From: Sasha Levin Date: Mon, 26 Jun 2023 04:23:24 +0000 (-0400) Subject: Fixes for 4.14 X-Git-Tag: v4.14.320~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=835c4e6b66f1df70dc8c57195a3604b7a150025c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/arm64-add-missing-set-way-cmo-encodings.patch b/queue-4.14/arm64-add-missing-set-way-cmo-encodings.patch new file mode 100644 index 00000000000..a8949374334 --- /dev/null +++ b/queue-4.14/arm64-add-missing-set-way-cmo-encodings.patch @@ -0,0 +1,43 @@ +From b9f058dffa23084eeed2b7bf6a2536667a523a59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 21:46:00 +0100 +Subject: arm64: Add missing Set/Way CMO encodings + +From: Marc Zyngier + +[ Upstream commit 8d0f019e4c4f2ee2de81efd9bf1c27e9fb3c0460 ] + +Add the missing Set/Way CMOs that apply to tagged memory. + +Signed-off-by: Marc Zyngier +Reviewed-by: Cornelia Huck +Reviewed-by: Steven Price +Reviewed-by: Oliver Upton +Link: https://lore.kernel.org/r/20230515204601.1270428-2-maz@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/sysreg.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h +index 3bbf0dc5ecad0..78d6f4bf117d6 100644 +--- a/arch/arm64/include/asm/sysreg.h ++++ b/arch/arm64/include/asm/sysreg.h +@@ -98,8 +98,14 @@ + (!!x)<<8 | 0x1f) + + #define SYS_DC_ISW sys_insn(1, 0, 7, 6, 2) ++#define SYS_DC_IGSW sys_insn(1, 0, 7, 6, 4) ++#define SYS_DC_IGDSW sys_insn(1, 0, 7, 6, 6) + #define SYS_DC_CSW sys_insn(1, 0, 7, 10, 2) ++#define SYS_DC_CGSW sys_insn(1, 0, 7, 10, 4) ++#define SYS_DC_CGDSW sys_insn(1, 0, 7, 10, 6) + #define SYS_DC_CISW sys_insn(1, 0, 7, 14, 2) ++#define SYS_DC_CIGSW sys_insn(1, 0, 7, 14, 4) ++#define SYS_DC_CIGDSW sys_insn(1, 0, 7, 14, 6) + + #define SYS_OSDTRRX_EL1 sys_reg(2, 0, 0, 0, 2) + #define SYS_MDCCINT_EL1 sys_reg(2, 0, 0, 2, 0) +-- +2.39.2 + diff --git a/queue-4.14/be2net-extend-xmit-workaround-to-be3-chip.patch b/queue-4.14/be2net-extend-xmit-workaround-to-be3-chip.patch new file mode 100644 index 00000000000..8d68174b5f4 --- /dev/null +++ b/queue-4.14/be2net-extend-xmit-workaround-to-be3-chip.patch @@ -0,0 +1,48 @@ +From 08990f9c300fd4903d5cf5268c4d1edc1c001454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 17:45:49 +0100 +Subject: be2net: Extend xmit workaround to BE3 chip + +From: Ross Lagerwall + +[ Upstream commit 7580e0a78eb29e7bb1a772eba4088250bbb70d41 ] + +We have seen a bug where the NIC incorrectly changes the length in the +IP header of a padded packet to include the padding bytes. The driver +already has a workaround for this so do the workaround for this NIC too. +This resolves the issue. + +The NIC in question identifies itself as follows: + +[ 8.828494] be2net 0000:02:00.0: FW version is 10.7.110.31 +[ 8.834759] be2net 0000:02:00.0: Emulex OneConnect(be3): PF FLEX10 port 1 + +02:00.0 Ethernet controller: Emulex Corporation OneConnect 10Gb NIC (be3) (rev 01) + +Fixes: ca34fe38f06d ("be2net: fix wrong usage of adapter->generation") +Signed-off-by: Ross Lagerwall +Link: https://lore.kernel.org/r/20230616164549.2863037-1-ross.lagerwall@citrix.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/emulex/benet/be_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index 43ae124cabff6..f8541d0c7bd52 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -1129,8 +1129,8 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter, + eth_hdr_len = ntohs(skb->protocol) == ETH_P_8021Q ? + VLAN_ETH_HLEN : ETH_HLEN; + if (skb->len <= 60 && +- (lancer_chip(adapter) || skb_vlan_tag_present(skb)) && +- is_ipv4_pkt(skb)) { ++ (lancer_chip(adapter) || BE3_chip(adapter) || ++ skb_vlan_tag_present(skb)) && is_ipv4_pkt(skb)) { + ip = (struct iphdr *)ip_hdr(skb); + pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len)); + } +-- +2.39.2 + diff --git a/queue-4.14/drm-exynos-fix-race-condition-uaf-in-exynos_g2d_exec.patch