From: Sasha Levin Date: Thu, 9 Jun 2022 13:40:33 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.9.318~117 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9d7a3e65d39e7f302c5f7a94edb2e1352e3cef54;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/afs-fix-infinite-loop-found-by-xfstest-generic-676.patch b/queue-5.10/afs-fix-infinite-loop-found-by-xfstest-generic-676.patch new file mode 100644 index 00000000000..08e288e1ad3 --- /dev/null +++ b/queue-5.10/afs-fix-infinite-loop-found-by-xfstest-generic-676.patch @@ -0,0 +1,65 @@ +From a538e5c8845674fed36f42c8d4c990607f34da5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 09:30:40 +0100 +Subject: afs: Fix infinite loop found by xfstest generic/676 + +From: David Howells + +[ Upstream commit 17eabd42560f4636648ad65ba5b20228071e2363 ] + +In AFS, a directory is handled as a file that the client downloads and +parses locally for the purposes of performing lookup and getdents +operations. The in-kernel afs filesystem has a number of functions that +do this. + +A directory file is arranged as a series of 2K blocks divided into +32-byte slots, where a directory entry occupies one or more slots, plus +each block starts with one or more metadata blocks. + +When parsing a block, if the last slots are occupied by a dirent that +occupies more than a single slot and the file position points at a slot +that's not the initial one, the logic in afs_dir_iterate_block() that +skips over it won't advance the file pointer to the end of it. This +will cause an infinite loop in getdents() as it will keep retrying that +block and failing to advance beyond the final entry. + +Fix this by advancing the file pointer if the next entry will be beyond +it when we skip a block. + +This was found by the generic/676 xfstest but can also be triggered with +something like: + + ~/xfstests-dev/src/t_readdir_3 /xfstest.test/z 4000 1 + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +Tested-by: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: http://lore.kernel.org/r/165391973497.110268.2939296942213894166.stgit@warthog.procyon.org.uk/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index 262c0ae505af..159795059547 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -412,8 +412,11 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode, + } + + /* skip if starts before the current position */ +- if (offset < curr) ++ if (offset < curr) { ++ if (next > curr) ++ ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent); + continue; ++ } + + /* found the next entry */ + if (!dir_emit(ctx, dire->u.name, nlen, +-- +2.35.1 + diff --git a/queue-5.10/arm64-initialize-jump-labels-before-setup_machine_fd.patch b/queue-5.10/arm64-initialize-jump-labels-before-setup_machine_fd.patch new file mode 100644 index 00000000000..129dc1e6e30 --- /dev/null +++ b/queue-5.10/arm64-initialize-jump-labels-before-setup_machine_fd.patch @@ -0,0 +1,93 @@ +From 7ead32d48ae1ed5d4d09546bc894b4a18ae70091 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 19:21:09 -0700 +Subject: arm64: Initialize jump labels before setup_machine_fdt() + +From: Stephen Boyd + +[ Upstream commit 73e2d827a501d48dceeb5b9b267a4cd283d6b1ae ] + +A static key warning splat appears during early boot on arm64 systems +that credit randomness from devicetrees that contain an "rng-seed" +property. This is because setup_machine_fdt() is called before +jump_label_init() during setup_arch(). Let's swap the order of these two +calls so that jump labels are initialized before the devicetree is +unflattened and the rng seed is credited. + + static_key_enable_cpuslocked(): static key '0xffffffe51c6fcfc0' used before call to jump_label_init() + WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xb0/0xb8 + Modules linked in: + CPU: 0 PID: 0 Comm: swapper Not tainted 5.18.0+ #224 44b43e377bfc84bc99bb5ab885ff694984ee09ff + pstate: 600001c9 (nZCv dAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : static_key_enable_cpuslocked+0xb0/0xb8 + lr : static_key_enable_cpuslocked+0xb0/0xb8 + sp : ffffffe51c393cf0 + x29: ffffffe51c393cf0 x28: 000000008185054c x27: 00000000f1042f10 + x26: 0000000000000000 x25: 00000000f10302b2 x24: 0000002513200000 + x23: 0000002513200000 x22: ffffffe51c1c9000 x21: fffffffdfdc00000 + x20: ffffffe51c2f0831 x19: ffffffe51c6fcfc0 x18: 00000000ffff1020 + x17: 00000000e1e2ac90 x16: 00000000000000e0 x15: ffffffe51b710708 + x14: 0000000000000066 x13: 0000000000000018 x12: 0000000000000000 + x11: 0000000000000000 x10: 00000000ffffffff x9 : 0000000000000000 + x8 : 0000000000000000 x7 : 61632065726f6665 x6 : 6220646573752027 + x5 : ffffffe51c641d25 x4 : ffffffe51c13142c x3 : ffff0a00ffffff05 + x2 : 40000000ffffe003 x1 : 00000000000001c0 x0 : 0000000000000065 + Call trace: + static_key_enable_cpuslocked+0xb0/0xb8 + static_key_enable+0x2c/0x40 + crng_set_ready+0x24/0x30 + execute_in_process_context+0x80/0x90 + _credit_init_bits+0x100/0x154 + add_bootloader_randomness+0x64/0x78 + early_init_dt_scan_chosen+0x140/0x184 + early_init_dt_scan_nodes+0x28/0x4c + early_init_dt_scan+0x40/0x44 + setup_machine_fdt+0x7c/0x120 + setup_arch+0x74/0x1d8 + start_kernel+0x84/0x44c + __primary_switched+0xc0/0xc8 + ---[ end trace 0000000000000000 ]--- + random: crng init done + Machine model: Google Lazor (rev1 - 2) with LTE + +Cc: Hsin-Yi Wang +Cc: Douglas Anderson +Cc: Ard Biesheuvel +Cc: Steven Rostedt +Cc: Jason A. Donenfeld +Cc: Dominik Brodowski +Fixes: f5bda35fba61 ("random: use static branch for crng_ready()") +Signed-off-by: Stephen Boyd +Reviewed-by: Jason A. Donenfeld +Link: https://lore.kernel.org/r/20220602022109.780348-1-swboyd@chromium.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/setup.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c +index eb4b24652c10..2360ff765979 100644 +--- a/arch/arm64/kernel/setup.c ++++ b/arch/arm64/kernel/setup.c +@@ -300,13 +300,14 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) + early_fixmap_init(); + early_ioremap_init(); + +- setup_machine_fdt(__fdt_pointer); +- + /* + * Initialise the static keys early as they may be enabled by the +- * cpufeature code and early parameters. ++ * cpufeature code, early parameters, and DT setup. + */ + jump_label_init(); ++ ++ setup_machine_fdt(__fdt_pointer); ++ + parse_early_param(); + + /* +-- +2.35.1 + diff --git a/queue-5.10/asoc-fsl_sai-fix-fsl_sai_xdr-xfr-definition.patch b/queue-5.10/asoc-fsl_sai-fix-fsl_sai_xdr-xfr-definition.patch new file mode 100644 index 00000000000..df53efdb24e --- /dev/null +++ b/queue-5.10/asoc-fsl_sai-fix-fsl_sai_xdr-xfr-definition.patch @@ -0,0 +1,40 @@ +From 80b4b5ab02b5efb653e2e9d5cfacc9fa258cd194 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 May 2022 13:44:21 +0800 +Subject: ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition + +From: Shengjiu Wang + +[ Upstream commit e4dd748dc87cf431af7b3954963be0d9f6150217 ] + +There are multiple xDR and xFR registers, the index is +from 0 to 7. FSL_SAI_xDR and FSL_SAI_xFR is abandoned, +replace them with FSL_SAI_xDR0 and FSL_SAI_xFR0. + +Fixes: 4f7a0728b530 ("ASoC: fsl_sai: Add support for SAI new version") +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1653284661-18964-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_sai.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h +index 4bbcd0dbe8f1..8923c680f0e0 100644 +--- a/sound/soc/fsl/fsl_sai.h ++++ b/sound/soc/fsl/fsl_sai.h +@@ -80,8 +80,8 @@ + #define FSL_SAI_xCR3(tx, ofs) (tx ? FSL_SAI_TCR3(ofs) : FSL_SAI_RCR3(ofs)) + #define FSL_SAI_xCR4(tx, ofs) (tx ? FSL_SAI_TCR4(ofs) : FSL_SAI_RCR4(ofs)) + #define FSL_SAI_xCR5(tx, ofs) (tx ? FSL_SAI_TCR5(ofs) : FSL_SAI_RCR5(ofs)) +-#define FSL_SAI_xDR(tx, ofs) (tx ? FSL_SAI_TDR(ofs) : FSL_SAI_RDR(ofs)) +-#define FSL_SAI_xFR(tx, ofs) (tx ? FSL_SAI_TFR(ofs) : FSL_SAI_RFR(ofs)) ++#define FSL_SAI_xDR0(tx) (tx ? FSL_SAI_TDR0 : FSL_SAI_RDR0) ++#define FSL_SAI_xFR0(tx) (tx ? FSL_SAI_TFR0 : FSL_SAI_RFR0) + #define FSL_SAI_xMR(tx) (tx ? FSL_SAI_TMR : FSL_SAI_RMR) + + /* SAI Transmit/Receive Control Register */ +-- +2.35.1 + diff --git a/queue-5.10/bpf-fix-probe-read-error-in-___bpf_prog_run.patch b/queue-5.10/bpf-fix-probe-read-error-in-___bpf_prog_run.patch new file mode 100644 index 00000000000..bbd7f784039 --- /dev/null +++ b/queue-5.10/bpf-fix-probe-read-error-in-___bpf_prog_run.patch @@ -0,0 +1,95 @@ +From 9307b6e6be94e5ab780cb7a13aae463a9f789aee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 10:12:27 +0800 +Subject: bpf: Fix probe read error in ___bpf_prog_run() + +From: Menglong Dong + +[ Upstream commit caff1fa4118cec4dfd4336521ebd22a6408a1e3e ] + +I think there is something wrong with BPF_PROBE_MEM in ___bpf_prog_run() +in big-endian machine. Let's make a test and see what will happen if we +want to load a 'u16' with BPF_PROBE_MEM. + +Let's make the src value '0x0001', the value of dest register will become +0x0001000000000000, as the value will be loaded to the first 2 byte of +DST with following code: + + bpf_probe_read_kernel(&DST, SIZE, (const void *)(long) (SRC + insn->off)); + +Obviously, the value in DST is not correct. In fact, we can compare +BPF_PROBE_MEM with LDX_MEM_H: + + DST = *(SIZE *)(unsigned long) (SRC + insn->off); + +If the memory load is done by LDX_MEM_H, the value in DST will be 0x1 now. + +And I think this error results in the test case 'test_bpf_sk_storage_map' +failing: + + test_bpf_sk_storage_map:PASS:bpf_iter_bpf_sk_storage_map__open_and_load 0 nsec + test_bpf_sk_storage_map:PASS:socket 0 nsec + test_bpf_sk_storage_map:PASS:map_update 0 nsec + test_bpf_sk_storage_map:PASS:socket 0 nsec + test_bpf_sk_storage_map:PASS:map_update 0 nsec + test_bpf_sk_storage_map:PASS:socket 0 nsec + test_bpf_sk_storage_map:PASS:map_update 0 nsec + test_bpf_sk_storage_map:PASS:attach_iter 0 nsec + test_bpf_sk_storage_map:PASS:create_iter 0 nsec + test_bpf_sk_storage_map:PASS:read 0 nsec + test_bpf_sk_storage_map:FAIL:ipv6_sk_count got 0 expected 3 + $10/26 bpf_iter/bpf_sk_storage_map:FAIL + +The code of the test case is simply, it will load sk->sk_family to the +register with BPF_PROBE_MEM and check if it is AF_INET6. With this patch, +now the test case 'bpf_iter' can pass: + + $10 bpf_iter:OK + +Fixes: 2a02759ef5f8 ("bpf: Add support for BTF pointers to interpreter") +Signed-off-by: Menglong Dong +Signed-off-by: Daniel Borkmann +Reviewed-by: Jiang Biao +Reviewed-by: Hao Peng +Cc: Ilya Leoshkevich +Link: https://lore.kernel.org/bpf/20220524021228.533216-1-imagedong@tencent.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/core.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index d3a1f25f8ec2..845a4c052433 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -1653,6 +1653,11 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) + CONT; \ + LDX_MEM_##SIZEOP: \ + DST = *(SIZE *)(unsigned long) (SRC + insn->off); \ ++ CONT; \ ++ LDX_PROBE_MEM_##SIZEOP: \ ++ bpf_probe_read_kernel(&DST, sizeof(SIZE), \ ++ (const void *)(long) (SRC + insn->off)); \ ++ DST = *((SIZE *)&DST); \ + CONT; + + LDST(B, u8) +@@ -1660,15 +1665,6 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) + LDST(W, u32) + LDST(DW, u64) + #undef LDST +-#define LDX_PROBE(SIZEOP, SIZE) \ +- LDX_PROBE_MEM_##SIZEOP: \ +- bpf_probe_read_kernel(&DST, SIZE, (const void *)(long) (SRC + insn->off)); \ +- CONT; +- LDX_PROBE(B, 1) +- LDX_PROBE(H, 2) +- LDX_PROBE(W, 4) +- LDX_PROBE(DW, 8) +-#undef LDX_PROBE + + STX_XADD_W: /* lock xadd *(u32 *)(dst_reg + off16) += src_reg */ + atomic_add((u32) SRC, (atomic_t *)(unsigned long) +-- +2.35.1 + diff --git a/queue-5.10/bus-ti-sysc-fix-warnings-for-unbind-for-serial.patch b/queue-5.10/bus-ti-sysc-fix-warnings-for-unbind-for-serial.patch new file mode 100644 index 00000000000..8e957bbba9d --- /dev/null +++ b/queue-5.10/bus-ti-sysc-fix-warnings-for-unbind-for-serial.patch @@ -0,0 +1,45 @@ +From 889d6f98828d7bad79214ef4905aec8d23ad33ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 08:30:21 +0300 +Subject: bus: ti-sysc: Fix warnings for unbind for serial + +From: Tony Lindgren + +[ Upstream commit c337125b8834f9719dfda0e40b25eaa266f1b8cf ] + +We can get "failed to disable" clock_unprepare warnings on unbind at least +for the serial console device if the unbind is done before the device has +been idled. + +As some devices are using deferred idle, we must check the status for +pending idle work to idle the device. + +Fixes: 76f0f772e469 ("bus: ti-sysc: Improve handling for no-reset-on-init and no-idle-on-init") +Cc: Romain Naour +Reviewed-by: Romain Naour +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20220512053021.61650-1-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index ac559c262033..4ee20be76508 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -3291,7 +3291,9 @@ static int sysc_remove(struct platform_device *pdev) + struct sysc *ddata = platform_get_drvdata(pdev); + int error; + +- cancel_delayed_work_sync(&ddata->idle_work); ++ /* Device can still be enabled, see deferred idle quirk in probe */ ++ if (cancel_delayed_work_sync(&ddata->idle_work)) ++ ti_sysc_idle(&ddata->idle_work.work); + + error = pm_runtime_get_sync(ddata->dev); + if (error < 0) { +-- +2.35.1 + diff --git a/queue-5.10/clocksource-drivers-oxnas-rps-fix-irq_of_parse_and_m.patch b/queue-5.10/clocksource-drivers-oxnas-rps-fix-irq_of_parse_and_m.patch new file mode 100644 index 00000000000..105a12f3a85 --- /dev/null +++ b/queue-5.10/clocksource-drivers-oxnas-rps-fix-irq_of_parse_and_m.patch @@ -0,0 +1,38 @@ +From e73239e27e988d2e42ef31f9c218447b8b9f361c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 12:41:01 +0200 +Subject: clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return + value + +From: Krzysztof Kozlowski + +[ Upstream commit 9c04a8ff03def4df3f81219ffbe1ec9b44ff5348 ] + +The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO. + +Fixes: 89355274e1f7 ("clocksource/drivers/oxnas-rps: Add Oxford Semiconductor RPS Dual Timer") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220422104101.55754-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-oxnas-rps.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-oxnas-rps.c b/drivers/clocksource/timer-oxnas-rps.c +index 56c0cc32d0ac..d514b44e67dd 100644 +--- a/drivers/clocksource/timer-oxnas-rps.c ++++ b/drivers/clocksource/timer-oxnas-rps.c +@@ -236,7 +236,7 @@ static int __init oxnas_rps_timer_init(struct device_node *np) + } + + rps->irq = irq_of_parse_and_map(np, 0); +- if (rps->irq < 0) { ++ if (!rps->irq) { + ret = -EINVAL; + goto err_iomap; + } +-- +2.35.1 + diff --git a/queue-5.10/clocksource-drivers-riscv-events-are-stopped-during-.patch b/queue-5.10/clocksource-drivers-riscv-events-are-stopped-during-.patch new file mode 100644 index 00000000000..b9046cf5a19 --- /dev/null +++ b/queue-5.10/clocksource-drivers-riscv-events-are-stopped-during-.patch @@ -0,0 +1,40 @@ +From 04e00f379dcc2bc003d1d91ad3398fe6b09c1896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 May 2022 20:21:21 -0500 +Subject: clocksource/drivers/riscv: Events are stopped during CPU suspend + +From: Samuel Holland + +[ Upstream commit 232ccac1bd9b5bfe73895f527c08623e7fa0752d ] + +Some implementations of the SBI time extension depend on hart-local +state (for example, CSRs) that are lost or hardware that is powered +down when a CPU is suspended. To be safe, the clockevents driver +cannot assume that timer IRQs will be received during CPU suspend. + +Fixes: 62b019436814 ("clocksource: new RISC-V SBI timer driver") +Signed-off-by: Samuel Holland +Reviewed-by: Anup Patel +Link: https://lore.kernel.org/r/20220509012121.40031-1-samuel@sholland.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-riscv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c +index c51c5ed15aa7..0e7748df4be3 100644 +--- a/drivers/clocksource/timer-riscv.c ++++ b/drivers/clocksource/timer-riscv.c +@@ -32,7 +32,7 @@ static int riscv_clock_next_event(unsigned long delta, + static unsigned int riscv_clock_event_irq; + static DEFINE_PER_CPU(struct clock_event_device, riscv_clock_event) = { + .name = "riscv_timer_clockevent", +- .features = CLOCK_EVT_FEAT_ONESHOT, ++ .features = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_C3STOP, + .rating = 100, + .set_next_event = riscv_clock_next_event, + }; +-- +2.35.1 + diff --git a/queue-5.10/coresight-cpu-debug-replace-mutex-with-mutex_trylock.patch b/queue-5.10/coresight-cpu-debug-replace-mutex-with-mutex_trylock.patch new file mode 100644 index 00000000000..fd2e1ca9dfc --- /dev/null +++ b/queue-5.10/coresight-cpu-debug-replace-mutex-with-mutex_trylock.patch @@ -0,0 +1,64 @@ +From 737a464239c0510c865d0941fbaaf0af8f02a901 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 19:49:03 -0300 +Subject: coresight: cpu-debug: Replace mutex with mutex_trylock on panic + notifier + +From: Guilherme G. Piccoli + +[ Upstream commit 1adff542d67a2ed1120955cb219bfff8a9c53f59 ] + +The panic notifier infrastructure executes registered callbacks when +a panic event happens - such callbacks are executed in atomic context, +with interrupts and preemption disabled in the running CPU and all other +CPUs disabled. That said, mutexes in such context are not a good idea. + +This patch replaces a regular mutex with a mutex_trylock safer approach; +given the nature of the mutex used in the driver, it should be pretty +uncommon being unable to acquire such mutex in the panic path, hence +no functional change should be observed (and if it is, that would be +likely a deadlock with the regular mutex). + +Fixes: 2227b7c74634 ("coresight: add support for CPU debug module") +Cc: Leo Yan +Cc: Mathieu Poirier +Cc: Mike Leach +Cc: Suzuki K Poulose +Signed-off-by: Guilherme G. Piccoli +Reviewed-by: Suzuki K Poulose +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20220427224924.592546-10-gpiccoli@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cpu-debug.