From: Sasha Levin Date: Sat, 24 Feb 2024 03:37:44 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v4.19.308~81 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9a73a716bdd08be443490783b437042af20ccc06;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/ksmbd-free-aux-buffer-if-ksmbd_iov_pin_rsp_read-fail.patch b/queue-5.15/ksmbd-free-aux-buffer-if-ksmbd_iov_pin_rsp_read-fail.patch new file mode 100644 index 00000000000..10d4f0fe302 --- /dev/null +++ b/queue-5.15/ksmbd-free-aux-buffer-if-ksmbd_iov_pin_rsp_read-fail.patch @@ -0,0 +1,56 @@ +From 82c2c22e7a5f5a134beaa1a3d643d51065669e81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Feb 2024 14:19:16 +0300 +Subject: ksmbd: free aux buffer if ksmbd_iov_pin_rsp_read fails + +From: Fedor Pchelkin + +[ Upstream commit 108a020c64434fed4b69762879d78cd24088b4c7 ] + +ksmbd_iov_pin_rsp_read() doesn't free the provided aux buffer if it +fails. Seems to be the caller's responsibility to clear the buffer in +error case. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: e2b76ab8b5c9 ("ksmbd: add support for read compound") +Cc: stable@vger.kernel.org +Signed-off-by: Fedor Pchelkin +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb2pdu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 7e8f1c89124fa..0613b8d14409c 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -6175,8 +6175,10 @@ static noinline int smb2_read_pipe(struct ksmbd_work *work) + err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, + offsetof(struct smb2_read_rsp, Buffer), + aux_payload_buf, nbytes); +- if (err) ++ if (err) { ++ kvfree(aux_payload_buf); + goto out; ++ } + kvfree(rpc_resp); + } else { + err = ksmbd_iov_pin_rsp(work, (void *)rsp, +@@ -6386,8 +6388,10 @@ int smb2_read(struct ksmbd_work *work) + err = ksmbd_iov_pin_rsp_read(work, (void *)rsp, + offsetof(struct smb2_read_rsp, Buffer), + aux_payload_buf, nbytes); +- if (err) ++ if (err) { ++ kvfree(aux_payload_buf); + goto out; ++ } + ksmbd_fd_put(work, fp); + return 0; + +-- +2.43.0 + diff --git a/queue-5.15/pmdomain-mediatek-fix-race-conditions-with-genpd.patch b/queue-5.15/pmdomain-mediatek-fix-race-conditions-with-genpd.patch new file mode 100644 index 00000000000..331695ff688 --- /dev/null +++ b/queue-5.15/pmdomain-mediatek-fix-race-conditions-with-genpd.patch @@ -0,0 +1,80 @@ +From b5a0d374739adce526350da6980e8c1a9d0cc87f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Dec 2023 15:36:15 +0200 +Subject: pmdomain: mediatek: fix race conditions with genpd + +From: Eugen Hristev + +[ Upstream commit c41336f4d69057cbf88fed47951379b384540df5 ] + +If the power domains are registered first with genpd and *after that* +the driver attempts to power them on in the probe sequence, then it is +possible that a race condition occurs if genpd tries to power them on +in the same time. +The same is valid for powering them off before unregistering them +from genpd. +Attempt to fix race conditions by first removing the domains from genpd +and *after that* powering down domains. +Also first power up the domains and *after that* register them +to genpd. + +Fixes: 59b644b01cf4 ("soc: mediatek: Add MediaTek SCPSYS power domains") +Signed-off-by: Eugen Hristev +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20231225133615.78993-1-eugen.hristev@collabora.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-pm-domains.