pdev, + struct ieee80211_hw *hw) + { +@@ -2021,7 +1981,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + pcipriv->ndis_adapter.amd_l1_patch); + + rtl_pci_parse_configuration(pdev, hw); +- list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list); + + return true; + } +@@ -2168,7 +2127,6 @@ int rtl_pci_probe(struct pci_dev *pdev, + rtlpriv->rtlhal.interface = INTF_PCI; + rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data); + rtlpriv->intf_ops = &rtl_pci_ops; +- rtlpriv->glb_var = &rtl_global_var; + rtl_efuse_ops_init(hw); + + /* MEM map */ +@@ -2326,7 +2284,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev) + if (rtlpci->using_msi) + pci_disable_msi(rtlpci->pdev); + +- list_del(&rtlpriv->list); + if (rtlpriv->io.pci_mem_start != 0) { + pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); + pci_release_regions(pdev); +@@ -2386,7 +2343,6 @@ const struct rtl_intf_ops rtl_pci_ops = { + .read_efuse_byte = read_efuse_byte, + .adapter_start = rtl_pci_start, + .adapter_stop = rtl_pci_stop, +- .check_buddy_priv = rtl_pci_check_buddy_priv, + .adapter_tx = rtl_pci_tx, + .flush = rtl_pci_flush, + .reset_trx_ring = rtl_pci_reset_trx_ring, +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index 99860f1547653..0dbe442d6c3e4 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2337,8 +2337,6 @@ struct rtl_intf_ops { + void (*read_efuse_byte)(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf); + int (*adapter_start)(struct ieee80211_hw *hw); + void (*adapter_stop)(struct ieee80211_hw *hw); +- bool (*check_buddy_priv)(struct ieee80211_hw *hw, +- struct rtl_priv **buddy_priv); + + int (*adapter_tx)(struct ieee80211_hw *hw, + struct ieee80211_sta *sta, +@@ -2582,14 +2580,6 @@ struct dig_t { + u32 rssi_max; + }; + +-struct rtl_global_var { +- /* from this list we can get +- * other adapter's rtl_priv +- */ +- struct list_head glb_priv_list; +- spinlock_t glb_list_lock; +-}; +- + #define IN_4WAY_TIMEOUT_TIME (30 * MSEC_PER_SEC) /* 30 seconds */ + + struct rtl_btc_info { +@@ -2735,9 +2725,7 @@ struct rtl_scan_list { + struct rtl_priv { + struct ieee80211_hw *hw; + struct completion firmware_loading_complete; +- struct list_head list; + struct rtl_priv *buddy_priv; +- struct rtl_global_var *glb_var; + struct rtl_dmsp_ctl dmsp_ctl; + struct rtl_locks locks; + struct rtl_works works; +-- +2.39.5 + diff --git a/queue-5.4/wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch b/queue-5.4/wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch new file mode 100644 index 0000000000..57d120e70f --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch @@ -0,0 +1,69 @@ +From 775768b4fa3e274166bc1975dfcc3a4fe50b8578 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 09:59:40 +0300 +Subject: wifi: rtlwifi: remove unused dualmac control leftovers + +From: Dmitry Antipov + +[ Upstream commit 557123259200b30863e1b6a8f24a8c8060b6fc1d ] + +Remove 'struct rtl_dualmac_easy_concurrent_ctl' of 'struct rtl_priv' +and related code in '_rtl_pci_tx_chk_waitq()'. + +Signed-off-by: Dmitry Antipov +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230602065940.149198-2-dmantipov@yandex.ru +Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 5 ----- + drivers/net/wireless/realtek/rtlwifi/wifi.h | 9 --------- + 2 files changed, 14 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index f8e34ae09a800..9ddd7bd6ee150 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -443,11 +443,6 @@ static void _rtl_pci_tx_chk_waitq(struct ieee80211_hw *hw) + if (!rtlpriv->rtlhal.earlymode_enable) + return; + +- if (rtlpriv->dm.supp_phymode_switch && +- (rtlpriv->easy_concurrent_ctl.switch_in_process || +- (rtlpriv->buddy_priv && +- rtlpriv->buddy_priv->easy_concurrent_ctl.switch_in_process))) +- return; + /* we just use em for BE/BK/VI/VO */ + for (tid = 7; tid >= 0; tid--) { + u8 hw_queue = ac_to_hwq[rtl_tid_to_ac(tid)]; +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index eebbd01256415..99860f1547653 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2498,14 +2498,6 @@ struct rtl_debug { + #define MIMO_PS_DYNAMIC 1 + #define MIMO_PS_NOLIMIT 3 + +-struct rtl_dualmac_easy_concurrent_ctl { +- enum band_type currentbandtype_backfordmdp; +- bool close_bbandrf_for_dmsp; +- bool change_to_dmdp; +- bool change_to_dmsp; +- bool switch_in_process; +-}; +- + struct rtl_dmsp_ctl { + bool activescan_for_slaveofdmsp; + bool scan_for_anothermac_fordmsp; +@@ -2746,7 +2738,6 @@ struct rtl_priv { + struct list_head list; + struct rtl_priv *buddy_priv; + struct rtl_global_var *glb_var; +- struct rtl_dualmac_easy_concurrent_ctl easy_concurrent_ctl; + struct rtl_dmsp_ctl dmsp_ctl; + struct rtl_locks