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c +index 2dcf13de751f..1e98562f4287 100644 +--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c ++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c +@@ -379,9 +379,10 @@ static int debug_notifier_call(struct notifier_block *self, + int cpu; + struct debug_drvdata *drvdata; + +- mutex_lock(&debug_lock); ++ /* Bail out if we can't acquire the mutex or the functionality is off */ ++ if (!mutex_trylock(&debug_lock)) ++ return NOTIFY_DONE; + +- /* Bail out if the functionality is disabled */ + if (!debug_enable) + goto skip_dump; + +@@ -400,7 +401,7 @@ static int debug_notifier_call(struct notifier_block *self, + + skip_dump: + mutex_unlock(&debug_lock); +- return 0; ++ return NOTIFY_DONE; + } + + static struct notifier_block debug_notifier = { +-- +2.35.1 + diff --git a/queue-5.10/driver-base-fix-uaf-when-driver_attach-failed.patch b/queue-5.10/driver-base-fix-uaf-when-driver_attach-failed.patch new file mode 100644 index 00000000000..559d32d6629 --- /dev/null +++ b/queue-5.10/driver-base-fix-uaf-when-driver_attach-failed.patch @@ -0,0 +1,48 @@ +From deecb71229658fc36f4bdfd9c1550ec92950ea19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 19:24:44 +0800 +Subject: driver: base: fix UAF when driver_attach failed + +From: Schspa Shi + +[ Upstream commit 310862e574001a97ad02272bac0fd13f75f42a27 ] + +When driver_attach(drv); failed, the driver_private will be freed. +But it has been added to the bus, which caused a UAF. + +To fix it, we need to delete it from the bus when failed. + +Fixes: 190888ac01d0 ("driver core: fix possible missing of device probe") +Signed-off-by: Schspa Shi +Link: https://lore.kernel.org/r/20220513112444.45112-1-schspa@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/bus.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/bus.c b/drivers/base/bus.c +index a9c23ecebc7c..df85e928b97f 100644 +--- a/drivers/base/bus.c ++++ b/drivers/base/bus.c +@@ -621,7 +621,7 @@ int bus_add_driver(struct device_driver *drv) + if (drv->bus->p->drivers_autoprobe) { + error = driver_attach(drv); + if (error) +- goto out_unregister; ++ goto out_del_list; + } + module_add_driver(drv->owner, drv); + +@@ -648,6 +648,8 @@ int bus_add_driver(struct device_driver *drv) + + return 0; + ++out_del_list: ++ klist_del(&priv->knode_bus); + out_unregister: + kobject_put(&priv->kobj); + /* drv->p is freed in driver_release() */ +-- +2.35.1 + diff --git a/queue-5.10/driver-core-fix-deadlock-in-__device_attach.patch b/queue-5.10/driver-core-fix-deadlock-in-__device_attach.patch new file mode 100644 index 00000000000..0eafc57d248 --- /dev/null +++ b/queue-5.10/driver-core-fix-deadlock-in-__device_attach.patch @@ -0,0 +1,79 @@ +From 187bcdd3a05c20c9374825fa8cc1530e1e3225aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 15:45:16 +0800 +Subject: driver core: fix deadlock in __device_attach + +From: Zhang Wensheng + +[ Upstream commit b232b02bf3c205b13a26dcec08e53baddd8e59ed ] + +In __device_attach function, The lock holding logic is as follows: +... +__device_attach +device_lock(dev) // get lock dev + async_schedule_dev(__device_attach_async_helper, dev); // func + async_schedule_node + async_schedule_node_domain(func) + entry = kzalloc(sizeof(struct async_entry), GFP_ATOMIC); + /* when fail or work limit, sync to execute func, but + __device_attach_async_helper will get lock dev as + well, which will lead to A-A deadlock. */ + if (!entry || atomic_read(&entry_count) > MAX_WORK) { + func; + else + queue_work_node(node, system_unbound_wq, &entry->work) + device_unlock(dev) + +As shown above, when it is allowed to do async probes, because of +out of memory or work limit, async work is not allowed, to do +sync execute instead. it will lead to A-A deadlock because of +__device_attach_async_helper getting lock dev. + +To fix the deadlock, move the async_schedule_dev outside device_lock, +as we can see, in async_schedule_node_domain, the parameter of +queue_work_node is system_unbound_wq, so it can accept concurrent +operations. which will also not change the code logic, and will +not lead to deadlock. + +Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers") +Signed-off-by: Zhang Wensheng +Link: https://lore.kernel.org/r/20220518074516.1225580-1-zhangwensheng5@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/dd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 2728223c1fbc..4f4e8aedbd2c 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -897,6 +897,7 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie) + static int __device_attach(struct device *dev, bool allow_async) + { + int ret = 0; ++ bool async = false; + + device_lock(dev); + if (dev->p->dead) { +@@ -935,7 +936,7 @@ static int __device_attach(struct device *dev, bool allow_async) + */ + dev_dbg(dev, "scheduling asynchronous probe\n"); + get_device(dev); +- async_schedule_dev(__device_attach_async_helper, dev); ++ async = true; + } else { + pm_request_idle(dev); + } +@@ -945,6 +946,8 @@ static int __device_attach(struct device *dev, bool allow_async) + } + out_unlock: + device_unlock(dev); ++ if (async) ++ async_schedule_dev(__device_attach_async_helper, dev); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.10/driver-core-fix-wait_for_device_probe-deferred_probe.patch b/queue-5.10/driver-core-fix-wait_for_device_probe-deferred_probe.patch new file mode 100644 index 00000000000..26e449a1952 --- /dev/null +++ b/queue-5.10/driver-core-fix-wait_for_device_probe-deferred_probe.patch @@ -0,0 +1,107 @@ +From 328c969650b7ecb222121fe6ee9cdacda7c24bd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 13:31:37 +0200 +Subject: driver core: Fix wait_for_device_probe() & deferred_probe_timeout + interaction + +From: Saravana Kannan + +[ Upstream commit 5ee76c256e928455212ab759c51d198fedbe7523 ] + +Mounting NFS rootfs was timing out when deferred_probe_timeout was +non-zero [1]. This was because ip_auto_config() initcall times out +waiting for the network interfaces to show up when +deferred_probe_timeout was non-zero. While ip_auto_config() calls +wait_for_device_probe() to make sure any currently running deferred +probe work or asynchronous probe finishes, that wasn't sufficient to +account for devices being deferred until deferred_probe_timeout. + +Commit 35a672363ab3 ("driver core: Ensure wait_for_device_probe() waits +until the deferred_probe_timeout fires") tried to fix that by making +sure wait_for_device_probe() waits for deferred_probe_timeout to expire +before returning. + +However, if wait_for_device_probe() is called from the kernel_init() +context: + +- Before deferred_probe_initcall() [2], it causes the boot process to + hang due to a deadlock. + +- After deferred_probe_initcall() [3], it blocks kernel_init() from + continuing till deferred_probe_timeout expires and beats the point of + deferred_probe_timeout that's trying to wait for userspace to load + modules. + +Neither of this is good. So revert the changes to +wait_for_device_probe(). + +[1] - https://lore.kernel.org/lkml/TYAPR01MB45443DF63B9EF29054F7C41FD8C60@TYAPR01MB4544.jpnprd01.prod.outlook.com/ +[2] - https://lore.kernel.org/lkml/YowHNo4sBjr9ijZr@dev-arch.thelio-3990X/ +[3] - https://lore.kernel.org/lkml/Yo3WvGnNk3LvLb7R@linutronix.de/ + +Fixes: 35a672363ab3 ("driver core: Ensure wait_for_device_probe() waits until the deferred_probe_timeout fires") +Cc: John Stultz +Cc: "David S. Miller" +Cc: Alexey Kuznetsov +Cc: Hideaki YOSHIFUJI +Cc: Jakub Kicinski +Cc: Rob Herring +Cc: Geert Uytterhoeven +Cc: Yoshihiro Shimoda +Cc: Robin Murphy +Cc: Andy Shevchenko +Cc: Sudeep Holla +Cc: Andy Shevchenko +Cc: Naresh Kamboju +Cc: Basil Eljuse +Cc: Ferry Toth +Cc: Arnd Bergmann +Cc: Anders Roxell +Cc: linux-pm@vger.kernel.org +Reported-by: Nathan Chancellor +Reported-by: Sebastian Andrzej Siewior +Tested-by: Geert Uytterhoeven +Acked-by: John Stultz +Signed-off-by: Saravana Kannan +Link: https://lore.kernel.org/r/20220526034609.480766-2-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Reviewed-by: Rafael J. Wysocki +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/base/dd.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 4f4e8aedbd2c..f9d9f1ad9215 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -250,7 +250,6 @@ DEFINE_SHOW_ATTRIBUTE(deferred_devs); + + int driver_deferred_probe_timeout; + EXPORT_SYMBOL_GPL(driver_deferred_probe_timeout); +-static DECLARE_WAIT_QUEUE_HEAD(probe_timeout_waitqueue); + + static int __init deferred_probe_timeout_setup(char *str) + { +@@ -302,7 +301,6 @@ static void deferred_probe_timeout_work_func(struct work_struct *work) + list_for_each_entry(p, &deferred_probe_pending_list, deferred_probe) + dev_info(p->device, "deferred probe pending\n"); + mutex_unlock(&deferred_probe_mutex); +- wake_up_all(&probe_timeout_waitqueue); + } + static DECLARE_DELAYED_WORK(deferred_probe_timeout_work, deferred_probe_timeout_work_func); + +@@ -706,9 +704,6 @@ int driver_probe_done(void) + */ + void wait_for_device_probe(void) + { +- /* wait for probe timeout */ +- wait_event(probe_timeout_waitqueue, !driver_deferred_probe_timeout); +- + /* wait for the deferred probe workqueue to finish */ + flush_work(&deferred_probe_work); + +-- +2.35.1 + diff --git a/queue-5.10/extcon-ptn5150-add-queue-work-sync-before-driver-rel.patch b/queue-5.10/extcon-ptn5150-add-queue-work-sync-before-driver-rel.patch new file mode 100644 index 00000000000..7f889184017 --- /dev/null +++ b/queue-5.10/extcon-ptn5150-add-queue-work-sync-before-driver-rel.patch @@ -0,0 +1,53 @@ +From 83ea1d64b17c3d94494801e77455b56b7a9817c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 20:44:08 +0800 +Subject: extcon: ptn5150: Add queue work sync before driver release + +From: Li Jun + +[ Upstream commit 782cd939cbe0f569197cd1c9b0477ee213167f04 ] + +Add device managed action to sync pending queue work, otherwise +the queued work may run after the work is destroyed. + +Fixes: 4ed754de2d66 ("extcon: Add support for ptn5150 extcon driver") +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Li Jun +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-ptn5150.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/extcon/extcon-ptn5150.c b/drivers/extcon/extcon-ptn5150.c +index 5b9a3cf8df26..2a7874108df8 100644 +--- a/drivers/extcon/extcon-ptn5150.c ++++ b/drivers/extcon/extcon-ptn5150.c +@@ -194,6 +194,13 @@ static int ptn5150_init_dev_type(struct ptn5150_info *info) + return 0; + } + ++static void ptn5150_work_sync_and_put(void *data) ++{ ++ struct ptn5150_info *info = data; ++ ++ cancel_work_sync(&info->irq_work); ++} ++ + static int ptn5150_i2c_probe(struct i2c_client *i2c) + { + struct device *dev = &i2c->dev; +@@ -284,6 +291,10 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c) + if (ret) + return -EINVAL; + ++ ret = devm_add_action_or_reset(dev, ptn5150_work_sync_and_put, info); ++ if (ret) ++ return ret; ++ + /* + * Update current extcon state if for example OTG connection was there + * before the probe +-- +2.35.1 + diff --git a/queue-5.10/firmware-dmi-sysfs-fix-memory-leak-in-dmi_sysfs_regi.patch b/queue-5.10/firmware-dmi-sysfs-fix-memory-leak-in-dmi_sysfs_regi.patch new file mode 100644 index 00000000000..8d1f4d6ad16 --- /dev/null +++ b/queue-5.10/firmware-dmi-sysfs-fix-memory-leak-in-dmi_sysfs_regi.patch @@ -0,0 +1,42 @@ +From d7812d5ed601065d133d6f1aacbe68d0a5b52ea5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 11:14:19 +0400 +Subject: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle + +From: Miaoqian Lin + +[ Upstream commit 660ba678f9998aca6db74f2dd912fa5124f0fa31 ] + +kobject_init_and_add() takes reference even when it fails. +According to the doc of kobject_init_and_add() + + If this function returns an error, kobject_put() must be called to + properly clean up the memory associated with the object. + +Fix this issue by calling kobject_put(). + +Fixes: 948af1f0bbc8 ("firmware: Basic dmi-sysfs support") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220511071421.9769-1-linmq006@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/dmi-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c +index 8b8127fa8955..4a93fb490cb4 100644 +--- a/drivers/firmware/dmi-sysfs.c ++++ b/drivers/firmware/dmi-sysfs.c +@@ -603,7 +603,7 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, + "%d-%d", dh->type, entry->instance); + + if (*ret) { +- kfree(entry); ++ kobject_put(&entry->kobj); + return; + } + +-- +2.35.1 + diff --git a/queue-5.10/firmware-stratix10-svc-fix-a-missing-check-on-list-i.patch b/queue-5.10/firmware-stratix10-svc-fix-a-missing-check-on-list-i.patch new file mode 100644 index 00000000000..052d9f8be21 --- /dev/null +++ b/queue-5.10/firmware-stratix10-svc-fix-a-missing-check-on-list-i.patch @@ -0,0 +1,60 @@ +From d573be90df507516102b76777d7fdd9892035f53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 11:56:09 +0800 +Subject: firmware: stratix10-svc: fix a missing check on list iterator + +From: Xiaomeng Tong + +[ Upstream commit 5a0793ac66ac0e254d292f129a4d6c526f9f2aff ] + +The bug is here: + pmem->vaddr = NULL; + +The list iterator 'pmem' will point to a bogus position containing +HEAD if the list is empty or no element is found. This case must +be checked before any use of the iterator, otherwise it will +lead to a invalid memory access. + +To fix this bug, just gen_pool_free/set NULL/list_del() and return +when found, otherwise list_del HEAD and return; + +Fixes: 7ca5ce896524f ("firmware: add Intel Stratix10 service layer driver") +Signed-off-by: Xiaomeng Tong +Link: https://lore.kernel.org/r/20220414035609.2239-1-xiam0nd.tong@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/stratix10-svc.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index 53c7e3f8cfde..7dd0ac1a0cfc 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -941,17 +941,17 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory); + void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr) + { + struct stratix10_svc_data_mem *pmem; +- size_t size = 0; + + list_for_each_entry(pmem, &svc_data_mem, node) + if (pmem->vaddr == kaddr) { +- size = pmem->size; +- break; ++ gen_pool_free(chan->ctrl->genpool, ++ (unsigned long)kaddr, pmem->size); ++ pmem->vaddr = NULL; ++ list_del(&pmem->node); ++ return; + } + +- gen_pool_free(chan->ctrl->genpool, (unsigned long)kaddr, size); +- pmem->vaddr = NULL; +- list_del(&pmem->node); ++ list_del(&svc_data_mem); + } + EXPORT_SYMBOL_GPL(stratix10_svc_free_memory); + +-- +2.35.1 + diff --git a/queue-5.10/gpio-pca953x-use-the-correct-register-address-to-do-.patch b/queue-5.10/gpio-pca953x-use-the-correct-register-address-to-do-.patch new file mode 100644 index 00000000000..8a1f5601ea9 --- /dev/null +++ b/queue-5.10/gpio-pca953x-use-the-correct-register-address-to-do-.patch @@ -0,0 +1,76 @@ +From ba76feb515b0769e813d7ebad7861f270f767f1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 18:48:48 +0800 +Subject: gpio: pca953x: use the correct register address to do regcache sync + +From: Haibo Chen + +[ Upstream commit 43624eda86c98b0de726d0b6f2516ccc3ef7313f ] + +For regcache_sync_region, need to use pca953x_recalc_addr() to get +the real register address. + +Fixes: b76574300504 ("gpio: pca953x: Restore registers after suspend/resume cycle") +Signed-off-by: Haibo Chen +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index e936e1eb1f95..bb4ca064447e 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -1107,20 +1107,21 @@ static int pca953x_regcache_sync(struct device *dev) + { + struct pca953x_chip *chip = dev_get_drvdata(dev); + int ret; ++ u8 regaddr; + + /* + * The ordering between direction and output is important, + * sync these registers first and only then sync the rest. + */ +- ret = regcache_sync_region(chip->regmap, chip->regs->direction, +- chip->regs->direction + NBANK(chip)); ++ regaddr = pca953x_recalc_addr(chip, chip->regs->direction, 0); ++ ret = regcache_sync_region(chip->regmap, regaddr, regaddr + NBANK(chip)); + if (ret) { + dev_err(dev, "Failed to sync GPIO dir registers: %d\n", ret); + return ret; + } + +- ret = regcache_sync_region(chip->regmap, chip->regs->output, +- chip->regs->output + NBANK(chip)); ++ regaddr = pca953x_recalc_addr(chip, chip->regs->output, 0); ++ ret = regcache_sync_region(chip->regmap, regaddr, regaddr + NBANK(chip)); + if (ret) { + dev_err(dev, "Failed to sync GPIO out registers: %d\n", ret); + return ret; +@@ -1128,16 +1129,18 @@ static int pca953x_regcache_sync(struct device *dev) + + #ifdef CONFIG_GPIO_PCA953X_IRQ + if (chip->driver_data & PCA_PCAL) { +- ret = regcache_sync_region(chip->regmap, PCAL953X_IN_LATCH, +- PCAL953X_IN_LATCH + NBANK(chip)); ++ regaddr = pca953x_recalc_addr(chip, PCAL953X_IN_LATCH, 0); ++ ret = regcache_sync_region(chip->regmap, regaddr, ++ regaddr + NBANK(chip)); + if (ret) { + dev_err(dev, "Failed to sync INT latch registers: %d\n", + ret); + return ret; + } + +- ret = regcache_sync_region(chip->regmap, PCAL953X_INT_MASK, +- PCAL953X_INT_MASK + NBANK(chip)); ++ regaddr = pca953x_recalc_addr(chip, PCAL953X_INT_MASK, 0); ++ ret = regcache_sync_region(chip->regmap, regaddr, ++ regaddr + NBANK(chip)); + if (ret) { + dev_err(dev, "Failed to sync INT mask registers: %d\n", + ret); +-- +2.35.1 + diff --git a/queue-5.10/iio-adc-ad7124-remove-shift-from-scan_type.patch b/queue-5.10/iio-adc-ad7124-remove-shift-from-scan_type.patch new file mode 100644 index 00000000000..91d9cf379c7 --- /dev/null +++ b/queue-5.10/iio-adc-ad7124-remove-shift-from-scan_type.patch @@ -0,0 +1,36 @@ +From 92ea92a38df25f5d37b93f6ff59eea861d3bf23d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Mar 2022 12:50:24 +0200 +Subject: iio: adc: ad7124: Remove shift from scan_type + +From: Alexandru Tachici + +[ Upstream commit fe78ccf79b0e29fd6d8dc2e2c3b0dbeda4ce3ad8 ] + +The 24 bits data is stored in 32 bits in BE. There +is no need to shift it. This confuses user-space apps. + +Fixes: b3af341bbd966 ("iio: adc: Add ad7124 support") +Signed-off-by: Alexandru Tachici +Link: https://lore.kernel.org/r/20220322105029.86389-2-alexandru.tachici@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad7124.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c +index bd3500995037..19ab7d7251bc 100644 +--- a/drivers/iio/adc/ad7124.c ++++ b/drivers/iio/adc/ad7124.c +@@ -170,7 +170,6 @@ static const struct iio_chan_spec ad7124_channel_template = { + .sign = 'u', + .realbits = 24, + .storagebits = 32, +- .shift = 8, + .endianness = IIO_BE, + }, + }; +-- +2.35.1 + diff --git a/queue-5.10/iio-adc-sc27xx-fine-tune-the-scale-calibration-value.patch b/queue-5.10/iio-adc-sc27xx-fine-tune-the-scale-calibration-value.patch new file mode 100644 index 00000000000..e0094aa0ed6 --- /dev/null +++ b/queue-5.10/iio-adc-sc27xx-fine-tune-the-scale-calibration-value.patch @@ -0,0 +1,64 @@ +From 75abe33b3c387606e9d23c3628629137c11bb9a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 22:24:54 +0800 +Subject: iio: adc: sc27xx: Fine tune the scale calibration values + +From: Cixi Geng + +[ Upstream commit 5a7a184b11c6910f47600ff5cbbee34168f701a8 ] + +Small adjustment the scale calibration value for the sc2731, +use new name sc2731_[big|small]_scale_graph_calib, and remove +the origin [big|small]_scale_graph_calib struct for unused. + +Fixes: 8ba0dbfd07a35 (iio: adc: sc27xx: Add ADC scale calibration) +Signed-off-by: Cixi Geng +Link: https://lore.kernel.org/r/20220419142458.884933-4-gengcixi@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/sc27xx_adc.