From: Greg Kroah-Hartman Date: Mon, 8 Apr 2024 08:44:32 +0000 (+0200) Subject: 6.8-stable patches X-Git-Tag: v5.15.154~54 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8703627ef8941f6d2b564bcf020aaea66f02cf07;p=thirdparty%2Fkernel%2Fstable-queue.git 6.8-stable patches added patches: alsa-hda-add-pplcllpl-u-members-to-hdac_ext_stream.patch alsa-hda-realtek-add-sound-quirks-for-lenovo-legion-slim-7-16arha7-models.patch alsa-hda-realtek-cs35l41-support-asus-rog-g634jyr.patch alsa-hda-realtek-fix-inactive-headset-mic-jack.patch alsa-hda-realtek-update-panasonic-cf-sz6-quirk-to-support-headset-with-microphone.patch gpio-cdev-check-for-null-labels-when-sanitizing-them-for-irqs.patch gpio-cdev-fix-missed-label-sanitizing-in-debounce_setup.patch ksmbd-do-not-set-smb2_global_cap_encryption-for-smb-3.1.1.patch ksmbd-don-t-send-oplock-break-if-rename-fails.patch ksmbd-validate-payload-size-in-ipc-response.patch revert-drm-amd-display-send-dtbclk-disable-message-on-first-commit.patch --- diff --git a/queue-6.8/alsa-hda-add-pplcllpl-u-members-to-hdac_ext_stream.patch b/queue-6.8/alsa-hda-add-pplcllpl-u-members-to-hdac_ext_stream.patch new file mode 100644 index 00000000000..b6a78c413d8 --- /dev/null +++ b/queue-6.8/alsa-hda-add-pplcllpl-u-members-to-hdac_ext_stream.patch @@ -0,0 +1,45 @@ +From f9eeb6bb13fb5d7af1ea5b74a10b1f8ead962540 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Thu, 21 Mar 2024 15:08:13 +0200 +Subject: ALSA: hda: Add pplcllpl/u members to hdac_ext_stream + +From: Peter Ujfalusi + +commit f9eeb6bb13fb5d7af1ea5b74a10b1f8ead962540 upstream. + +The pplcllpl/u can be used to save the Link Connection Linear Link +Position register value to be used for compensation of the LLP register +value in case the counter is not reset (after pause/resume or +stop/start without closing the stream). + +The LLP can be used along with PPHCLDP to calculate delay caused by the DSP +processing for HDA links. + +Cc: stable@vger.kernel.org # 6.8 +Signed-off-by: Peter Ujfalusi +Reviewed-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Link: https://msgid.link/r/20240321130814.4412-17-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + include/sound/hdaudio_ext.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/sound/hdaudio_ext.h b/include/sound/hdaudio_ext.h +index a8bebac1e4b2..957295364a5e 100644 +--- a/include/sound/hdaudio_ext.h ++++ b/include/sound/hdaudio_ext.h +@@ -56,6 +56,9 @@ struct hdac_ext_stream { + u32 pphcldpl; + u32 pphcldpu; + ++ u32 pplcllpl; ++ u32 pplcllpu; ++ + bool decoupled:1; + bool link_locked:1; + bool link_prepared; +-- +2.44.0 + diff --git a/queue-6.8/alsa-hda-realtek-add-sound-quirks-for-lenovo-legion-slim-7-16arha7-models.patch b/queue-6.8/alsa-hda-realtek-add-sound-quirks-for-lenovo-legion-slim-7-16arha7-models.patch new file mode 100644 index 00000000000..1bbeb1df913 --- /dev/null +++ b/queue-6.8/alsa-hda-realtek-add-sound-quirks-for-lenovo-legion-slim-7-16arha7-models.patch @@ -0,0 +1,54 @@ +From b67a7dc418aabbddec41c752ac29b6fa0250d0a8 Mon Sep 17 00:00:00 2001 +From: Christian Bendiksen +Date: Mon, 1 Apr 2024 12:26:10 +0000 +Subject: ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models + +From: Christian Bendiksen + +commit b67a7dc418aabbddec41c752ac29b6fa0250d0a8 upstream. + +This fixes the sound not working from internal speakers on +Lenovo Legion Slim 7 16ARHA7 models. The correct subsystem