locks; + struct rtl_works works; +-- +2.39.5 + diff --git a/queue-5.4/wifi-rtlwifi-remove-unused-timer-and-related-code.patch b/queue-5.4/wifi-rtlwifi-remove-unused-timer-and-related-code.patch new file mode 100644 index 0000000000..8fd15d39ba --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-remove-unused-timer-and-related-code.patch @@ -0,0 +1,95 @@ +From 79043426ec7419378694dffcbf8c69956538423b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 09:59:39 +0300 +Subject: wifi: rtlwifi: remove unused timer and related code + +From: Dmitry Antipov + +[ Upstream commit 358b94f0a7cadd2ec7824531d54dadaa8b71de04 ] + +Drop unused 'dualmac_easyconcurrent_retrytimer' of 'struct rtl_works', +corresponding 'rtl_easy_concurrent_retrytimer_callback()' handler, +'dualmac_easy_concurrent' function pointer of 'struct rtl_hal_ops' +and related call to 'timer_setup()' in '_rtl_init_deferred_work()'. + +Signed-off-by: Dmitry Antipov +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230602065940.149198-1-dmantipov@yandex.ru +Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 16 +--------------- + drivers/net/wireless/realtek/rtlwifi/base.h | 1 - + drivers/net/wireless/realtek/rtlwifi/wifi.h | 2 -- + 3 files changed, 1 insertion(+), 18 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 5898109b1c3e8..3c844d7ba2bef 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -448,8 +448,7 @@ static int _rtl_init_deferred_work(struct ieee80211_hw *hw) + /* <1> timer */ + timer_setup(&rtlpriv->works.watchdog_timer, + rtl_watch_dog_timer_callback, 0); +- timer_setup(&rtlpriv->works.dualmac_easyconcurrent_retrytimer, +- rtl_easy_concurrent_retrytimer_callback, 0); ++ + /* <2> work queue */ + rtlpriv->works.hw = hw; + rtlpriv->works.rtl_wq = wq; +@@ -2378,19 +2377,6 @@ void rtl_c2hcmd_wq_callback(void *data) + rtl_c2hcmd_launcher(hw, 1); + } + +-void rtl_easy_concurrent_retrytimer_callback(struct timer_list *t) +-{ +- struct rtl_priv *rtlpriv = +- from_timer(rtlpriv, t, works.dualmac_easyconcurrent_retrytimer); +- struct ieee80211_hw *hw = rtlpriv->hw; +- struct rtl_priv *buddy_priv = rtlpriv->buddy_priv; +- +- if (buddy_priv == NULL) +- return; +- +- rtlpriv->cfg->ops->dualmac_easy_concurrent(hw); +-} +- + /********************************************************* + * + * frame process functions +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h +index e4a7e074ae3ff..1eccdf9d62a66 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.h ++++ b/drivers/net/wireless/realtek/rtlwifi/base.h +@@ -127,7 +127,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw, + u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie); + void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len); + u8 rtl_tid_to_ac(u8 tid); +-void rtl_easy_concurrent_retrytimer_callback(struct timer_list *t); + extern struct rtl_global_var rtl_global_var; + void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index abec9ceabe285..eebbd01256415 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2302,7 +2302,6 @@ struct rtl_hal_ops { + u32 regaddr, u32 bitmask, u32 data); + void (*linked_set_reg)(struct ieee80211_hw *hw); + void (*chk_switch_dmdp)(struct ieee80211_hw *hw); +- void (*dualmac_easy_concurrent)(struct ieee80211_hw *hw); + void (*dualmac_switch_to_dmdp)(struct ieee80211_hw *hw); + bool (*phy_rf6052_config)(struct ieee80211_hw *hw); + void (*phy_rf6052_set_cck_txpower)(struct ieee80211_hw *hw, +@@ -2468,7 +2467,6 @@ struct rtl_works { + + /*timer */ + struct timer_list watchdog_timer; +- struct timer_list dualmac_easyconcurrent_retrytimer; + struct timer_list fw_clockoff_timer; + struct timer_list fast_antenna_training_timer; + /*task */ +-- +2.39.5 + diff --git a/queue-5.4/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch b/queue-5.4/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch new file mode 100644 index 0000000000..ca8109eba6 --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch @@ -0,0 +1,59 @@ +From 964f504606e873e65c7e017c47fb364fa0123a18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:19 -0300 +Subject: wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last + step + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit 8559a9e0c457729fe3edb3176bbf7c7874f482b0 ] + +Just like in commit 4dfde294b979 ("rtlwifi: rise completion at the last +step of firmware callback"), only signal completion once the function is +finished. Otherwise, the module removal waiting for the completion could +free the memory that the callback will still use before returning. + +Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load") +Signed-off-by: Thadeu Lima de Souza Cascardo +Acked-by: Ping-Ke Shih +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-3-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c +index 4c4a1201d420f..78547e4035dc6 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c +@@ -68,22 +68,23 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context) + + rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, + "Firmware callback routine entered!