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/iio/adc/sc27xx_adc.c b/drivers/iio/adc/sc27xx_adc.c +index 2c0d0d1634c8..2b463e1cf1c7 100644 +--- a/drivers/iio/adc/sc27xx_adc.c ++++ b/drivers/iio/adc/sc27xx_adc.c +@@ -103,14 +103,14 @@ static struct sc27xx_adc_linear_graph small_scale_graph = { + 100, 341, + }; + +-static const struct sc27xx_adc_linear_graph big_scale_graph_calib = { +- 4200, 856, +- 3600, 733, ++static const struct sc27xx_adc_linear_graph sc2731_big_scale_graph_calib = { ++ 4200, 850, ++ 3600, 728, + }; + +-static const struct sc27xx_adc_linear_graph small_scale_graph_calib = { +- 1000, 833, +- 100, 80, ++static const struct sc27xx_adc_linear_graph sc2731_small_scale_graph_calib = { ++ 1000, 838, ++ 100, 84, + }; + + static int sc27xx_adc_get_calib_data(u32 calib_data, int calib_adc) +@@ -130,11 +130,11 @@ static int sc27xx_adc_scale_calibration(struct sc27xx_adc_data *data, + size_t len; + + if (big_scale) { +- calib_graph = &big_scale_graph_calib; ++ calib_graph = &sc2731_big_scale_graph_calib; + graph = &big_scale_graph; + cell_name = "big_scale_calib"; + } else { +- calib_graph = &small_scale_graph_calib; ++ calib_graph = &sc2731_small_scale_graph_calib; + graph = &small_scale_graph; + cell_name = "small_scale_calib"; + } +-- +2.35.1 + diff --git a/queue-5.10/iio-adc-sc27xx-fix-read-big-scale-voltage-not-right.patch b/queue-5.10/iio-adc-sc27xx-fix-read-big-scale-voltage-not-right.patch new file mode 100644 index 00000000000..b6657dbb141 --- /dev/null +++ b/queue-5.10/iio-adc-sc27xx-fix-read-big-scale-voltage-not-right.patch @@ -0,0 +1,40 @@ +From 644e233b68abdce0e519021116f5e0901b1f561f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 22:24:53 +0800 +Subject: iio: adc: sc27xx: fix read big scale voltage not right + +From: Cixi Geng + +[ Upstream commit ad930a75613282400179361e220e58b87386b8c7 ] + +Fix wrong configuration value of SC27XX_ADC_SCALE_MASK and +SC27XX_ADC_SCALE_SHIFT by spec documetation. + +Fixes: 5df362a6cf49c (iio: adc: Add Spreadtrum SC27XX PMICs ADC support) +Signed-off-by: Cixi Geng +Reviewed-by: Baolin Wang +Link: https://lore.kernel.org/r/20220419142458.884933-3-gengcixi@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/sc27xx_adc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/adc/sc27xx_adc.c b/drivers/iio/adc/sc27xx_adc.c +index aa32a1f385e2..2c0d0d1634c8 100644 +--- a/drivers/iio/adc/sc27xx_adc.c ++++ b/drivers/iio/adc/sc27xx_adc.c +@@ -36,8 +36,8 @@ + + /* Bits and mask definition for SC27XX_ADC_CH_CFG register */ + #define SC27XX_ADC_CHN_ID_MASK GENMASK(4, 0) +-#define SC27XX_ADC_SCALE_MASK GENMASK(10, 8) +-#define SC27XX_ADC_SCALE_SHIFT 8 ++#define SC27XX_ADC_SCALE_MASK GENMASK(10, 9) ++#define SC27XX_ADC_SCALE_SHIFT 9 + + /* Bits definitions for SC27XX_ADC_INT_EN registers */ + #define SC27XX_ADC_IRQ_EN BIT(0) +-- +2.35.1 + diff --git a/queue-5.10/iio-adc-stmpe-adc-fix-wait_for_completion_timeout-re.patch b/queue-5.10/iio-adc-stmpe-adc-fix-wait_for_completion_timeout-re.patch new file mode 100644 index 00000000000..6651aaa0e67 --- /dev/null +++ b/queue-5.10/iio-adc-stmpe-adc-fix-wait_for_completion_timeout-re.patch @@ -0,0 +1,68 @@ +From 93baa144e36e04e3d19594e59d95e7351e6bea04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 06:51:45 +0000 +Subject: iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value + check + +From: Miaoqian Lin + +[ Upstream commit d345b23200bcdbd2bd3582213d738c258b77718f ] + +wait_for_completion_timeout() returns unsigned long not long. +it returns 0 if timed out, and positive if completed. +The check for <= 0 is ambiguous and should be == 0 here +indicating timeout which is the only error case + +Fixes: e813dde6f833 ("iio: stmpe-adc: Use wait_for_completion_timeout") +Signed-off-by: Miaoqian Lin +Reviewed-by: Philippe Schenker +Link: https://lore.kernel.org/r/20220412065150.14486-1-linmq006@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/stmpe-adc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/adc/stmpe-adc.c b/drivers/iio/adc/stmpe-adc.c +index fba659bfdb40..64305d9fa560 100644 +--- a/drivers/iio/adc/stmpe-adc.c ++++ b/drivers/iio/adc/stmpe-adc.c +@@ -61,7 +61,7 @@ struct stmpe_adc { + static int stmpe_read_voltage(struct stmpe_adc *info, + struct iio_chan_spec const *chan, int *val) + { +- long ret; ++ unsigned long ret; + + mutex_lock(&info->lock); + +@@ -79,7 +79,7 @@ static int stmpe_read_voltage(struct stmpe_adc *info, + + ret = wait_for_completion_timeout(&info->completion, STMPE_ADC_TIMEOUT); + +- if (ret <= 0) { ++ if (ret == 0) { + stmpe_reg_write(info->stmpe, STMPE_REG_ADC_INT_STA, + STMPE_ADC_CH(info->channel)); + mutex_unlock(&info->lock); +@@ -96,7 +96,7 @@ static int stmpe_read_voltage(struct stmpe_adc *info, + static int stmpe_read_temp(struct stmpe_adc *info, + struct iio_chan_spec const *chan, int *val) + { +- long ret; ++ unsigned long ret; + + mutex_lock(&info->lock); + +@@ -114,7 +114,7 @@ static int stmpe_read_temp(struct stmpe_adc *info, + + ret = wait_for_completion_timeout(&info->completion, STMPE_ADC_TIMEOUT); + +- if (ret <= 0) { ++ if (ret == 0) { + mutex_unlock(&info->lock); + return -ETIMEDOUT; + } +-- +2.35.1 + diff --git a/queue-5.10/iio-proximity-vl53l0x-fix-return-value-check-of-wait.patch b/queue-5.10/iio-proximity-vl53l0x-fix-return-value-check-of-wait.patch new file mode 100644 index 00000000000..c6dc7447db8 --- /dev/null +++ b/queue-5.10/iio-proximity-vl53l0x-fix-return-value-check-of-wait.patch @@ -0,0 +1,52 @@ +From 901ff94701d9e7e69b2711016fca2e44b846c1b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 06:42:09 +0000 +Subject: iio: proximity: vl53l0x: Fix return value check of + wait_for_completion_timeout + +From: Miaoqian Lin + +[ Upstream commit 50f2959113cb6756ffd73c4fedc712cf2661f711 ] + +wait_for_completion_timeout() returns unsigned long not int. +It returns 0 if timed out, and positive if completed. +The check for <= 0 is ambiguous and should be == 0 here +indicating timeout which is the only error case. + +Fixes: 3cef2e31b54b ("iio: proximity: vl53l0x: Add IRQ support") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220412064210.10734-1-linmq006@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/proximity/vl53l0x-i2c.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/proximity/vl53l0x-i2c.c b/drivers/iio/proximity/vl53l0x-i2c.c +index 235e125aeb3a..3d3ab86423ee 100644 +--- a/drivers/iio/proximity/vl53l0x-i2c.c ++++ b/drivers/iio/proximity/vl53l0x-i2c.c +@@ -104,6 +104,7 @@ static int vl53l0x_read_proximity(struct vl53l0x_data *data, + u16 tries = 20; + u8 buffer[12]; + int ret; ++ unsigned long time_left; + + ret = i2c_smbus_write_byte_data(client, VL_REG_SYSRANGE_START, 1); + if (ret < 0) +@@ -112,10 +113,8 @@ static int vl53l0x_read_proximity(struct vl53l0x_data *data, + if (data->client->irq) { + reinit_completion(&data->completion); + +- ret = wait_for_completion_timeout(&data->completion, HZ/10); +- if (ret < 0) +- return ret; +- else if (ret == 0) ++ time_left = wait_for_completion_timeout(&data->completion, HZ/10); ++ if (time_left == 0) + return -ETIMEDOUT; + + vl53l0x_clear_irq(data); +-- +2.35.1 + diff --git a/queue-5.10/jffs2-fix-memory-leak-in-jffs2_do_fill_super.patch b/queue-5.10/jffs2-fix-memory-leak-in-jffs2_do_fill_super.patch new file mode 100644 index 00000000000..d9dc362f419 --- /dev/null +++ b/queue-5.10/jffs2-fix-memory-leak-in-jffs2_do_fill_super.patch @@ -0,0 +1,68 @@ +From d732f6751f6f80a114784a9fc592bd4430ab0ba9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 17:38:16 +0800 +Subject: jffs2: fix memory leak in jffs2_do_fill_super + +From: Baokun Li + +[ Upstream commit c14adb1cf70a984ed081c67e9d27bc3caad9537c ] + +If jffs2_iget() or d_make_root() in jffs2_do_fill_super() returns +an error, we can observe the following kmemleak report: + +-------------------------------------------- +unreferenced object 0xffff888105a65340 (size 64): + comm "mount", pid 710, jiffies 4302851558 (age 58.239s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] kmem_cache_alloc_trace+0x475/0x8a0 + [] jffs2_sum_init+0x96/0x1a0 + [] jffs2_do_mount_fs+0x745/0x2120 + [] jffs2_do_fill_super+0x35c/0x810 + [] jffs2_fill_super+0x2b9/0x3b0 + [...] +unreferenced object 0xffff8881bd7f0000 (size 65536): + comm "mount", pid 710, jiffies 4302851558 (age 58.239s) + hex dump (first 32 bytes): + bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ + bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ + backtrace: + [] kmalloc_order+0xda/0x110 + [] kmalloc_order_trace+0x21/0x130 + [] __kmalloc+0x711/0x8a0 + [] jffs2_sum_init+0xd9/0x1a0 + [] jffs2_do_mount_fs+0x745/0x2120 + [] jffs2_do_fill_super+0x35c/0x810 + [] jffs2_fill_super+0x2b9/0x3b0 + [...] +-------------------------------------------- + +This is because the resources allocated in jffs2_sum_init() are not +released. Call jffs2_sum_exit() to release these resources to solve +the problem. + +Fixes: e631ddba5887 ("[JFFS2] Add erase block summary support (mount time improvement)") +Signed-off-by: Baokun Li +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/jffs2/fs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c +index 7170de78cd26..db210989784d 100644 +--- a/fs/jffs2/fs.c ++++ b/fs/jffs2/fs.c +@@ -603,6 +603,7 @@ int jffs2_do_fill_super(struct super_block *sb, struct fs_context *fc) + jffs2_free_raw_node_refs(c); + kvfree(c->blocks); + jffs2_clear_xattr_subsystem(c); ++ jffs2_sum_exit(c); + out_inohash: + kfree(c->inocache_list); + out_wbuf: +-- +2.35.1 + diff --git a/queue-5.10/lkdtm-bugs-check-for-the-null-pointer-after-calling-.patch b/queue-5.10/lkdtm-bugs-check-for-the-null-pointer-after-calling-.patch new file mode 100644 index 00000000000..f3774b43b28 --- /dev/null +++ b/queue-5.10/lkdtm-bugs-check-for-the-null-pointer-after-calling-.patch @@ -0,0 +1,47 @@ +From 1e4b2c82e1da3b1c2d1388503ad0d6d8bc945a90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 17:29:36 +0800 +Subject: lkdtm/bugs: Check for the NULL pointer after calling kmalloc + +From: Jiasheng Jiang + +[ Upstream commit 4a9800c81d2f34afb66b4b42e0330ae8298019a2 ] + +As the possible failure of the kmalloc(), the not_checked and checked +could be NULL pointer. +Therefore, it should be better to check it in order to avoid the +dereference of the NULL pointer. +Also, we need to kfree the 'not_checked' and 'checked' to avoid +the memory leak if fails. +And since it is just a test, it may directly return without error +number. + +Fixes: ae2e1aad3e48 ("drivers/misc/lkdtm/bugs.c: add arithmetic overflow and array bounds checks") +Signed-off-by: Jiasheng Jiang +Acked-by: Dan Carpenter +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220120092936.1874264-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/misc/lkdtm/bugs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c +index a337f97b30e2..d39b8139b096 100644 +--- a/drivers/misc/lkdtm/bugs.c ++++ b/drivers/misc/lkdtm/bugs.c +@@ -231,6 +231,11 @@ void lkdtm_ARRAY_BOUNDS(void) + + not_checked = kmalloc(sizeof(*not_checked) * 2, GFP_KERNEL); + checked = kmalloc(sizeof(*checked) * 2, GFP_KERNEL); ++ if (!not_checked || !checked) { ++ kfree(not_checked); ++ kfree(checked); ++ return; ++ } + + pr_info("Array access within bounds ...\n"); + /* For both, touch all bytes in the actual member size. */ +-- +2.35.1 + diff --git a/queue-5.10/misc-fastrpc-fix-an-incorrect-null-check-on-list-ite.patch b/queue-5.10/misc-fastrpc-fix-an-incorrect-null-check-on-list-ite.patch new file mode 100644 index 00000000000..c0469a7410a --- /dev/null +++ b/queue-5.10/misc-fastrpc-fix-an-incorrect-null-check-on-list-ite.patch @@ -0,0 +1,60 @@ +From 6ba71abf7a118fbe5b535753696e19ce3f86e6c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Mar 2022 14:22:02 +0800 +Subject: misc: fastrpc: fix an incorrect NULL check on list iterator + +From: Xiaomeng Tong + +[ Upstream commit 5ac11fe03a0a83042d1a040dbce4fa2fb5521e23 ] + +The bug is here: + if (!buf) { + +The list iterator value 'buf' will *always* be set and non-NULL +by list_for_each_entry(), so it is incorrect to assume that the +iterator value will be NULL if the list is empty (in this case, the +check 'if (!buf) {' will always be false and never exit expectly). + +To fix the bug, use a new variable 'iter' as the list iterator, +while use the original variable 'buf' as a dedicated pointer to +point to the found element. + +Fixes: 2419e55e532de ("misc: fastrpc: add mmap/unmap support") +Signed-off-by: Xiaomeng Tong +Link: https://lore.kernel.org/r/20220327062202.5720-1-xiam0nd.tong@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/fastrpc.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index d0471fec37fb..65f24b6150aa 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1349,17 +1349,18 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, + struct fastrpc_req_munmap *req) + { + struct fastrpc_invoke_args args[1] = { [0] = { 0 } }; +- struct fastrpc_buf *buf, *b; ++ struct fastrpc_buf *buf = NULL, *iter, *b; + struct fastrpc_munmap_req_msg req_msg; + struct device *dev = fl->sctx->dev; + int err; + u32 sc; + + spin_lock(&fl->lock); +- list_for_each_entry_safe(buf, b, &fl->mmaps, node) { +- if ((buf->raddr == req->vaddrout) && (buf->size == req->size)) ++ list_for_each_entry_safe(iter, b, &fl->mmaps, node) { ++ if ((iter->raddr == req->vaddrout) && (iter->size == req->size)) { ++ buf = iter; + break; +- buf = NULL; ++ } + } + spin_unlock(&fl->lock); + +-- +2.35.1 + diff --git a/queue-5.10/modpost-fix-removing-numeric-suffixes.patch b/queue-5.10/modpost-fix-removing-numeric-suffixes.patch new file mode 100644 index 00000000000..1339370d0cc --- /dev/null +++ b/queue-5.10/modpost-fix-removing-numeric-suffixes.patch @@ -0,0 +1,58 @@ +From 3abf029fa63349fed5d1e5b62ecaa3bdf3203c80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 17:27:18 +0200 +Subject: modpost: fix removing numeric suffixes + +From: Alexander Lobakin + +[ Upstream commit b5beffa20d83c4e15306c991ffd00de0d8628338 ] + +With the `-z unique-symbol` linker flag or any similar mechanism, +it is possible to trigger the following: + +ERROR: modpost: "param_set_uint.0" [vmlinux] is a static EXPORT_SYMBOL + +The reason is that for now the condition from remove_dot(): + +if (m && (s[n + m] == '.' || s[n + m] == 0)) + +which was designed to test if it's a dot or a '\0' after the suffix +is never satisfied. +This is due to that `s[n + m]` always points to the last digit of a +numeric suffix, not on the symbol next to it (from a custom debug +print added to modpost): + +param_set_uint.0, s[n + m] is '0', s[n + m + 1] is '\0' + +So it's off-by-one and was like that since 2014. + +Fix this for the sake of any potential upcoming features, but don't +bother stable-backporting, as it's well hidden -- apart from that +LD flag, it can be triggered only with GCC LTO which never landed +upstream. + +Fixes: fcd38ed0ff26 ("scripts: modpost: fix compilation warning") +Signed-off-by: Alexander Lobakin +Reviewed-by: Petr Mladek +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index e08f75aed429..a21aa74b4948 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1982,7 +1982,7 @@ static char *remove_dot(char *s) + + if (n && s[n]) { + size_t m = strspn(s + n + 1, "0123456789"); +- if (m && (s[n + m] == '.' || s[n + m] == 0)) ++ if (m && (s[n + m + 1] == '.' || s[n + m + 1] == 0)) + s[n] = 0; + } + return s; +-- +2.35.1 + diff --git a/queue-5.10/net-dsa-mv88e6xxx-fix-refcount-leak-in-mv88e6xxx_mdi.patch b/queue-5.10/net-dsa-mv88e6xxx-fix-refcount-leak-in-mv88e6xxx_mdi.patch new file mode 100644 index 00000000000..22a295a4c5d --- /dev/null +++ b/queue-5.10/net-dsa-mv88e6xxx-fix-refcount-leak-in-mv88e6xxx_mdi.patch @@ -0,0 +1,44 @@ +From 4c6dd1ddbcb245c820374ffbd13054281d45fd2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 18:52:08 +0400 +Subject: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miaoqian Lin + +[ Upstream commit 02ded5a173619b11728b8bf75a3fd995a2c1ff28 ] + +of_get_child_by_name() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. + +mv88e6xxx_mdio_register() pass the device node to of_mdiobus_register(). +We don't need the device node after it. + +Add missing of_node_put() to avoid refcount leak. + +Fixes: a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") +Signed-off-by: Miaoqian Lin +Reviewed-by: Marek Behún +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index e79a808375fc..7b7a8a74405d 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3148,6 +3148,7 @@ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip, + */ + child = of_get_child_by_name(np, "mdio"); + err = mv88e6xxx_mdio_register(chip, child, false); ++ of_node_put(child); + if (err) + return err; + +-- +2.35.1 + diff --git a/queue-5.10/net-ethernet-mtk_eth_soc-out-of-bounds-read-in-mtk_h.patch b/queue-5.10/net-ethernet-mtk_eth_soc-out-of-bounds-read-in-mtk_h.patch new file mode 100644 index 00000000000..8e38e766c36 --- /dev/null +++ b/queue-5.10/net-ethernet-mtk_eth_soc-out-of-bounds-read-in-mtk_h.patch @@ -0,0 +1,38 @@ +From 2e8aa148fe50cbba2714c9d84578136aab083300 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 11:02:42 +0300 +Subject: net: ethernet: mtk_eth_soc: out of bounds read in + mtk_hwlro_get_fdir_entry() + +From: Dan Carpenter + +[ Upstream commit e7e7104e2d5ddf3806a28695670f21bef471f1e1 ] + +The "fsp->location" variable comes from user via ethtool_get_rxnfc(). +Check that it is valid to prevent an out of bounds read. + +Fixes: 7aab747e5563 ("net: ethernet: mediatek: add ethtool functions to configure RX flows of HW LRO") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 7d7dc0754a3a..789642647cd3 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -1966,6 +1966,9 @@ static int mtk_hwlro_get_fdir_entry(struct net_device *dev, + struct ethtool_rx_flow_spec *fsp = + (struct ethtool_rx_flow_spec *)&cmd->fs; + ++ if (fsp->location >= ARRAY_SIZE(mac->hwlro_ip)) ++ return -EINVAL; ++ + /* only tcp dst ipv4 is meaningful, others are meaningless */ + fsp->flow_type = TCP_V4_FLOW; + fsp->h_u.tcp_ip4_spec.ip4dst = ntohl(mac->hwlro_ip[fsp->location]); +-- +2.35.1 + diff --git a/queue-5.10/net-ethernet-ti-am65-cpsw-nuss-fix-some-refcount-lea.patch b/queue-5.10/net-ethernet-ti-am65-cpsw-nuss-fix-some-refcount-lea.patch new file mode 100644 index 00000000000..1a15487721a --- /dev/null +++ b/queue-5.10/net-ethernet-ti-am65-cpsw-nuss-fix-some-refcount-lea.patch @@ -0,0 +1,50 @@ +From 3edf2c3f86f0853de45f8f565124fa33783f055e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 12:52:08 +0400 +Subject: net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks + +From: Miaoqian Lin + +[ Upstream commit 5dd89d2fc438457811cbbec07999ce0d80051ff5 ] + +of_get_child_by_name() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not need anymore. +am65_cpsw_init_cpts() and am65_cpsw_nuss_probe() don't release +the refcount in error case. +Add missing of_node_put() to avoid refcount leak. + +Fixes: b1f66a5bee07 ("net: ethernet: ti: am65-cpsw-nuss: enable packet timestamping support") +Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") +Signed-off-by: Miaoqian Lin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 0805edef5625..059d68d48f1e 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -1716,6 +1716,7 @@ static int am65_cpsw_init_cpts(struct am65_cpsw_common *common) + if (IS_ERR(cpts)) { + int ret = PTR_ERR(cpts); + ++ of_node_put(node); + if (ret == -EOPNOTSUPP) { + dev_info(dev, "cpts disabled\n"); + return 0; +@@ -2064,9 +2065,9 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev) + if (!node) + return -ENOENT; + common->port_num = of_get_child_count(node); ++ of_node_put(node); + if (common->port_num < 1 || common->port_num > AM65_CPSW_MAX_PORTS) + return -ENOENT; +- of_node_put(node); + + if (common->port_num != 1) + return -EOPNOTSUPP; +-- +2.35.1 + diff --git a/queue-5.10/net-mlx5-correct-ece-offset-in-query-qp-output.patch b/queue-5.10/net-mlx5-correct-ece-offset-in-query-qp-output.patch new file mode 100644 index 00000000000..ee8193d6f0f --- /dev/null +++ b/queue-5.10/net-mlx5-correct-ece-offset-in-query-qp-output.patch @@ -0,0 +1,41 @@ +From f37f90fec66bb8296979ca310eb1b65b14f6ad23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 21:28:14 +0800 +Subject: net/mlx5: correct ECE offset in query qp output + +From: Changcheng Liu + +[ Upstream commit 3fc2a9e89b3508a5cc0c324f26d7b4740ba8c456 ] + +ECE field should be after opt_param_mask in query qp output. + +Fixes: 6b646a7e4af6 ("net/mlx5: Add ability to read and write ECE options") +Signed-off-by: Changcheng Liu +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + include/linux/mlx5/mlx5_ifc.