From: Greg Kroah-Hartman Date: Sun, 28 May 2023 16:57:05 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: review~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=82ff65ef0b6d9132f8e07393c744679d65a55863;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: 3c589_cs-fix-an-error-handling-path-in-tc589_probe.patch firmware-arm_ffa-set-reserved-mbz-fields-to-zero-in-the-memory-descriptors.patch net-phy-mscc-add-vsc8502-to-module_device_table.patch net-smc-reset-connection-when-trying-to-use-smcrv2-fails.patch regulator-mt6359-add-read-check-for-pmic-mt6359.patch --- diff --git a/queue-6.1/3c589_cs-fix-an-error-handling-path-in-tc589_probe.patch b/queue-6.1/3c589_cs-fix-an-error-handling-path-in-tc589_probe.patch new file mode 100644 index 00000000000..4affa87b300 --- /dev/null +++ b/queue-6.1/3c589_cs-fix-an-error-handling-path-in-tc589_probe.patch @@ -0,0 +1,49 @@ +From 640bf95b2c7c2981fb471acdafbd3e0458f8390d Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 20 May 2023 11:48:55 +0200 +Subject: 3c589_cs: Fix an error handling path in tc589_probe() + +From: Christophe JAILLET + +commit 640bf95b2c7c2981fb471acdafbd3e0458f8390d upstream. + +Should tc589_config() fail, some resources need to be released as already +done in the remove function. + +Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions") +Signed-off-by: Christophe JAILLET +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/d8593ae867b24c79063646e36f9b18b0790107cb.1684575975.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/3com/3c589_cs.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/3com/3c589_cs.c ++++ b/drivers/net/ethernet/3com/3c589_cs.c +@@ -195,6 +195,7 @@ static int tc589_probe(struct pcmcia_dev + { + struct el3_private *lp; + struct net_device *dev; ++ int ret; + + dev_dbg(&link->dev, "3c589_attach()\n"); + +@@ -218,7 +219,15 @@ static int tc589_probe(struct pcmcia_dev + + dev->ethtool_ops = &netdev_ethtool_ops; + +- return tc589_config(link); ++ ret = tc589_config(link); ++ if (ret) ++ goto err_free_netdev; ++ ++ return 0; ++ ++err_free_netdev: ++ free_netdev(dev); ++ return ret; + } + + static void tc589_detach(struct pcmcia_device *link) diff --git a/queue-6.1/arm64-dts-imx8mn-var-som-fix-phy-detection-bug-by-adding-deassert-delay.patch b/queue-6.1/arm64-dts-imx8mn-var-som-fix-phy-detection-bug-by-adding-deassert-delay.patch index aa614ed81ca..c6c605c4a13 100644 --- a/queue-6.1/arm64-dts-imx8mn-var-som-fix-phy-detection-bug-by-adding-deassert-delay.patch +++ b/queue-6.1/arm64-dts-imx8mn-var-som-fix-phy-detection-bug-by-adding-deassert-delay.patch @@ -32,14 +32,12 @@ Signed-off-by: Hugo Villeneuve Signed-off-by: Shawn Guo Signed-off-by: Greg Kroah-Hartman --- - arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi | 8 +++++++- + arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) -diff --git a/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi -index 67072e6c77d5..cbd9d124c80d 100644 --- a/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi -@@ -98,11 +98,17 @@ mdio { +@@ -98,11 +98,17 @@ #address-cells = <1>; #size-cells = <0>; @@ -58,6 +56,3 @@ index 67072e6c77d5..cbd9d124c80d 100644 }; }; }; --- -2.40.1 - diff --git a/queue-6.1/firmware-arm_ffa-set-reserved-mbz-fields-to-zero-in-the-memory-descriptors.patch b/queue-6.1/firmware-arm_ffa-set-reserved-mbz-fields-to-zero-in-the-memory-descriptors.patch new file mode 100644 index 00000000000..bc7b66dfcbf --- /dev/null +++ b/queue-6.1/firmware-arm_ffa-set-reserved-mbz-fields-to-zero-in-the-memory-descriptors.patch @@ -0,0 +1,59 @@ +From 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 