\n"); +- complete(&rtlpriv->firmware_loading_complete); + if (!firmware) { + pr_err("Firmware %s not available\n", fw_name); + rtlpriv->max_fw_size = 0; +- return; ++ goto exit; + } + if (firmware->size > rtlpriv->max_fw_size) { + pr_err("Firmware is too big!\n"); + rtlpriv->max_fw_size = 0; + release_firmware(firmware); +- return; ++ goto exit; + } + pfirmware = (struct rt_firmware *)rtlpriv->rtlhal.pfirmware; + memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size); + pfirmware->sz_fw_tmpbufferlen = firmware->size; + release_firmware(firmware); ++exit: ++ complete(&rtlpriv->firmware_loading_complete); + } + + static int rtl92s_init_sw_vars(struct ieee80211_hw *hw) +-- +2.39.5 + diff --git a/queue-5.4/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch b/queue-5.4/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch new file mode 100644 index 0000000000..0639a87145 --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch @@ -0,0 +1,38 @@ +From 0e89ad2619dd78ad64c3f7f475f6d3b1cebe93b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2024 10:33:22 -0300 +Subject: wifi: rtlwifi: usb: fix workqueue leak when probe fails + +From: Thadeu Lima de Souza Cascardo + +[ Upstream commit f79bc5c67867c19ce2762e7934c20dbb835ed82c ] + +rtl_init_core creates a workqueue that is then assigned to rtl_wq. +rtl_deinit_core does not destroy it. It is left to rtl_usb_deinit, which +must be called in the probe error path. + +Fixes: 2ca20f79e0d8 ("rtlwifi: Add usb driver") +Fixes: 851639fdaeac ("rtlwifi: Modify some USB de-initialize code.") +Signed-off-by: Thadeu Lima de Souza Cascardo +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241107133322.855112-6-cascardo@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/usb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index b5b95ec1231e0..9e31ce0a9f562 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1079,6 +1079,7 @@ int rtl_usb_probe(struct usb_interface *intf, + return 0; + + error_out: ++ rtl_usb_deinit(hw); + rtl_deinit_core(hw); + error_out2: + _rtl_usb_io_handler_release(hw); +-- +2.39.5 + diff --git a/queue-5.4/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch b/queue-5.4/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch new file mode 100644 index 0000000000..47c455b7ec --- /dev/null +++ b/queue-5.4/wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch @@ -0,0 +1,70 @@ +From ad61ed223ef2184a0acd8213ae5ba338970f6474 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jan 2025 20:55:07 +0100 +Subject: wifi: wlcore: fix unbalanced pm_runtime calls + +From: Andreas Kemnade + +[ Upstream commit 996c934c8c196144af386c4385f61fcd5349af28 ] + +If firmware boot failes, runtime pm is put too often: +[12092.708099] wlcore: ERROR firmware boot failed despite 3 retries +[12092.708099] wl18xx_driver wl18xx.1.auto: Runtime PM usage count underflow! +Fix that by redirecting all error gotos before runtime_get so that runtime is +not put. + +Fixes: c40aad28a3cf ("wlcore: Make sure firmware is initialized in wl1271_op_add_interface()") +Signed-off-by: Andreas Kemnade +Reviewed-by: Michael Nemanov +Signed-off-by: Kalle Valo +Link: https://patch.msgid.link/20250104195507.402673-1-akemnade@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ti/wlcore/main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c +index be0ed19f93569..5af0f0fdecda1 100644 +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -2546,24 +2546,24 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw, + if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags) || + test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)) { + ret = -EBUSY; +- goto out; ++ goto out_unlock; + } + + + ret = wl12xx_init_vif_data(wl, vif); + if (ret < 0) +- goto out; ++ goto out_unlock; + + wlvif->wl = wl; + role_type = wl12xx_get_role_type(wl, wlvif); + if (role_type == WL12XX_INVALID_ROLE_TYPE) { + ret = -EINVAL; +- goto out; ++ goto out_unlock; + } + + ret = wlcore_allocate_hw_queue_base(wl, wlvif); + if (ret < 0) +- goto out; ++ goto out_unlock; + + /* + * TODO: after the nvs issue will be solved, move this block +@@ -2578,7 +2578,7 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw, + + ret = wl12xx_init_fw(wl); + if (ret < 0) +- goto out; ++ goto out_unlock; + } + + /* +-- +2.39.5 +