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index eba1f1cbc9fb..6ca97729b54a 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -4877,12 +4877,11 @@ struct mlx5_ifc_query_qp_out_bits { + + u8 syndrome[0x20]; + +- u8 reserved_at_40[0x20]; +- u8 ece[0x20]; ++ u8 reserved_at_40[0x40]; + + u8 opt_param_mask[0x20]; + +- u8 reserved_at_a0[0x20]; ++ u8 ece[0x20]; + + struct mlx5_ifc_qpc_bits qpc; + +-- +2.35.1 + diff --git a/queue-5.10/net-mlx5-don-t-use-already-freed-action-pointer.patch b/queue-5.10/net-mlx5-don-t-use-already-freed-action-pointer.patch new file mode 100644 index 00000000000..5ee432389e1 --- /dev/null +++ b/queue-5.10/net-mlx5-don-t-use-already-freed-action-pointer.patch @@ -0,0 +1,50 @@ +From 136f1b4e7f64fb63203a53298ffc07beac38c4a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 15:59:27 +0300 +Subject: net/mlx5: Don't use already freed action pointer + +From: Leon Romanovsky + +[ Upstream commit 80b2bd737d0e833e6a2b77e482e5a714a79c86a4 ] + +The call to mlx5dr_action_destroy() releases "action" memory. That +pointer is set to miss_action later and generates the following smatch +error: + + drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c:53 set_miss_action() + warn: 'action' was already freed. + +Make sure that the pointer is always valid by setting NULL after destroy. + +Fixes: 6a48faeeca10 ("net/mlx5: Add direct rule fs_cmd implementation") +Reported-by: Dan Carpenter +Signed-off-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +index 96c39a17d026..b227fa9ada46 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +@@ -43,11 +43,10 @@ static int set_miss_action(struct mlx5_flow_root_namespace *ns, + err = mlx5dr_table_set_miss_action(ft->fs_dr_table.dr_table, action); + if (err && action) { + err = mlx5dr_action_destroy(action); +- if (err) { +- action = NULL; +- mlx5_core_err(ns->dev, "Failed to destroy action (%d)\n", +- err); +- } ++ if (err) ++ mlx5_core_err(ns->dev, ++ "Failed to destroy action (%d)\n", err); ++ action = NULL; + } + ft->fs_dr_table.miss_action = action; + if (old_miss_action) { +-- +2.35.1 + diff --git a/queue-5.10/net-mlx5e-update-netdev-features-after-changing-xdp-.patch b/queue-5.10/net-mlx5e-update-netdev-features-after-changing-xdp-.patch new file mode 100644 index 00000000000..27134f23fa2 --- /dev/null +++ b/queue-5.10/net-mlx5e-update-netdev-features-after-changing-xdp-.patch @@ -0,0 +1,44 @@ +From e9b107c4a3ca5e3d5e8145f621c169e20094c1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 May 2022 15:39:13 +0300 +Subject: net/mlx5e: Update netdev features after changing XDP state + +From: Maxim Mikityanskiy + +[ Upstream commit f6279f113ad593971999c877eb69dc3d36a75894 ] + +Some features (LRO, HW GRO) conflict with XDP. If there is an attempt to +enable such features while XDP is active, they will be set to `off +[requested on]`. In order to activate these features after XDP is turned +off, the driver needs to call netdev_update_features(). This commit adds +this missing call after XDP state changes. + +Fixes: cf6e34c8c22f ("net/mlx5e: Properly block LRO when XDP is enabled") +Fixes: b0617e7b3500 ("net/mlx5e: Properly block HW GRO when XDP is enabled") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index d9cc0ed6c5f7..cfc3bfcb04a2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4576,6 +4576,11 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) + + unlock: + mutex_unlock(&priv->state_lock); ++ ++ /* Need to fix some features. */ ++ if (!err) ++ netdev_update_features(netdev); ++ + return err; + } + +-- +2.35.1 + diff --git a/queue-5.10/net-sched-add-barrier-to-fix-packet-stuck-problem-fo.patch b/queue-5.10/net-sched-add-barrier-to-fix-packet-stuck-problem-fo.patch new file mode 100644 index 00000000000..1e619630079 --- /dev/null +++ b/queue-5.10/net-sched-add-barrier-to-fix-packet-stuck-problem-fo.patch @@ -0,0 +1,71 @@ +From 0ea0fb8d6f3411155496289337d4999e8c518ce8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 May 2022 18:16:28 +0800 +Subject: net: sched: add barrier to fix packet stuck problem for lockless + qdisc + +From: Guoju Fang + +[ Upstream commit 2e8728c955ce0624b958eee6e030a37aca3a5d86 ] + +In qdisc_run_end(), the spin_unlock() only has store-release semantic, +which guarantees all earlier memory access are visible before it. But +the subsequent test_bit() has no barrier semantics so may be reordered +ahead of the spin_unlock(). The store-load reordering may cause a packet +stuck problem. + +The concurrent operations can be described as below, + CPU 0 | CPU 1 + qdisc_run_end() | qdisc_run_begin() + . | . + ----> /* may be reorderd here */ | . +| . | . +| spin_unlock() | set_bit() +| . | smp_mb__after_atomic() + ---- test_bit() | spin_trylock() + . | . + +Consider the following sequence of events: + CPU 0 reorder test_bit() ahead and see MISSED = 0 + CPU 1 calls set_bit() + CPU 1 calls spin_trylock() and return fail + CPU 0 executes spin_unlock() + +At the end of the sequence, CPU 0 calls spin_unlock() and does nothing +because it see MISSED = 0. The skb on CPU 1 has beed enqueued but no one +take it, until the next cpu pushing to the qdisc (if ever ...) will +notice and dequeue it. + +This patch fix this by adding one explicit barrier. As spin_unlock() and +test_bit() ordering is a store-load ordering, a full memory barrier +smp_mb() is needed here. + +Fixes: a90c57f2cedd ("net: sched: fix packet stuck problem for lockless qdisc") +Signed-off-by: Guoju Fang +Link: https://lore.kernel.org/r/20220528101628.120193-1-gjfang@linux.alibaba.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/sch_generic.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 769764bda7a8..bed2387af456 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -197,6 +197,12 @@ static inline void qdisc_run_end(struct Qdisc *qdisc) + if (qdisc->flags & TCQ_F_NOLOCK) { + spin_unlock(&qdisc->seqlock); + ++ /* spin_unlock() only has store-release semantic. The unlock ++ * and test_bit() ordering is a store-load ordering, so a full ++ * memory barrier is needed here. ++ */ ++ smp_mb(); ++ + if (unlikely(test_bit(__QDISC_STATE_MISSED, + &qdisc->state))) { + clear_bit(__QDISC_STATE_MISSED, &qdisc->state); +-- +2.35.1 + diff --git a/queue-5.10/net-sched-fixed-barrier-to-prevent-skbuff-sticking-i.patch b/queue-5.10/net-sched-fixed-barrier-to-prevent-skbuff-sticking-i.patch new file mode 100644 index 00000000000..15ae9457c5f --- /dev/null +++ b/queue-5.10/net-sched-fixed-barrier-to-prevent-skbuff-sticking-i.patch @@ -0,0 +1,140 @@ +From 6b7e52168ef524ed7c26cc0f0abecaa3e126abed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 17:17:46 -0700 +Subject: net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog + +From: Vincent Ray + +[ Upstream commit a54ce3703613e41fe1d98060b62ec09a3984dc28 ] + +In qdisc_run_begin(), smp_mb__before_atomic() used before test_bit() +does not provide any ordering guarantee as test_bit() is not an atomic +operation. This, added to the fact that the spin_trylock() call at +the beginning of qdisc_run_begin() does not guarantee acquire +semantics if it does not grab the lock, makes it possible for the +following statement : + +if (test_bit(__QDISC_STATE_MISSED, &qdisc->state)) + +to be executed before an enqueue operation called before +qdisc_run_begin(). + +As a result the following race can happen : + + CPU 1 CPU 2 + + qdisc_run_begin() qdisc_run_begin() /* true */ + set(MISSED) . + /* returns false */ . + . /* sees MISSED = 1 */ + . /* so qdisc not empty */ + . __qdisc_run() + . . + . pfifo_fast_dequeue() + ----> /* may be done here */ . +| . clear(MISSED) +| . . +| . smp_mb __after_atomic(); +| . . +| . /* recheck the queue */ +| . /* nothing => exit */ +| enqueue(skb1) +| . +| qdisc_run_begin() +| . +| spin_trylock() /* fail */ +| . +| smp_mb__before_atomic() /* not enough */ +| . + ---- if (test_bit(MISSED)) + return false; /* exit */ + +In the above scenario, CPU 1 and CPU 2 both try to grab the +qdisc->seqlock at the same time. Only CPU 2 succeeds and enters the +bypass code path, where it emits its skb then calls __qdisc_run(). + +CPU1 fails, sets MISSED and goes down the traditionnal enqueue() + +dequeue() code path. But when executing qdisc_run_begin() for the +second time, after enqueuing its skbuff, it sees the MISSED bit still +set (by itself) and consequently chooses to exit early without setting +it again nor trying to grab the spinlock again. + +Meanwhile CPU2 has seen MISSED = 1, cleared it, checked the queue +and found it empty, so it returned. + +At the end of the sequence, we end up with skb1 enqueued in the +backlog, both CPUs out of __dev_xmit_skb(), the MISSED bit not set, +and no __netif_schedule() called made. skb1 will now linger in the +qdisc until somebody later performs a full __qdisc_run(). Associated +to the bypass capacity of the qdisc, and the ability of the TCP layer +to avoid resending packets which it knows are still in the qdisc, this +can lead to serious traffic "holes" in a TCP connection. + +We fix this by replacing the smp_mb__before_atomic() / test_bit() / +set_bit() / smp_mb__after_atomic() sequence inside qdisc_run_begin() +by a single test_and_set_bit() call, which is more concise and +enforces the needed memory barriers. + +Fixes: 89837eb4b246 ("net: sched: add barrier to ensure correct ordering for lockless qdisc") +Signed-off-by: Vincent Ray +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20220526001746.2437669-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/sch_generic.h | 36 ++++++++---------------------------- + 1 file changed, 8 insertions(+), 28 deletions(-) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 1042c449e7db..769764bda7a8 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -163,37 +163,17 @@ static inline bool qdisc_run_begin(struct Qdisc *qdisc) + if (spin_trylock(&qdisc->seqlock)) + goto nolock_empty; + +- /* Paired with smp_mb__after_atomic() to make sure +- * STATE_MISSED checking is synchronized with clearing +- * in pfifo_fast_dequeue(). ++ /* No need to insist if the MISSED flag was already set. ++ * Note that test_and_set_bit() also gives us memory ordering ++ * guarantees wrt potential earlier enqueue() and below ++ * spin_trylock(), both of which are necessary to prevent races + */ +- smp_mb__before_atomic(); +- +- /* If the MISSED flag is set, it means other thread has +- * set the MISSED flag before second spin_trylock(), so +- * we can return false here to avoid multi cpus doing +- * the set_bit() and second spin_trylock() concurrently. +- */ +- if (test_bit(__QDISC_STATE_MISSED, &qdisc->state)) ++ if (test_and_set_bit(__QDISC_STATE_MISSED, &qdisc->state)) + return false; + +- /* Set the MISSED flag before the second spin_trylock(), +- * if the second spin_trylock() return false, it means +- * other cpu holding the lock will do dequeuing for us +- * or it will see the MISSED flag set after releasing +- * lock and reschedule the net_tx_action() to do the +- * dequeuing. +- */ +- set_bit(__QDISC_STATE_MISSED, &qdisc->state); +- +- /* spin_trylock() only has load-acquire semantic, so use +- * smp_mb__after_atomic() to ensure STATE_MISSED is set +- * before doing the second spin_trylock(). +- */ +- smp_mb__after_atomic(); +- +- /* Retry again in case other CPU may not see the new flag +- * after it releases the lock at the end of qdisc_run_end(). ++ /* Try to take the lock again to make sure that we will either ++ * grab it or the CPU that still has it will see MISSED set ++ * when testing it in qdisc_run_end() + */ + if (!spin_trylock(&qdisc->seqlock)) + return false; +-- +2.35.1 + diff --git a/queue-5.10/net-smc-fixes-for-converting-from-struct-smc_cdc_tx_.patch b/queue-5.10/net-smc-fixes-for-converting-from-struct-smc_cdc_tx_.patch new file mode 100644 index 00000000000..e82224af33e --- /dev/null +++ b/queue-5.10/net-smc-fixes-for-converting-from-struct-smc_cdc_tx_.patch @@ -0,0 +1,37 @@ +From e68a9dec45fbf339483e53771a840c3ad29df820 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 May 2022 14:54:57 +0800 +Subject: net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to + "struct smc_wr_tx_pend_priv *" + +From: Guangguan Wang + +[ Upstream commit e225c9a5a74b12e9ef8516f30a3db2c7eb866ee1 ] + +"struct smc_cdc_tx_pend **" can not directly convert +to "struct smc_wr_tx_pend_priv *". + +Fixes: 2bced6aefa3d ("net/smc: put slot when connection is killed") +Signed-off-by: Guangguan Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_cdc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c +index 0c490cdde6a4..94503f36b9a6 100644 +--- a/net/smc/smc_cdc.c ++++ b/net/smc/smc_cdc.c +@@ -72,7 +72,7 @@ int smc_cdc_get_free_slot(struct smc_connection *conn, + /* abnormal termination */ + if (!rc) + smc_wr_tx_put_slot(link, +- (struct smc_wr_tx_pend_priv *)pend); ++ (struct smc_wr_tx_pend_priv *)(*pend)); + rc = -EPIPE; + } + return rc; +-- +2.35.1 + diff --git a/queue-5.10/nfp-only-report-pause-frame-configuration-for-physic.patch b/queue-5.10/nfp-only-report-pause-frame-configuration-for-physic.patch new file mode 100644 index 00000000000..641dbfab87c --- /dev/null +++ b/queue-5.10/nfp-only-report-pause-frame-configuration-for-physic.patch @@ -0,0 +1,46 @@ +From 3f22e35bf684a2c892ad0c156aba0900363d49b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 May 2022 20:24:24 +0200 +Subject: nfp: only report pause frame configuration for physical device + +From: Yu Xiao + +[ Upstream commit 0649e4d63420ebc8cbebef3e9d39e12ffc5eb9fa ] + +Only report pause frame configuration for physical device. Logical +port of both PCI PF and PCI VF do not support it. + +Fixes: 9fdc5d85a8fe ("nfp: update ethtool reporting of pauseframe control") +Signed-off-by: Yu Xiao +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index cd0c9623f7dd..e0b801d10739 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -286,8 +286,6 @@ nfp_net_get_link_ksettings(struct net_device *netdev, + + /* Init to unknowns */ + ethtool_link_ksettings_add_link_mode(cmd, supported, FIBRE); +- ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); +- ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + cmd->base.port = PORT_OTHER; + cmd->base.speed = SPEED_UNKNOWN; + cmd->base.duplex = DUPLEX_UNKNOWN; +@@ -295,6 +293,8 @@ nfp_net_get_link_ksettings(struct net_device *netdev, + port = nfp_port_from_netdev(netdev); + eth_port = nfp_port_get_eth_port(port); + if (eth_port) { ++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + cmd->base.autoneg = eth_port->aneg != NFP_ANEG_DISABLED ? + AUTONEG_ENABLE : AUTONEG_DISABLE; + nfp_net_set_fec_link_mode(eth_port, cmd); +-- +2.35.1 + diff --git a/queue-5.10/pcmcia-db1xxx_ss-restrict-to-mips_db1xxx-boards.patch b/queue-5.10/pcmcia-db1xxx_ss-restrict-to-mips_db1xxx-boards.patch new file mode 100644 index 00000000000..fa6f937820a --- /dev/null +++ b/queue-5.10/pcmcia-db1xxx_ss-restrict-to-mips_db1xxx-boards.patch @@ -0,0 +1,48 @@ +From 60a2bda8b9c8eaa85749c9b819f55181fb7e9fd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jan 2022 09:40:31 -0800 +Subject: pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards + +From: Randy Dunlap + +[ Upstream commit 3928cf08334ed895a31458cbebd8d4ec6d84c080 ] + +When the MIPS_ALCHEMY board selection is MIPS_XXS1500 instead of +MIPS_DB1XXX, the PCMCIA driver 'db1xxx_ss' has build errors due +to missing DB1XXX symbols. The PCMCIA driver should be restricted +to MIPS_DB1XXX instead of MIPS_ALCHEMY to fix this build error. + +ERROR: modpost: "bcsr_read" [drivers/pcmcia/db1xxx_ss.ko] undefined! +ERROR: modpost: "bcsr_mod" [drivers/pcmcia/db1xxx_ss.ko] undefined! + +Fixes: 42a4f17dc356 ("MIPS: Alchemy: remove SOC_AU1X00 in favor of MIPS_ALCHEMY") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Arnd Bergmann +Cc: Daniel Vetter +Cc: Kees Cook +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Acked-by: Manuel Lauss +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig +index 82d10b6661c7..73508fca520c 100644 +--- a/drivers/pcmcia/Kconfig ++++ b/drivers/pcmcia/Kconfig +@@ -151,7 +151,7 @@ config TCIC + + config PCMCIA_ALCHEMY_DEVBOARD + tristate "Alchemy Db/Pb1xxx PCMCIA socket services" +- depends on MIPS_ALCHEMY && PCMCIA ++ depends on MIPS_DB1XXX && PCMCIA + help + Enable this driver of you want PCMCIA support on your Alchemy + Db1000, Db/Pb1100, Db/Pb1500, Db/Pb1550, Db/Pb1200, DB1300 +-- +2.35.1 + diff --git a/queue-5.10/perf-c2c-fix-sorting-in-percent_rmt_hitm_cmp.patch b/queue-5.10/perf-c2c-fix-sorting-in-percent_rmt_hitm_cmp.patch new file mode 100644 index 00000000000..4a09396fa4e --- /dev/null +++ b/queue-5.10/perf-c2c-fix-sorting-in-percent_rmt_hitm_cmp.patch @@ -0,0 +1,49 @@ +From f3141e077ee6e455e57d2a6b8127e93d8922d165 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 16:42:53 +0800 +Subject: perf c2c: Fix sorting in percent_rmt_hitm_cmp() + +From: Leo Yan + +[ Upstream commit b24192a17337abbf3f44aaa75e15df14a2d0016e ] + +The function percent_rmt_hitm_cmp() wrongly uses local HITMs for +sorting remote HITMs. + +Since this function is to sort cache lines for remote HITMs, this patch +changes to use 'rmt_hitm' field for correct sorting. + +Fixes: 9cb3500afc0980c5 ("perf c2c report: Add hitm/store percent related sort keys") +Signed-off-by: Leo Yan +Acked-by: Namhyung Kim +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Joe Mario +Cc: Mark Rutland +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20220530084253.750190-1-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-c2c.