Mon Sep 17 00:00:00 2001 +From: Sudeep Holla +Date: Wed, 3 May 2023 14:12:52 +0100 +Subject: firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors + +From: Sudeep Holla + +commit 111a833dc5cbef3d05b2a796a7e23cb7f6ff2192 upstream. + +The transmit buffers allocated by the driver can be used to transmit data +by any messages/commands needing the buffer. However, it is not guaranteed +to have been zero-ed before every new transmission and hence it will just +contain residual value from the previous transmission. There are several +reserved fields in the memory descriptors that must be zero(MBZ). The +receiver can reject the transmission if any such MBZ fields are non-zero. + +While we can set the whole page to zero, it is not optimal as most of the +fields get initialised to the value required for the current transmission. + +So, just set the reserved/MBZ fields to zero in the memory descriptors +explicitly to honour the requirement and keep the receiver happy. + +Fixes: cc2195fe536c ("firmware: arm_ffa: Add support for MEM_* interfaces") +Reported-by: Marc Bonnici +Link: https://lore.kernel.org/r/20230503131252.12585-1-sudeep.holla@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/arm_ffa/driver.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -501,12 +501,17 @@ ffa_setup_and_transmit(u32 func_id, void + ep_mem_access->receiver = args->attrs[idx].receiver; + ep_mem_access->attrs = args->attrs[idx].attrs; + ep_mem_access->composite_off = COMPOSITE_OFFSET(args->nattrs); ++ ep_mem_access->flag = 0; ++ ep_mem_access->reserved = 0; + } ++ mem_region->reserved_0 = 0; ++ mem_region->reserved_1 = 0; + mem_region->ep_count = args->nattrs; + + composite = buffer + COMPOSITE_OFFSET(args->nattrs); + composite->total_pg_cnt = ffa_get_num_pages_sg(args->sg); + composite->addr_range_cnt = num_entries; ++ composite->reserved = 0; + + length = COMPOSITE_CONSTITUENTS_OFFSET(args->nattrs, num_entries); + frag_len = COMPOSITE_CONSTITUENTS_OFFSET(args->nattrs, 0); +@@ -541,6 +546,7 @@ ffa_setup_and_transmit(u32 func_id, void + + constituents->address = sg_phys(args->sg); + constituents->pg_cnt = args->sg->length / FFA_PAGE_SIZE; ++ constituents->reserved = 0; + constituents++; + frag_len += sizeof(struct ffa_mem_region_addr_range); + } while ((args->sg = sg_next(args->sg))); diff --git a/queue-6.1/net-phy-mscc-add-vsc8502-to-module_device_table.patch b/queue-6.1/net-phy-mscc-add-vsc8502-to-module_device_table.patch new file mode 100644 index 00000000000..89b3c9f1d29 --- /dev/null +++ b/queue-6.1/net-phy-mscc-add-vsc8502-to-module_device_table.patch @@ -0,0 +1,31 @@ +From 57fb54ab9f6945e204740b696bd4cee61ee04e5e Mon Sep 17 00:00:00 2001 +From: David Epping +Date: Tue, 23 May 2023 17:31:05 +0200 +Subject: net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE + +From: David Epping + +commit 57fb54ab9f6945e204740b696bd4cee61ee04e5e upstream. + +The mscc driver implements support for VSC8502, so its ID should be in +the MODULE_DEVICE_TABLE for automatic loading. + +Signed-off-by: David Epping +Fixes: d3169863310d ("net: phy: mscc: add support for VSC8502") +Reviewed-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/mscc/mscc_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/phy/mscc/mscc_main.c ++++ b/drivers/net/phy/mscc/mscc_main.c +@@ -2664,6 +2664,7 @@ static struct phy_driver vsc85xx_driver[ + module_phy_driver(vsc85xx_driver); + + static struct mdio_device_id __maybe_unused vsc85xx_tbl[] = { ++ { PHY_ID_VSC8502, 0xfffffff0, }, + { PHY_ID_VSC8504, 0xfffffff0, }, + { PHY_ID_VSC8514, 0xfffffff0, }, + { PHY_ID_VSC8530, 0xfffffff0, }, diff --git