ID +have been added to cs35l41_hda_property.c and patch_realtek.c. + +Signed-off-by: Christian Bendiksen +Cc: +Message-ID: <20240401122603.6634-1-christian@bendiksen.me> +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/cs35l41_hda_property.c | 4 ++++ + sound/pci/hda/patch_realtek.c | 2 ++ + 2 files changed, 6 insertions(+) + +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -98,6 +98,8 @@ static const struct cs35l41_config cs35l + { "10431F1F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, + { "10431F62", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, + { "17AA386F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, ++ { "17AA3877", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, ++ { "17AA3878", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, + { "17AA38A9", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 2, -1, 0, 0, 0 }, + { "17AA38AB", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 2, -1, 0, 0, 0 }, + { "17AA38B4", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, +@@ -435,6 +437,8 @@ static const struct cs35l41_prop_model c + { "CSC3551", "10431F1F", generic_dsd_config }, + { "CSC3551", "10431F62", generic_dsd_config }, + { "CSC3551", "17AA386F", generic_dsd_config }, ++ { "CSC3551", "17AA3877", generic_dsd_config }, ++ { "CSC3551", "17AA3878", generic_dsd_config }, + { "CSC3551", "17AA38A9", generic_dsd_config }, + { "CSC3551", "17AA38AB", generic_dsd_config }, + { "CSC3551", "17AA38B4", generic_dsd_config }, +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10361,6 +10361,8 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x3869, "Lenovo Yoga7 14IAL7", ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN), + SND_PCI_QUIRK(0x17aa, 0x386f, "Legion 7i 16IAX7", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x3870, "Lenovo Yoga 7 14ARB7", ALC287_FIXUP_YOGA7_14ARB7_I2C), ++ SND_PCI_QUIRK(0x17aa, 0x3877, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2), ++ SND_PCI_QUIRK(0x17aa, 0x3878, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x17aa, 0x387d, "Yoga S780-16 pro Quad AAC", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x387e, "Yoga S780-16 pro Quad YC", ALC287_FIXUP_TAS2781_I2C), + SND_PCI_QUIRK(0x17aa, 0x3881, "YB9 dual power mode2 YC", ALC287_FIXUP_TAS2781_I2C), diff --git a/queue-6.8/alsa-hda-realtek-cs35l41-support-asus-rog-g634jyr.patch b/queue-6.8/alsa-hda-realtek-cs35l41-support-asus-rog-g634jyr.patch new file mode 100644 index 00000000000..ae7079855b7 --- /dev/null +++ b/queue-6.8/alsa-hda-realtek-cs35l41-support-asus-rog-g634jyr.patch @@ -0,0 +1,53 @@ +From 0bfe105018bd2d7b1e4373193d9b55b37cf4458b Mon Sep 17 00:00:00 2001 +From: "Luke D. Jones" +Date: Tue, 2 Apr 2024 14:51:26 +1300 +Subject: ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR + +From: Luke D. Jones + +commit 0bfe105018bd2d7b1e4373193d9b55b37cf4458b upstream. + +Fixes the realtek quirk to initialise the Cirrus amp correctly and adds +related quirk for missing DSD properties. This model laptop has slightly +updated internals compared to the previous version with Realtek Codec +ID of 0x1caf. + +Signed-off-by: Luke D. Jones +Cc: +Message-ID: <20240402015126.21115-1-luke@ljones.dev> +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/cs35l41_hda_property.c | 2 ++ + sound/pci/hda/patch_realtek.