From: Greg Kroah-Hartman Date: Mon, 20 Dec 2021 11:42:20 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.296~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8f9d2d0a4ef16cdf0619e2bd30a83efc08f87693;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch media-mxl111sf-change-mutex_init-location.patch xsk-do-not-sleep-in-poll-when-need_wakeup-set.patch --- diff --git a/queue-5.4/arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch b/queue-5.4/arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch new file mode 100644 index 00000000000..40d0dbf5152 --- /dev/null +++ b/queue-5.4/arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch @@ -0,0 +1,37 @@ +From 737e65c7956795b3553781fb7bc82fce1c39503f Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 24 Nov 2021 15:45:41 -0300 +Subject: ARM: dts: imx6ull-pinfunc: Fix CSI_DATA07__ESAI_TX0 pad name + +From: Fabio Estevam + +commit 737e65c7956795b3553781fb7bc82fce1c39503f upstream. + +According to the i.MX6ULL Reference Manual, pad CSI_DATA07 may +have the ESAI_TX0 functionality, not ESAI_T0. + +Also, NXP's i.MX Config Tools 10.0 generates dtsi with the +MX6ULL_PAD_CSI_DATA07__ESAI_TX0 naming, so fix it accordingly. + +There are no devicetree users in mainline that use the old name, +so just remove the old entry. + +Fixes: c201369d4aa5 ("ARM: dts: imx6ull: add imx6ull support") +Reported-by: George Makarov +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx6ull-pinfunc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/imx6ull-pinfunc.h ++++ b/arch/arm/boot/dts/imx6ull-pinfunc.h +@@ -82,6 +82,6 @@ + #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0 + #define MX6ULL_PAD_CSI_DATA06__ESAI_TX5_RX0 0x01FC 0x0488 0x0000 0x9 0x0 +-#define MX6ULL_PAD_CSI_DATA07__ESAI_T0 0x0200 0x048C 0x0000 0x9 0x0 ++#define MX6ULL_PAD_CSI_DATA07__ESAI_TX0 0x0200 0x048C 0x0000 0x9 0x0 + + #endif /* __DTS_IMX6ULL_PINFUNC_H */ diff --git a/queue-5.4/media-mxl111sf-change-mutex_init-location.patch b/queue-5.4/media-mxl111sf-change-mutex_init-location.patch new file mode 100644 index 00000000000..b40ad88913b --- /dev/null +++ b/queue-5.4/media-mxl111sf-change-mutex_init-location.patch @@ -0,0 +1,112 @@ +From 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Thu, 19 Aug 2021 12:42:21 +0200 +Subject: media: mxl111sf: change mutex_init() location + +From: Pavel Skripkin + +commit 44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f upstream. + +Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized +mutex. The problem was in wrong mutex_init() location. + +Previous mutex_init(&state->msg_lock) call was in ->init() function, but +dvb_usbv2_init() has this order of calls: + + dvb_usbv2_init() + dvb_usbv2_adapter_init() + dvb_usbv2_adapter_frontend_init() + props->frontend_attach() + + props->init() + +Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach() +internally we need to initialize state->msg_lock before +frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_* +devices, which will simply initiaize mutex. + +Reported-and-tested-by: syzbot+5ca0bf339f13c4243001@syzkaller.appspotmail.com + +Fixes: 8572211842af ("[media] mxl111sf: convert to new DVB USB") +Signed-off-by: Pavel Skripkin +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/dvb-usb-v2/mxl111sf.