b/queue-4.14/drm-exynos-fix-race-condition-uaf-in-exynos_g2d_exec.patch new file mode 100644 index 00000000000..10ccfb4f757 --- /dev/null +++ b/queue-4.14/drm-exynos-fix-race-condition-uaf-in-exynos_g2d_exec.patch @@ -0,0 +1,37 @@ +From 67612d894ba7ac6b5936bf01a8071547a543d36b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 21:01:31 +0800 +Subject: drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl + +From: Min Li + +[ Upstream commit 48bfd02569f5db49cc033f259e66d57aa6efc9a3 ] + +If it is async, runqueue_node is freed in g2d_runqueue_worker on another +worker thread. So in extreme cases, if g2d_runqueue_worker runs first, and +then executes the following if statement, there will be use-after-free. + +Signed-off-by: Min Li +Reviewed-by: Andi Shyti +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_g2d.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c +index 9effe40f5fa5d..ddfcf22a883d5 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c +@@ -1387,7 +1387,7 @@ int exynos_g2d_exec_ioctl(struct drm_device *drm_dev, void *data, + /* Let the runqueue know that there is work to do. */ + queue_work(g2d->g2d_workq, &g2d->runqueue_work); + +- if (runqueue_node->async) ++ if (req->async) + goto out; + + wait_for_completion(&runqueue_node->complete); +-- +2.39.2 + diff --git a/queue-4.14/drm-exynos-vidi-fix-a-wrong-error-return.patch b/queue-4.14/drm-exynos-vidi-fix-a-wrong-error-return.patch new file mode 100644 index 00000000000..acd78ad3e23 --- /dev/null +++ b/queue-4.14/drm-exynos-vidi-fix-a-wrong-error-return.patch @@ -0,0 +1,38 @@ +From dd97bfd76ecf917cee65b93ddcbd7922d1be6a2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 08:55:05 +0900 +Subject: drm/exynos: vidi: fix a wrong error return + +From: Inki Dae + +[ Upstream commit 4a059559809fd1ddbf16f847c4d2237309c08edf ] + +Fix a wrong error return by dropping an error return. + +When vidi driver is remvoed, if ctx->raw_edid isn't same as fake_edid_info +then only what we have to is to free ctx->raw_edid so that driver removing +can work correctly - it's not an error case. + +Signed-off-by: Inki Dae +Reviewed-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_vidi.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c +index 53e03f8af3d5e..f36d4df4d481d 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c +@@ -480,8 +480,6 @@ static int vidi_remove(struct platform_device *pdev) + if (ctx->raw_edid != (struct edid *)fake_edid_info) { + kfree(ctx->raw_edid); + ctx->raw_edid = NULL; +- +- return -EINVAL; + } + + component_del(&pdev->dev, &vidi_component_ops); +-- +2.39.2 + diff --git a/queue-4.14/drm-radeon-fix-race-condition-uaf-in-radeon_gem_set_.patch b/queue-4.14/drm-radeon-fix-race-condition-uaf-in-radeon_gem_set_.patch new file mode 100644 index 00000000000..59877f6f7e4 --- /dev/null +++ b/queue-4.14/drm-radeon-fix-race-condition-uaf-in-radeon_gem_set_.patch @@ -0,0 +1,54 @@ +From 450645d76b6b89cb7a8431b51e1535ed9ea80573 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jun 2023 15:43:45 +0800 +Subject: drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Min Li + +[ Upstream commit 982b173a6c6d9472730c3116051977e05d17c8c5 ] + +Userspace can race to free the gobj(robj converted from), robj should not +be accessed again after drm_gem_object_put, otherwith it will result in +use-after-free. + +Reviewed-by: Christian König +Signed-off-by: Min Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_gem.