From: Greg Kroah-Hartman Date: Thu, 23 Nov 2023 12:22:54 +0000 (+0000) Subject: 5.15-stable patches X-Git-Tag: v4.14.331~85 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=86644d907b29d4e4f156199838bb8bf59bdaadee;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch i2c-core-run-atomic-i2c-xfer-when-preemptible.patch i3c-master-cdns-fix-reading-status-register.patch i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch kernel-reboot-emergency_restart-set-correct-system_state.patch mcb-fix-error-handling-for-different-scenarios-when-parsing.patch mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch mtd-cfi_cmdset_0001-byte-swap-otp-info.patch quota-explicitly-forbid-quota-files-from-being-encrypted.patch s390-cmma-fix-detection-of-dat-pages.patch s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch --- diff --git a/queue-5.15/asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch b/queue-5.15/asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch new file mode 100644 index 00000000000..8d68ec8a7b7 --- /dev/null +++ b/queue-5.15/asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch @@ -0,0 +1,36 @@ +From 72151ad0cba8a07df90130ff62c979520d71f23b Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 3 Oct 2023 17:54:22 +0200 +Subject: ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix + +From: Krzysztof Kozlowski + +commit 72151ad0cba8a07df90130ff62c979520d71f23b upstream. + +Driver compares widget name in wsa_macro_spk_boost_event() widget event +callback, however it does not handle component's name prefix. This +leads to using uninitialized stack variables as registers and register +values. Handle gracefully such case. + +Fixes: 2c4066e5d428 ("ASoC: codecs: lpass-wsa-macro: add dapm widgets and route") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20231003155422.801160-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/lpass-wsa-macro.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/soc/codecs/lpass-wsa-macro.c ++++ b/sound/soc/codecs/lpass-wsa-macro.c +@@ -1678,6 +1678,9 @@ static int wsa_macro_spk_boost_event(str + boost_path_cfg1 = CDC_WSA_RX1_RX_PATH_CFG1; + reg = CDC_WSA_RX1_RX_PATH_CTL; + reg_mix = CDC_WSA_RX1_RX_PATH_MIX_CTL; ++ } else { ++ dev_warn(component->dev, "Incorrect widget name in the driver\n"); ++ return -EINVAL; + } + + switch (event) { diff --git a/queue-5.15/dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch b/queue-5.15/dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch new file mode 100644 index 00000000000..23ba4530e45 --- /dev/null +++ b/queue-5.15/dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch @@ -0,0 +1,48 @@ +From 03f25d53b145bc2f7ccc82fc04e4482ed734f524 Mon Sep 17 00:00:00 2001 +From: Alain Volmat +Date: Mon, 9 Oct 2023 10:24:50 +0200 +Subject: dmaengine: stm32-mdma: correct desc prep when channel running + +From: Alain Volmat + +commit 03f25d53b145bc2f7ccc82fc04e4482ed734f524 upstream. + +In case of the prep descriptor while the channel is already running, the +CCR register value stored into the channel could already have its EN bit +set. This would lead to a bad transfer since, at start transfer time, +enabling the channel while other registers aren't yet properly set. +To avoid this, ensure to mask the CCR_EN bit when storing the ccr value +into the mdma channel structure. + +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Signed-off-by: Alain Volmat +Signed-off-by: Amelie Delaunay +Cc: stable@vger.kernel.org +Tested-by: Alain Volmat +Link: https://lore.kernel.org/r/20231009082450.452877-1-amelie.delaunay@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/stm32-mdma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -509,7 +509,7 @@ static int stm32_mdma_set_xfer_param(str + src_maxburst = chan->dma_config.src_maxburst; + dst_maxburst = chan->dma_config.dst_maxburst; + +- ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)); ++ ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)) & ~STM32_MDMA_CCR_EN; + ctcr = stm32_mdma_read(dmadev, STM32_MDMA_CTCR(chan->id)); + ctbr = stm32_mdma_read(dmadev, STM32_MDMA_CTBR(chan->id)); + +@@ -937,7 +937,7 @@ stm32_mdma_prep_dma_memcpy(struct dma_ch + if (!desc) + return NULL; + +- ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)); ++ ccr = stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)) & ~STM32_MDMA_CCR_EN; + ctcr = stm32_mdma_read(dmadev, STM32_MDMA_CTCR(chan->id)); + ctbr = stm32_mdma_read(dmadev, STM32_MDMA_CTBR(chan->id)); + cbndtr = stm32_mdma_read(dmadev, STM32_MDMA_CBNDTR(chan->id)); diff --git a/queue-5.15/i2c-core-run-atomic-i2c-xfer-when-preemptible.patch b/queue-5.15/i2c-core-run-atomic-i2c-xfer-when-preemptible.patch new file mode 100644 index 00000000000..d15481f2061 --- /dev/null +++ b/queue-5.15/i2c-core-run-atomic-i2c-xfer-when-preemptible.patch @@ -0,0 +1,54 @@ +From aa49c90894d06e18a1ee7c095edbd2f37c232d02 Mon Sep 17 00:00:00 2001 +From: Benjamin Bara +Date: Sat, 15 Jul 2023 09:53:24 +0200 +Subject: i2c: core: Run atomic i2c xfer when !preemptible + +From: Benjamin Bara + +commit aa49c90894d06e18a1ee7c095edbd2f37c232d02 upstream. + +Since bae1d3a05a8b, i2c transfers are non-atomic if preemption is +disabled. However, non-atomic i2c transfers require preemption (e.g. in +wait_for_completion() while waiting for the DMA). + +panic() calls preempt_disable_notrace() before calling +emergency_restart(). Therefore, if an i2c device is used for the +restart, the xfer should be atomic. This avoids warnings like: + +[ 12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0 +[ 12.676926] Voluntary context switch within RCU read-side critical section! +... +[ 12.742376] schedule_timeout from wait_for_completion_timeout+0x90/0x114 +[ 12.749179] wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70 +... +[ 12.994527] atomic_notifier_call_chain from machine_restart+0x34/0x58 +[ 13.001050] machine_restart from panic+0x2a8/0x32c + +Use !preemptible() instead, which is basically the same check as +pre-v5.2. + +Fixes: bae1d3a05a8b ("i2c: core: remove use of in_atomic()") +Cc: stable@vger.kernel.org # v5.2+ +Suggested-by: Dmitry Osipenko +Acked-by: Wolfram Sang +Reviewed-by: Dmitry Osipenko +Tested-by: Nishanth Menon +Signed-off-by: Benjamin Bara +Link: https://lore.kernel.org/r/20230327-tegra-pmic-reboot-v7-2-18699d5dcd76@skidata.com +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/i2c-core.