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c +index 7f7111d4b3ad..fb7d01f3961b 100644 +--- a/tools/perf/builtin-c2c.c ++++ b/tools/perf/builtin-c2c.c +@@ -918,8 +918,8 @@ percent_rmt_hitm_cmp(struct perf_hpp_fmt *fmt __maybe_unused, + double per_left; + double per_right; + +- per_left = PERCENT(left, lcl_hitm); +- per_right = PERCENT(right, lcl_hitm); ++ per_left = PERCENT(left, rmt_hitm); ++ per_right = PERCENT(right, rmt_hitm); + + return per_left - per_right; + } +-- +2.35.1 + diff --git a/queue-5.10/phy-qcom-qmp-fix-pipe-clock-imbalance-on-power-on-fa.patch b/queue-5.10/phy-qcom-qmp-fix-pipe-clock-imbalance-on-power-on-fa.patch new file mode 100644 index 00000000000..992083d1577 --- /dev/null +++ b/queue-5.10/phy-qcom-qmp-fix-pipe-clock-imbalance-on-power-on-fa.patch @@ -0,0 +1,40 @@ +From e33ae7a2938dab1df95981775b5b35d38c59a834 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 15:31:29 +0200 +Subject: phy: qcom-qmp: fix pipe-clock imbalance on power-on failure + +From: Johan Hovold + +[ Upstream commit 5e73b2d9867998278479ccc065a8a8227a5513ef ] + +Make sure to disable the pipe clock also if ufs-reset deassertion fails +during power on. + +Note that the ufs-reset is asserted in qcom_qmp_phy_com_exit(). + +Fixes: c9b589791fc1 ("phy: qcom: Utilize UFS reset controller") +Cc: Evan Green +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220502133130.4125-2-johan+linaro@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c +index ea46950c5d2a..afcc82ab3202 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c +@@ -3141,7 +3141,7 @@ static int qcom_qmp_phy_power_on(struct phy *phy) + + ret = reset_control_deassert(qmp->ufs_reset); + if (ret) +- goto err_lane_rst; ++ goto err_pcs_ready; + + qcom_qmp_phy_configure(pcs_misc, cfg->regs, cfg->pcs_misc_tbl, + cfg->pcs_misc_tbl_num); +-- +2.35.1 + diff --git a/queue-5.10/platform-finally-disallow-irq0-in-platform_get_irq-a.patch b/queue-5.10/platform-finally-disallow-irq0-in-platform_get_irq-a.patch new file mode 100644 index 00000000000..6ba9648b9cf --- /dev/null +++ b/queue-5.10/platform-finally-disallow-irq0-in-platform_get_irq-a.patch @@ -0,0 +1,55 @@ +From f774747a385caf5dca7e9c779ba82873c11159a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Mar 2022 22:35:29 +0300 +Subject: platform: finally disallow IRQ0 in platform_get_irq() and its ilk + +From: Sergey Shtylyov + +[ Upstream commit ce753ad1549cbe9ccaea4c06a1f5fa47432c8289 ] + +The commit a85a6c86c25b ("driver core: platform: Clarify that IRQ 0 is +invalid") only calls WARN() when IRQ0 is about to be returned, however +using IRQ0 is considered invalid (according to Linus) outside the arch/ +code where it's used by the i8253 drivers. Many driver subsystems treat +0 specially (e.g. as an indication of the polling mode by libata), so +the users of platform_get_irq[_byname]() in them would have to filter +out IRQ0 explicitly and this (quite obviously) doesn't scale... +Let's finally get this straight and return -EINVAL instead of IRQ0! + +Fixes: a85a6c86c25b ("driver core: platform: Clarify that IRQ 0 is invalid") +Acked-by: Marc Zyngier +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/025679e1-1f0a-ae4b-4369-01164f691511@omp.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/platform.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index 88aef93eb4dd..ad9ef67df7ad 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -235,7 +235,8 @@ int platform_get_irq_optional(struct platform_device *dev, unsigned int num) + ret = -ENXIO; + #endif + out: +- WARN(ret == 0, "0 is an invalid IRQ number\n"); ++ if (WARN(!ret, "0 is an invalid IRQ number\n")) ++ return -EINVAL; + return ret; + } + EXPORT_SYMBOL_GPL(platform_get_irq_optional); +@@ -328,7 +329,8 @@ static int __platform_get_irq_byname(struct platform_device *dev, + + r = platform_get_resource_byname(dev, IORESOURCE_IRQ, name); + if (r) { +- WARN(r->start == 0, "0 is an invalid IRQ number\n"); ++ if (WARN(!r->start, "0 is an invalid IRQ number\n")) ++ return -EINVAL; + return r->start; + } + +-- +2.35.1 + diff --git a/queue-5.10/pwm-lp3943-fix-duty-calculation-in-case-period-was-c.patch b/queue-5.10/pwm-lp3943-fix-duty-calculation-in-case-period-was-c.patch new file mode 100644 index 00000000000..22ad6c0bb5f --- /dev/null +++ b/queue-5.10/pwm-lp3943-fix-duty-calculation-in-case-period-was-c.patch @@ -0,0 +1,40 @@ +From fdd8a3e769015178cd27e2d48e971abdbe951592 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 17:22:38 +0200 +Subject: pwm: lp3943: Fix duty calculation in case period was clamped +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 5e3b07ca5cc78cd4a987e78446849e41288d87cb ] + +The hardware only supports periods <= 1.6 ms and if a bigger period is +requested it is clamped to 1.6 ms. In this case duty_cycle might be bigger +than 1.6 ms and then the duty cycle register is written with a value +bigger than LP3943_MAX_DUTY. So clamp duty_cycle accordingly. + +Fixes: af66b3c0934e ("pwm: Add LP3943 PWM driver") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-lp3943.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c +index bf3f14fb5f24..05e4120fd702 100644 +--- a/drivers/pwm/pwm-lp3943.c ++++ b/drivers/pwm/pwm-lp3943.c +@@ -125,6 +125,7 @@ static int lp3943_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + if (err) + return err; + ++ duty_ns = min(duty_ns, period_ns); + val = (u8)(duty_ns * LP3943_MAX_DUTY / period_ns); + + return lp3943_write_byte(lp3943, reg_duty, val); +-- +2.35.1 + diff --git a/queue-5.10/riscv-read-only-pages-should-not-be-writable.patch b/queue-5.10/riscv-read-only-pages-should-not-be-writable.patch new file mode 100644 index 00000000000..740ed129acc --- /dev/null +++ b/queue-5.10/riscv-read-only-pages-should-not-be-writable.patch @@ -0,0 +1,39 @@ +From 7cc8a92f36a29ba8b3e102f23dd4899e048d1b79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 May 2022 03:41:32 +0200 +Subject: riscv: read-only pages should not be writable + +From: Heinrich Schuchardt + +[ Upstream commit 630f972d76d6460235e84e1aa034ee06f9c8c3a9 ] + +If EFI pages are marked as read-only, +we should remove the _PAGE_WRITE flag. + +The current code overwrites an unused value. + +Fixes: b91540d52a08b ("RISC-V: Add EFI runtime services") +Signed-off-by: Heinrich Schuchardt +Link: https://lore.kernel.org/r/20220528014132.91052-1-heinrich.schuchardt@canonical.com +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/efi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/riscv/kernel/efi.c b/arch/riscv/kernel/efi.c +index 024159298231..1aa540350abd 100644 +--- a/arch/riscv/kernel/efi.c ++++ b/arch/riscv/kernel/efi.c +@@ -65,7 +65,7 @@ static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data) + + if (md->attribute & EFI_MEMORY_RO) { + val = pte_val(pte) & ~_PAGE_WRITE; +- val = pte_val(pte) | _PAGE_READ; ++ val |= _PAGE_READ; + pte = __pte(val); + } + if (md->attribute & EFI_MEMORY_XP) { +-- +2.35.1 + diff --git a/queue-5.10/rpmsg-qcom_smd-fix-irq_of_parse_and_map-return-value.patch b/queue-5.10/rpmsg-qcom_smd-fix-irq_of_parse_and_map-return-value.patch new file mode 100644 index 00000000000..f93d3c7a184 --- /dev/null +++ b/queue-5.10/rpmsg-qcom_smd-fix-irq_of_parse_and_map-return-value.patch @@ -0,0 +1,36 @@ +From 132b6a392b159d0d24738ad03cefafad55102275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 12:53:26 +0200 +Subject: rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value + +From: Krzysztof Kozlowski + +[ Upstream commit 1a358d35066487d228a68303d808bc4721c6b1b9 ] + +The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO. + +Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220422105326.78713-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_smd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index 19903de6268d..db5f6009fb49 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1388,7 +1388,7 @@ static int qcom_smd_parse_edge(struct device *dev, + edge->name = node->name; + + irq = irq_of_parse_and_map(node, 0); +- if (irq < 0) { ++ if (!irq) { + dev_err(dev, "required smd interrupt missing\n"); + ret = irq; + goto put_node; +-- +2.35.1 + diff --git a/queue-5.10/rpmsg-qcom_smd-fix-returning-0-if-irq_of_parse_and_m.patch b/queue-5.10/rpmsg-qcom_smd-fix-returning-0-if-irq_of_parse_and_m.patch new file mode 100644 index 00000000000..61351864138 --- /dev/null +++ b/queue-5.10/rpmsg-qcom_smd-fix-returning-0-if-irq_of_parse_and_m.patch @@ -0,0 +1,37 @@ +From 159f33f46e513eb79a87d5855843808933287589 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 11:39:32 +0200 +Subject: rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails + +From: Krzysztof Kozlowski + +[ Upstream commit 59d6f72f6f9c92fec8757d9e29527da828e9281f ] + +irq_of_parse_and_map() returns 0 on failure, so this should not be +passed further as error return code. + +Fixes: 1a358d350664 ("rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220423093932.32136-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_smd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index db5f6009fb49..a4db9f6100d2 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1390,7 +1390,7 @@ static int qcom_smd_parse_edge(struct device *dev, + irq = irq_of_parse_and_map(node, 0); + if (!irq) { + dev_err(dev, "required smd interrupt missing\n"); +- ret = irq; ++ ret = -EINVAL; + goto put_node; + } + +-- +2.35.1 + diff --git a/queue-5.10/rtc-mt6397-check-return-value-after-calling-platform.patch b/queue-5.10/rtc-mt6397-check-return-value-after-calling-platform.patch new file mode 100644 index 00000000000..ce379bd734d --- /dev/null +++ b/queue-5.10/rtc-mt6397-check-return-value-after-calling-platform.patch @@ -0,0 +1,38 @@ +From aaca53482568b0e439b8d36847bd812c75e9ed91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 May 2022 20:50:43 +0800 +Subject: rtc: mt6397: check return value after calling platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit d3b43eb505bffb8e4cdf6800c15660c001553fe6 ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Fixes: fc2979118f3f ("rtc: mediatek: Add MT6397 RTC driver") +Signed-off-by: Yang Yingliang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20220505125043.1594771-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-mt6397.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c +index 1894aded4c85..acfcb378767d 100644 +--- a/drivers/rtc/rtc-mt6397.c ++++ b/drivers/rtc/rtc-mt6397.c +@@ -269,6 +269,8 @@ static int mtk_rtc_probe(struct platform_device *pdev) + return -ENOMEM; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + rtc->addr_base = res->start; + + rtc->data = of_device_get_match_data(&pdev->dev); +-- +2.35.1 + diff --git a/queue-5.10/s390-crypto-fix-scatterwalk_unmap-callers-in-aes-gcm.patch b/queue-5.10/s390-crypto-fix-scatterwalk_unmap-callers-in-aes-gcm.patch new file mode 100644 index 00000000000..2c4a83cc271 --- /dev/null +++ b/queue-5.10/s390-crypto-fix-scatterwalk_unmap-callers-in-aes-gcm.patch @@ -0,0 +1,52 @@ +From 4dccaf60167ec8349f55005685a156ffb2b6f263 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 16:30:47 +0200 +Subject: s390/crypto: fix scatterwalk_unmap() callers in AES-GCM + +From: Jann Horn + +[ Upstream commit bd52cd5e23f134019b23f0c389db0f9a436e4576 ] + +The argument of scatterwalk_unmap() is supposed to be the void* that was +returned by the previous scatterwalk_map() call. +The s390 AES-GCM implementation was instead passing the pointer to the +struct scatter_walk. + +This doesn't actually break anything because scatterwalk_unmap() only uses +its argument under CONFIG_HIGHMEM and ARCH_HAS_FLUSH_ON_KUNMAP. + +Fixes: bf7fa038707c ("s390/crypto: add s390 platform specific aes gcm support.") +Signed-off-by: Jann Horn +Acked-by: Harald Freudenberger +Link: https://lore.kernel.org/r/20220517143047.3054498-1-jannh@google.com +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/crypto/aes_s390.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c +index 73044634d342..812730e6bfff 100644 +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -700,7 +700,7 @@ static inline void _gcm_sg_unmap_and_advance(struct gcm_sg_walk *gw, + unsigned int nbytes) + { + gw->walk_bytes_remain -= nbytes; +- scatterwalk_unmap(&gw->walk); ++ scatterwalk_unmap(gw->walk_ptr); + scatterwalk_advance(&gw->walk, nbytes); + scatterwalk_done(&gw->walk, 0, gw->walk_bytes_remain); + gw->walk_ptr = NULL; +@@ -775,7 +775,7 @@ static int gcm_out_walk_go(struct gcm_sg_walk *gw, unsigned int minbytesneeded) + goto out; + } + +- scatterwalk_unmap(&gw->walk); ++ scatterwalk_unmap(gw->walk_ptr); + gw->walk_ptr = NULL; + + gw->ptr = gw->buf; +-- +2.35.1 + diff --git a/queue-5.10/scsi-sd-fix-potential-null-pointer-dereference.patch b/queue-5.10/scsi-sd-fix-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..9552228e641 --- /dev/null +++ b/queue-5.10/scsi-sd-fix-potential-null-pointer-dereference.patch @@ -0,0 +1,47 @@ +From 5b8f2a9a838e0536bce900eabaa2c1ee30a81ffb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 15:25:43 +0900 +Subject: scsi: sd: Fix potential NULL pointer dereference + +From: Damien Le Moal + +[ Upstream commit 05fbde3a77a4f1d62e4c4428f384288c1f1a0be5 ] + +If sd_probe() sees an early error before sdkp->device is initialized, +sd_zbc_release_disk() is called. This causes a NULL pointer dereference +when sd_is_zoned() is called inside that function. Avoid this by removing +the call to sd_zbc_release_disk() in sd_probe() error path. + +This change is safe and does not result in zone information memory leakage +because the zone information for a zoned disk is allocated only when +sd_revalidate_disk() is called, at which point sdkp->disk_dev is fully set, +resulting in sd_disk_release() being called when needed to cleanup a disk +zone information using sd_zbc_release_disk(). + +Link: https://lore.kernel.org/r/20220601062544.905141-2-damien.lemoal@opensource.wdc.com +Fixes: 89d947561077 ("sd: Implement support for ZBC devices") +Reported-by: Dongliang Mu +Suggested-by: Christoph Hellwig +Reviewed-by: Christoph Hellwig +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sd.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 56e291708587..bd068d3bb455 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -3511,7 +3511,6 @@ static int sd_probe(struct device *dev) + out_put: + put_disk(gd); + out_free: +- sd_zbc_release_disk(sdkp); + kfree(sdkp); + out: + scsi_autopm_put_device(sdp); +-- +2.35.1 + diff --git a/queue-5.10/serial-8250_fintek-check-ser_rs485_rts_-only-with-rs.patch b/queue-5.10/serial-8250_fintek-check-ser_rs485_rts_-only-with-rs.patch new file mode 100644 index 00000000000..613cddee7ca --- /dev/null +++ b/queue-5.10/serial-8250_fintek-check-ser_rs485_rts_-only-with-rs.patch @@ -0,0 +1,61 @@ +From 93b0645b10d17c0ffe0961ef9f09e58a1582e623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 16:46:43 +0300 +Subject: serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit af0179270977508df6986b51242825d7edd59caf ] + +SER_RS485_RTS_ON_SEND and SER_RS485_RTS_AFTER_SEND relate to behavior +within RS485 operation. The driver checks if they have the same value +which is not possible to realize with the hardware. The check is taken +regardless of SER_RS485_ENABLED flag and -EINVAL is returned when the +check fails, which creates problems. + +This check makes it unnecessarily complicated to turn RS485 mode off as +simple zeroed serial_rs485 struct will trigger that equal values check. +In addition, the driver itself memsets its rs485 structure to zero when +RS485 is disabled but if userspace would try to make an TIOCSRS485 +ioctl() call with the very same struct, it would end up failing with +-EINVAL which doesn't make much sense. + +Resolve the problem by moving the check inside SER_RS485_ENABLED block. + +Fixes: 7ecc77011c6f ("serial: 8250_fintek: Return -EINVAL on invalid configuration") +Cc: Ricardo Ribalda Delgado +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/035c738-8ea5-8b17-b1d7-84a7b3aeaa51@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_fintek.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c +index 251f0018ae8c..dba5950b8d0e 100644 +--- a/drivers/tty/serial/8250/8250_fintek.c ++++ b/drivers/tty/serial/8250/8250_fintek.c +@@ -200,12 +200,12 @@ static int fintek_8250_rs485_config(struct uart_port *port, + if (!pdata) + return -EINVAL; + +- /* Hardware do not support same RTS level on send and receive */ +- if (!(rs485->flags & SER_RS485_RTS_ON_SEND) == +- !(rs485->flags & SER_RS485_RTS_AFTER_SEND)) +- return -EINVAL; + + if (rs485->flags & SER_RS485_ENABLED) { ++ /* Hardware do not support same RTS level on send and receive */ ++ if (!(rs485->flags & SER_RS485_RTS_ON_SEND) == ++ !(rs485->flags & SER_RS485_RTS_AFTER_SEND)) ++ return -EINVAL; + memset(rs485->padding, 0, sizeof(rs485->padding)); + config |= RS485_URA; + } else { +-- +2.35.1 + diff --git a/queue-5.10/serial-digicolor-usart-don-t-allow-cs5-6.patch b/queue-5.10/serial-digicolor-usart-don-t-allow-cs5-6.patch new file mode 100644 index 00000000000..eb81dc52229 --- /dev/null +++ b/queue-5.10/serial-digicolor-usart-don-t-allow-cs5-6.patch @@ -0,0 +1,46 @@ +From 0b8fd10699a987cba3ab7b9a271edd131f800ebc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 11:18:01 +0300 +Subject: serial: digicolor-usart: Don't allow CS5-6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit fd63031b8c0763addcecdefe0e0c59d49646204e ] + +Only CS7 and CS8 seem supported but CSIZE is not sanitized to CS8 in +the default: block. + +Set CSIZE correctly so that userspace knows the effective value. +Incorrect CSIZE also results in miscalculation of the frame bits in +tty_get_char_size() or in its predecessor where the roughly the same +code is directly within uart_update_timeout(). + +Fixes: 5930cb3511df (serial: driver for Conexant Digicolor USART) +Acked-by: Baruch Siach +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20220519081808.3776-3-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/digicolor-usart.