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/drivers/soc/mediatek/mtk-pm-domains.c b/drivers/soc/mediatek/mtk-pm-domains.c +index 52ecde8e446cf..9e649b7077c6a 100644 +--- a/drivers/soc/mediatek/mtk-pm-domains.c ++++ b/drivers/soc/mediatek/mtk-pm-domains.c +@@ -493,6 +493,11 @@ static int scpsys_add_subdomain(struct scpsys *scpsys, struct device_node *paren + goto err_put_node; + } + ++ /* recursive call to add all subdomains */ ++ ret = scpsys_add_subdomain(scpsys, child); ++ if (ret) ++ goto err_put_node; ++ + ret = pm_genpd_add_subdomain(parent_pd, child_pd); + if (ret) { + dev_err(scpsys->dev, "failed to add %s subdomain to parent %s\n", +@@ -502,11 +507,6 @@ static int scpsys_add_subdomain(struct scpsys *scpsys, struct device_node *paren + dev_dbg(scpsys->dev, "%s add subdomain: %s\n", parent_pd->name, + child_pd->name); + } +- +- /* recursive call to add all subdomains */ +- ret = scpsys_add_subdomain(scpsys, child); +- if (ret) +- goto err_put_node; + } + + return 0; +@@ -520,9 +520,6 @@ static void scpsys_remove_one_domain(struct scpsys_domain *pd) + { + int ret; + +- if (scpsys_domain_is_on(pd)) +- scpsys_power_off(&pd->genpd); +- + /* + * We're in the error cleanup already, so we only complain, + * but won't emit another error on top of the original one. +@@ -532,6 +529,8 @@ static void scpsys_remove_one_domain(struct scpsys_domain *pd) + dev_err(pd->scpsys->dev, + "failed to remove domain '%s' : %d - state may be inconsistent\n", + pd->genpd.name, ret); ++ if (scpsys_domain_is_on(pd)) ++ scpsys_power_off(&pd->genpd); + + clk_bulk_put(pd->num_clks, pd->clks); + clk_bulk_put(pd->num_subsys_clks, pd->subsys_clks); +-- +2.43.0 + diff --git a/queue-5.15/pmdomain-renesas-r8a77980-sysc-cr7-must-be-always-on.patch b/queue-5.15/pmdomain-renesas-r8a77980-sysc-cr7-must-be-always-on.patch new file mode 100644 index 00000000000..8303d1432ee --- /dev/null +++ b/queue-5.15/pmdomain-renesas-r8a77980-sysc-cr7-must-be-always-on.patch @@ -0,0 +1,47 @@ +From f3d656c2053957c0239787dc7108f7d1b5d6bc6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jan 2024 17:33:55 +0100 +Subject: pmdomain: renesas: r8a77980-sysc: CR7 must be always on +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit f0e4a1356466ec1858ae8e5c70bea2ce5e55008b ] + +The power domain containing the Cortex-R7 CPU core on the R-Car V3H SoC +must always be in power-on state, unlike on other SoCs in the R-Car Gen3 +family. See Table 9.4 "Power domains" in the R-Car Series, 3rd +Generation Hardware User’s Manual Rev.1.00 and later. + +Fix this by marking the domain as a CPU domain without control +registers, so the driver will not touch it. + +Fixes: 41d6d8bd8ae9 ("soc: renesas: rcar-sysc: add R8A77980 support") +Signed-off-by: Geert Uytterhoeven +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/fdad9a86132d53ecddf72b734dac406915c4edc0.1705076735.git.geert+renesas@glider.be +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/soc/renesas/r8a77980-sysc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/renesas/r8a77980-sysc.c b/drivers/soc/renesas/r8a77980-sysc.c +index 39ca84a67daad..621e411fc9991 100644 +--- a/drivers/soc/renesas/r8a77980-sysc.c ++++ b/drivers/soc/renesas/r8a77980-sysc.c +@@ -25,7 +25,8 @@ static const struct rcar_sysc_area r8a77980_areas[] __initconst = { + PD_CPU_NOCR }, + { "ca53-cpu3", 0x200, 3, R8A77980_PD_CA53_CPU3, R8A77980_PD_CA53_SCU, + PD_CPU_NOCR }, +- { "cr7", 0x240, 0, R8A77980_PD_CR7, R8A77980_PD_ALWAYS_ON }, ++ { "cr7", 0x240, 0, R8A77980_PD_CR7, R8A77980_PD_ALWAYS_ON, ++ PD_CPU_NOCR }, + { "a3ir", 0x180, 0, R8A77980_PD_A3IR, R8A77980_PD_ALWAYS_ON }, + { "a2ir0", 0x400, 0, R8A77980_PD_A2IR0, R8A77980_PD_A3IR }, + { "a2ir1", 0x400, 1, R8A77980_PD_A2IR1, R8A77980_PD_A3IR }, +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 5ecd06429c1..02dc62afee4 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -71,3 +71,6 @@ firewire-core-send-bus-reset-promptly-on-gap-count-e.patch drm-amdgpu-skip-to-program-gfxdec-registers-for-susp.patch drm-amdgpu-reset-gpu-for-s3-suspend-abort-case.patch virtio-blk-ensure-no-requests-in-virtqueues-before-d.patch +pmdomain-mediatek-fix-race-conditions-with-genpd.patch +ksmbd-free-aux-buffer-if-ksmbd_iov_pin_rsp_read-fail.patch +pmdomain-renesas-r8a77980-sysc-cr7-must-be-always-on.patch