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/i2c-core.h ++++ b/drivers/i2c/i2c-core.h +@@ -29,7 +29,7 @@ int i2c_dev_irq_from_resources(const str + */ + static inline bool i2c_in_atomic_xfer_mode(void) + { +- return system_state > SYSTEM_RUNNING && irqs_disabled(); ++ return system_state > SYSTEM_RUNNING && !preemptible(); + } + + static inline int __i2c_lock_bus_helper(struct i2c_adapter *adap) diff --git a/queue-5.15/i3c-master-cdns-fix-reading-status-register.patch b/queue-5.15/i3c-master-cdns-fix-reading-status-register.patch new file mode 100644 index 00000000000..a63a442e30c --- /dev/null +++ b/queue-5.15/i3c-master-cdns-fix-reading-status-register.patch @@ -0,0 +1,49 @@ +From 4bd8405257da717cd556f99e5fb68693d12c9766 Mon Sep 17 00:00:00 2001 +From: Joshua Yeong +Date: Wed, 13 Sep 2023 11:17:45 +0800 +Subject: i3c: master: cdns: Fix reading status register + +From: Joshua Yeong + +commit 4bd8405257da717cd556f99e5fb68693d12c9766 upstream. + +IBIR_DEPTH and CMDR_DEPTH should read from status0 instead of status1. + +Cc: stable@vger.kernel.org +Fixes: 603f2bee2c54 ("i3c: master: Add driver for Cadence IP") +Signed-off-by: Joshua Yeong +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/r/20230913031743.11439-2-joshua.yeong@starfivetech.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/i3c-master-cdns.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/i3c/master/i3c-master-cdns.c ++++ b/drivers/i3c/master/i3c-master-cdns.c +@@ -192,7 +192,7 @@ + #define SLV_STATUS1_HJ_DIS BIT(18) + #define SLV_STATUS1_MR_DIS BIT(17) + #define SLV_STATUS1_PROT_ERR BIT(16) +-#define SLV_STATUS1_DA(x) (((s) & GENMASK(15, 9)) >> 9) ++#define SLV_STATUS1_DA(s) (((s) & GENMASK(15, 9)) >> 9) + #define SLV_STATUS1_HAS_DA BIT(8) + #define SLV_STATUS1_DDR_RX_FULL BIT(7) + #define SLV_STATUS1_DDR_TX_FULL BIT(6) +@@ -1624,13 +1624,13 @@ static int cdns_i3c_master_probe(struct + /* Device ID0 is reserved to describe this master. */ + master->maxdevs = CONF_STATUS0_DEVS_NUM(val); + master->free_rr_slots = GENMASK(master->maxdevs, 1); ++ master->caps.ibirfifodepth = CONF_STATUS0_IBIR_DEPTH(val); ++ master->caps.cmdrfifodepth = CONF_STATUS0_CMDR_DEPTH(val); + + val = readl(master->regs + CONF_STATUS1); + master->caps.cmdfifodepth = CONF_STATUS1_CMD_DEPTH(val); + master->caps.rxfifodepth = CONF_STATUS1_RX_DEPTH(val); + master->caps.txfifodepth = CONF_STATUS1_TX_DEPTH(val); +- master->caps.ibirfifodepth = CONF_STATUS0_IBIR_DEPTH(val); +- master->caps.cmdrfifodepth = CONF_STATUS0_CMDR_DEPTH(val); + + spin_lock_init(&master->ibi.lock); + master->ibi.num_slots = CONF_STATUS1_IBI_HW_RES(val); diff --git a/queue-5.15/i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch b/queue-5.15/i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch new file mode 100644 index 00000000000..645e58568ba --- /dev/null +++ b/queue-5.15/i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch @@ -0,0 +1,34 @@ +From 225d5ef048c4ed01a475c95d94833bd7dd61072d Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:56 -0400 +Subject: i3c: master: svc: fix check wrong status register in irq handler + +From: Frank Li + +commit 225d5ef048c4ed01a475c95d94833bd7dd61072d upstream. + +svc_i3c_master_irq_handler() wrongly checks register SVC_I3C_MINTMASKED. It +should be SVC_I3C_MSTATUS. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-5-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -438,7 +438,7 @@ reenable_ibis: + static irqreturn_t svc_i3c_master_irq_handler(int irq, void *dev_id) + { + struct svc_i3c_master *master = (struct svc_i3c_master *)dev_id; +- u32 active = readl(master->regs + SVC_I3C_MINTMASKED); ++ u32 active = readl(master->regs + SVC_I3C_MSTATUS); + + if (!SVC_I3C_MSTATUS_SLVSTART(active)) + return IRQ_NONE; diff --git a/queue-5.15/i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch b/queue-5.15/i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch new file mode 100644 index 00000000000..23314fba0c9 --- /dev/null +++ b/queue-5.15/i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch @@ -0,0 +1,52 @@ +From c85e209b799f12d18a90ae6353b997b1bb1274a5 Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:55 -0400 +Subject: i3c: master: svc: fix ibi may not return mandatory data byte + +From: Frank Li + +commit c85e209b799f12d18a90ae6353b997b1bb1274a5 upstream. + +MSTATUS[RXPEND] is only updated after the data transfer cycle started. This +creates an issue when the I3C clock is slow, and the CPU is running fast +enough that MSTATUS[RXPEND] may not be updated when the code reaches +checking point. As a result, mandatory data can be missed. + +Add a wait for MSTATUS[COMPLETE] to ensure that all mandatory data is +already in FIFO. It also works without mandatory data. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-4-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -294,6 +294,7 @@ static int svc_i3c_master_handle_ibi(str + struct i3c_ibi_slot *slot; + unsigned int count; + u32 mdatactrl; ++ int ret, val; + u8 *buf; + + slot = i3c_generic_ibi_get_free_slot(data->ibi_pool); +@@ -303,6 +304,13 @@ static int svc_i3c_master_handle_ibi(str + slot->len = 0; + buf = slot->data; + ++ ret = readl_relaxed_poll_timeout(master->regs + SVC_I3C_MSTATUS, val, ++ SVC_I3C_MSTATUS_COMPLETE(val), 0, 1000); ++ if (ret) { ++ dev_err(master->dev, "Timeout when polling for COMPLETE\n"); ++ return ret; ++ } ++ + while (SVC_I3C_MSTATUS_RXPEND(readl(master->regs + SVC_I3C_MSTATUS)) && + slot->len < SVC_I3C_FIFO_SIZE) { + mdatactrl = readl(master->regs + SVC_I3C_MDATACTRL); diff --git a/queue-5.15/i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch b/queue-5.15/i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch new file mode 100644 index 00000000000..0259ae2f1ae --- /dev/null +++ b/queue-5.15/i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch @@ -0,0 +1,115 @@ +From 6bf3fc268183816856c96b8794cd66146bc27b35 Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:53 -0400 +Subject: i3c: master: svc: fix race condition in ibi work thread + +From: Frank Li + +commit 6bf3fc268183816856c96b8794cd66146bc27b35 upstream. + +The ibi work thread operates asynchronously with other transfers, such as +svc_i3c_master_priv_xfers(). Introduce mutex protection to ensure the +completion of the entire i3c/i2c transaction. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-2-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -165,6 +165,7 @@ struct svc_i3c_xfer { + * @ibi.slots: Available IBI slots + * @ibi.tbq_slot: To be queued IBI slot + * @ibi.lock: IBI lock ++ * @lock: Transfer lock, protect between IBI work thread and callbacks from master + */ + struct svc_i3c_master { + struct i3c_master_controller base; +@@ -192,6 +193,7 @@ struct svc_i3c_master { + /* Prevent races within IBI handlers */ + spinlock_t lock; + } ibi; ++ struct mutex lock; + }; + + /** +@@ -345,6 +347,7 @@ static void svc_i3c_master_ibi_work(stru + u32 status, val; + int ret; + ++ mutex_lock(&master->lock); + /* Acknowledge the incoming interrupt with the AUTOIBI mechanism */ + writel(SVC_I3C_MCTRL_REQUEST_AUTO_IBI | + SVC_I3C_MCTRL_IBIRESP_AUTO, +@@ -421,6 +424,7 @@ static void svc_i3c_master_ibi_work(stru + + reenable_ibis: + svc_i3c_master_enable_interrupts(master, SVC_I3C_MINT_SLVSTART); ++ mutex_unlock(&master->lock); + } + + static irqreturn_t svc_i3c_master_irq_handler(int irq, void *dev_id) +@@ -1095,9 +1099,11 @@ static int svc_i3c_master_send_bdcast_cc + cmd->read_len = 0; + cmd->continued = false; + ++ mutex_lock(&master->lock); + svc_i3c_master_enqueue_xfer(master, xfer); + if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000))) + svc_i3c_master_dequeue_xfer(master, xfer); ++ mutex_unlock(&master->lock); + + ret = xfer->ret; + kfree(buf); +@@ -1141,9 +1147,11 @@ static int svc_i3c_master_send_direct_cc + cmd->read_len = read_len; + cmd->continued = false; + ++ mutex_lock(&master->lock); + svc_i3c_master_enqueue_xfer(master, xfer); + if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000))) + svc_i3c_master_dequeue_xfer(master, xfer); ++ mutex_unlock(&master->lock); + + ret = xfer->ret; + svc_i3c_master_free_xfer(xfer); +@@ -1197,9 +1205,11 @@ static int svc_i3c_master_priv_xfers(str + cmd->continued = (i + 1) < nxfers; + } + ++ mutex_lock(&master->lock); + svc_i3c_master_enqueue_xfer(master, xfer); + if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000))) + svc_i3c_master_dequeue_xfer(master, xfer); ++ mutex_unlock(&master->lock); + + ret = xfer->ret; + svc_i3c_master_free_xfer(xfer); +@@ -1235,9 +1245,11 @@ static int svc_i3c_master_i2c_xfers(stru + cmd->continued = (i + 1 < nxfers); + } + ++ mutex_lock(&master->lock); + svc_i3c_master_enqueue_xfer(master, xfer); + if (!wait_for_completion_timeout(&xfer->comp, msecs_to_jiffies(1000))) + svc_i3c_master_dequeue_xfer(master, xfer); ++ mutex_unlock(&master->lock); + + ret = xfer->ret; + svc_i3c_master_free_xfer(xfer); +@@ -1407,6 +1419,8 @@ static int svc_i3c_master_probe(struct p + + INIT_WORK(&master->hj_work, svc_i3c_master_hj_work); + INIT_WORK(&master->ibi_work, svc_i3c_master_ibi_work); ++ mutex_init(&master->lock); ++ + ret = devm_request_irq(dev, master->irq, svc_i3c_master_irq_handler, + IRQF_NO_SUSPEND, "svc-i3c-irq", master); + if (ret) diff --git a/queue-5.15/i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch b/queue-5.15/i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch new file mode 100644 index 00000000000..fcf79e934ee --- /dev/null +++ b/queue-5.15/i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch @@ -0,0 +1,34 @@ +From dfd7cd6aafdb1f5ba93828e97e56b38304b23a05 Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:57 -0400 +Subject: i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen + +From: Frank Li + +commit dfd7cd6aafdb1f5ba93828e97e56b38304b23a05 upstream. + +Upon IBIWON timeout, the SDA line will always be kept low if we don't emit +a stop. Calling svc_i3c_master_emit_stop() there will let the bus return to +idle state. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-6-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -366,6 +366,7 @@ static void svc_i3c_master_ibi_work(stru + SVC_I3C_MSTATUS_IBIWON(val), 0, 1000); + if (ret) { + dev_err(master->dev, "Timeout when polling for IBIWON\n"); ++ svc_i3c_master_emit_stop(master); + goto reenable_ibis; + } + diff --git a/queue-5.15/i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch b/queue-5.15/i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch new file mode 100644 index 00000000000..ad4f3a659da --- /dev/null +++ b/queue-5.15/i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch @@ -0,0 +1,77 @@ +From 5e5e3c92e748a6d859190e123b9193cf4911fcca Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Mon, 23 Oct 2023 12:16:54 -0400 +Subject: i3c: master: svc: fix wrong data return when IBI happen during start frame +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frank Li + +commit 5e5e3c92e748a6d859190e123b9193cf4911fcca upstream. + + ┌─────┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┏──┐ ┌───── +SCL: ┘ └─────┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┛ └──┘ + ───┐ ┌─────┐ ┌─────┐ ┌───────────┐ +SDA: └───────────────────────┘ └─────┘ └─────┘ └───── + xxx╱ ╲╱ ╲╱ ╲╱ ╲╱ ╲ + : xxx╲IBI ╱╲ Addr(0x0a) ╱╲ RW ╱╲NACK╱╲ S ╱ + +If an In-Band Interrupt (IBI) occurs and IBI work thread is not immediately +scheduled, when svc_i3c_master_priv_xfers() initiates the I3C transfer and +attempts to send address 0x7e, the target interprets it as an +IBI handler and returns the target address 0x0a. + +However, svc_i3c_master_priv_xfers() does not handle this case and proceeds +with other transfers, resulting in incorrect data being returned. + +Add IBIWON check in svc_i3c_master_xfer(). In case this situation occurs, +return a failure to the driver. + +Fixes: dd3c52846d59 ("i3c: master: svc: Add Silvaco I3C master driver") +Cc: +Reviewed-by: Miquel Raynal +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20231023161658.3890811-3-Frank.Li@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master/svc-i3c-master.