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/digicolor-usart.c b/drivers/tty/serial/digicolor-usart.c +index c7f81aa1ce91..5fea9bf86e85 100644 +--- a/drivers/tty/serial/digicolor-usart.c ++++ b/drivers/tty/serial/digicolor-usart.c +@@ -309,6 +309,8 @@ static void digicolor_uart_set_termios(struct uart_port *port, + case CS8: + default: + config |= UA_CONFIG_CHAR_LEN; ++ termios->c_cflag &= ~CSIZE; ++ termios->c_cflag |= CS8; + break; + } + +-- +2.35.1 + diff --git a/queue-5.10/serial-meson-acquire-port-lock-in-startup.patch b/queue-5.10/serial-meson-acquire-port-lock-in-startup.patch new file mode 100644 index 00000000000..9e87c82d20c --- /dev/null +++ b/queue-5.10/serial-meson-acquire-port-lock-in-startup.patch @@ -0,0 +1,98 @@ +From ac425ddac119d0ce700dbbb1166230a7b4bdaf27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 May 2022 12:41:47 +0206 +Subject: serial: meson: acquire port->lock in startup() + +From: John Ogness + +[ Upstream commit 589f892ac8ef244e47c5a00ffd8605daa1eaef8e ] + +The uart_ops startup() callback is called without interrupts +disabled and without port->lock locked, relatively late during the +boot process (from the call path of console_on_rootfs()). If the +device is a console, it was already previously registered and could +be actively printing messages. + +Since the startup() callback is reading/writing registers used by +the console write() callback (AML_UART_CONTROL), its access must +be synchronized using the port->lock. Currently it is not. + +The startup() callback is the only function that explicitly enables +interrupts. Without the synchronization, it is possible that +interrupts become accidentally permanently disabled. + +CPU0 CPU1 +meson_serial_console_write meson_uart_startup +-------------------------- ------------------ +spin_lock(port->lock) +val = readl(AML_UART_CONTROL) +uart_console_write() + writel(INT_EN, AML_UART_CONTROL) +writel(val, AML_UART_CONTROL) +spin_unlock(port->lock) + +Add port->lock synchronization to meson_uart_startup() to avoid +racing with meson_serial_console_write(). + +Also add detailed comments to meson_uart_reset() explaining why it +is *not* using port->lock synchronization. + +Link: https://lore.kernel.org/lkml/2a82eae7-a256-f70c-fd82-4e510750906e@samsung.com +Fixes: ff7693d079e5 ("ARM: meson: serial: add MesonX SoC on-chip uart driver") +Reported-by: Marek Szyprowski +Tested-by: Marek Szyprowski +Reviewed-by: Petr Mladek +Reviewed-by: Jiri Slaby +Acked-by: Neil Armstrong +Signed-off-by: John Ogness +Link: https://lore.kernel.org/r/20220508103547.626355-1-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/meson_uart.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/tty/serial/meson_uart.c b/drivers/tty/serial/meson_uart.c +index d2c08b760f83..91b7359b79a2 100644 +--- a/drivers/tty/serial/meson_uart.c ++++ b/drivers/tty/serial/meson_uart.c +@@ -255,6 +255,14 @@ static const char *meson_uart_type(struct uart_port *port) + return (port->type == PORT_MESON) ? "meson_uart" : NULL; + } + ++/* ++ * This function is called only from probe() using a temporary io mapping ++ * in order to perform a reset before setting up the device. Since the ++ * temporarily mapped region was successfully requested, there can be no ++ * console on this port at this time. Hence it is not necessary for this ++ * function to acquire the port->lock. (Since there is no console on this ++ * port at this time, the port->lock is not initialized yet.) ++ */ + static void meson_uart_reset(struct uart_port *port) + { + u32 val; +@@ -269,9 +277,12 @@ static void meson_uart_reset(struct uart_port *port) + + static int meson_uart_startup(struct uart_port *port) + { ++ unsigned long flags; + u32 val; + int ret = 0; + ++ spin_lock_irqsave(&port->lock, flags); ++ + val = readl(port->membase + AML_UART_CONTROL); + val |= AML_UART_CLEAR_ERR; + writel(val, port->membase + AML_UART_CONTROL); +@@ -287,6 +298,8 @@ static int meson_uart_startup(struct uart_port *port) + val = (AML_UART_RECV_IRQ(1) | AML_UART_XMIT_IRQ(port->fifosize / 2)); + writel(val, port->membase + AML_UART_MISC); + ++ spin_unlock_irqrestore(&port->lock, flags); ++ + ret = request_irq(port->irq, meson_uart_interrupt, 0, + port->name, port); + +-- +2.35.1 + diff --git a/queue-5.10/serial-rda-uart-don-t-allow-cs5-6.patch b/queue-5.10/serial-rda-uart-don-t-allow-cs5-6.patch new file mode 100644 index 00000000000..6a0cc93b46a --- /dev/null +++ b/queue-5.10/serial-rda-uart-don-t-allow-cs5-6.patch @@ -0,0 +1,46 @@ +From 65107c40d0086f1588914d9c9cec4bb2a327e8be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 11:18:02 +0300 +Subject: serial: rda-uart: Don't allow CS5-6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 098333a9c7d12bb3ce44c82f08b4d810c44d31b0 ] + +Only CS7 and CS8 are supported but CSIZE is not sanitized after +fallthrough from CS5 or CS6 to CS7. + +Set CSIZE correctly so that userspace knows the effective value. +Incorrect CSIZE also results in miscalculation of the frame bits in +tty_get_char_size() or in its predecessor where the roughly the same +code is directly within uart_update_timeout(). + +Fixes: c10b13325ced (tty: serial: Add RDA8810PL UART driver) +Cc: Manivannan Sadhasivam +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20220519081808.3776-4-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/rda-uart.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/rda-uart.c b/drivers/tty/serial/rda-uart.c +index 85366e059258..a45069e7ebea 100644 +--- a/drivers/tty/serial/rda-uart.c ++++ b/drivers/tty/serial/rda-uart.c +@@ -262,6 +262,8 @@ static void rda_uart_set_termios(struct uart_port *port, + fallthrough; + case CS7: + ctrl &= ~RDA_UART_DBITS_8; ++ termios->c_cflag &= ~CSIZE; ++ termios->c_cflag |= CS7; + break; + default: + ctrl |= RDA_UART_DBITS_8; +-- +2.35.1 + diff --git a/queue-5.10/serial-sh-sci-don-t-allow-cs5-6.patch b/queue-5.10/serial-sh-sci-don-t-allow-cs5-6.patch new file mode 100644 index 00000000000..49ce947ff01 --- /dev/null +++ b/queue-5.10/serial-sh-sci-don-t-allow-cs5-6.patch @@ -0,0 +1,50 @@ +From b3f343540f36f836b23e8fc861b1c2d6b5ce9d09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 11:18:04 +0300 +Subject: serial: sh-sci: Don't allow CS5-6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 9b87162de8be26bf3156460b37deee6399fd0fcb ] + +Only CS7 and CS8 seem supported but CSIZE is not sanitized from +CS5 or CS6 to CS8. + +Set CSIZE correctly so that userspace knows the effective value. +Incorrect CSIZE also results in miscalculation of the frame bits in +tty_get_char_size() or in its predecessor where the roughly the same +code is directly within uart_update_timeout(). + +Fixes: 1da177e4c3f4 (Linux-2.6.12-rc2) +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20220519081808.3776-6-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index f700bfaef129..8d924727d6f0 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -2392,8 +2392,12 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios, + int best_clk = -1; + unsigned long flags; + +- if ((termios->c_cflag & CSIZE) == CS7) ++ if ((termios->c_cflag & CSIZE) == CS7) { + smr_val |= SCSMR_CHR; ++ } else { ++ termios->c_cflag &= ~CSIZE; ++ termios->c_cflag |= CS8; ++ } + if (termios->c_cflag & PARENB) + smr_val |= SCSMR_PE; + if (termios->c_cflag & PARODD) +-- +2.35.1 + diff --git a/queue-5.10/serial-sifive-report-actual-baud-base-rather-than-fi.patch b/queue-5.10/serial-sifive-report-actual-baud-base-rather-than-fi.patch new file mode 100644 index 00000000000..f5ad7fd70eb --- /dev/null +++ b/queue-5.10/serial-sifive-report-actual-baud-base-rather-than-fi.patch @@ -0,0 +1,66 @@ +From 29077072641d25fc0a2c08ce25fa1f4465258af2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 21:40:18 +0100 +Subject: serial: sifive: Report actual baud base rather than fixed 115200 + +From: Maciej W. Rozycki + +[ Upstream commit 0a7ff843d507ce2cca2c3b7e169ee56e28133530 ] + +The base baud value reported is supposed to be the highest baud rate +that can be set for a serial port. The SiFive FU740-C000 SOC's on-chip +UART supports baud rates of up to 1/16 of the input clock rate, which is +the bus clock `tlclk'[1], often at 130MHz in the case of the HiFive +Unmatched board. + +However the sifive UART driver reports a fixed value of 115200 instead: + +10010000.serial: ttySIF0 at MMIO 0x10010000 (irq = 1, base_baud = 115200) is a SiFive UART v0 +10011000.serial: ttySIF1 at MMIO 0x10011000 (irq = 2, base_baud = 115200) is a SiFive UART v0 + +even though we already support setting higher baud rates, e.g.: + +$ tty +/dev/ttySIF1 +$ stty speed +230400 + +The baud base value is computed by the serial core by dividing the UART +clock recorded in `struct uart_port' by 16, which is also the minimum +value of the clock divider supported, so correct the baud base value +reported by setting the UART clock recorded to the input clock rate +rather than 115200: + +10010000.serial: ttySIF0 at MMIO 0x10010000 (irq = 1, base_baud = 8125000) is a SiFive UART v0 +10011000.serial: ttySIF1 at MMIO 0x10011000 (irq = 2, base_baud = 8125000) is a SiFive UART v0 + +References: + +[1] "SiFive FU740-C000 Manual", v1p3, SiFive, Inc., August 13, 2021, + Section 16.9 "Baud Rate Divisor Register (div)", pp.143-144 + +Signed-off-by: Maciej W. Rozycki +Fixes: 1f1496a923b6 ("riscv: Fix sifive serial driver") +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204291656280.9383@angie.orcam.me.uk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sifive.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/sifive.c b/drivers/tty/serial/sifive.c +index 214bf3086c68..24036a02a424 100644 +--- a/drivers/tty/serial/sifive.c ++++ b/drivers/tty/serial/sifive.c +@@ -999,7 +999,7 @@ static int sifive_serial_probe(struct platform_device *pdev) + /* Set up clock divider */ + ssp->clkin_rate = clk_get_rate(ssp->clk); + ssp->baud_rate = SIFIVE_DEFAULT_BAUD_RATE; +- ssp->port.uartclk = ssp->baud_rate * 16; ++ ssp->port.uartclk = ssp->clkin_rate; + __ssp_update_div(ssp); + + platform_set_drvdata(pdev, ssp); +-- +2.35.1 + diff --git a/queue-5.10/serial-sifive-sanitize-csize-and-c_iflag.patch b/queue-5.10/serial-sifive-sanitize-csize-and-c_iflag.patch new file mode 100644 index 00000000000..4edbce7f5da --- /dev/null +++ b/queue-5.10/serial-sifive-sanitize-csize-and-c_iflag.patch @@ -0,0 +1,58 @@ +From a5529b764108640aa65097959223ec5dabfece6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 11:18:05 +0300 +Subject: serial: sifive: Sanitize CSIZE and c_iflag +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit c069d2756c01ed36121fae6a42c14fdf1325c71d ] + +Only CS8 is supported but CSIZE was not sanitized to CS8. + +Set CSIZE correctly so that userspace knows the effective value. +Incorrect CSIZE also results in miscalculation of the frame bits in +tty_get_char_size() or in its predecessor where the roughly the same +code is directly within uart_update_timeout(). + +Similarly, INPCK, PARMRK, and BRKINT are reported textually unsupported +but were not cleared in termios c_iflag which is the machine-readable +format. + +Fixes: 45c054d0815b (tty: serial: add driver for the SiFive UART) +Cc: Paul Walmsley +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20220519081808.3776-7-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sifive.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/sifive.c b/drivers/tty/serial/sifive.c +index 24036a02a424..91952be01074 100644 +--- a/drivers/tty/serial/sifive.c ++++ b/drivers/tty/serial/sifive.c +@@ -667,12 +667,16 @@ static void sifive_serial_set_termios(struct uart_port *port, + int rate; + char nstop; + +- if ((termios->c_cflag & CSIZE) != CS8) ++ if ((termios->c_cflag & CSIZE) != CS8) { + dev_err_once(ssp->port.dev, "only 8-bit words supported\n"); ++ termios->c_cflag &= ~CSIZE; ++ termios->c_cflag |= CS8; ++ } + if (termios->c_iflag & (INPCK | PARMRK)) + dev_err_once(ssp->port.dev, "parity checking not supported\n"); + if (termios->c_iflag & BRKINT) + dev_err_once(ssp->port.dev, "BREAK detection not supported\n"); ++ termios->c_iflag &= ~(INPCK|PARMRK|BRKINT); + + /* Set number of stop bits */ + nstop = (termios->c_cflag & CSTOPB) ? 2 : 1; +-- +2.35.1 + diff --git a/queue-5.10/serial-st-asc-sanitize-csize-and-correct-parenb-for-.patch b/queue-5.10/serial-st-asc-sanitize-csize-and-correct-parenb-for-.patch new file mode 100644 index 00000000000..3aa11ec209f --- /dev/null +++ b/queue-5.10/serial-st-asc-sanitize-csize-and-correct-parenb-for-.patch @@ -0,0 +1,52 @@ +From 2ca8a4edb419ef51f97b4a5d0f88aba7a618871a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 11:18:06 +0300 +Subject: serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 52bb1cb7118564166b04d52387bd8403632f5190 ] + +Only CS7 and CS8 seem supported but CSIZE is not sanitized from CS5 or +CS6 to CS8. In addition, ASC_CTL_MODE_7BIT_PAR suggests that CS7 has +to have parity, thus add PARENB. + +Incorrect CSIZE results in miscalculation of the frame bits in +tty_get_char_size() or in its predecessor where the roughly the same +code is directly within uart_update_timeout(). + +Fixes: c4b058560762 (serial:st-asc: Add ST ASC driver.) +Cc: Srinivas Kandagatla +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20220519081808.3776-8-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/st-asc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/st-asc.c b/drivers/tty/serial/st-asc.c +index e7048515a79c..97d36f870f64 100644 +--- a/drivers/tty/serial/st-asc.c ++++ b/drivers/tty/serial/st-asc.c +@@ -535,10 +535,14 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios, + /* set character length */ + if ((cflag & CSIZE) == CS7) { + ctrl_val |= ASC_CTL_MODE_7BIT_PAR; ++ cflag |= PARENB; + } else { + ctrl_val |= (cflag & PARENB) ? ASC_CTL_MODE_8BIT_PAR : + ASC_CTL_MODE_8BIT; ++ cflag &= ~CSIZE; ++ cflag |= CS8; + } ++ termios->c_cflag = cflag; + + /* set stop bit */ + ctrl_val |= (cflag & CSTOPB) ? ASC_CTL_STOP_2BIT : ASC_CTL_STOP_1BIT; +-- +2.35.1 + diff --git a/queue-5.10/serial-stm32-usart-correct-csize-bits-and-parity.patch b/queue-5.10/serial-stm32-usart-correct-csize-bits-and-parity.patch new file mode 100644 index 00000000000..7dfdc4fa934 --- /dev/null +++ b/queue-5.10/serial-stm32-usart-correct-csize-bits-and-parity.patch @@ -0,0 +1,64 @@ +From fe76d7c68ebb250324d226a0a362817f91294dea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 11:18:07 +0300 +Subject: serial: stm32-usart: Correct CSIZE, bits, and parity +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 1deeda8d2877c18bc2b9eeee10dd6d2628852848 ] + +Add CSIZE sanitization for unsupported CSIZE configurations. In +addition, if parity is asked for but CSx was unsupported, the sensible +result is CS8+parity which requires setting USART_CR1_M0 like with 9 +bits. + +Incorrect CSIZE results in miscalculation of the frame bits in +tty_get_char_size() or in its predecessor where the roughly the same +code is directly within uart_update_timeout(). + +Fixes: c8a9d043947b (serial: stm32: fix word length configuration) +Cc: Erwan Le Ray +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20220519081808.3776-9-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 6afae051ba8d..8cd9e5b077b6 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -810,13 +810,22 @@ static void stm32_usart_set_termios(struct uart_port *port, + * CS8 or (CS7 + parity), 8 bits word aka [M1:M0] = 0b00 + * M0 and M1 already cleared by cr1 initialization. + */ +- if (bits == 9) ++ if (bits == 9) { + cr1 |= USART_CR1_M0; +- else if ((bits == 7) && cfg->has_7bits_data) ++ } else if ((bits == 7) && cfg->has_7bits_data) { + cr1 |= USART_CR1_M1; +- else if (bits != 8) ++ } else if (bits != 8) { + dev_dbg(port->dev, "Unsupported data bits config: %u bits\n" + , bits); ++ cflag &= ~CSIZE; ++ cflag |= CS8; ++ termios->c_cflag = cflag; ++ bits = 8; ++ if (cflag & PARENB) { ++ bits++; ++ cr1 |= USART_CR1_M0; ++ } ++ } + + if (ofs->rtor != UNDEF_REG && (stm32_port->rx_ch || + stm32_port->fifoen)) { +-- +2.35.1 + diff --git a/queue-5.10/serial-txx9-don-t-allow-cs5-6.patch b/queue-5.10/serial-txx9-don-t-allow-cs5-6.patch new file mode 100644 index 00000000000..31aca82d3f2 --- /dev/null +++ b/queue-5.10/serial-txx9-don-t-allow-cs5-6.patch @@ -0,0 +1,45 @@ +From 79bf133fef3902fc54439ba10e537c13f614a1d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 11:18:03 +0300 +Subject: serial: txx9: Don't allow CS5-6 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 79ac88655dc0551e3571ad16bdabdbe65d61553e ] + +Only CS7 and CS8 are supported but CSIZE is not sanitized with +CS5 or CS6 to CS8. + +Set CSIZE correctly so that userspace knows the effective value. +Incorrect CSIZE also results in miscalculation of the frame bits in +tty_get_char_size() or in its predecessor where the roughly the same +code is directly within uart_update_timeout(). + +Fixes: 1da177e4c3f4 (Linux-2.6.12-rc2) +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20220519081808.3776-5-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial_txx9.