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c +index ac467b80edc7c..59ad0a4e2fd53 100644 +--- a/drivers/gpu/drm/radeon/radeon_gem.c ++++ b/drivers/gpu/drm/radeon/radeon_gem.c +@@ -376,7 +376,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, + struct radeon_device *rdev = dev->dev_private; + struct drm_radeon_gem_set_domain *args = data; + struct drm_gem_object *gobj; +- struct radeon_bo *robj; + int r; + + /* for now if someone requests domain CPU - +@@ -389,13 +388,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, + up_read(&rdev->exclusive_lock); + return -ENOENT; + } +- robj = gem_to_radeon_bo(gobj); + + r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain); + + drm_gem_object_put_unlocked(gobj); + up_read(&rdev->exclusive_lock); +- r = radeon_gem_handle_lockup(robj->rdev, r); ++ r = radeon_gem_handle_lockup(rdev, r); + return r; + } + +-- +2.39.2 + diff --git a/queue-4.14/fbdev-imsttfb-release-framebuffer-and-dealloc-cmap-o.patch b/queue-4.14/fbdev-imsttfb-release-framebuffer-and-dealloc-cmap-o.patch new file mode 100644 index 00000000000..9d081088a17 --- /dev/null +++ b/queue-4.14/fbdev-imsttfb-release-framebuffer-and-dealloc-cmap-o.patch @@ -0,0 +1,39 @@ +From 4eec244fe5a687b3b926a3ee5f2884614c63c8c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 11:28:36 +0200 +Subject: fbdev: imsttfb: Release framebuffer and dealloc cmap on error path + +From: Helge Deller + +[ Upstream commit 5cf9a090a39c97f4506b7b53739d469b1c05a7e9 ] + +Add missing cleanups in error path. + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/imsttfb.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c +index ecdcf358ad5ea..6589d5f0a5a40 100644 +--- a/drivers/video/fbdev/imsttfb.c ++++ b/drivers/video/fbdev/imsttfb.c +@@ -1452,9 +1452,13 @@ static void init_imstt(struct fb_info *info) + FBINFO_HWACCEL_FILLRECT | + FBINFO_HWACCEL_YPAN; + +- fb_alloc_cmap(&info->cmap, 0, 0); ++ if (fb_alloc_cmap(&info->cmap, 0, 0)) { ++ framebuffer_release(info); ++ return -ENODEV; ++ } + + if (register_framebuffer(info) < 0) { ++ fb_dealloc_cmap(&info->cmap); + framebuffer_release(info); + return; + } +-- +2.39.2 + diff --git a/queue-4.14/hid-wacom-add-error-check-to-wacom_parse_and_registe.patch b/queue-4.14/hid-wacom-add-error-check-to-wacom_parse_and_registe.patch new file mode 100644 index 00000000000..8fead828d9d --- /dev/null +++ b/queue-4.14/hid-wacom-add-error-check-to-wacom_parse_and_registe.patch @@ -0,0 +1,44 @@ +From f18a0146b3bd6dec53c75498e7f3a30ffaa4fb1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 14:47:45 +0300 +Subject: HID: wacom: Add error check to wacom_parse_and_register() + +From: Denis Arefev + +[ Upstream commit 16a9c24f24fbe4564284eb575b18cc20586b9270 ] + + Added a variable check and + transition in case of an error + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Denis Arefev +Reviewed-by: Ping Cheng +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/wacom_sys.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 3d521f289984a..28e7a4950b74a 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -2251,8 +2251,13 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless) + goto fail_quirks; + } + +- if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR) ++ if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR) { + error = hid_hw_open(hdev); ++ if (error) { ++ hid_err(hdev, "hw open failed\n"); ++ goto fail_quirks; ++ } ++ } + + wacom_set_shared_values(wacom_wac); + devres_close_group(&hdev->dev, wacom); +-- +2.39.2 + diff --git a/queue-4.14/mmc-mtk-sd-fix-deferred-probing.patch b/queue-4.14/mmc-mtk-sd-fix-deferred-probing.patch new file mode 100644 index 00000000000..0605a972d92 --- /dev/null +++ b/queue-4.14/mmc-mtk-sd-fix-deferred-probing.patch @@ -0,0 +1,39 @@ +From cb77101c27e08cdc91b3cf033c98e87897cba1fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 23:36:13 +0300 +Subject: mmc: mtk-sd: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 0c4dc0f054891a2cbde0426b0c0fdf232d89f47f ] + +The driver overrides the error codes returned by platform_get_irq() to +-EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe +permanently instead of the deferred probing. Switch to propagating the +error codes upstream. + +Fixes: 208489032bdd ("mmc: mediatek: Add Mediatek MMC driver") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/20230617203622.6812-4-s.shtylyov@omp.