From: Greg Kroah-Hartman Date: Thu, 16 Oct 2025 12:47:29 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.15.195~78 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9073e170af14f80851689323197eb435fb3554d9;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: copy_sighand-handle-architectures-where-sizeof-unsigned-long-sizeof-u64.patch cpufreq-intel_pstate-fix-object-lifecycle-issue-in-update_qos_request.patch crypto-atmel-fix-dma_unmap_sg-direction.patch iio-dac-ad5360-use-int-type-to-store-negative-error-codes.patch iio-dac-ad5421-use-int-type-to-store-negative-error-codes.patch iio-frequency-adf4350-fix-prescaler-usage.patch iio-imu-inv_icm42600-drop-redundant-pm_runtime-reinitialization-in-resume.patch init-handle-bootloader-identifier-in-kernel-parameters.patch --- diff --git a/queue-5.10/copy_sighand-handle-architectures-where-sizeof-unsigned-long-sizeof-u64.patch b/queue-5.10/copy_sighand-handle-architectures-where-sizeof-unsigned-long-sizeof-u64.patch new file mode 100644 index 0000000000..0d7f13177d --- /dev/null +++ b/queue-5.10/copy_sighand-handle-architectures-where-sizeof-unsigned-long-sizeof-u64.patch @@ -0,0 +1,58 @@ +From 04ff48239f46e8b493571e260bd0e6c3a6400371 Mon Sep 17 00:00:00 2001 +From: Simon Schuster +Date: Mon, 1 Sep 2025 15:09:50 +0200 +Subject: copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64) + +From: Simon Schuster + +commit 04ff48239f46e8b493571e260bd0e6c3a6400371 upstream. + +With the introduction of clone3 in commit 7f192e3cd316 ("fork: add +clone3") the effective bit width of clone_flags on all architectures was +increased from 32-bit to 64-bit. However, the signature of the copy_* +helper functions (e.g., copy_sighand) used by copy_process was not +adapted. + +As such, they truncate the flags on any 32-bit architectures that +supports clone3 (arc, arm, csky, m68k, microblaze, mips32, openrisc, +parisc32, powerpc32, riscv32, x86-32 and xtensa). + +For copy_sighand with CLONE_CLEAR_SIGHAND being an actual u64 +constant, this triggers an observable bug in kernel selftest +clone3_clear_sighand: + + if (clone_flags & CLONE_CLEAR_SIGHAND) + +in function copy_sighand within fork.c will always fail given: + + unsigned long /* == uint32_t */ clone_flags + #define CLONE_CLEAR_SIGHAND 0x100000000ULL + +This commit fixes the bug by always passing clone_flags to copy_sighand +via their declared u64 type, invariant of architecture-dependent integer +sizes. + +Fixes: b612e5df4587 ("clone3: add CLONE_CLEAR_SIGHAND") +Cc: stable@vger.kernel.org # linux-5.5+ +Signed-off-by: Simon Schuster +Link: https://lore.kernel.org/20250901-nios2-implement-clone3-v2-1-53fcf5577d57@siemens-energy.com +Acked-by: David Hildenbrand +Reviewed-by: Lorenzo Stoakes +Reviewed-by: Arnd Bergmann +Signed-off-by: Christian Brauner +Signed-off-by: Greg Kroah-Hartman +--- + kernel/fork.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1519,7 +1519,7 @@ static int copy_io(unsigned long clone_f + return 0; + } + +-static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk) ++static int copy_sighand(u64 clone_flags, struct task_struct *tsk) + { + struct sighand_struct *sig; + diff --git a/queue-5.10/cpufreq-intel_pstate-fix-object-lifecycle-issue-in-update_qos_request.patch b/queue-5.10/cpufreq-intel_pstate-fix-object-lifecycle-issue-in-update_qos_request.patch new file mode 100644 index 0000000000..6ffb5f6feb --- /dev/null +++ b/queue-5.10/cpufreq-intel_pstate-fix-object-lifecycle-issue-in-update_qos_request.patch @@ -0,0 +1,58 @@ +From 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Fri, 5 Sep 2025 15:52:03 +0200 +Subject: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() + +From: Rafael J. Wysocki + +commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 upstream. + +The cpufreq_cpu_put() call in update_qos_request() takes place too early +because the latter subsequently calls freq_qos_update_request() that +indirectly accesses the policy object in question through the QoS request +object passed to it. + +Fortunately, update_qos_request() is called under intel_pstate_driver_lock, +so this issue does not matter for changing the intel_pstate operation +mode, but it theoretically can cause a crash to occur on CPU device hot +removal (which currently can only happen in virt, but it is formally +supported nevertheless). + +Address this issue by modifying update_qos_request() to drop the +reference to the policy later. + +Fixes: da5c504c7aae ("cpufreq: intel_pstate: Implement QoS supported freq constraints") +Cc: 5.4+ # 5.4+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Zihuan Zhang +Link: https://patch.msgid.link/2255671.irdbgypaU6@rafael.j.wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/intel_pstate.