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -930,6 +930,9 @@ static int svc_i3c_master_xfer(struct sv + u32 reg; + int ret; + ++ /* clean SVC_I3C_MINT_IBIWON w1c bits */ ++ writel(SVC_I3C_MINT_IBIWON, master->regs + SVC_I3C_MSTATUS); ++ + writel(SVC_I3C_MCTRL_REQUEST_START_ADDR | + xfer_type | + SVC_I3C_MCTRL_IBIRESP_NACK | +@@ -943,6 +946,23 @@ static int svc_i3c_master_xfer(struct sv + if (ret) + goto emit_stop; + ++ /* ++ * According to I3C spec ver 1.1.1, 5.1.2.2.3 Consequence of Controller Starting a Frame ++ * with I3C Target Address. ++ * ++ * The I3C Controller normally should start a Frame, the Address may be arbitrated, and so ++ * the Controller shall monitor to see whether an In-Band Interrupt request, a Controller ++ * Role Request (i.e., Secondary Controller requests to become the Active Controller), or ++ * a Hot-Join Request has been made. ++ * ++ * If missed IBIWON check, the wrong data will be return. When IBIWON happen, return failure ++ * and yield the above events handler. ++ */ ++ if (SVC_I3C_MSTATUS_IBIWON(reg)) { ++ ret = -ENXIO; ++ goto emit_stop; ++ } ++ + if (rnw) + ret = svc_i3c_master_read(master, in, xfer_len); + else diff --git a/queue-5.15/jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch b/queue-5.15/jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch new file mode 100644 index 00000000000..5895327fbcd --- /dev/null +++ b/queue-5.15/jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch @@ -0,0 +1,94 @@ +From 61187fce8600e8ef90e601be84f9d0f3222c1206 Mon Sep 17 00:00:00 2001 +From: Zhihao Cheng +Date: Tue, 19 Sep 2023 09:25:25 +0800 +Subject: jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev + +From: Zhihao Cheng + +commit 61187fce8600e8ef90e601be84f9d0f3222c1206 upstream. + +JBD2 makes sure journal data is fallen on fs device by sync_blockdev(), +however, other process could intercept the EIO information from bdev's +mapping, which leads journal recovering successful even EIO occurs during +data written back to fs device. + +We found this problem in our product, iscsi + multipath is chosen for block +device of ext4. Unstable network may trigger kpartx to rescan partitions in +device mapper layer. Detailed process is shown as following: + + mount kpartx irq +jbd2_journal_recover + do_one_pass + memcpy(nbh->b_data, obh->b_data) // copy data to fs dev from journal + mark_buffer_dirty // mark bh dirty + vfs_read + generic_file_read_iter // dio + filemap_write_and_wait_range + __filemap_fdatawrite_range + do_writepages + block_write_full_folio + submit_bh_wbc + >> EIO occurs in disk << + end_buffer_async_write + mark_buffer_write_io_error + mapping_set_error + set_bit(AS_EIO, &mapping->flags) // set! + filemap_check_errors + test_and_clear_bit(AS_EIO, &mapping->flags) // clear! + err2 = sync_blockdev + filemap_write_and_wait + filemap_check_errors + test_and_clear_bit(AS_EIO, &mapping->flags) // false + err2 = 0 + +Filesystem is mounted successfully even data from journal is failed written +into disk, and ext4/ocfs2 could become corrupted. + +Fix it by comparing the wb_err state in fs block device before recovering +and after recovering. + +A reproducer can be found in the kernel bugzilla referenced below. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217888 +Cc: stable@vger.kernel.org +Signed-off-by: Zhihao Cheng +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230919012525.1783108-1-chengzhihao1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/jbd2/recovery.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/fs/jbd2/recovery.c ++++ b/fs/jbd2/recovery.c +@@ -283,6 +283,8 @@ int jbd2_journal_recover(journal_t *jour + journal_superblock_t * sb; + + struct recovery_info info; ++ errseq_t wb_err; ++ struct address_space *mapping; + + memset(&info, 0, sizeof(info)); + sb = journal->j_superblock; +@@ -300,6 +302,9 @@ int jbd2_journal_recover(journal_t *jour + return 0; + } + ++ wb_err = 0; ++ mapping = journal->j_fs_dev->bd_inode->i_mapping; ++ errseq_check_and_advance(&mapping->wb_err, &wb_err); + err = do_one_pass(journal, &info, PASS_SCAN); + if (!err) + err = do_one_pass(journal, &info, PASS_REVOKE); +@@ -320,6 +325,9 @@ int jbd2_journal_recover(journal_t *jour + err2 = sync_blockdev(journal->j_fs_dev); + if (!err) + err = err2; ++ err2 = errseq_check_and_advance(&mapping->wb_err, &wb_err); ++ if (!err) ++ err = err2; + /* Make sure all replayed data is on permanent storage */ + if (journal->j_flags & JBD2_BARRIER) { + err2 = blkdev_issue_flush(journal->j_fs_dev); diff --git a/queue-5.15/kernel-reboot-emergency_restart-set-correct-system_state.patch b/queue-5.15/kernel-reboot-emergency_restart-set-correct-system_state.patch new file mode 100644 index 00000000000..43ffc7f5c87 --- /dev/null +++ b/queue-5.15/kernel-reboot-emergency_restart-set-correct-system_state.patch @@ -0,0 +1,49 @@ +From 60466c067927abbcaff299845abd4b7069963139 Mon Sep 17 00:00:00 2001 +From: Benjamin Bara +Date: Sat, 15 Jul 2023 09:53:23 +0200 +Subject: kernel/reboot: emergency_restart: Set correct system_state + +From: Benjamin Bara + +commit 60466c067927abbcaff299845abd4b7069963139 upstream. + +As the emergency restart does not call kernel_restart_prepare(), the +system_state stays in SYSTEM_RUNNING. + +Since bae1d3a05a8b, this hinders i2c_in_atomic_xfer_mode() from becoming +active, and therefore might lead to avoidable warnings in the restart +handlers, e.g.: + +[ 12.667612] WARNING: CPU: 1 PID: 1 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x33c/0x6b0 +[ 12.676926] Voluntary context switch within RCU read-side critical section! +... +[ 12.742376] schedule_timeout from wait_for_completion_timeout+0x90/0x114 +[ 12.749179] wait_for_completion_timeout from tegra_i2c_wait_completion+0x40/0x70 +... +[ 12.994527] atomic_notifier_call_chain from machine_restart+0x34/0x58 +[ 13.001050] machine_restart from panic+0x2a8/0x32c + +Avoid these by setting the correct system_state. + +Fixes: bae1d3a05a8b ("i2c: core: remove use of in_atomic()") +Cc: stable@vger.kernel.org # v5.2+ +Reviewed-by: Dmitry Osipenko +Tested-by: Nishanth Menon +Signed-off-by: Benjamin Bara +Link: https://lore.kernel.org/r/20230327-tegra-pmic-reboot-v7-1-18699d5dcd76@skidata.com +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + kernel/reboot.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/reboot.c ++++ b/kernel/reboot.c +@@ -65,6 +65,7 @@ EXPORT_SYMBOL_GPL(pm_power_off_prepare); + void emergency_restart(void) + { + kmsg_dump(KMSG_DUMP_EMERG); ++ system_state = SYSTEM_RESTART; + machine_emergency_restart(); + } + EXPORT_SYMBOL_GPL(emergency_restart); diff --git a/queue-5.15/mcb-fix-error-handling-for-different-scenarios-when-parsing.patch b/queue-5.15/mcb-fix-error-handling-for-different-scenarios-when-parsing.patch new file mode 100644 index 00000000000..65f8839e14f --- /dev/null +++ b/queue-5.15/mcb-fix-error-handling-for-different-scenarios-when-parsing.patch @@ -0,0 +1,49 @@ +From 63ba2d07b4be72b94216d20561f43e1150b25d98 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sanju=C3=A1n=20Garc=C3=ADa=2C=20Jorge?