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/cs35l41_hda_property.c ++++ b/sound/pci/hda/cs35l41_hda_property.c +@@ -97,6 +97,7 @@ static const struct cs35l41_config cs35l + { "10431F12", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 1000, 4500, 24 }, + { "10431F1F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, -1, 0, 0, 0, 0 }, + { "10431F62", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 0, 0, 0 }, ++ { "10433A60", 2, INTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 1, 2, 0, 1000, 4500, 24 }, + { "17AA386F", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, -1, -1, 0, 0, 0 }, + { "17AA3877", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, + { "17AA3878", 2, EXTERNAL, { CS35L41_LEFT, CS35L41_RIGHT, 0, 0 }, 0, 1, -1, 0, 0, 0 }, +@@ -436,6 +437,7 @@ static const struct cs35l41_prop_model c + { "CSC3551", "10431F12", generic_dsd_config }, + { "CSC3551", "10431F1F", generic_dsd_config }, + { "CSC3551", "10431F62", generic_dsd_config }, ++ { "CSC3551", "10433A60", generic_dsd_config }, + { "CSC3551", "17AA386F", generic_dsd_config }, + { "CSC3551", "17AA3877", generic_dsd_config }, + { "CSC3551", "17AA3878", generic_dsd_config }, +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10164,7 +10164,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x3a50, "ASUS G834JYR/JZR", ALC245_FIXUP_CS35L41_SPI_2), +- SND_PCI_QUIRK(0x1043, 0x3a60, "ASUS G634JYR/JZR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a60, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), diff --git a/queue-6.8/alsa-hda-realtek-fix-inactive-headset-mic-jack.patch b/queue-6.8/alsa-hda-realtek-fix-inactive-headset-mic-jack.patch new file mode 100644 index 00000000000..0331585c7bc --- /dev/null +++ b/queue-6.8/alsa-hda-realtek-fix-inactive-headset-mic-jack.patch @@ -0,0 +1,33 @@ +From daf6c4681a74034d5723e2fb761e0d7f3a1ca18f Mon Sep 17 00:00:00 2001 +From: Christoffer Sandberg +Date: Thu, 28 Mar 2024 11:27:57 +0100 +Subject: ALSA: hda/realtek - Fix inactive headset mic jack + +From: Christoffer Sandberg + +commit daf6c4681a74034d5723e2fb761e0d7f3a1ca18f upstream. + +This patch adds the existing fixup to certain TF platforms implementing +the ALC274 codec with a headset jack. It fixes/activates the inactive +microphone of the headset. + +Signed-off-by: Christoffer Sandberg +Signed-off-by: Werner Sembach +Cc: +Message-ID: <20240328102757.50310-1-wse@tuxedocomputers.com> +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10427,6 +10427,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1d05, 0x1147, "TongFang GMxTGxx", ALC269_FIXUP_NO_SHUTUP), + SND_PCI_QUIRK(0x1d05, 0x115c, "TongFang GMxTGxx", ALC269_FIXUP_NO_SHUTUP), + SND_PCI_QUIRK(0x1d05, 0x121b, "TongFang GMxAGxx", ALC269_FIXUP_NO_SHUTUP), ++ SND_PCI_QUIRK(0x1d05, 0x1387, "TongFang GMxIXxx", ALC2XX_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), diff --git a/queue-6.8/alsa-hda-realtek-update-panasonic-cf-sz6-quirk-to-support-headset-with-microphone.patch b/queue-6.8/alsa-hda-realtek-update-panasonic-cf-sz6-quirk-to-support-headset-with-microphone.patch new file mode 100644 index 00000000000..1ae35666ce3 --- /dev/null +++ b/queue-6.8/alsa-hda-realtek-update-panasonic-cf-sz6-quirk-to-support-headset-with-microphone.patch @@ -0,0 +1,43 @@ +From 1576f263ee2147dc395531476881058609ad3d38 Mon Sep 17 00:00:00 2001 +From: I Gede Agastya Darma Laksana +Date: Tue, 2 Apr 2024 00:46:02 +0700 +Subject: ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone + +From: I Gede Agastya Darma Laksana + +commit 1576f263ee2147dc395531476881058609ad3d38 upstream. + +This patch addresses an issue with the Panasonic CF-SZ6's existing quirk, +specifically its headset microphone functionality. Previously, the quirk +used ALC269_FIXUP_HEADSET_MODE, which does not support the CF-SZ6's design +of a single 3.5mm jack for both mic and audio output effectively. The +device uses pin 0x19 for the headset mic without jack detection. + +Following verification on the CF-SZ6 and discussions with the original +patch author, i determined that the update to +ALC269_FIXUP_ASPIRE_HEADSET_MIC is the appropriate solution. This change +is custom-designed for the CF-SZ6's unique hardware setup, which includes +a single 3.5mm jack for both mic and audio output, connecting the headset +microphone to pin 0x19 without the use of jack detection. + +Fixes: 0fca97a29b83 ("ALSA: hda/realtek - Add Panasonic CF-SZ6 headset jack quirk") +Signed-off-by: I Gede Agastya Darma Laksana +Cc: +Message-ID: <20240401174602.14133-1-gedeagas22@gmail.com> +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10189,7 +10189,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x10ec, 0x1252, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10ec, 0x1254, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x10ec, 0x12cc, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK), +- SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE), ++ SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_ASPIRE_HEADSET_MIC), + SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_AMP), + SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_AMP), diff --git a/queue-6.8/gpio-cdev-check-for-null-labels-when-sanitizing-them-for-irqs.patch b/queue-6.8/gpio-cdev-check-for-null-labels-when-sanitizing-them-for-irqs.patch new file mode 100644 index 00000000000..ac0d4fb3055 --- /dev/null +++ b/queue-6.8/gpio-cdev-check-for-null-labels-when-sanitizing-them-for-irqs.patch @@ -0,0 +1,69 @@ +From b3b95964590a3d756d69ea8604c856de805479ad Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Thu, 4 Apr 2024 11:33:27 +0200 +Subject: gpio: cdev: check for NULL labels when sanitizing them for irqs + +From: Bartosz Golaszewski + +commit b3b95964590a3d756d69ea8604c856de805479ad upstream. + +We need to take into account that a line's consumer label may be NULL +and not try to kstrdup() it in that case but rather pass the NULL +pointer up the stack to the interrupt request function. + +To that end: let make_irq_label() return NULL as a valid return value +and use ERR_PTR() instead to signal an allocation failure to callers. + +Cc: stable@vger.kernel.org +Fixes: b34490879baa ("gpio: cdev: sanitize the label before requesting the interrupt") +Reported-by: Linux Kernel Functional Testing +Closes: https://lore.kernel.org/lkml/20240402093534.212283-1-naresh.kamboju@linaro.org/ +Signed-off-by: Bartosz Golaszewski +Tested-by: Anders Roxell +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib-cdev.