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mtk-sd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index e51a62cff5ecc..3c77469df73b1 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -1663,7 +1663,7 @@ static int msdc_drv_probe(struct platform_device *pdev) + + host->irq = platform_get_irq(pdev, 0); + if (host->irq < 0) { +- ret = -EINVAL; ++ ret = host->irq; + goto host_free; + } + +-- +2.39.2 + diff --git a/queue-4.14/mmc-omap-fix-deferred-probing.patch b/queue-4.14/mmc-omap-fix-deferred-probing.patch new file mode 100644 index 00000000000..e43db5c652f --- /dev/null +++ b/queue-4.14/mmc-omap-fix-deferred-probing.patch @@ -0,0 +1,39 @@ +From 8f076b09e7e4ef0ea5ba429d186bf7fd23693ded Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 23:36:15 +0300 +Subject: mmc: omap: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit aedf4ba1ad00aaa94c1b66c73ecaae95e2564b95 ] + +The driver overrides the error codes returned by platform_get_irq() to +-ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe +permanently instead of the deferred probing. Switch to propagating the +error codes upstream. + +Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/20230617203622.6812-6-s.shtylyov@omp.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c +index f11245a0521ca..1d3c668ab4460 100644 +--- a/drivers/mmc/host/omap.c ++++ b/drivers/mmc/host/omap.c +@@ -1348,7 +1348,7 @@ static int mmc_omap_probe(struct platform_device *pdev) + + irq = platform_get_irq(pdev, 0); + if (irq < 0) +- return -ENXIO; ++ return irq; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + host->virt_base = devm_ioremap_resource(&pdev->dev, res); +-- +2.39.2 + diff --git a/queue-4.14/mmc-omap_hsmmc-fix-deferred-probing.patch b/queue-4.14/mmc-omap_hsmmc-fix-deferred-probing.patch new file mode 100644 index 00000000000..0eed24a3635 --- /dev/null +++ b/queue-4.14/mmc-omap_hsmmc-fix-deferred-probing.patch @@ -0,0 +1,44 @@ +From 9ee6dedee0d1c3b73ca890f3b015d28a68e0ee6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 23:36:16 +0300 +Subject: mmc: omap_hsmmc: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit fb51b74a57859b707c3e8055ed0c25a7ca4f6a29 ] + +The driver overrides the error codes returned by platform_get_irq() to +-ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe +permanently instead of the deferred probing. Switch to propagating the +error codes upstream. + +Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/20230617203622.6812-7-s.shtylyov@omp.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/omap_hsmmc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c +index ea12712bd2c36..36e8f0be70516 100644 +--- a/drivers/mmc/host/omap_hsmmc.c ++++ b/drivers/mmc/host/omap_hsmmc.c +@@ -2023,9 +2023,11 @@ static int omap_hsmmc_probe(struct platform_device *pdev) + } + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- irq = platform_get_irq(pdev, 0); +- if (res == NULL || irq < 0) ++ if (!res) + return -ENXIO; ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return irq; + + base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(base)) +-- +2.39.2 + diff --git a/queue-4.14/mmc-usdhi60rol0-fix-deferred-probing.patch b/queue-4.14/mmc-usdhi60rol0-fix-deferred-probing.patch new file mode 100644 index 00000000000..9dd78806f84 --- /dev/null +++ b/queue-4.14/mmc-usdhi60rol0-fix-deferred-probing.patch @@ -0,0 +1,43 @@ +From 597d2bda7fb20ee5cb31a0e54eaa1865df2a2970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 23:36:22 +0300 +Subject: mmc: usdhi60rol0: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 413db499730248431c1005b392e8ed82c4fa19bf ] + +The driver overrides the error codes returned by platform_get_irq_byname() +to -ENODEV, so if it returns -EPROBE_DEFER, the driver will fail the probe +permanently instead of the deferred probing. Switch to propagating error +codes upstream. + +Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/20230617203622.6812-13-s.shtylyov@omp.