= + +Date: Thu, 19 Oct 2023 14:15:34 +0000 +Subject: mcb: fix error handling for different scenarios when parsing + +From: Sanjuán García, Jorge + +commit 63ba2d07b4be72b94216d20561f43e1150b25d98 upstream. + +chameleon_parse_gdd() may fail for different reasons and end up +in the err tag. Make sure we at least always free the mcb_device +allocated with mcb_alloc_dev(). + +If mcb_device_register() fails, make sure to give up the reference +in the same place the device was added. + +Fixes: 728ac3389296 ("mcb: mcb-parse: fix error handing in chameleon_parse_gdd()") +Cc: stable +Reviewed-by: Jose Javier Rodriguez Barbarin +Signed-off-by: Jorge Sanjuan Garcia +Link: https://lore.kernel.org/r/20231019141434.57971-2-jorge.sanjuangarcia@duagon.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mcb/mcb-core.c | 1 + + drivers/mcb/mcb-parse.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mcb/mcb-core.c ++++ b/drivers/mcb/mcb-core.c +@@ -246,6 +246,7 @@ int mcb_device_register(struct mcb_bus * + return 0; + + out: ++ put_device(&dev->dev); + + return ret; + } +--- a/drivers/mcb/mcb-parse.c ++++ b/drivers/mcb/mcb-parse.c +@@ -106,7 +106,7 @@ static int chameleon_parse_gdd(struct mc + return 0; + + err: +- put_device(&mdev->dev); ++ mcb_free_dev(mdev); + + return ret; + } diff --git a/queue-5.15/mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch b/queue-5.15/mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch new file mode 100644 index 00000000000..db2906d2165 --- /dev/null +++ b/queue-5.15/mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch @@ -0,0 +1,59 @@ +From 2e7cfe5cd5b6b0b98abf57a3074885979e187c1c Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Wed, 13 Sep 2023 16:12:44 -0400 +Subject: mm/cma: use nth_page() in place of direct struct page manipulation + +From: Zi Yan + +commit 2e7cfe5cd5b6b0b98abf57a3074885979e187c1c upstream. + +Patch series "Use nth_page() in place of direct struct page manipulation", +v3. + +On SPARSEMEM without VMEMMAP, struct page is not guaranteed to be +contiguous, since each memory section's memmap might be allocated +independently. hugetlb pages can go beyond a memory section size, thus +direct struct page manipulation on hugetlb pages/subpages might give wrong +struct page. Kernel provides nth_page() to do the manipulation properly. +Use that whenever code can see hugetlb pages. + + +This patch (of 5): + +When dealing with hugetlb pages, manipulating struct page pointers +directly can get to wrong struct page, since struct page is not guaranteed +to be contiguous on SPARSEMEM without VMEMMAP. Use nth_page() to handle +it properly. + +Without the fix, page_kasan_tag_reset() could reset wrong page tags, +causing a wrong kasan result. No related bug is reported. The fix +comes from code inspection. + +Link: https://lkml.kernel.org/r/20230913201248.452081-1-zi.yan@sent.com +Link: https://lkml.kernel.org/r/20230913201248.452081-2-zi.yan@sent.com +Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc") +Signed-off-by: Zi Yan +Reviewed-by: Muchun Song +Cc: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: Mike Kravetz +Cc: Mike Rapoport (IBM) +Cc: Thomas Bogendoerfer +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/cma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/cma.c ++++ b/mm/cma.c +@@ -503,7 +503,7 @@ struct page *cma_alloc(struct cma *cma, + */ + if (page) { + for (i = 0; i < count; i++) +- page_kasan_tag_reset(page + i); ++ page_kasan_tag_reset(nth_page(page, i)); + } + + if (ret && !no_warn) { diff --git a/queue-5.15/mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch b/queue-5.15/mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch new file mode 100644 index 00000000000..0124153d3c6 --- /dev/null +++ b/queue-5.15/mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch @@ -0,0 +1,46 @@ +From 1640a0ef80f6d572725f5b0330038c18e98ea168 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Wed, 13 Sep 2023 16:12:46 -0400 +Subject: mm/memory_hotplug: use pfn math in place of direct struct page manipulation + +From: Zi Yan + +commit 1640a0ef80f6d572725f5b0330038c18e98ea168 upstream. + +When dealing with hugetlb pages, manipulating struct page pointers +directly can get to wrong struct page, since struct page is not guaranteed +to be contiguous on SPARSEMEM without VMEMMAP. Use pfn calculation to +handle it properly. + +Without the fix, a wrong number of page might be skipped. Since skip cannot be +negative, scan_movable_page() will end early and might miss a movable page with +-ENOENT. This might fail offline_pages(). No bug is reported. The fix comes +from code inspection. + +Link: https://lkml.kernel.org/r/20230913201248.452081-4-zi.yan@sent.com +Fixes: eeb0efd071d8 ("mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages") +Signed-off-by: Zi Yan +Reviewed-by: Muchun Song +Acked-by: David Hildenbrand +Cc: Matthew Wilcox (Oracle) +Cc: Mike Kravetz +Cc: Mike Rapoport (IBM) +Cc: Thomas Bogendoerfer +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory_hotplug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1677,7 +1677,7 @@ static int scan_movable_pages(unsigned l + */ + if (HPageMigratable(head)) + goto found; +- skip = compound_nr(head) - (page - head); ++ skip = compound_nr(head) - (pfn - page_to_pfn(head)); + pfn += skip - 1; + } + return -ENOENT; diff --git a/queue-5.15/mtd-cfi_cmdset_0001-byte-swap-otp-info.patch b/queue-5.15/mtd-cfi_cmdset_0001-byte-swap-otp-info.patch new file mode 100644 index 00000000000..a95fe44f8ae --- /dev/null +++ b/queue-5.15/mtd-cfi_cmdset_0001-byte-swap-otp-info.patch @@ -0,0 +1,75 @@ +From 565fe150624ee77dc63a735cc1b3bff5101f38a3 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Fri, 20 Oct 2023 22:30:29 +0200 +Subject: mtd: cfi_cmdset_0001: Byte swap OTP info + +From: Linus Walleij + +commit 565fe150624ee77dc63a735cc1b3bff5101f38a3 upstream. + +Currently the offset into the device when looking for OTP +bits can go outside of the address of the MTD NOR devices, +and if that memory isn't readable, bad things happen +on the IXP4xx (added prints that illustrate the problem before +the crash): + +cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100 +ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78 +cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000 +ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78 +8<--- cut here --- +Unable to handle kernel paging request at virtual address db000000 +[db000000] *pgd=00000000 +(...) + +This happens in this case because the IXP4xx is big endian and +the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not +properly byteswapped. Compare to how the code in read_pri_intelext() +byteswaps the fields in struct cfi_pri_intelext. + +Adding a small byte swapping loop for the OTP in read_pri_intelext() +and the crash goes away. + +The problem went unnoticed for many years until I enabled +CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug. + +Cc: stable@vger.kernel.org +Reviewed-by: Nicolas Pitre +Signed-off-by: Linus Walleij +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20231020-mtd-otp-byteswap-v4-1-0d132c06aa9d@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/chips/cfi_cmdset_0001.