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/gpio/gpiolib-cdev.c ++++ b/drivers/gpio/gpiolib-cdev.c +@@ -1091,7 +1091,16 @@ static u32 gpio_v2_line_config_debounce_ + + static inline char *make_irq_label(const char *orig) + { +- return kstrdup_and_replace(orig, '/', ':', GFP_KERNEL); ++ char *new; ++ ++ if (!orig) ++ return NULL; ++ ++ new = kstrdup_and_replace(orig, '/', ':', GFP_KERNEL); ++ if (!new) ++ return ERR_PTR(-ENOMEM); ++ ++ return new; + } + + static inline void free_irq_label(const char *label) +@@ -1164,8 +1173,8 @@ static int edge_detector_setup(struct li + irqflags |= IRQF_ONESHOT; + + label = make_irq_label(line->req->label); +- if (!label) +- return -ENOMEM; ++ if (IS_ERR(label)) ++ return PTR_ERR(label); + + /* Request a thread to read the events */ + ret = request_threaded_irq(irq, edge_irq_handler, edge_irq_thread, +@@ -2223,8 +2232,8 @@ static int lineevent_create(struct gpio_ + goto out_free_le; + + label = make_irq_label(le->label); +- if (!label) { +- ret = -ENOMEM; ++ if (IS_ERR(label)) { ++ ret = PTR_ERR(label); + goto out_free_le; + } + diff --git a/queue-6.8/gpio-cdev-fix-missed-label-sanitizing-in-debounce_setup.patch b/queue-6.8/gpio-cdev-fix-missed-label-sanitizing-in-debounce_setup.patch new file mode 100644 index 00000000000..557c695bf87 --- /dev/null +++ b/queue-6.8/gpio-cdev-fix-missed-label-sanitizing-in-debounce_setup.patch @@ -0,0 +1,110 @@ +From 83092341e15d0dfee1caa8dc502f66c815ccd78a Mon Sep 17 00:00:00 2001 +From: Kent Gibson +Date: Thu, 4 Apr 2024 11:33:28 +0200 +Subject: gpio: cdev: fix missed label sanitizing in debounce_setup() + +From: Kent Gibson + +commit 83092341e15d0dfee1caa8dc502f66c815ccd78a upstream. + +When adding sanitization of the label, the path through +edge_detector_setup() that leads to debounce_setup() was overlooked. +A request taking this path does not allocate a new label and the +request label is freed twice when the request is released, resulting +in memory corruption. + +Add label sanitization to debounce_setup(). + +Cc: stable@vger.kernel.org +Fixes: b34490879baa ("gpio: cdev: sanitize the label before requesting the interrupt") +Signed-off-by: Kent Gibson +[Bartosz: rebased on top of the fix for empty GPIO labels] +Co-developed-by: Bartosz Golaszewski +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib-cdev.c | 49 +++++++++++++++++++++++++------------------- + 1 file changed, 28 insertions(+), 21 deletions(-) + +--- a/drivers/gpio/gpiolib-cdev.c ++++ b/drivers/gpio/gpiolib-cdev.c +@@ -734,6 +734,25 @@ static u32 line_event_id(int level) + GPIO_V2_LINE_EVENT_FALLING_EDGE; + } + ++static inline char *make_irq_label(const char *orig) ++{ ++ char *new; ++ ++ if (!orig) ++ return NULL; ++ ++ new = kstrdup_and_replace(orig, '/', ':', GFP_KERNEL); ++ if (!new) ++ return ERR_PTR(-ENOMEM); ++ ++ return new; ++} ++ ++static inline void free_irq_label(const char *label) ++{ ++ kfree(label); ++} ++ + #ifdef CONFIG_HTE + + static enum hte_return process_hw_ts_thread(void *p) +@@ -1021,6 +1040,7 @@ static int debounce_setup(struct line *l + { + unsigned long irqflags; + int ret, level, irq; ++ char *label; + + /* try hardware */ + ret = gpiod_set_debounce(line->desc, debounce_period_us); +@@ -1043,11 +1063,17 @@ static int debounce_setup(struct line *l + if (irq < 0) + return -ENXIO; + ++ label = make_irq_label(line->req->label); ++ if (IS_ERR(label)) ++ return -ENOMEM; ++ + irqflags = IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING; + ret = request_irq(irq, debounce_irq_handler, irqflags, +- line->req->label, line); +- if (ret) ++ label, line); ++ if (ret) { ++ free_irq_label(label); + return ret; ++ } + line->irq = irq; + } else { + ret = hte_edge_setup(line, GPIO_V2_LINE_FLAG_EDGE_BOTH); +@@ -1089,25 +1115,6 @@ static u32 