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c ++++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c +@@ -931,8 +931,6 @@ static int mxl111sf_init(struct dvb_usb_ + .len = sizeof(eeprom), .buf = eeprom }, + }; + +- mutex_init(&state->msg_lock); +- + ret = get_chip_info(state); + if (mxl_fail(ret)) + pr_err("failed to get chip info during probe"); +@@ -1074,6 +1072,14 @@ static int mxl111sf_get_stream_config_dv + return 0; + } + ++static int mxl111sf_probe(struct dvb_usb_device *dev) ++{ ++ struct mxl111sf_state *state = d_to_priv(dev); ++ ++ mutex_init(&state->msg_lock); ++ return 0; ++} ++ + static struct dvb_usb_device_properties mxl111sf_props_dvbt = { + .driver_name = KBUILD_MODNAME, + .owner = THIS_MODULE, +@@ -1083,6 +1089,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_dvbt, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1124,6 +1131,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_atsc, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1165,6 +1173,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mh, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1233,6 +1242,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_atsc_mh, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1311,6 +1321,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mercury, + .tuner_attach = mxl111sf_attach_tuner, +@@ -1381,6 +1392,7 @@ static struct dvb_usb_device_properties + .generic_bulk_ctrl_endpoint = 0x02, + .generic_bulk_ctrl_endpoint_response = 0x81, + ++ .probe = mxl111sf_probe, + .i2c_algo = &mxl111sf_i2c_algo, + .frontend_attach = mxl111sf_frontend_attach_mercury_mh, + .tuner_attach = mxl111sf_attach_tuner, diff --git a/queue-5.4/series b/queue-5.4/series index dbe94f4c9eb..2b63138a9d7 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -54,3 +54,6 @@ drm-amdgpu-correct-register-access-for-rlc_jump_table_restore.patch mac80211-validate-extended-element-id-is-present.patch mwifiex-remove-unnecessary-braces-from-hostcmd_set_seq_no_bss_info.patch input-touchscreen-avoid-bitwise-vs-logical-or-warning.patch +arm-dts-imx6ull-pinfunc-fix-csi_data07__esai_tx0-pad-name.patch +xsk-do-not-sleep-in-poll-when-need_wakeup-set.patch +media-mxl111sf-change-mutex_init-location.patch diff --git a/queue-5.4/xsk-do-not-sleep-in-poll-when-need_wakeup-set.patch b/queue-5.4/xsk-do-not-sleep-in-poll-when-need_wakeup-set.patch new file mode 100644 index 00000000000..ae42e55d576 --- /dev/null +++ b/queue-5.4/xsk-do-not-sleep-in-poll-when-need_wakeup-set.patch @@ -0,0 +1,52 @@ +From bd0687c18e635b63233dc87f38058cd728802ab4 Mon Sep 17 00:00:00 2001 +From: Magnus Karlsson +Date: Tue, 14 Dec 2021 11:26:07 +0100 +Subject: xsk: Do not sleep in poll() when need_wakeup set + +From: Magnus Karlsson + +commit bd0687c18e635b63233dc87f38058cd728802ab4 upstream. + +Do not sleep in poll() when the need_wakeup flag is set. When this +flag is set, the application needs to explicitly wake up the driver +with a syscall (poll, recvmsg, sendmsg, etc.) to guarantee that Rx +and/or Tx processing will be processed promptly. But the current code +in poll(), sleeps first then wakes up the driver. This means that no +driver processing will occur (baring any interrupts) until the timeout +has expired. + +Fix this by checking the need_wakeup flag first and if set, wake the +driver and return to the application. Only if need_wakeup is not set +should the process sleep if there is a timeout set in the poll() call. + +Fixes: 77cd0d7b3f25 ("xsk: add support for need_wakeup flag in AF_XDP rings") +Reported-by: Keith Wiles +Signed-off-by: Magnus Karlsson +Signed-off-by: Daniel Borkmann +Acked-by: Maciej Fijalkowski +Link: https://lore.kernel.org/bpf/20211214102607.7677-1-magnus.karlsson@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + net/xdp/xsk.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -434,8 +434,6 @@ static __poll_t xsk_poll(struct file *fi + struct xdp_sock *xs = xdp_sk(sk); + struct xdp_umem *umem; + +- sock_poll_wait(file, sock, wait); +- + if (unlikely(!xsk_is_bound(xs))) + return mask; + +@@ -447,6 +445,8 @@ static __poll_t xsk_poll(struct file *fi + else + /* Poll needs to drive Tx also in copy mode */ + __xsk_sendmsg(sk); ++ } else { ++ sock_poll_wait(file, sock, wait); + } + + if (xs->rx && !xskq_empty_desc(xs->rx))