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0001.c ++++ b/drivers/mtd/chips/cfi_cmdset_0001.c +@@ -421,9 +421,25 @@ read_pri_intelext(struct map_info *map, + extra_size = 0; + + /* Protection Register info */ +- if (extp->NumProtectionFields) ++ if (extp->NumProtectionFields) { ++ struct cfi_intelext_otpinfo *otp = ++ (struct cfi_intelext_otpinfo *)&extp->extra[0]; ++ + extra_size += (extp->NumProtectionFields - 1) * +- sizeof(struct cfi_intelext_otpinfo); ++ sizeof(struct cfi_intelext_otpinfo); ++ ++ if (extp_size >= sizeof(*extp) + extra_size) { ++ int i; ++ ++ /* Do some byteswapping if necessary */ ++ for (i = 0; i < extp->NumProtectionFields - 1; i++) { ++ otp->ProtRegAddr = le32_to_cpu(otp->ProtRegAddr); ++ otp->FactGroups = le16_to_cpu(otp->FactGroups); ++ otp->UserGroups = le16_to_cpu(otp->UserGroups); ++ otp++; ++ } ++ } ++ } + } + + if (extp->MinorVersion >= '1') { diff --git a/queue-5.15/quota-explicitly-forbid-quota-files-from-being-encrypted.patch b/queue-5.15/quota-explicitly-forbid-quota-files-from-being-encrypted.patch new file mode 100644 index 00000000000..a2caacb5840 --- /dev/null +++ b/queue-5.15/quota-explicitly-forbid-quota-files-from-being-encrypted.patch @@ -0,0 +1,64 @@ +From d3cc1b0be258191d6360c82ea158c2972f8d3991 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 4 Sep 2023 17:32:27 -0700 +Subject: quota: explicitly forbid quota files from being encrypted + +From: Eric Biggers + +commit d3cc1b0be258191d6360c82ea158c2972f8d3991 upstream. + +Since commit d7e7b9af104c ("fscrypt: stop using keyrings subsystem for +fscrypt_master_key"), xfstest generic/270 causes a WARNING when run on +f2fs with test_dummy_encryption in the mount options: + +$ kvm-xfstests -c f2fs/encrypt generic/270 +[...] +WARNING: CPU: 1 PID: 2453 at fs/crypto/keyring.c:240 fscrypt_destroy_keyring+0x1f5/0x260 + +The cause of the WARNING is that not all encrypted inodes have been +evicted before fscrypt_destroy_keyring() is called, which violates an +assumption. This happens because the test uses an external quota file, +which gets automatically encrypted due to test_dummy_encryption. + +Encryption of quota files has never really been supported. On ext4, +ext4_quota_read() does not decrypt the data, so encrypted quota files +are always considered invalid on ext4. On f2fs, f2fs_quota_read() uses +the pagecache, so trying to use an encrypted quota file gets farther, +resulting in the issue described above being possible. But this was +never intended to be possible, and there is no use case for it. + +Therefore, make the quota support layer explicitly reject using +IS_ENCRYPTED inodes when quotaon is attempted. + +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Jan Kara +Message-Id: <20230905003227.326998-1-ebiggers@kernel.org> +Signed-off-by: Greg Kroah-Hartman +--- + fs/quota/dquot.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -2396,6 +2396,20 @@ static int vfs_setup_quota_inode(struct + if (sb_has_quota_loaded(sb, type)) + return -EBUSY; + ++ /* ++ * Quota files should never be encrypted. They should be thought of as ++ * filesystem metadata, not user data. New-style internal quota files ++ * cannot be encrypted by users anyway, but old-style external quota ++ * files could potentially be incorrectly created in an encrypted ++ * directory, hence this explicit check. Some reasons why encrypted ++ * quota files don't work include: (1) some filesystems that support ++ * encryption don't handle it in their quota_read and quota_write, and ++ * (2) cleaning up encrypted quota files at unmount would need special ++ * consideration, as quota files are cleaned up later than user files. ++ */ ++ if (IS_ENCRYPTED(inode)) ++ return -EINVAL; ++ + dqopt->files[type] = igrab(inode); + if (!dqopt->files[type]) + return -EIO; diff --git a/queue-5.15/s390-cmma-fix-detection-of-dat-pages.patch b/queue-5.15/s390-cmma-fix-detection-of-dat-pages.patch new file mode 100644 index 00000000000..e686adb3a17 --- /dev/null +++ b/queue-5.15/s390-cmma-fix-detection-of-dat-pages.patch @@ -0,0 +1,62 @@ +From 44d93045247661acbd50b1629e62f415f2747577 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 24 Oct 2023 10:15:19 +0200 +Subject: s390/cmma: fix detection of DAT pages + +From: Heiko Carstens + +commit 44d93045247661acbd50b1629e62f415f2747577 upstream. + +If the cmma no-dat feature is available the kernel page tables are walked +to identify and mark all pages which are used for address translation (all +region, segment, and page tables). In a subsequent loop all other pages are +marked as "no-dat" pages with the ESSA instruction. + +This information is visible to the hypervisor, so that the hypervisor can +optimize purging of guest TLB entries. The initial loop however is +incorrect: only the first three of the four pages which belong to segment +and region tables will be marked as being used for DAT. The last page is +incorrectly marked as no-dat. + +This can result in incorrect guest TLB flushes. + +Fix this by simply marking all four pages. + +Cc: +Reviewed-by: Claudio Imbrenda +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/page-states.