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -1205,10 +1205,10 @@ static void update_qos_request(enum freq + continue; + + req = policy->driver_data; +- cpufreq_cpu_put(policy); +- +- if (!req) ++ if (!req) { ++ cpufreq_cpu_put(policy); + continue; ++ } + + if (hwp_active) + intel_pstate_get_hwp_max(cpu, &turbo_max, &max_state); +@@ -1227,6 +1227,8 @@ static void update_qos_request(enum freq + + if (freq_qos_update_request(req, freq) < 0) + pr_warn("Failed to update freq constraint: CPU%d\n", i); ++ ++ cpufreq_cpu_put(policy); + } + } + diff --git a/queue-5.10/crypto-atmel-fix-dma_unmap_sg-direction.patch b/queue-5.10/crypto-atmel-fix-dma_unmap_sg-direction.patch new file mode 100644 index 0000000000..c8de44670c --- /dev/null +++ b/queue-5.10/crypto-atmel-fix-dma_unmap_sg-direction.patch @@ -0,0 +1,32 @@ +From f5d643156ef62216955c119216d2f3815bd51cb1 Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Wed, 3 Sep 2025 10:34:46 +0200 +Subject: crypto: atmel - Fix dma_unmap_sg() direction + +From: Thomas Fourier + +commit f5d643156ef62216955c119216d2f3815bd51cb1 upstream. + +It seems like everywhere in this file, dd->in_sg is mapped with +DMA_TO_DEVICE and dd->out_sg is mapped with DMA_FROM_DEVICE. + +Fixes: 13802005d8f2 ("crypto: atmel - add Atmel DES/TDES driver") +Cc: +Signed-off-by: Thomas Fourier +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/atmel-tdes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/atmel-tdes.c ++++ b/drivers/crypto/atmel-tdes.c +@@ -558,7 +558,7 @@ static int atmel_tdes_crypt_start(struct + + if (err && (dd->flags & TDES_FLAGS_FAST)) { + dma_unmap_sg(dd->dev, dd->in_sg, 1, DMA_TO_DEVICE); +- dma_unmap_sg(dd->dev, dd->out_sg, 1, DMA_TO_DEVICE); ++ dma_unmap_sg(dd->dev, dd->out_sg, 1, DMA_FROM_DEVICE); + } + + return err; diff --git a/queue-5.10/iio-dac-ad5360-use-int-type-to-store-negative-error-codes.patch b/queue-5.10/iio-dac-ad5360-use-int-type-to-store-negative-error-codes.patch new file mode 100644 index 0000000000..a3c00f31de --- /dev/null +++ b/queue-5.10/iio-dac-ad5360-use-int-type-to-store-negative-error-codes.patch @@ -0,0 +1,35 @@ +From f9381ece76de999a2065d5b4fdd87fa17883978c Mon Sep 17 00:00:00 2001 +From: Qianfeng Rong +Date: Mon, 1 Sep 2025 21:57:25 +0800 +Subject: iio: dac: ad5360: use int type to store negative error codes + +From: Qianfeng Rong + +commit f9381ece76de999a2065d5b4fdd87fa17883978c upstream. + +Change the 'ret' variable in ad5360_update_ctrl() from unsigned int to +int, as it needs to store either negative error codes or zero returned +by ad5360_write_unlocked(). + +Fixes: a3e2940c24d3 ("staging:iio:dac: Add AD5360 driver") +Signed-off-by: Qianfeng Rong +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20250901135726.17601-2-rongqianfeng@vivo.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5360.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5360.c ++++ b/drivers/iio/dac/ad5360.c +@@ -262,7 +262,7 @@ static int ad5360_update_ctrl(struct iio + unsigned int clr) + { + struct ad5360_state *st = iio_priv(indio_dev); +- unsigned int ret; ++ int ret; + + mutex_lock(&st->lock); + diff --git a/queue-5.10/iio-dac-ad5421-use-int-type-to-store-negative-error-codes.patch b/queue-5.10/iio-dac-ad5421-use-int-type-to-store-negative-error-codes.patch new file mode 100644 index 0000000000..70a3b1b068 --- /dev/null +++ b/queue-5.10/iio-dac-ad5421-use-int-type-to-store-negative-error-codes.patch @@ -0,0 +1,35 @@ +From 3379c900320954d768ed9903691fb2520926bbe3 Mon Sep 17 00:00:00 2001 +From: Qianfeng Rong +Date: Mon, 1 Sep 2025 21:57:26 +0800 +Subject: iio: dac: ad5421: use int type to store negative error codes + +From: Qianfeng Rong + +commit 3379c900320954d768ed9903691fb2520926bbe3 upstream. + +Change the 'ret' variable in ad5421_update_ctrl() from unsigned int to +int, as it needs to store either negative error codes or zero returned +by ad5421_write_unlocked(). + +Fixes: 5691b23489db ("staging:iio:dac: Add AD5421 driver") +Signed-off-by: Qianfeng Rong +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20250901135726.17601-3-rongqianfeng@vivo.