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c +index 7a07e7272de1..7beec331010c 100644 +--- a/drivers/tty/serial/serial_txx9.c ++++ b/drivers/tty/serial/serial_txx9.c +@@ -644,6 +644,8 @@ serial_txx9_set_termios(struct uart_port *port, struct ktermios *termios, + case CS6: /* not supported */ + case CS8: + cval |= TXX9_SILCR_UMODE_8BIT; ++ termios->c_cflag &= ~CSIZE; ++ termios->c_cflag |= CS8; + break; + } + +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 00000000000..cc822c519cc --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1,76 @@ +pcmcia-db1xxx_ss-restrict-to-mips_db1xxx-boards.patch +staging-greybus-codecs-fix-type-confusion-of-list-it.patch +iio-adc-ad7124-remove-shift-from-scan_type.patch +lkdtm-bugs-check-for-the-null-pointer-after-calling-.patch +tty-goldfish-use-tty_port_destroy-to-destroy-port.patch +tty-serial-owl-fix-missing-clk_disable_unprepare-in-.patch +tty-n_tty-restore-eof-push-handling-behavior.patch +tty-serial-fsl_lpuart-fix-potential-bug-when-using-b.patch +usb-usbip-fix-a-refcount-leak-in-stub_probe.patch +usb-usbip-add-missing-device-lock-on-tweak-configura.patch +usb-storage-karma-fix-rio_karma_init-return.patch +usb-musb-fix-missing-of_node_put-in-omap2430_probe.patch +staging-fieldbus-fix-the-error-handling-path-in-anyb.patch +pwm-lp3943-fix-duty-calculation-in-case-period-was-c.patch +rpmsg-qcom_smd-fix-irq_of_parse_and_map-return-value.patch +usb-dwc3-pci-fix-pm_runtime_get_sync-error-checking.patch +misc-fastrpc-fix-an-incorrect-null-check-on-list-ite.patch +firmware-stratix10-svc-fix-a-missing-check-on-list-i.patch +usb-typec-mux-check-dev_set_name-return-value.patch +platform-finally-disallow-irq0-in-platform_get_irq-a.patch +iio-adc-stmpe-adc-fix-wait_for_completion_timeout-re.patch +iio-proximity-vl53l0x-fix-return-value-check-of-wait.patch +iio-adc-sc27xx-fix-read-big-scale-voltage-not-right.patch +iio-adc-sc27xx-fine-tune-the-scale-calibration-value.patch +rpmsg-qcom_smd-fix-returning-0-if-irq_of_parse_and_m.patch +phy-qcom-qmp-fix-pipe-clock-imbalance-on-power-on-fa.patch +serial-sifive-report-actual-baud-base-rather-than-fi.patch +coresight-cpu-debug-replace-mutex-with-mutex_trylock.patch +extcon-ptn5150-add-queue-work-sync-before-driver-rel.patch +soc-rockchip-fix-refcount-leak-in-rockchip_grf_init.patch +clocksource-drivers-riscv-events-are-stopped-during-.patch +rtc-mt6397-check-return-value-after-calling-platform.patch +serial-meson-acquire-port-lock-in-startup.patch +serial-8250_fintek-check-ser_rs485_rts_-only-with-rs.patch +serial-digicolor-usart-don-t-allow-cs5-6.patch +serial-rda-uart-don-t-allow-cs5-6.patch +serial-txx9-don-t-allow-cs5-6.patch +serial-sh-sci-don-t-allow-cs5-6.patch +serial-sifive-sanitize-csize-and-c_iflag.patch +serial-st-asc-sanitize-csize-and-correct-parenb-for-.patch +serial-stm32-usart-correct-csize-bits-and-parity.patch +firmware-dmi-sysfs-fix-memory-leak-in-dmi_sysfs_regi.patch +bus-ti-sysc-fix-warnings-for-unbind-for-serial.patch +driver-base-fix-uaf-when-driver_attach-failed.patch +driver-core-fix-deadlock-in-__device_attach.patch +watchdog-rti-wdt-fix-pm_runtime_get_sync-error-check.patch +watchdog-ts4800_wdt-fix-refcount-leak-in-ts4800_wdt_.patch +asoc-fsl_sai-fix-fsl_sai_xdr-xfr-definition.patch +clocksource-drivers-oxnas-rps-fix-irq_of_parse_and_m.patch +s390-crypto-fix-scatterwalk_unmap-callers-in-aes-gcm.patch +net-sched-fixed-barrier-to-prevent-skbuff-sticking-i.patch +net-ethernet-mtk_eth_soc-out-of-bounds-read-in-mtk_h.patch +net-ethernet-ti-am65-cpsw-nuss-fix-some-refcount-lea.patch +net-dsa-mv88e6xxx-fix-refcount-leak-in-mv88e6xxx_mdi.patch +modpost-fix-removing-numeric-suffixes.patch +jffs2-fix-memory-leak-in-jffs2_do_fill_super.patch +ubi-fastmap-fix-high-cpu-usage-of-ubi_bgt-by-making-.patch +ubi-ubi_create_volume-fix-use-after-free-when-volume.patch +bpf-fix-probe-read-error-in-___bpf_prog_run.patch +riscv-read-only-pages-should-not-be-writable.patch +net-smc-fixes-for-converting-from-struct-smc_cdc_tx_.patch +nfp-only-report-pause-frame-configuration-for-physic.patch +sfc-fix-considering-that-all-channels-have-tx-queues.patch +sfc-fix-wrong-tx-channel-offset-with-efx_separate_tx.patch +net-mlx5-don-t-use-already-freed-action-pointer.patch +net-mlx5-correct-ece-offset-in-query-qp-output.patch +net-mlx5e-update-netdev-features-after-changing-xdp-.patch +net-sched-add-barrier-to-fix-packet-stuck-problem-fo.patch +tcp-tcp_rtx_synack-can-be-called-from-process-contex.patch +gpio-pca953x-use-the-correct-register-address-to-do-.patch +afs-fix-infinite-loop-found-by-xfstest-generic-676.patch +scsi-sd-fix-potential-null-pointer-dereference.patch +tipc-check-attribute-length-for-bearer-name.patch +arm64-initialize-jump-labels-before-setup_machine_fd.patch +driver-core-fix-wait_for_device_probe-deferred_probe.patch +perf-c2c-fix-sorting-in-percent_rmt_hitm_cmp.patch diff --git a/queue-5.10/sfc-fix-considering-that-all-channels-have-tx-queues.patch b/queue-5.10/sfc-fix-considering-that-all-channels-have-tx-queues.patch new file mode 100644 index 00000000000..aa8d3604aeb --- /dev/null +++ b/queue-5.10/sfc-fix-considering-that-all-channels-have-tx-queues.patch @@ -0,0 +1,68 @@ +From 963b54515d8e2c010b6ebdfc2fdea269c184233a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 May 2022 10:05:28 +0200 +Subject: sfc: fix considering that all channels have TX queues +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Habets + +[ Upstream commit 2e102b53f8a778f872dc137f4c7ac548705817aa ] + +Normally, all channels have RX and TX queues, but this is not true if +modparam efx_separate_tx_channels=1 is used. In that cases, some +channels only have RX queues and others only TX queues (or more +preciselly, they have them allocated, but not initialized). + +Fix efx_channel_has_tx_queues to return the correct value for this case +too. + +Messages shown at probe time before the fix: + sfc 0000:03:00.0 ens6f0np0: MC command 0x82 inlen 544 failed rc=-22 (raw=0) arg=0 + ------------[ cut here ]------------ + netdevice: ens6f0np0: failed to initialise TXQ -1 + WARNING: CPU: 1 PID: 626 at drivers/net/ethernet/sfc/ef10.c:2393 efx_ef10_tx_init+0x201/0x300 [sfc] + [...] stripped + RIP: 0010:efx_ef10_tx_init+0x201/0x300 [sfc] + [...] stripped + Call Trace: + efx_init_tx_queue+0xaa/0xf0 [sfc] + efx_start_channels+0x49/0x120 [sfc] + efx_start_all+0x1f8/0x430 [sfc] + efx_net_open+0x5a/0xe0 [sfc] + __dev_open+0xd0/0x190 + __dev_change_flags+0x1b3/0x220 + dev_change_flags+0x21/0x60 + [...] stripped + +Messages shown at remove time before the fix: + sfc 0000:03:00.0 ens6f0np0: failed to flush 10 queues + sfc 0000:03:00.0 ens6f0np0: failed to flush queues + +Fixes: 8700aff08984 ("sfc: fix channel allocation with brute force") +Reported-by: Tianhao Zhao +Signed-off-by: Martin Habets +Tested-by: Íñigo Huguet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/net_driver.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h +index 9f7dfdf708cf..8aecb4bd2c0d 100644 +--- a/drivers/net/ethernet/sfc/net_driver.h ++++ b/drivers/net/ethernet/sfc/net_driver.h +@@ -1522,7 +1522,7 @@ static inline bool efx_channel_is_xdp_tx(struct efx_channel *channel) + + static inline bool efx_channel_has_tx_queues(struct efx_channel *channel) + { +- return true; ++ return channel && channel->channel >= channel->efx->tx_channel_offset; + } + + static inline unsigned int efx_channel_num_tx_queues(struct efx_channel *channel) +-- +2.35.1 + diff --git a/queue-5.10/sfc-fix-wrong-tx-channel-offset-with-efx_separate_tx.patch b/queue-5.10/sfc-fix-wrong-tx-channel-offset-with-efx_separate_tx.patch new file mode 100644 index 00000000000..de90fcf3da2 --- /dev/null +++ b/queue-5.10/sfc-fix-wrong-tx-channel-offset-with-efx_separate_tx.patch @@ -0,0 +1,70 @@ +From 0b2f8314aaca6a95bea5fa537055b7e0232cd7e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 May 2022 10:05:29 +0200 +Subject: sfc: fix wrong tx channel offset with efx_separate_tx_channels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit c308dfd1b43ef0d4c3e57b741bb3462eb7a7f4a2 ] + +tx_channel_offset is calculated in efx_allocate_msix_channels, but it is +also calculated again in efx_set_channels because it was originally done +there, and when efx_allocate_msix_channels was introduced it was +forgotten to be removed from efx_set_channels. + +Moreover, the old calculation is wrong when using +efx_separate_tx_channels because now we can have XDP channels after the +TX channels, so n_channels - n_tx_channels doesn't point to the first TX +channel. + +Remove the old calculation from efx_set_channels, and add the +initialization of this variable if MSI or legacy interrupts are used, +next to the initialization of the rest of the related variables, where +it was missing. + +Fixes: 3990a8fffbda ("sfc: allocate channels for XDP tx queues") +Reported-by: Tianhao Zhao +Signed-off-by: Íñigo Huguet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/efx_channels.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/efx_channels.c b/drivers/net/ethernet/sfc/efx_channels.c +index 2ab8571ef1cc..d0f1b2dc7dff 100644 +--- a/drivers/net/ethernet/sfc/efx_channels.c ++++ b/drivers/net/ethernet/sfc/efx_channels.c +@@ -287,6 +287,7 @@ int efx_probe_interrupts(struct efx_nic *efx) + efx->n_channels = 1; + efx->n_rx_channels = 1; + efx->n_tx_channels = 1; ++ efx->tx_channel_offset = 0; + efx->n_xdp_channels = 0; + efx->xdp_channel_offset = efx->n_channels; + rc = pci_enable_msi(efx->pci_dev); +@@ -307,6 +308,7 @@ int efx_probe_interrupts(struct efx_nic *efx) + efx->n_channels = 1 + (efx_separate_tx_channels ? 1 : 0); + efx->n_rx_channels = 1; + efx->n_tx_channels = 1; ++ efx->tx_channel_offset = 1; + efx->n_xdp_channels = 0; + efx->xdp_channel_offset = efx->n_channels; + efx->legacy_irq = efx->pci_dev->irq; +@@ -858,10 +860,6 @@ int efx_set_channels(struct efx_nic *efx) + int xdp_queue_number; + int rc; + +- efx->tx_channel_offset = +- efx_separate_tx_channels ? +- efx->n_channels - efx->n_tx_channels : 0; +- + if (efx->xdp_tx_queue_count) { + EFX_WARN_ON_PARANOID(efx->xdp_tx_queues); + +-- +2.35.1 + diff --git a/queue-5.10/soc-rockchip-fix-refcount-leak-in-rockchip_grf_init.patch b/queue-5.10/soc-rockchip-fix-refcount-leak-in-rockchip_grf_init.patch new file mode 100644 index 00000000000..875aa65030a --- /dev/null +++ b/queue-5.10/soc-rockchip-fix-refcount-leak-in-rockchip_grf_init.patch @@ -0,0 +1,44 @@ +From cb2b550f207b821c627f25345358c84696a3acc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 May 2022 11:20:10 +0400 +Subject: soc: rockchip: Fix refcount leak in rockchip_grf_init + +From: Miaoqian Lin + +[ Upstream commit 9b59588d8be91c96bfb0371e912ceb4f16315dbf ] + +of_find_matching_node_and_match returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 4c58063d4258 ("soc: rockchip: add driver handling grf setup") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220516072013.19731-1-linmq006@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/soc/rockchip/grf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/soc/rockchip/grf.c b/drivers/soc/rockchip/grf.c +index 494cf2b5bf7b..343ff61ccccb 100644 +--- a/drivers/soc/rockchip/grf.c ++++ b/drivers/soc/rockchip/grf.c +@@ -148,12 +148,14 @@ static int __init rockchip_grf_init(void) + return -ENODEV; + if (!match || !match->data) { + pr_err("%s: missing grf data\n", __func__); ++ of_node_put(np); + return -EINVAL; + } + + grf_info = match->data; + + grf = syscon_node_to_regmap(np); ++ of_node_put(np); + if (IS_ERR(grf)) { + pr_err("%s: could not get grf syscon\n", __func__); + return PTR_ERR(grf); +-- +2.35.1 + diff --git a/queue-5.10/staging-fieldbus-fix-the-error-handling-path-in-anyb.patch b/queue-5.10/staging-fieldbus-fix-the-error-handling-path-in-anyb.patch new file mode 100644 index 00000000000..77b598c3dd5 --- /dev/null +++ b/queue-5.10/staging-fieldbus-fix-the-error-handling-path-in-anyb.patch @@ -0,0 +1,39 @@ +From 3ea47d9bfc07eb7916c11c888796284810cdd598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 08:48:18 +0200 +Subject: staging: fieldbus: Fix the error handling path in + anybuss_host_common_probe() + +From: Christophe JAILLET + +[ Upstream commit 7079b3483a17be2cfba64cbd4feb1b7ae07f1ea7 ] + +If device_register() fails, device_unregister() should not be called +because it will free some resources that are not allocated. +put_device() should be used instead. + +Fixes: 308ee87a2f1e ("staging: fieldbus: anybus-s: support HMS Anybus-S bus") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/5401a519608d6e1a4e7435c20f4f20b0c5c36c23.1650610082.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fieldbus/anybuss/host.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/fieldbus/anybuss/host.c b/drivers/staging/fieldbus/anybuss/host.c +index 549cb7d51af8..2a20a1767d77 100644 +--- a/drivers/staging/fieldbus/anybuss/host.c ++++ b/drivers/staging/fieldbus/anybuss/host.c +@@ -1384,7 +1384,7 @@ anybuss_host_common_probe(struct device *dev, + goto err_device; + return cd; + err_device: +- device_unregister(&cd->client->dev); ++ put_device(&cd->client->dev); + err_kthread: + kthread_stop(cd->qthread); + err_reset: +-- +2.35.1 + diff --git a/queue-5.10/staging-greybus-codecs-fix-type-confusion-of-list-it.patch b/queue-5.10/staging-greybus-codecs-fix-type-confusion-of-list-it.patch new file mode 100644 index 00000000000..bf722e90d3d --- /dev/null +++ b/queue-5.10/staging-greybus-codecs-fix-type-confusion-of-list-it.patch @@ -0,0 +1,44 @@ +From 3479b578b7877bb0f4aba854937e3cb7c7994ea5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 13:36:26 +0100 +Subject: staging: greybus: codecs: fix type confusion of list iterator + variable + +From: Jakob Koschel + +[ Upstream commit 84ef256550196bc06e6849a34224c998b45bd557 ] + +If the list does not exit early then data == NULL and 'module' does not +point to a valid list element. +Using 'module' in such a case is not valid and was therefore removed. + +Fixes: 6dd67645f22c ("greybus: audio: Use single codec driver registration") +Reviewed-by: Dan Carpenter +Reviewed-by: Vaibhav Agarwal +Reviewed-by: Mark Greer +Signed-off-by: Jakob Koschel +Link: https://lore.kernel.org/r/20220321123626.3068639-1-jakobkoschel@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/audio_codec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c +index 42ce6c88ea75..4ed29f852c23 100644 +--- a/drivers/staging/greybus/audio_codec.c ++++ b/drivers/staging/greybus/audio_codec.c +@@ -621,8 +621,8 @@ static int gbcodec_mute_stream(struct snd_soc_dai *dai, int mute, int stream) + break; + } + if (!data) { +- dev_err(dai->dev, "%s:%s DATA connection missing\n", +- dai->name, module->name); ++ dev_err(dai->dev, "%s DATA connection missing\n", ++ dai->name); + mutex_unlock(&codec->lock); + return -ENODEV; + } +-- +2.35.1 + diff --git a/queue-5.10/tcp-tcp_rtx_synack-can-be-called-from-process-contex.patch b/queue-5.10/tcp-tcp_rtx_synack-can-be-called-from-process-contex.patch new file mode 100644 index 00000000000..bd0164f056c --- /dev/null +++ b/queue-5.10/tcp-tcp_rtx_synack-can-be-called-from-process-contex.patch @@ -0,0 +1,92 @@ +From 02def38f30fb65e8706c3bb9ee3fa03043a1470d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 14:37:13 -0700 +Subject: tcp: tcp_rtx_synack() can be called from process context + +From: Eric Dumazet + +[ Upstream commit 0a375c822497ed6ad6b5da0792a12a6f1af10c0b ] + +Laurent reported the enclosed report [1] + +This bug triggers with following coditions: + +0) Kernel built with CONFIG_DEBUG_PREEMPT=y + +1) A new passive FastOpen TCP socket is created. + This FO socket waits for an ACK coming from client to be a complete + ESTABLISHED one. +2) A socket operation on this socket goes through lock_sock() + release_sock() dance. +3) While the socket is owned by the user in step 2), + a retransmit of the SYN is received and stored in socket backlog. +4) At release_sock() time, the socket backlog is processed while + in process context. +5) A SYNACK packet is cooked in response of the SYN retransmit. +6) -> tcp_rtx_synack() is called in process context. + +Before blamed commit, tcp_rtx_synack() was always called from BH handler, +from a timer handler. + +Fix this by using TCP_INC_STATS() & NET_INC_STATS() +which do not assume caller is in non preemptible context. + +[1] +BUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180 +caller is tcp_rtx_synack.part.0+0x36/0xc0 +CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1 +Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021 +Call Trace: + + dump_stack_lvl+0x48/0x5e + check_preemption_disabled+0xde/0xe0 + tcp_rtx_synack.part.0+0x36/0xc0 + tcp_rtx_synack+0x8d/0xa0 + ? kmem_cache_alloc+0x2e0/0x3e0 + ? apparmor_file_alloc_security+0x3b/0x1f0 + inet_rtx_syn_ack+0x16/0x30 + tcp_check_req+0x367/0x610 + tcp_rcv_state_process+0x91/0xf60 + ? get_nohz_timer_target+0x18/0x1a0 + ? lock_timer_base+0x61/0x80 + ? preempt_count_add+0x68/0xa0 + tcp_v4_do_rcv+0xbd/0x270 + __release_sock+0x6d/0xb0 + release_sock+0x2b/0x90 + sock_setsockopt+0x138/0x1140 + ? __sys_getsockname+0x7e/0xc0 + ? aa_sk_perm+0x3e/0x1a0 + __sys_setsockopt+0x198/0x1e0 + __x64_sys_setsockopt+0x21/0x30 + do_syscall_64+0x38/0xc0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path") +Signed-off-by: Eric Dumazet +Reported-by: Laurent Fasnacht +Acked-by: Neal Cardwell +Link: https://lore.kernel.org/r/20220530213713.601888-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index e37ad0b3645c..8634a5c853f5 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -4115,8 +4115,8 @@ int tcp_rtx_synack(const struct sock *sk, struct request_sock *req) + res = af_ops->send_synack(sk, NULL, &fl, req, NULL, TCP_SYNACK_NORMAL, + NULL); + if (!res) { +- __TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS); +- __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS); ++ TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS); ++ NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS); + if (unlikely(tcp_passive_fastopen(sk))) + tcp_sk(sk)->total_retrans++; + trace_tcp_retransmit_synack(sk, req); +-- +2.35.1 + diff --git a/queue-5.10/tipc-check-attribute-length-for-bearer-name.patch b/queue-5.10/tipc-check-attribute-length-for-bearer-name.patch new file mode 100644 index 00000000000..77c1b661086 --- /dev/null +++ b/queue-5.10/tipc-check-attribute-length-for-bearer-name.patch @@ -0,0 +1,58 @@ +From 721a326b0cb08c0e8ff11e7fc97a2bc3c35dee54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 13:30:53 +0700 +Subject: tipc: check attribute length for bearer name + +From: Hoang Le + +[ Upstream commit 7f36f798f89bf32c0164049cb0e3fd1af613d0bb ] + +syzbot reported uninit-value: +===================================================== +BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 [inline] +BUG: KMSAN: uninit-value in string+0x4f9/0x6f0 lib/vsprintf.c:725 + string_nocheck lib/vsprintf.c:644 [inline] + string+0x4f9/0x6f0 lib/vsprintf.c:725 + vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806 + vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158 + vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256 + vprintk_default+0x86/0xa0 kernel/printk/printk.c:2283 + vprintk+0x15f/0x180 kernel/printk/printk_safe.c:50 + _printk+0x18d/0x1cf kernel/printk/printk.c:2293 + tipc_enable_bearer net/tipc/bearer.c:371 [inline] + __tipc_nl_bearer_enable+0x2022/0x22a0 net/tipc/bearer.c:1033 + tipc_nl_bearer_enable+0x6c/0xb0 net/tipc/bearer.c:1042 + genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline] + +- Do sanity check the attribute length for TIPC_NLA_BEARER_NAME. +- Do not use 'illegal name' in printing message. + +Reported-by: syzbot+e820fdc8ce362f2dea51@syzkaller.appspotmail.com +Fixes: cb30a63384bc ("tipc: refactor function tipc_enable_bearer()") +Acked-by: Jon Maloy +Signed-off-by: Hoang Le +Link: https://lore.kernel.org/r/20220602063053.5892-1-hoang.h.le@dektech.com.au +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tipc/bearer.