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -131,7 +131,7 @@ static void mark_kernel_pud(p4d_t *p4d, + continue; + if (!pud_folded(*pud)) { + page = phys_to_page(pud_val(*pud)); +- for (i = 0; i < 3; i++) ++ for (i = 0; i < 4; i++) + set_bit(PG_arch_1, &page[i].flags); + } + mark_kernel_pmd(pud, addr, next); +@@ -152,7 +152,7 @@ static void mark_kernel_p4d(pgd_t *pgd, + continue; + if (!p4d_folded(*p4d)) { + page = phys_to_page(p4d_val(*p4d)); +- for (i = 0; i < 3; i++) ++ for (i = 0; i < 4; i++) + set_bit(PG_arch_1, &page[i].flags); + } + mark_kernel_pud(p4d, addr, next); +@@ -181,7 +181,7 @@ static void mark_kernel_pgd(void) + continue; + if (!pgd_folded(*pgd)) { + page = phys_to_page(pgd_val(*pgd)); +- for (i = 0; i < 3; i++) ++ for (i = 0; i < 4; i++) + set_bit(PG_arch_1, &page[i].flags); + } + mark_kernel_p4d(pgd, addr, next); diff --git a/queue-5.15/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch b/queue-5.15/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch new file mode 100644 index 00000000000..bb35d3989f4 --- /dev/null +++ b/queue-5.15/s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch @@ -0,0 +1,45 @@ +From 84bb41d5df48868055d159d9247b80927f1f70f9 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 24 Oct 2023 10:15:20 +0200 +Subject: s390/cmma: fix handling of swapper_pg_dir and invalid_pg_dir + +From: Heiko Carstens + +commit 84bb41d5df48868055d159d9247b80927f1f70f9 upstream. + +If the cmma no-dat feature is available the kernel page tables are walked +to identify and mark all pages which are used for address translation (all +region, segment, and page tables). In a subsequent loop all other pages are +marked as "no-dat" pages with the ESSA instruction. + +This information is visible to the hypervisor, so that the hypervisor can +optimize purging of guest TLB entries. All pages used for swapper_pg_dir +and invalid_pg_dir are incorrectly marked as no-dat, which in turn can +result in incorrect guest TLB flushes. + +Fix this by marking those pages correctly as being used for DAT. + +Cc: +Reviewed-by: Claudio Imbrenda +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/page-states.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -198,6 +198,12 @@ void __init cmma_init_nodat(void) + return; + /* Mark pages used in kernel page tables */ + mark_kernel_pgd(); ++ page = virt_to_page(&swapper_pg_dir); ++ for (i = 0; i < 4; i++) ++ set_bit(PG_arch_1, &page[i].flags); ++ page = virt_to_page(&invalid_pg_dir); ++ for (i = 0; i < 4; i++) ++ set_bit(PG_arch_1, &page[i].flags); + + /* Set all kernel pages not used for page tables to stable/no-dat */ + for_each_mem_pfn_range(i, MAX_NUMNODES, &start, &end, NULL) { diff --git a/queue-5.15/s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch b/queue-5.15/s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch new file mode 100644 index 00000000000..0b07e751946 --- /dev/null +++ b/queue-5.15/s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch @@ -0,0 +1,69 @@ +From 16ba44826a04834d3eeeda4b731c2ea3481062b7 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Tue, 17 Oct 2023 21:07:03 +0200 +Subject: s390/cmma: fix initial kernel address space page table walk + +From: Heiko Carstens + +commit 16ba44826a04834d3eeeda4b731c2ea3481062b7 upstream. + +If the cmma no-dat feature is available the kernel page tables are walked +to identify and mark all pages which are used for address translation (all +region, segment, and page tables). In a subsequent loop all other pages are +marked as "no-dat" pages with the ESSA instruction. + +This information is visible to the hypervisor, so that the hypervisor can +optimize purging of guest TLB entries. The initial loop however does not +cover the complete kernel address space. This can result in pages being +marked as not being used for dynamic address translation, even though they +are. In turn guest TLB entries incorrectly may not be purged. + +Fix this by adjusting the end address of the kernel address range being +walked. + +Cc: +Reviewed-by: Claudio Imbrenda +Reviewed-by: Alexander Gordeev +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/page-states.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/arch/s390/mm/page-states.c ++++ b/arch/s390/mm/page-states.c +@@ -161,15 +161,22 @@ static void mark_kernel_p4d(pgd_t *pgd, + + static void mark_kernel_pgd(void) + { +- unsigned long addr, next; ++ unsigned long addr, next, max_addr; + struct page *page; + pgd_t *pgd; + int i; + + addr = 0; ++ /* ++ * Figure out maximum virtual address accessible with the ++ * kernel ASCE. This is required to keep the page table walker ++ * from accessing non-existent entries. ++ */ ++ max_addr = (S390_lowcore.kernel_asce.val & _ASCE_TYPE_MASK) >> 2; ++ max_addr = 1UL << (max_addr * 11 + 31); + pgd = pgd_offset_k(addr); + do { +- next = pgd_addr_end(addr, MODULES_END); ++ next = pgd_addr_end(addr, max_addr); + if (pgd_none(*pgd)) + continue; + if (!pgd_folded(*pgd)) { +@@ -178,7 +185,7 @@ static void mark_kernel_pgd(void) + set_bit(PG_arch_1, &page[i].flags); + } + mark_kernel_p4d(pgd, addr, next); +- } while (pgd++, addr = next, addr != MODULES_END); ++ } while (pgd++, addr = next, addr != max_addr); + } + + void __init cmma_init_nodat(void) diff --git a/queue-5.15/selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch b/queue-5.15/selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch new file mode 100644 index 00000000000..4804c714695 --- /dev/null +++ b/queue-5.15/selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch @@ -0,0 +1,67 @@ +From ef43c30858754d99373a63dff33280a9969b49bc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 2 Oct 2023 12:48:13 +0300 +Subject: selftests/resctrl: Reduce failures due to outliers in MBA/MBM tests +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit ef43c30858754d99373a63dff33280a9969b49bc upstream. + +The initial value of 5% chosen for the maximum allowed percentage +difference between resctrl mbm value and IMC mbm value in + +commit 06bd03a57f8c ("selftests/resctrl: Fix MBA/MBM results reporting + format") was "randomly chosen value" (as admitted by the changelog). + +When running tests in our lab across a large number platforms, 5% +difference upper bound for success seems a bit on the low side for the +MBA and MBM tests. Some platforms produce outliers that are slightly +above that, typically 6-7%, which leads MBA/MBM test frequently +failing. + +Replace the "randomly chosen value" with a success bound that is based +on those measurements across large number of platforms by relaxing the +MBA/MBM success bound to 8%. The relaxed bound removes the failures due +the frequent outliers. + +Fixed commit description style error during merge: +Shuah Khan + +Fixes: 06bd03a57f8c ("selftests/resctrl: Fix MBA/MBM results reporting format") +Signed-off-by: Ilpo Järvinen +Tested-by: Shaopeng Tan +Reviewed-by: Reinette Chatre +Reviewed-by: Shaopeng Tan +Cc: +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/resctrl/mba_test.c | 2 +- + tools/testing/selftests/resctrl/mbm_test.