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5421.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5421.c ++++ b/drivers/iio/dac/ad5421.c +@@ -186,7 +186,7 @@ static int ad5421_update_ctrl(struct iio + unsigned int clr) + { + struct ad5421_state *st = iio_priv(indio_dev); +- unsigned int ret; ++ int ret; + + mutex_lock(&st->lock); + diff --git a/queue-5.10/iio-frequency-adf4350-fix-prescaler-usage.patch b/queue-5.10/iio-frequency-adf4350-fix-prescaler-usage.patch new file mode 100644 index 0000000000..b0b01b33f1 --- /dev/null +++ b/queue-5.10/iio-frequency-adf4350-fix-prescaler-usage.patch @@ -0,0 +1,72 @@ +From 33d7ecbf69aa7dd4145e3b77962bcb8759eede3d Mon Sep 17 00:00:00 2001 +From: Michael Hennerich +Date: Fri, 29 Aug 2025 12:25:42 +0100 +Subject: iio: frequency: adf4350: Fix prescaler usage. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Hennerich + +commit 33d7ecbf69aa7dd4145e3b77962bcb8759eede3d upstream. + +The ADF4350/1 features a programmable dual-modulus prescaler of 4/5 or 8/9. +When set to 4/5, the maximum RF frequency allowed is 3 GHz. +Therefore, when operating the ADF4351 above 3 GHz, this must be set to 8/9. +In this context not the RF output frequency is meant +- it's the VCO frequency. + +Therefore move the prescaler selection after we derived the VCO frequency +from the desired RF output frequency. + +This BUG may have caused PLL lock instabilities when operating the VCO at +the very high range close to 4.4 GHz. + +Fixes: e31166f0fd48 ("iio: frequency: New driver for Analog Devices ADF4350/ADF4351 Wideband Synthesizers") +Signed-off-by: Michael Hennerich +Signed-off-by: Nuno Sá +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20250829-adf4350-fix-v2-1-0bf543ba797d@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/frequency/adf4350.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/iio/frequency/adf4350.c ++++ b/drivers/iio/frequency/adf4350.c +@@ -143,6 +143,19 @@ static int adf4350_set_freq(struct adf43 + if (freq > ADF4350_MAX_OUT_FREQ || freq < st->min_out_freq) + return -EINVAL; + ++ st->r4_rf_div_sel = 0; ++ ++ /* ++ * !\TODO: The below computation is making sure we get a power of 2 ++ * shift (st->r4_rf_div_sel) so that freq becomes higher or equal to ++ * ADF4350_MIN_VCO_FREQ. This might be simplified with fls()/fls_long() ++ * and friends. ++ */ ++ while (freq < ADF4350_MIN_VCO_FREQ) { ++ freq <<= 1; ++ st->r4_rf_div_sel++; ++ } ++ + if (freq > ADF4350_MAX_FREQ_45_PRESC) { + prescaler = ADF4350_REG1_PRESCALER; + mdiv = 75; +@@ -151,13 +164,6 @@ static int adf4350_set_freq(struct adf43 + mdiv = 23; + } + +- st->r4_rf_div_sel = 0; +- +- while (freq < ADF4350_MIN_VCO_FREQ) { +- freq <<= 1; +- st->r4_rf_div_sel++; +- } +- + /* + * Allow a predefined reference division factor + * if not set, compute our own diff --git a/queue-5.10/iio-imu-inv_icm42600-drop-redundant-pm_runtime-reinitialization-in-resume.patch b/queue-5.10/iio-imu-inv_icm42600-drop-redundant-pm_runtime-reinitialization-in-resume.patch new file mode 100644 index 0000000000..3ad194f9d3 --- /dev/null +++ b/queue-5.10/iio-imu-inv_icm42600-drop-redundant-pm_runtime-reinitialization-in-resume.patch @@ -0,0 +1,37 @@ +From a95a0b4e471a6d8860f40c6ac8f1cad9dde3189a Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Mon, 1 Sep 2025 09:49:14 +0200 +Subject: iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume + +From: Sean Nyekjaer + +commit a95a0b4e471a6d8860f40c6ac8f1cad9dde3189a upstream. + +Remove unnecessary calls to pm_runtime_disable(), pm_runtime_set_active(), +and pm_runtime_enable() from the resume path. These operations are not +required here and can interfere with proper pm_runtime state handling, +especially when resuming from a pm_runtime suspended state. + +Fixes: 31c24c1e93c3 ("iio: imu: inv_icm42600: add core of new inv_icm42600 driver") +Signed-off-by: Sean Nyekjaer +Link: https://patch.msgid.link/20250901-icm42pmreg-v3-2-ef1336246960@geanix.