gpio_v2_line_config_debounce_ + return 0; + } + +-static inline char *make_irq_label(const char *orig) +-{ +- char *new; +- +- if (!orig) +- return NULL; +- +- new = kstrdup_and_replace(orig, '/', ':', GFP_KERNEL); +- if (!new) +- return ERR_PTR(-ENOMEM); +- +- return new; +-} +- +-static inline void free_irq_label(const char *label) +-{ +- kfree(label); +-} +- + static void edge_detector_stop(struct line *line) + { + if (line->irq) { diff --git a/queue-6.8/ksmbd-do-not-set-smb2_global_cap_encryption-for-smb-3.1.1.patch b/queue-6.8/ksmbd-do-not-set-smb2_global_cap_encryption-for-smb-3.1.1.patch new file mode 100644 index 00000000000..c4d8ca1ca20 --- /dev/null +++ b/queue-6.8/ksmbd-do-not-set-smb2_global_cap_encryption-for-smb-3.1.1.patch @@ -0,0 +1,49 @@ +From 5ed11af19e56f0434ce0959376d136005745a936 Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Tue, 2 Apr 2024 09:31:22 +0900 +Subject: ksmbd: do not set SMB2_GLOBAL_CAP_ENCRYPTION for SMB 3.1.1 + +From: Namjae Jeon + +commit 5ed11af19e56f0434ce0959376d136005745a936 upstream. + +SMB2_GLOBAL_CAP_ENCRYPTION flag should be used only for 3.0 and +3.0.2 dialects. This flags set cause compatibility problems with +other SMB clients. + +Reported-by: James Christopher Adduono +Tested-by: James Christopher Adduono +Cc: stable@vger.kernel.org +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/smb2ops.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/fs/smb/server/smb2ops.c ++++ b/fs/smb/server/smb2ops.c +@@ -228,6 +228,11 @@ void init_smb3_0_server(struct ksmbd_con + conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION) + conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; + ++ if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION || ++ (!(server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) && ++ conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION)) ++ conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; ++ + if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) + conn->vals->capabilities |= SMB2_GLOBAL_CAP_MULTI_CHANNEL; + } +@@ -275,11 +280,6 @@ int init_smb3_11_server(struct ksmbd_con + conn->vals->capabilities |= SMB2_GLOBAL_CAP_LEASING | + SMB2_GLOBAL_CAP_DIRECTORY_LEASING; + +- if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION || +- (!(server_conf.flags & KSMBD_GLOBAL_FLAG_SMB2_ENCRYPTION_OFF) && +- conn->cli_cap & SMB2_GLOBAL_CAP_ENCRYPTION)) +- conn->vals->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION; +- + if (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) + conn->vals->capabilities |= SMB2_GLOBAL_CAP_MULTI_CHANNEL; + diff --git a/queue-6.8/ksmbd-don-t-send-oplock-break-if-rename-fails.patch b/queue-6.8/ksmbd-don-t-send-oplock-break-if-rename-fails.patch new file mode 100644 index 00000000000..f6aa5279c84 --- /dev/null +++ b/queue-6.8/ksmbd-don-t-send-oplock-break-if-rename-fails.patch @@ -0,0 +1,33 @@ +From c1832f67035dc04fb89e6b591b64e4d515843cda Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Sun, 31 Mar 2024 21:58:26 +0900 +Subject: ksmbd: don't send oplock break if rename fails + +From: Namjae Jeon + +commit c1832f67035dc04fb89e6b591b64e4d515843cda upstream. + +Don't send oplock break if rename fails. This patch fix +smb2.oplock.batch20 test. + +Cc: stable@vger.kernel.org +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/smb2pdu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/smb/server/smb2pdu.c ++++ b/fs/smb/server/smb2pdu.c +@@ -5632,8 +5632,9 @@ static int smb2_rename(struct ksmbd_work + if (!file_info->ReplaceIfExists) + flags = RENAME_NOREPLACE; + +- smb_break_all_levII_oplock(work, fp, 0); + rc = ksmbd_vfs_rename(work, &fp->filp->f_path, new_name, flags); ++ if (!rc) ++ smb_break_all_levII_oplock(work, fp, 0); + out: + kfree(new_name); + return rc; diff --git a/queue-6.8/ksmbd-validate-payload-size-in-ipc-response.patch b/queue-6.8/ksmbd-validate-payload-size-in-ipc-response.patch new file mode 100644 index 00000000000..dbe893846ec --- /dev/null +++ b/queue-6.8/ksmbd-validate-payload-size-in-ipc-response.patch @@ -0,0 +1,120 @@ +From a677ebd8ca2f2632ccdecbad7b87641274e15aac Mon Sep 17 00:00:00 2001 +From: Namjae Jeon +Date: Sun, 31 Mar 2024 21:59:10 +0900 +Subject: ksmbd: validate payload size in ipc response + +From: Namjae Jeon + +commit a677ebd8ca2f2632ccdecbad7b87641274e15aac upstream. + +If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc +response to ksmbd kernel server. ksmbd should validate payload size of +ipc response from ksmbd.mountd to avoid memory overrun or +slab-out-of-bounds. This patch validate 3 ipc response that has payload. + +Cc: stable@vger.kernel.org +Reported-by: Chao Ma +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/ksmbd_netlink.h | 3 ++- + fs/smb/server/mgmt/share_config.c | 7 ++++++- + fs/smb/server/transport_ipc.c | 37 +++++++++++++++++++++++++++++++++++++ + 3 files changed, 45 insertions(+), 2 deletions(-) + +--- a/fs/smb/server/ksmbd_netlink.h ++++ b/fs/smb/server/ksmbd_netlink.h +@@ -166,7 +166,8 @@ struct ksmbd_share_config_response { + __u16 force_uid; + __u16 force_gid; + __s8 share_name[KSMBD_REQ_MAX_SHARE_NAME]; +- __u32 reserved[112]; /* Reserved room */ ++ __u32 reserved[111]; /* Reserved room */ ++ __u32 payload_sz; + __u32 veto_list_sz; + __s8 ____payload[]; + }; +--- a/fs/smb/server/mgmt/share_config.c ++++ b/fs/smb/server/mgmt/share_config.c +@@ -158,7 +158,12 @@ static struct ksmbd_share_config *share_ + share->name = kstrdup(name, GFP_KERNEL); + + if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { +- share->path = kstrdup(ksmbd_share_config_path(resp), ++ int path_len = PATH_MAX; ++ ++ if (resp->payload_sz) ++ path_len = resp->payload_sz - resp->veto_list_sz; ++ ++ share->path = kstrndup(ksmbd_share_config_path(resp), path_len, + GFP_KERNEL); + if (share->path) + share->path_sz = strlen(share->path); +--- a/fs/smb/server/transport_ipc.c ++++ b/fs/smb/server/transport_ipc.c +@@ -65,6 +65,7 @@ struct ipc_msg_table_entry { + struct hlist_node ipc_table_hlist; + + void *response; ++ unsigned int msg_sz; + }; + + static struct delayed_work ipc_timer_work; +@@ -275,6 +276,7 @@ static int handle_response(int type, voi + } + + memcpy(entry->response, payload, sz); ++ entry->msg_sz = sz; + wake_up_interruptible(&entry->wait); + ret = 0; + break; +@@ -453,6 +455,34 @@ out: + return ret; + } + ++static int ipc_validate_msg(struct ipc_msg_table_entry *entry) ++{ ++ unsigned int msg_sz = entry->msg_sz; ++ ++ if (entry->type == KSMBD_EVENT_RPC_REQUEST) { ++ struct ksmbd_rpc_command *resp = entry->response; ++ ++ msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; ++ } else if (entry->type == KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST) { ++ struct ksmbd_spnego_authen_response *resp = entry->response; ++ ++ msg_sz = sizeof(struct ksmbd_spnego_authen_response) + ++ resp->session_key_len + resp->spnego_blob_len; ++ } else if (entry->type == KSMBD_EVENT_SHARE_CONFIG_REQUEST) { ++ struct ksmbd_share_config_response *resp = entry->response; ++ ++ if (resp->payload_sz) { ++ if (resp->payload_sz < resp->veto_list_sz) ++ return -EINVAL; ++ ++ msg_sz = sizeof(struct ksmbd_share_config_response) + ++ resp->payload_sz; ++ } ++ } ++ ++ return entry->msg_sz != msg_sz ? -EINVAL : 0; ++} ++ + static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle) + { + struct ipc_msg_table_entry entry; +@@ -477,6 +507,13 @@ static void *ipc_msg_send_request(struct + ret = wait_event_interruptible_timeout(entry.wait, + entry.response != NULL, + IPC_WAIT_TIMEOUT); ++ if (entry.response) { ++ ret = ipc_validate_msg(&entry); ++ if (ret) { ++ kvfree(entry.response); ++ entry.response = NULL; ++ } ++ } + out: + down_write(&ipc_msg_table_lock); + hash_del(&entry.ipc_table_hlist); diff --git a/queue-6.8/revert-drm-amd-display-send-dtbclk-disable-message-on-first-commit.patch b/queue-6.8/revert-drm-amd-display-send-dtbclk-disable-message-on-first-commit.patch new file mode 100644 index 00000000000..8597e5bcb3f --- /dev/null +++ b/queue-6.8/revert-drm-amd-display-send-dtbclk-disable-message-on-first-commit.patch @@ -0,0 +1,37 @@ +From 3a6a32b31a111f6e66526fb2d3cb13a876465076 Mon Sep 17 00:00:00 2001 +From: Gabe Teeger +Date: Mon, 29 Jan 2024 13:31:44 -0500 +Subject: Revert "drm/amd/display: Send DTBCLK disable message on first commit" + +From: Gabe Teeger + +commit 3a6a32b31a111f6e66526fb2d3cb13a876465076 upstream. + +This reverts commit f341055b10bd8be55c3c995dff5f770b236b8ca9. + +System hang observed, this commit is thought to be the +regression point. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Reviewed-by: Ovidiu Bunea +Acked-by: Aurabindo Pillai +Signed-off-by: Gabe Teeger +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +@@ -415,7 +415,6 @@ void dcn35_init_clocks(struct clk_mgr *c + memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks)); + + // Assumption is that boot state always supports pstate +- clk_mgr->clks.dtbclk_en = true; + clk_mgr->clks.ref_dtbclk_khz = ref_dtbclk; // restore ref_dtbclk + clk_mgr->clks.p_state_change_support = true; + clk_mgr->clks.prev_p_state_change_support = true; diff --git a/queue-6.8/series b/queue-6.8/series index 198176b4634..b7dd1676b69 100644 --- a/queue-6.8/series +++ b/queue-6.8/series @@ -196,3 +196,14 @@ nfsd-hold-a-lighter-weight-client-reference-over-cb_.patch lib-stackdepot-move-stack_record-struct-definition-i.patch stackdepot-rename-pool_index-to-pool_index_plus_1.patch x86-retpoline-add-noendbr-annotation-to-the-srso-dummy-return-thunk.patch +revert-drm-amd-display-send-dtbclk-disable-message-on-first-commit.patch +gpio-cdev-check-for-null-labels-when-sanitizing-them-for-irqs.patch +gpio-cdev-fix-missed-label-sanitizing-in-debounce_setup.patch +ksmbd-don-t-send-oplock-break-if-rename-fails.patch +ksmbd-validate-payload-size-in-ipc-response.patch +ksmbd-do-not-set-smb2_global_cap_encryption-for-smb-3.1.1.patch +alsa-hda-add-pplcllpl-u-members-to-hdac_ext_stream.patch +alsa-hda-realtek-fix-inactive-headset-mic-jack.patch +alsa-hda-realtek-add-sound-quirks-for-lenovo-legion-slim-7-16arha7-models.patch +alsa-hda-realtek-cs35l41-support-asus-rog-g634jyr.patch +alsa-hda-realtek-update-panasonic-cf-sz6-quirk-to-support-headset-with-microphone.patch