a/queue-6.1/net-smc-reset-connection-when-trying-to-use-smcrv2-fails.patch b/queue-6.1/net-smc-reset-connection-when-trying-to-use-smcrv2-fails.patch new file mode 100644 index 00000000000..5f62c10e2f5 --- /dev/null +++ b/queue-6.1/net-smc-reset-connection-when-trying-to-use-smcrv2-fails.patch @@ -0,0 +1,138 @@ +From 35112271672ae98f45df7875244a4e33aa215e31 Mon Sep 17 00:00:00 2001 +From: Wen Gu +Date: Thu, 18 May 2023 13:14:55 +0800 +Subject: net/smc: Reset connection when trying to use SMCRv2 fails. + +From: Wen Gu + +commit 35112271672ae98f45df7875244a4e33aa215e31 upstream. + +We found a crash when using SMCRv2 with 2 Mellanox ConnectX-4. It +can be reproduced by: + +- smc_run nginx +- smc_run wrk -t 32 -c 500 -d 30 http://: + + BUG: kernel NULL pointer dereference, address: 0000000000000014 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 8000000108713067 P4D 8000000108713067 PUD 151127067 PMD 0 + Oops: 0000 [#1] PREEMPT SMP PTI + CPU: 4 PID: 2441 Comm: kworker/4:249 Kdump: loaded Tainted: G W E 6.4.0-rc1+ #42 + Workqueue: smc_hs_wq smc_listen_work [smc] + RIP: 0010:smc_clc_send_confirm_accept+0x284/0x580 [smc] + RSP: 0018:ffffb8294b2d7c78 EFLAGS: 00010a06 + RAX: ffff8f1873238880 RBX: ffffb8294b2d7dc8 RCX: 0000000000000000 + RDX: 00000000000000b4 RSI: 0000000000000001 RDI: 0000000000b40c00 + RBP: ffffb8294b2d7db8 R08: ffff8f1815c5860c R09: 0000000000000000 + R10: 0000000000000400 R11: 0000000000000000 R12: ffff8f1846f56180 + R13: ffff8f1815c5860c R14: 0000000000000001 R15: 0000000000000001 + FS: 0000000000000000(0000) GS:ffff8f1aefd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000014 CR3: 00000001027a0001 CR4: 00000000003706e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + ? mlx5_ib_map_mr_sg+0xa1/0xd0 [mlx5_ib] + ? smcr_buf_map_link+0x24b/0x290 [smc] + ? __smc_buf_create+0x4ee/0x9b0 [smc] + smc_clc_send_accept+0x4c/0xb0 [smc] + smc_listen_work+0x346/0x650 [smc] + ? __schedule+0x279/0x820 + process_one_work+0x1e5/0x3f0 + worker_thread+0x4d/0x2f0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xe5/0x120 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2c/0x50 + + +During the CLC handshake, server sequentially tries available SMCRv2 +and SMCRv1 devices in smc_listen_work(). + +If an SMCRv2 device is found. SMCv2 based link group and link will be +assigned to the connection. Then assumed that some buffer assignment +errors happen later in the CLC handshake, such as RMB registration +failure, server will give up SMCRv2 and try SMCRv1 device instead. But +the resources assigned to the connection won't be reset. + +When server tries SMCRv1 device, the connection creation process will +be executed again. Since conn->lnk has been assigned when trying SMCRv2, +it will not be set to the correct SMCRv1 link in +smcr_lgr_conn_assign_link(). So in such situation, conn->lgr points to +correct SMCRv1 link group but conn->lnk points to the SMCRv2 link +mistakenly. + +Then in smc_clc_send_confirm_accept(), conn->rmb_desc->mr[link->link_idx] +will be accessed. Since the link->link_idx is not correct, the related +MR may not have been initialized, so crash happens. + + | Try SMCRv2 device first + | |-> conn->lgr: assign existed SMCRv2 link group; + | |-> conn->link: assign existed SMCRv2 link (link_idx may be 1 in SMC_LGR_SYMMETRIC); + | |-> sndbuf & RMB creation fails, quit; + | + | Try SMCRv1 device then + | |-> conn->lgr: create SMCRv1 link group and assign; + | |-> conn->link: keep SMCRv2 link mistakenly; + | |-> sndbuf & RMB creation succeed, only RMB->mr[link_idx = 0] + | initialized. + | + | Then smc_clc_send_confirm_accept() accesses + | conn->rmb_desc->mr[conn->link->link_idx, which is 1], then crash. + v + +This patch tries to fix this by cleaning conn->lnk before assigning +link. In addition, it is better to reset the connection and clean the +resources assigned if trying SMCRv2 failed in buffer creation or +registration. + +Fixes: e49300a6bf62 ("net/smc: add listen processing for SMC-Rv2") +Link: https://lore.kernel.org/r/20220523055056.2078994-1-liuyacan@corp.netease.com/ +Signed-off-by: Wen Gu +Reviewed-by: Tony Lu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/smc/af_smc.c | 9 +++++++-- + net/smc/smc_core.c | 1 + + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1987,8 +1987,10 @@ static int smc_listen_rdma_init(struct s + return rc; + + /* create send buffer and rmb */ +- if (smc_buf_create(new_smc, false)) ++ if (smc_buf_create(new_smc, false)) { ++ smc_conn_abort(new_smc, ini->first_contact_local); + return SMC_CLC_DECL_MEM; ++ } + + return 0; + } +@@ -2204,8 +2206,11 @@ static void smc_find_rdma_v2_device_serv + smcr_version = ini->smcr_version; + ini->smcr_version = SMC_V2; + rc = smc_listen_rdma_init(new_smc, ini); +- if (!rc) ++ if (!rc) { + rc = smc_listen_rdma_reg(new_smc, ini->first_contact_local); ++ if (rc) ++ smc_conn_abort(new_smc, ini->first_contact_local); ++ } + if (!rc) + return; + ini->smcr_version = smcr_version; +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -127,6 +127,7 @@ static int smcr_lgr_conn_assign_link(str + int i, j; + + /* do link balancing */ ++ conn->lnk = NULL; /* reset conn->lnk first */ + for (i = 0; i < SMC_LINKS_PER_LGR_MAX; i++) { + struct smc_link *lnk = &conn->lgr->lnk[i]; + diff --git a/queue-6.1/regulator-mt6359-add-read-check-for-pmic-mt6359.patch b/queue-6.1/regulator-mt6359-add-read-check-for-pmic-mt6359.patch new file mode 100644 index 00000000000..b933c42a84d --- /dev/null +++ b/queue-6.1/regulator-mt6359-add-read-check-for-pmic-mt6359.patch @@ -0,0 +1,38 @@ +From a511637502b1caa135046d0f8fdabd55a31af8ef Mon Sep 17 00:00:00 2001 +From: Sen Chu +Date: Thu, 18 May 2023 12:06:46 +0800 +Subject: regulator: mt6359: add read check for PMIC MT6359 + +From: Sen Chu + +commit a511637502b1caa135046d0f8fdabd55a31af8ef upstream. + +Add hardware version read check for PMIC MT6359 + +Signed-off-by: Sen Chu +--- + drivers/regulator/mt6359-regulator.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/regulator/mt6359-regulator.c ++++ b/drivers/regulator/mt6359-regulator.c +@@ -951,9 +951,12 @@ static int mt6359_regulator_probe(struct + struct regulator_config config = {}; + struct regulator_dev *rdev; + struct mt6359_regulator_info *mt6359_info; +- int i, hw_ver; ++ int i, hw_ver, ret; ++ ++ ret = regmap_read(mt6397->regmap, MT6359P_HWCID, &hw_ver); ++ if (ret) ++ return ret; + +- regmap_read(mt6397->regmap, MT6359P_HWCID, &hw_ver); + if (hw_ver >= MT6359P_CHIP_VER) + mt6359_info = mt6359p_regulators; + else diff --git a/queue-6.1/series b/queue-6.1/series index f377467c9dc..6bb6a794e67 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -112,3 +112,8 @@ net-mlx5-collect-command-failures-data-only-for-known-commands.patch net-mlx5-devcom-fix-error-flow-in-mlx5_devcom_register_device.patch net-mlx5-devcom-serialize-devcom-registration.patch arm64-dts-imx8mn-var-som-fix-phy-detection-bug-by-adding-deassert-delay.patch +firmware-arm_ffa-set-reserved-mbz-fields-to-zero-in-the-memory-descriptors.patch +regulator-mt6359-add-read-check-for-pmic-mt6359.patch +net-smc-reset-connection-when-trying-to-use-smcrv2-fails.patch +3c589_cs-fix-an-error-handling-path-in-tc589_probe.patch +net-phy-mscc-add-vsc8502-to-module_device_table.patch