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +@@ -730,10 +730,6 @@ static int __maybe_unused inv_icm42600_r + if (ret) + goto out_unlock; + +- pm_runtime_disable(dev); +- pm_runtime_set_active(dev); +- pm_runtime_enable(dev); +- + /* restore sensors state */ + ret = inv_icm42600_set_pwr_mgmt0(st, st->suspended.gyro, + st->suspended.accel, diff --git a/queue-5.10/init-handle-bootloader-identifier-in-kernel-parameters.patch b/queue-5.10/init-handle-bootloader-identifier-in-kernel-parameters.patch new file mode 100644 index 0000000000..eec1a7f844 --- /dev/null +++ b/queue-5.10/init-handle-bootloader-identifier-in-kernel-parameters.patch @@ -0,0 +1,72 @@ +From e416f0ed3c500c05c55fb62ee62662717b1c7f71 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Mon, 21 Jul 2025 18:13:43 +0800 +Subject: init: handle bootloader identifier in kernel parameters + +From: Huacai Chen + +commit e416f0ed3c500c05c55fb62ee62662717b1c7f71 upstream. + +BootLoaders (Grub, LILO, etc) may pass an identifier such as "BOOT_IMAGE= +/boot/vmlinuz-x.y.z" to kernel parameters. But these identifiers are not +recognized by the kernel itself so will be passed to userspace. However +user space init program also don't recognize it. + +KEXEC/KDUMP (kexec-tools) may also pass an identifier such as "kexec" on +some architectures. + +We cannot change BootLoader's behavior, because this behavior exists for +many years, and there are already user space programs search BOOT_IMAGE= +in /proc/cmdline to obtain the kernel image locations: + +https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/util.go +(search getBootOptions) +https://github.com/linuxdeepin/deepin-ab-recovery/blob/master/main.go +(search getKernelReleaseWithBootOption) So the the best way is handle +(ignore) it by the kernel itself, which can avoid such boot warnings (if +we use something like init=/bin/bash, bootloader identifier can even cause +a crash): + +Kernel command line: BOOT_IMAGE=(hd0,1)/vmlinuz-6.x root=/dev/sda3 ro console=tty +Unknown kernel command line parameters "BOOT_IMAGE=(hd0,1)/vmlinuz-6.x", will be passed to user space. + +[chenhuacai@loongson.cn: use strstarts()] + Link: https://lkml.kernel.org/r/20250815090120.1569947-1-chenhuacai@loongson.cn +Link: https://lkml.kernel.org/r/20250721101343.3283480-1-chenhuacai@loongson.cn +Signed-off-by: Huacai Chen +Cc: Al Viro +Cc: Christian Brauner +Cc: Jan Kara +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + init/main.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/init/main.c ++++ b/init/main.c +@@ -531,9 +531,23 @@ static int __init unknown_bootoption(cha + const char *unused, void *arg) + { + size_t len = strlen(param); ++ int i; ++ ++ /* ++ * Well-known bootloader identifiers: ++ * 1. LILO/Grub pass "BOOT_IMAGE=..."; ++ * 2. kexec/kdump (kexec-tools) pass "kexec". ++ */ ++ const char *bootloader[] = { "BOOT_IMAGE=", "kexec", NULL }; + + repair_env_string(param, val); + ++ /* Handle bootloader identifier */ ++ for (i = 0; bootloader[i]; i++) { ++ if (strstarts(param, bootloader[i])) ++ return 0; ++ } ++ + /* Handle obsolete-style parameters */ + if (obsolete_checksetup(param)) + return 0; diff --git a/queue-5.10/series b/queue-5.10/series index 7a3298e862..320392cd16 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -134,3 +134,11 @@ xen-manage-fix-suspend-error-path.patch firmware-meson_sm-fix-device-leak-at-probe.patch media-i2c-mt9v111-fix-incorrect-type-for-ret.patch drm-nouveau-fix-bad-ret-code-in-nouveau_bo_move_prep.patch +copy_sighand-handle-architectures-where-sizeof-unsigned-long-sizeof-u64.patch +cpufreq-intel_pstate-fix-object-lifecycle-issue-in-update_qos_request.patch +crypto-atmel-fix-dma_unmap_sg-direction.patch +iio-dac-ad5360-use-int-type-to-store-negative-error-codes.patch +iio-dac-ad5421-use-int-type-to-store-negative-error-codes.patch +iio-frequency-adf4350-fix-prescaler-usage.patch +init-handle-bootloader-identifier-in-kernel-parameters.patch +iio-imu-inv_icm42600-drop-redundant-pm_runtime-reinitialization-in-resume.patch