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/usdhi6rol0.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c +index d27ee9eb2eacf..27459eab0ed09 100644 +--- a/drivers/mmc/host/usdhi6rol0.c ++++ b/drivers/mmc/host/usdhi6rol0.c +@@ -1749,8 +1749,10 @@ static int usdhi6_probe(struct platform_device *pdev) + irq_cd = platform_get_irq_byname(pdev, "card detect"); + irq_sd = platform_get_irq_byname(pdev, "data"); + irq_sdio = platform_get_irq_byname(pdev, "SDIO"); +- if (irq_sd < 0 || irq_sdio < 0) +- return -ENODEV; ++ if (irq_sd < 0) ++ return irq_sd; ++ if (irq_sdio < 0) ++ return irq_sdio; + + mmc = mmc_alloc_host(sizeof(struct usdhi6_host), dev); + if (!mmc) +-- +2.39.2 + diff --git a/queue-4.14/net-qca_spi-avoid-high-load-if-qca7000-is-not-availa.patch b/queue-4.14/net-qca_spi-avoid-high-load-if-qca7000-is-not-availa.patch new file mode 100644 index 00000000000..76c74175a30 --- /dev/null +++ b/queue-4.14/net-qca_spi-avoid-high-load-if-qca7000-is-not-availa.patch @@ -0,0 +1,40 @@ +From 53ba84b4c0c33dfc8942a5b351a48842157c4c9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 23:06:56 +0200 +Subject: net: qca_spi: Avoid high load if QCA7000 is not available + +From: Stefan Wahren + +[ Upstream commit 92717c2356cb62c89e8a3dc37cbbab2502562524 ] + +In case the QCA7000 is not available via SPI (e.g. in reset), +the driver will cause a high load. The reason for this is +that the synchronization is never finished and schedule() +is never called. Since the synchronization is not timing +critical, it's safe to drop this from the scheduling condition. + +Signed-off-by: Stefan Wahren +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 1ca1f72474abe..0c454eeb3bd8e 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -553,8 +553,7 @@ qcaspi_spi_thread(void *data) + while (!kthread_should_stop()) { + set_current_state(TASK_INTERRUPTIBLE); + if ((qca->intr_req == qca->intr_svc) && +- (qca->txr.skb[qca->txr.head] == NULL) && +- (qca->sync == QCASPI_SYNC_READY)) ++ !qca->txr.skb[qca->txr.head]) + schedule(); + + set_current_state(TASK_RUNNING); +-- +2.39.2 + diff --git a/queue-4.14/netfilter-nf_tables-disallow-element-updates-of-boun.patch b/queue-4.14/netfilter-nf_tables-disallow-element-updates-of-boun.patch new file mode 100644 index 00000000000..9b1beaca247 --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-disallow-element-updates-of-boun.patch @@ -0,0 +1,49 @@ +From f1d675b44e6d2de43b0b231ee03809e5321fb6a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 15:20:16 +0200 +Subject: netfilter: nf_tables: disallow element updates of bound anonymous + sets + +From: Pablo Neira Ayuso + +[ Upstream commit c88c535b592d3baeee74009f3eceeeaf0fdd5e1b ] + +Anonymous sets come with NFT_SET_CONSTANT from userspace. Although API +allows to create anonymous sets without NFT_SET_CONSTANT, it makes no +sense to allow to add and to delete elements for bound anonymous sets. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 241a3032d0e66..e091c552b0b92 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4220,7 +4220,8 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk, + return PTR_ERR(set); + } + +- if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) ++ if (!list_empty(&set->bindings) && ++ (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS))) + return -EBUSY; + + nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) { +@@ -4399,7 +4400,9 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk, + genmask); + if (IS_ERR(set)) + return PTR_ERR(set); +- if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) ++ ++ if (!list_empty(&set->bindings) && ++ (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS))) + return -EBUSY; + + if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) { +-- +2.39.2 + diff --git a/queue-4.14/nfcsim.c-fix-error-checking-for-debugfs_create_dir.patch b/queue-4.14/nfcsim.c-fix-error-checking-for-debugfs_create_dir.patch new file mode 100644 index 00000000000..d61528edca5 --- /dev/null +++ b/queue-4.14/nfcsim.c-fix-error-checking-for-debugfs_create_dir.patch @@ -0,0 +1,40 @@ +From 6865f443dbbdf3737be96db09a678f6f7718ffd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 22:27:46 +0500 +Subject: nfcsim.c: Fix error checking for debugfs_create_dir + +From: Osama Muhammad + +[ Upstream commit 9b9e46aa07273ceb96866b2e812b46f1ee0b8d2f ] + +This patch fixes the error checking in nfcsim.c. +The DebugFS kernel API is developed in +a way that the caller can safely ignore the errors that +occur during the creation of DebugFS nodes. + +Signed-off-by: Osama Muhammad +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/nfcsim.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/nfc/nfcsim.c b/drivers/nfc/nfcsim.c +index 533e3aa6275cd..cf07b366500e9 100644 +--- a/drivers/nfc/nfcsim.c ++++ b/drivers/nfc/nfcsim.c +@@ -345,10 +345,6 @@ static struct dentry *nfcsim_debugfs_root; + static void nfcsim_debugfs_init(void) + { + nfcsim_debugfs_root = debugfs_create_dir("nfcsim", NULL); +- +- if (!nfcsim_debugfs_root) +- pr_err("Could not create debugfs entry\n"); +- + } + + static void nfcsim_debugfs_remove(void) +-- +2.39.2 + diff --git a/queue-4.14/s390-cio-unregister-device-when-the-only-path-is-gon.patch b/queue-4.14/s390-cio-unregister-device-when-the-only-path-is-gon.patch new file mode 100644 index 00000000000..aa5fe2bf0c3 --- /dev/null +++ b/queue-4.14/s390-cio-unregister-device-when-the-only-path-is-gon.patch @@ -0,0 +1,62 @@ +From a8091900cfe4430a76d7d4cc1e54a1102f4b68cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 20:53:20 +0200 +Subject: s390/cio: unregister device when the only path is gone + +From: Vineeth Vijayan + +[ Upstream commit 89c0c62e947a01e7a36b54582fd9c9e346170255 ] + +Currently, if the device is offline and all the channel paths are +either configured or varied offline, the associated subchannel gets +unregistered. Don't unregister the subchannel, instead unregister +offline device. + +Signed-off-by: Vineeth Vijayan +Reviewed-by: Peter Oberparleiter +Signed-off-by: Alexander Gordeev +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index d2203cd178138..6721e984782db 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1357,6 +1357,7 @@ void ccw_device_set_notoper(struct ccw_device *cdev) + enum io_sch_action { + IO_SCH_UNREG, + IO_SCH_ORPH_UNREG, ++ IO_SCH_UNREG_CDEV, + IO_SCH_ATTACH, + IO_SCH_UNREG_ATTACH, + IO_SCH_ORPH_ATTACH, +@@ -1389,7 +1390,7 @@ static enum io_sch_action sch_get_action(struct subchannel *sch) + } + if ((sch->schib.pmcw.pam & sch->opm) == 0) { + if (ccw_device_notify(cdev, CIO_NO_PATH) != NOTIFY_OK) +- return IO_SCH_UNREG; ++ return IO_SCH_UNREG_CDEV; + return IO_SCH_DISC; + } + if (device_is_disconnected(cdev)) +@@ -1451,6 +1452,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process) + case IO_SCH_ORPH_ATTACH: + ccw_device_set_disconnected(cdev); + break; ++ case IO_SCH_UNREG_CDEV: + case IO_SCH_UNREG_ATTACH: + case IO_SCH_UNREG: + if (!cdev) +@@ -1484,6 +1486,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process) + if (rc) + goto out; + break; ++ case IO_SCH_UNREG_CDEV: + case IO_SCH_UNREG_ATTACH: + spin_lock_irqsave(sch->lock, flags); + if (cdev->private->flags.resuming) { +-- +2.39.2 + diff --git a/queue-4.14/scsi-target-iscsi-prevent-login-threads-from-racing-.patch b/queue-4.14/scsi-target-iscsi-prevent-login-threads-from-racing-.patch new file mode 100644 index 00000000000..be8a2190171 --- /dev/null +++ b/queue-4.14/scsi-target-iscsi-prevent-login-threads-from-racing-.patch @@ -0,0 +1,71 @@ +From 569eb70b65cca5101c6e781a24541df0bd72d081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 18:22:19 +0200 +Subject: scsi: target: iscsi: Prevent login threads from racing between each + other + +From: Maurizio Lombardi + +[ Upstream commit 2a737d3b8c792400118d6cf94958f559de9c5e59 ] + +The tpg->np_login_sem is a semaphore that is used to serialize the login +process when multiple login threads run concurrently against the same +target portal group. + +The iscsi_target_locate_portal() function finds the tpg, calls +iscsit_access_np() against the np_login_sem semaphore and saves the tpg +pointer in conn->tpg; + +If iscsi_target_locate_portal() fails, the caller will check for the +conn->tpg pointer and, if it's not NULL, then it will assume that +iscsi_target_locate_portal() called iscsit_access_np() on the semaphore. + +Make sure that conn->tpg gets initialized only if iscsit_access_np() was +successful, otherwise iscsit_deaccess_np() may end up being called against +a semaphore we never took, allowing more than one thread to access the same +tpg. + +Signed-off-by: Maurizio Lombardi +Link: https://lore.kernel.org/r/20230508162219.1731964-4-mlombard@redhat.com +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target_nego.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c +index 07335357418c8..d94f711afee07 100644 +--- a/drivers/target/iscsi/iscsi_target_nego.c ++++ b/drivers/target/iscsi/iscsi_target_nego.c +@@ -1067,6 +1067,7 @@ int iscsi_target_locate_portal( + iscsi_target_set_sock_callbacks(conn); + + login->np = np; ++ conn->tpg = NULL; + + login_req = (struct iscsi_login_req *) login->req; + payload_length = ntoh24(login_req->dlength); +@@ -1136,7 +1137,6 @@ int iscsi_target_locate_portal( + */ + sessiontype = strncmp(s_buf, DISCOVERY, 9); + if (!sessiontype) { +- conn->tpg = iscsit_global->discovery_tpg; + if (!login->leading_connection) + goto get_target; + +@@ -1153,9 +1153,11 @@ int iscsi_target_locate_portal( + * Serialize access across the discovery struct iscsi_portal_group to + * process login attempt. + */ ++ conn->tpg = iscsit_global->discovery_tpg; + if (iscsit_access_np(np, conn->tpg) < 0) { + iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, + ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE); ++ conn->tpg = NULL; + ret = -1; + goto out; + } +-- +2.39.2 + diff --git a/queue-4.14/series b/queue-4.14/series index 8bbebda1dd0..51ab439d71f 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -4,3 +4,21 @@ nilfs2-fix-buffer-corruption-due-to-concurrent-device-reads.patch drivers-hv-vmbus-fix-vmbus_wait_for_unload-to-scan-present-cpus.patch cgroup-do-not-corrupt-task-iteration-when-rebinding-subsystem.patch nilfs2-prevent-general-protection-fault-in-nilfs_clear_dirty_page.patch +xfrm-linearize-the-skb-after-offloading-if-needed.patch +net-qca_spi-avoid-high-load-if-qca7000-is-not-availa.patch +mmc-mtk-sd-fix-deferred-probing.patch +mmc-omap-fix-deferred-probing.patch +mmc-omap_hsmmc-fix-deferred-probing.patch +mmc-usdhi60rol0-fix-deferred-probing.patch +be2net-extend-xmit-workaround-to-be3-chip.patch +netfilter-nf_tables-disallow-element-updates-of-boun.patch +scsi-target-iscsi-prevent-login-threads-from-racing-.patch +hid-wacom-add-error-check-to-wacom_parse_and_registe.patch +arm64-add-missing-set-way-cmo-encodings.patch +nfcsim.c-fix-error-checking-for-debugfs_create_dir.patch +fbdev-imsttfb-release-framebuffer-and-dealloc-cmap-o.patch +usb-gadget-udc-fix-null-dereference-in-remove.patch +s390-cio-unregister-device-when-the-only-path-is-gon.patch +drm-exynos-vidi-fix-a-wrong-error-return.patch +drm-exynos-fix-race-condition-uaf-in-exynos_g2d_exec.patch +drm-radeon-fix-race-condition-uaf-in-radeon_gem_set_.patch diff --git a/queue-4.14/usb-gadget-udc-fix-null-dereference-in-remove.patch b/queue-4.14/usb-gadget-udc-fix-null-dereference-in-remove.patch new file mode 100644 index 00000000000..fb4dd39ec99 --- /dev/null +++ b/queue-4.14/usb-gadget-udc-fix-null-dereference-in-remove.patch @@ -0,0 +1,39 @@ +From acc04b12f87a8b0f0885e3b906e46271a611e49e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 18:38:37 +0300 +Subject: usb: gadget: udc: fix NULL dereference in remove() + +From: Dan Carpenter + +[ Upstream commit 016da9c65fec9f0e78c4909ed9a0f2d567af6775 ] + +The "udc" pointer was never set in the probe() function so it will +lead to a NULL dereference in udc_pci_remove() when we do: + + usb_del_gadget_udc(&udc->gadget); + +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/ZG+A/dNpFWAlCChk@kili +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/amd5536udc_pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/gadget/udc/amd5536udc_pci.c b/drivers/usb/gadget/udc/amd5536udc_pci.c +index 73413c1211cbd..8849fc3030bd2 100644 +--- a/drivers/usb/gadget/udc/amd5536udc_pci.c ++++ b/drivers/usb/gadget/udc/amd5536udc_pci.c +@@ -175,6 +175,9 @@ static int udc_pci_probe( + retval = -ENODEV; + goto err_probe; + } ++ ++ udc = dev; ++ + return 0; + + err_probe: +-- +2.39.2 + diff --git a/queue-4.14/xfrm-linearize-the-skb-after-offloading-if-needed.patch b/queue-4.14/xfrm-linearize-the-skb-after-offloading-if-needed.patch new file mode 100644 index 00000000000..89f6f36b1ee --- /dev/null +++ b/queue-4.14/xfrm-linearize-the-skb-after-offloading-if-needed.patch @@ -0,0 +1,64 @@ +From e61cfa5af02207fa3e3d8bd51c476e863245529d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 12:02:02 +0200 +Subject: xfrm: Linearize the skb after offloading if needed. + +From: Sebastian Andrzej Siewior + +[ Upstream commit f015b900bc3285322029b4a7d132d6aeb0e51857 ] + +With offloading enabled, esp_xmit() gets invoked very late, from within +validate_xmit_xfrm() which is after validate_xmit_skb() validates and +linearizes the skb if the underlying device does not support fragments. + +esp_output_tail() may add a fragment to the skb while adding the auth +tag/ IV. Devices without the proper support will then send skb->data +points to with the correct length so the packet will have garbage at the +end. A pcap sniffer will claim that the proper data has been sent since +it parses the skb properly. + +It is not affected with INET_ESP_OFFLOAD disabled. + +Linearize the skb after offloading if the sending hardware requires it. +It was tested on v4, v6 has been adopted. + +Fixes: 7785bba299a8d ("esp: Add a software GRO codepath") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv4/esp4_offload.c | 3 +++ + net/ipv6/esp6_offload.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c +index 29b333a62ab01..5be59ccb61aa2 100644 +--- a/net/ipv4/esp4_offload.c ++++ b/net/ipv4/esp4_offload.c +@@ -268,6 +268,9 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ + + secpath_reset(skb); + ++ if (skb_needs_linearize(skb, skb->dev->features) && ++ __skb_linearize(skb)) ++ return -ENOMEM; + return 0; + } + +diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c +index a50d1943dd620..7c72b85c93396 100644 +--- a/net/ipv6/esp6_offload.c ++++ b/net/ipv6/esp6_offload.c +@@ -304,6 +304,9 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features + + secpath_reset(skb); + ++ if (skb_needs_linearize(skb, skb->dev->features) && ++ __skb_linearize(skb)) ++ return -ENOMEM; + return 0; + } + +-- +2.39.2 +