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/resctrl/mba_test.c ++++ b/tools/testing/selftests/resctrl/mba_test.c +@@ -12,7 +12,7 @@ + + #define RESULT_FILE_NAME "result_mba" + #define NUM_OF_RUNS 5 +-#define MAX_DIFF_PERCENT 5 ++#define MAX_DIFF_PERCENT 8 + #define ALLOCATION_MAX 100 + #define ALLOCATION_MIN 10 + #define ALLOCATION_STEP 10 +--- a/tools/testing/selftests/resctrl/mbm_test.c ++++ b/tools/testing/selftests/resctrl/mbm_test.c +@@ -11,7 +11,7 @@ + #include "resctrl.h" + + #define RESULT_FILE_NAME "result_mbm" +-#define MAX_DIFF_PERCENT 5 ++#define MAX_DIFF_PERCENT 8 + #define NUM_OF_RUNS 5 + + static int diff --git a/queue-5.15/selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch b/queue-5.15/selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch new file mode 100644 index 00000000000..bb5d72ace97 --- /dev/null +++ b/queue-5.15/selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch @@ -0,0 +1,41 @@ +From 030b48fb2cf045dead8ee2c5ead560930044c029 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Mon, 2 Oct 2023 12:48:09 +0300 +Subject: selftests/resctrl: Remove duplicate feature check from CMT test +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit 030b48fb2cf045dead8ee2c5ead560930044c029 upstream. + +The test runner run_cmt_test() in resctrl_tests.c checks for CMT +feature and does not run cmt_resctrl_val() if CMT is not supported. +Then cmt_resctrl_val() also check is CMT is supported. + +Remove the duplicated feature check for CMT from cmt_resctrl_val(). + +Signed-off-by: Ilpo Järvinen +Tested-by: Shaopeng Tan +Reviewed-by: Reinette Chatre +Reviewed-by: Shaopeng Tan +Cc: +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/resctrl/cmt_test.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/tools/testing/selftests/resctrl/cmt_test.c ++++ b/tools/testing/selftests/resctrl/cmt_test.c +@@ -91,9 +91,6 @@ int cmt_resctrl_val(int cpu_no, int n, c + if (ret) + return ret; + +- if (!validate_resctrl_feature_request(CMT_STR)) +- return -1; +- + ret = get_cbm_mask("L3", cbm_mask); + if (ret) + return ret; diff --git a/queue-5.15/series b/queue-5.15/series index b8dfaf91e04..c0ef5c42e23 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -211,3 +211,25 @@ pci-keystone-don-t-discard-.remove-callback.patch pci-keystone-don-t-discard-.probe-callback.patch netfilter-nf_tables-remove-catchall-element-in-gc-sy.patch netfilter-nf_tables-split-async-and-sync-catchall-in.patch +selftests-resctrl-remove-duplicate-feature-check-from-cmt-test.patch +selftests-resctrl-reduce-failures-due-to-outliers-in-mba-mbm-tests.patch +asoc-codecs-wsa-macro-fix-uninitialized-stack-variables-with-name-prefix.patch +jbd2-fix-potential-data-lost-in-recovering-journal-raced-with-synchronizing-fs-bdev.patch +quota-explicitly-forbid-quota-files-from-being-encrypted.patch +kernel-reboot-emergency_restart-set-correct-system_state.patch +i2c-core-run-atomic-i2c-xfer-when-preemptible.patch +tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch +mcb-fix-error-handling-for-different-scenarios-when-parsing.patch +dmaengine-stm32-mdma-correct-desc-prep-when-channel-running.patch +s390-cmma-fix-initial-kernel-address-space-page-table-walk.patch +s390-cmma-fix-detection-of-dat-pages.patch +s390-cmma-fix-handling-of-swapper_pg_dir-and-invalid_pg_dir.patch +mm-cma-use-nth_page-in-place-of-direct-struct-page-manipulation.patch +mm-memory_hotplug-use-pfn-math-in-place-of-direct-struct-page-manipulation.patch +mtd-cfi_cmdset_0001-byte-swap-otp-info.patch +i3c-master-cdns-fix-reading-status-register.patch +i3c-master-svc-fix-race-condition-in-ibi-work-thread.patch +i3c-master-svc-fix-wrong-data-return-when-ibi-happen-during-start-frame.patch +i3c-master-svc-fix-ibi-may-not-return-mandatory-data-byte.patch +i3c-master-svc-fix-check-wrong-status-register-in-irq-handler.patch +i3c-master-svc-fix-sda-keep-low-when-polling-ibiwon-timeout-happen.patch diff --git a/queue-5.15/tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch b/queue-5.15/tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch new file mode 100644 index 00000000000..b946bacfba4 --- /dev/null +++ b/queue-5.15/tracing-have-the-user-copy-of-synthetic-event-address-use-correct-context.patch @@ -0,0 +1,47 @@ +From 4f7969bcd6d33042d62e249b41b5578161e4c868 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Google)" +Date: Tue, 31 Oct 2023 15:10:33 -0400 +Subject: tracing: Have the user copy of synthetic event address use correct context + +From: Steven Rostedt (Google) + +commit 4f7969bcd6d33042d62e249b41b5578161e4c868 upstream. + +A synthetic event is created by the synthetic event interface that can +read both user or kernel address memory. In reality, it reads any +arbitrary memory location from within the kernel. If the address space is +in USER (where CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE is set) then +it uses strncpy_from_user_nofault() to copy strings otherwise it uses +strncpy_from_kernel_nofault(). + +But since both functions use the same variable there's no annotation to +what that variable is (ie. __user). This makes sparse complain. + +Quiet sparse by typecasting the strncpy_from_user_nofault() variable to +a __user pointer. + +Link: https://lore.kernel.org/linux-trace-kernel/20231031151033.73c42e23@gandalf.local.home + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Fixes: 0934ae9977c2 ("tracing: Fix reading strings from synthetic events"); +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202311010013.fm8WTxa5-lkp@intel.com/ +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace_events_synth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace_events_synth.c ++++ b/kernel/trace/trace_events_synth.c +@@ -454,7 +454,7 @@ static unsigned int trace_string(struct + + #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE + if ((unsigned long)str_val < TASK_SIZE) +- ret = strncpy_from_user_nofault(str_field, str_val, STR_VAR_LEN_MAX); ++ ret = strncpy_from_user_nofault(str_field, (const void __user *)str_val, STR_VAR_LEN_MAX); + else + #endif + ret = strncpy_from_kernel_nofault(str_field, str_val, STR_VAR_LEN_MAX);