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c +index 6911f1cab206..72c31ef985eb 100644 +--- a/net/tipc/bearer.c ++++ b/net/tipc/bearer.c +@@ -249,9 +249,8 @@ static int tipc_enable_bearer(struct net *net, const char *name, + u32 i; + + if (!bearer_name_validate(name, &b_names)) { +- errstr = "illegal name"; + NL_SET_ERR_MSG(extack, "Illegal name"); +- goto rejected; ++ return res; + } + + if (prio > TIPC_MAX_LINK_PRI && prio != TIPC_MEDIA_LINK_PRI) { +-- +2.35.1 + diff --git a/queue-5.10/tty-goldfish-use-tty_port_destroy-to-destroy-port.patch b/queue-5.10/tty-goldfish-use-tty_port_destroy-to-destroy-port.patch new file mode 100644 index 00000000000..245fc7bca30 --- /dev/null +++ b/queue-5.10/tty-goldfish-use-tty_port_destroy-to-destroy-port.patch @@ -0,0 +1,48 @@ +From 33f13769489948ad23801c6641ecc75b091753dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 19:58:44 +0800 +Subject: tty: goldfish: Use tty_port_destroy() to destroy port + +From: Wang Weiyang + +[ Upstream commit 507b05063d1b7a1fcb9f7d7c47586fc4f3508f98 ] + +In goldfish_tty_probe(), the port initialized through tty_port_init() +should be destroyed in error paths.In goldfish_tty_remove(), qtty->port +also should be destroyed or else might leak resources. + +Fix the above by calling tty_port_destroy(). + +Fixes: 666b7793d4bf ("goldfish: tty driver") +Reviewed-by: Jiri Slaby +Signed-off-by: Wang Weiyang +Link: https://lore.kernel.org/r/20220328115844.86032-1-wangweiyang2@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/goldfish.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c +index c8c5cdfc5e19..abc84d84f638 100644 +--- a/drivers/tty/goldfish.c ++++ b/drivers/tty/goldfish.c +@@ -407,6 +407,7 @@ static int goldfish_tty_probe(struct platform_device *pdev) + err_tty_register_device_failed: + free_irq(irq, qtty); + err_dec_line_count: ++ tty_port_destroy(&qtty->port); + goldfish_tty_current_line_count--; + if (goldfish_tty_current_line_count == 0) + goldfish_tty_delete_driver(); +@@ -428,6 +429,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) + iounmap(qtty->base); + qtty->base = NULL; + free_irq(qtty->irq, pdev); ++ tty_port_destroy(&qtty->port); + goldfish_tty_current_line_count--; + if (goldfish_tty_current_line_count == 0) + goldfish_tty_delete_driver(); +-- +2.35.1 + diff --git a/queue-5.10/tty-n_tty-restore-eof-push-handling-behavior.patch b/queue-5.10/tty-n_tty-restore-eof-push-handling-behavior.patch new file mode 100644 index 00000000000..e8617ec0cfc --- /dev/null +++ b/queue-5.10/tty-n_tty-restore-eof-push-handling-behavior.patch @@ -0,0 +1,123 @@ +From f265ba02781ecc6b02942a3119d4bdc724c587d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 01:58:10 +0200 +Subject: tty: n_tty: Restore EOF push handling behavior + +From: Daniel Gibson + +[ Upstream commit 65a8b287023da68c4550deab5c764e6891cf1caf ] + +TTYs in ICANON mode have a special case that allows "pushing" a line +without a regular EOL character (like newline), by using EOF (the EOT +character - ASCII 0x4) as a pseudo-EOL. It is silently discarded, so +the reader of the PTS will receive the line *without* EOF or any other +terminating character. + +This special case has an edge case: What happens if the readers buffer +is the same size as the line (without EOF)? Will they be able to tell +if the whole line is received, i.e. if the next read() will return more +of the same line or the next line? + +There are two possibilities, that both have (dis)advantages: + +1. The next read() returns 0. FreeBSD (13.0) and OSX (10.11) do this. + Advantage: The reader can interpret this as "the line is over". + Disadvantage: read() returning 0 means EOF, the reader could also + interpret it as "there's no more data" and stop reading or even + close the PT. + +2. The next read() returns the next line, the EOF is silently discarded. + Solaris (or at least OpenIndiana 2021.10) does this, Linux has done + do this since commit 40d5e0905a03 ("n_tty: Fix EOF push handling"); + this behavior was recently broken by commit 359303076163 ("tty: + n_tty: do not look ahead for EOL character past the end of the buffer"). + Advantage: read() won't return 0 (EOF), reader less likely to be + confused (and things like `while(read(..)>0)` don't break) + Disadvantage: The reader can't really know if the read() continues + the last line (that filled the whole read buffer) or starts a + new line. + +As both options are defensible (and are used by other Unix-likes), it's +best to stick to the "old" behavior since "n_tty: Fix EOF push handling" +of 2013, i.e. silently discard that EOF. + +This patch - that I actually got from Linus for testing and only +modified slightly - restores that behavior by skipping an EOF +character if it's the next character after reading is done. + +Based on a patch from Linus Torvalds. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215611 +Fixes: 359303076163 ("tty: n_tty: do not look ahead for EOL character past the end of the buffer") +Cc: Peter Hurley +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Reviewed-and-tested-by: Daniel Gibson +Acked-by: Linus Torvalds +Signed-off-by: Daniel Gibson +Link: https://lore.kernel.org/r/20220329235810.452513-2-daniel@gibson.sh +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_tty.c | 38 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 58190135efb7..12dde01e576b 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -2073,6 +2073,35 @@ static bool canon_copy_from_read_buf(struct tty_struct *tty, + return ldata->read_tail != canon_head; + } + ++/* ++ * If we finished a read at the exact location of an ++ * EOF (special EOL character that's a __DISABLED_CHAR) ++ * in the stream, silently eat the EOF. ++ */ ++static void canon_skip_eof(struct tty_struct *tty) ++{ ++ struct n_tty_data *ldata = tty->disc_data; ++ size_t tail, canon_head; ++ ++ canon_head = smp_load_acquire(&ldata->canon_head); ++ tail = ldata->read_tail; ++ ++ // No data? ++ if (tail == canon_head) ++ return; ++ ++ // See if the tail position is EOF in the circular buffer ++ tail &= (N_TTY_BUF_SIZE - 1); ++ if (!test_bit(tail, ldata->read_flags)) ++ return; ++ if (read_buf(ldata, tail) != __DISABLED_CHAR) ++ return; ++ ++ // Clear the EOL bit, skip the EOF char. ++ clear_bit(tail, ldata->read_flags); ++ smp_store_release(&ldata->read_tail, ldata->read_tail + 1); ++} ++ + /** + * job_control - check job control + * @tty: tty +@@ -2142,7 +2171,14 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + */ + if (*cookie) { + if (ldata->icanon && !L_EXTPROC(tty)) { +- if (canon_copy_from_read_buf(tty, &kb, &nr)) ++ /* ++ * If we have filled the user buffer, see ++ * if we should skip an EOF character before ++ * releasing the lock and returning done. ++ */ ++ if (!nr) ++ canon_skip_eof(tty); ++ else if (canon_copy_from_read_buf(tty, &kb, &nr)) + return kb - kbuf; + } else { + if (copy_from_read_buf(tty, &kb, &nr)) +-- +2.35.1 + diff --git a/queue-5.10/tty-serial-fsl_lpuart-fix-potential-bug-when-using-b.patch b/queue-5.10/tty-serial-fsl_lpuart-fix-potential-bug-when-using-b.patch new file mode 100644 index 00000000000..22c3b80cec3 --- /dev/null +++ b/queue-5.10/tty-serial-fsl_lpuart-fix-potential-bug-when-using-b.patch @@ -0,0 +1,118 @@ +From 330cdbca6347e0c0dca88953fd6438b4d443ecf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 19:22:11 +0800 +Subject: tty: serial: fsl_lpuart: fix potential bug when using both + of_alias_get_id and ida_simple_get + +From: Sherry Sun + +[ Upstream commit f398e0aa325c61fa20903833a5b534ecb8e6e418 ] + +Now fsl_lpuart driver use both of_alias_get_id() and ida_simple_get() in +.probe(), which has the potential bug. For example, when remove the +lpuart7 alias in dts, of_alias_get_id() will return error, then call +ida_simple_get() to allocate the id 0 for lpuart7, this may confilct +with the lpuart4 which has alias 0. + + aliases { + ... + serial0 = &lpuart4; + serial1 = &lpuart5; + serial2 = &lpuart6; + serial3 = &lpuart7; + } + +So remove the ida_simple_get() in .probe(), return an error directly +when calling of_alias_get_id() fails, which is consistent with other +uart drivers behavior. + +Fixes: 3bc3206e1c0f ("serial: fsl_lpuart: Remove the alias node dependence") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20220321112211.8895-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 24 ++++-------------------- + 1 file changed, 4 insertions(+), 20 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index b9f8add284e3..52a603a6f9b8 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -229,8 +229,6 @@ + /* IMX lpuart has four extra unused regs located at the beginning */ + #define IMX_REG_OFF 0x10 + +-static DEFINE_IDA(fsl_lpuart_ida); +- + enum lpuart_type { + VF610_LPUART, + LS1021A_LPUART, +@@ -265,7 +263,6 @@ struct lpuart_port { + int rx_dma_rng_buf_len; + unsigned int dma_tx_nents; + wait_queue_head_t dma_wait; +- bool id_allocated; + }; + + struct lpuart_soc_data { +@@ -2638,23 +2635,18 @@ static int lpuart_probe(struct platform_device *pdev) + + ret = of_alias_get_id(np, "serial"); + if (ret < 0) { +- ret = ida_simple_get(&fsl_lpuart_ida, 0, UART_NR, GFP_KERNEL); +- if (ret < 0) { +- dev_err(&pdev->dev, "port line is full, add device failed\n"); +- return ret; +- } +- sport->id_allocated = true; ++ dev_err(&pdev->dev, "failed to get alias id, errno %d\n", ret); ++ return ret; + } + if (ret >= ARRAY_SIZE(lpuart_ports)) { + dev_err(&pdev->dev, "serial%d out of range\n", ret); +- ret = -EINVAL; +- goto failed_out_of_range; ++ return -EINVAL; + } + sport->port.line = ret; + + ret = lpuart_enable_clks(sport); + if (ret) +- goto failed_clock_enable; ++ return ret; + sport->port.uartclk = lpuart_get_baud_clk_rate(sport); + + lpuart_ports[sport->port.line] = sport; +@@ -2697,10 +2689,6 @@ static int lpuart_probe(struct platform_device *pdev) + failed_attach_port: + failed_irq_request: + lpuart_disable_clks(sport); +-failed_clock_enable: +-failed_out_of_range: +- if (sport->id_allocated) +- ida_simple_remove(&fsl_lpuart_ida, sport->port.line); + return ret; + } + +@@ -2710,9 +2698,6 @@ static int lpuart_remove(struct platform_device *pdev) + + uart_remove_one_port(&lpuart_reg, &sport->port); + +- if (sport->id_allocated) +- ida_simple_remove(&fsl_lpuart_ida, sport->port.line); +- + lpuart_disable_clks(sport); + + if (sport->dma_tx_chan) +@@ -2842,7 +2827,6 @@ static int __init lpuart_serial_init(void) + + static void __exit lpuart_serial_exit(void) + { +- ida_destroy(&fsl_lpuart_ida); + platform_driver_unregister(&lpuart_driver); + uart_unregister_driver(&lpuart_reg); + } +-- +2.35.1 + diff --git a/queue-5.10/tty-serial-owl-fix-missing-clk_disable_unprepare-in-.patch b/queue-5.10/tty-serial-owl-fix-missing-clk_disable_unprepare-in-.patch new file mode 100644 index 00000000000..a474b665298 --- /dev/null +++ b/queue-5.10/tty-serial-owl-fix-missing-clk_disable_unprepare-in-.patch @@ -0,0 +1,37 @@ +From 4004d07f66c699b31424ac3ae4190ba675f78533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 10:51:35 +0000 +Subject: tty: serial: owl: Fix missing clk_disable_unprepare() in + owl_uart_probe + +From: Miaoqian Lin + +[ Upstream commit bcea0f547ec1a2ee44d429aaf0334633e386e67c ] + +Fix the missing clk_disable_unprepare() before return +from owl_uart_probe() in the error handling case. + +Fixes: abf42d2f333b ("tty: serial: owl: add "much needed" clk_prepare_enable()") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220307105135.11698-1-linmq006@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/owl-uart.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/serial/owl-uart.c b/drivers/tty/serial/owl-uart.c +index c149f8c30007..a0d4bffe70bd 100644 +--- a/drivers/tty/serial/owl-uart.c ++++ b/drivers/tty/serial/owl-uart.c +@@ -695,6 +695,7 @@ static int owl_uart_probe(struct platform_device *pdev) + owl_port->port.uartclk = clk_get_rate(owl_port->clk); + if (owl_port->port.uartclk == 0) { + dev_err(&pdev->dev, "clock rate is zero\n"); ++ clk_disable_unprepare(owl_port->clk); + return -EINVAL; + } + owl_port->port.flags = UPF_BOOT_AUTOCONF | UPF_IOREMAP | UPF_LOW_LATENCY; +-- +2.35.1 + diff --git a/queue-5.10/ubi-fastmap-fix-high-cpu-usage-of-ubi_bgt-by-making-.patch b/queue-5.10/ubi-fastmap-fix-high-cpu-usage-of-ubi_bgt-by-making-.patch new file mode 100644 index 00000000000..b43448f587e --- /dev/null +++ b/queue-5.10/ubi-fastmap-fix-high-cpu-usage-of-ubi_bgt-by-making-.patch @@ -0,0 +1,300 @@ +From 5c07185f3ea8f43b6c82a1db15e8b936deedc323 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 20:31:24 +0800 +Subject: ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool + not empty + +From: Zhihao Cheng + +[ Upstream commit d09e9a2bddba6c48e0fddb16c4383172ac593251 ] + +There at least 6 PEBs reserved on UBI device: +1. EBA_RESERVED_PEBS[1] +2. WL_RESERVED_PEBS[1] +3. UBI_LAYOUT_VOLUME_EBS[2] +4. MIN_FASTMAP_RESERVED_PEBS[2] + +When all ubi volumes take all their PEBs, there are 3 (EBA_RESERVED_PEBS + +WL_RESERVED_PEBS + MIN_FASTMAP_RESERVED_PEBS - MIN_FASTMAP_TAKEN_PEBS[1]) +free PEBs. Since commit f9c34bb529975fe ("ubi: Fix producing anchor PEBs") +and commit 4b68bf9a69d22dd ("ubi: Select fastmap anchor PEBs considering +wear level rules") applied, there is only 1 (3 - FASTMAP_ANCHOR_PEBS[1] - +FASTMAP_NEXT_ANCHOR_PEBS[1]) free PEB to fill pool and wl_pool, after +filling pool, wl_pool is always empty. So, UBI could be stuck in an +infinite loop: + + ubi_thread system_wq +wear_leveling_worker <-------------------------------------------------- + get_peb_for_wl | + // fm_wl_pool, used = size = 0 | + schedule_work(&ubi->fm_work) | + | + update_fastmap_work_fn | + ubi_update_fastmap | + ubi_refill_pools | + // ubi->free_count - ubi->beb_rsvd_pebs < 5 | + // wl_pool is not filled with any PEBs | + schedule_erase(old_fm_anchor) | + ubi_ensure_anchor_pebs | + __schedule_ubi_work(wear_leveling_worker) | + | +__erase_worker | + ensure_wear_leveling | + __schedule_ubi_work(wear_leveling_worker) -------------------------- + +, which cause high cpu usage of ubi_bgt: +top - 12:10:42 up 5 min, 2 users, load average: 1.76, 0.68, 0.27 +Tasks: 123 total, 3 running, 54 sleeping, 0 stopped, 0 zombie + + PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND + 1589 root 20 0 0 0 0 R 45.0 0.0 0:38.86 ubi_bgt0d + 319 root 20 0 0 0 0 I 15.2 0.0 0:15.29 kworker/0:3-eve + 371 root 20 0 0 0 0 I 14.9 0.0 0:12.85 kworker/3:3-eve + 20 root 20 0 0 0 0 I 11.3 0.0 0:05.33 kworker/1:0-eve + 202 root 20 0 0 0 0 I 11.3 0.0 0:04.93 kworker/2:3-eve + +In commit 4b68bf9a69d22dd ("ubi: Select fastmap anchor PEBs considering +wear level rules"), there are three key changes: + 1) Choose the fastmap anchor when the most free PEBs are available. + 2) Enable anchor move within the anchor area again as it is useful + for distributing wear. + 3) Import a candidate fm anchor and check this PEB's erase count during + wear leveling. If the wear leveling limit is exceeded, use the used + anchor area PEB with the lowest erase count to replace it. + +The anchor candidate can be removed, we can check fm_anchor PEB's erase +count during wear leveling. Fix it by: + 1) Removing 'fm_next_anchor' and check 'fm_anchor' during wear leveling. + 2) Preferentially filling one free peb into fm_wl_pool in condition of + ubi->free_count > ubi->beb_rsvd_pebs, then try to reserve enough + free count for fastmap non anchor pebs after the above prerequisites + are met. +Then, there are at least 1 PEB in pool and 1 PEB in wl_pool after calling +ubi_refill_pools() with all erase works done. + +Fetch a reproducer in [Link]. + +Fixes: 4b68bf9a69d22dd ("ubi: Select fastmap anchor PEBs ... rules") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215407 +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/fastmap-wl.c | 69 ++++++++++++++++++++++++------------ + drivers/mtd/ubi/fastmap.c | 11 ------ + drivers/mtd/ubi/ubi.h | 4 +-- + drivers/mtd/ubi/wl.c | 19 +++++----- + 4 files changed, 57 insertions(+), 46 deletions(-) + +diff --git a/drivers/mtd/ubi/fastmap-wl.c b/drivers/mtd/ubi/fastmap-wl.c +index 28f55f9cf715..053ab52668e8 100644 +--- a/drivers/mtd/ubi/fastmap-wl.c ++++ b/drivers/mtd/ubi/fastmap-wl.c +@@ -97,6 +97,33 @@ struct ubi_wl_entry *ubi_wl_get_fm_peb(struct ubi_device *ubi, int anchor) + return e; + } + ++/* ++ * has_enough_free_count - whether ubi has enough free pebs to fill fm pools ++ * @ubi: UBI device description object ++ * @is_wl_pool: whether UBI is filling wear leveling pool ++ * ++ * This helper function checks whether there are enough free pebs (deducted ++ * by fastmap pebs) to fill fm_pool and fm_wl_pool, above rule works after ++ * there is at least one of free pebs is filled into fm_wl_pool. ++ * For wear leveling pool, UBI should also reserve free pebs for bad pebs ++ * handling, because there maybe no enough free pebs for user volumes after ++ * producing new bad pebs. ++ */ ++static bool has_enough_free_count(struct ubi_device *ubi, bool is_wl_pool) ++{ ++ int fm_used = 0; // fastmap non anchor pebs. ++ int beb_rsvd_pebs; ++ ++ if (!ubi->free.rb_node) ++ return false; ++ ++ beb_rsvd_pebs = is_wl_pool ? ubi->beb_rsvd_pebs : 0; ++ if (ubi->fm_wl_pool.size > 0 && !(ubi->ro_mode || ubi->fm_disabled)) ++ fm_used = ubi->fm_size / ubi->leb_size - 1; ++ ++ return ubi->free_count - beb_rsvd_pebs > fm_used; ++} ++ + /** + * ubi_refill_pools - refills all fastmap PEB pools. + * @ubi: UBI device description object +@@ -120,21 +147,17 @@ void ubi_refill_pools(struct ubi_device *ubi) + wl_tree_add(ubi->fm_anchor, &ubi->free); + ubi->free_count++; + } +- if (ubi->fm_next_anchor) { +- wl_tree_add(ubi->fm_next_anchor, &ubi->free); +- ubi->free_count++; +- } + +- /* All available PEBs are in ubi->free, now is the time to get ++ /* ++ * All available PEBs are in ubi->free, now is the time to get + * the best anchor PEBs. + */ + ubi->fm_anchor = ubi_wl_get_fm_peb(ubi, 1); +- ubi->fm_next_anchor = ubi_wl_get_fm_peb(ubi, 1); + + for (;;) { + enough = 0; + if (pool->size < pool->max_size) { +- if (!ubi->free.rb_node) ++ if (!has_enough_free_count(ubi, false)) + break; + + e = wl_get_wle(ubi); +@@ -147,8 +170,7 @@ void ubi_refill_pools(struct ubi_device *ubi) + enough++; + + if (wl_pool->size < wl_pool->max_size) { +- if (!ubi->free.rb_node || +- (ubi->free_count - ubi->beb_rsvd_pebs < 5)) ++ if (!has_enough_free_count(ubi, true)) + break; + + e = find_wl_entry(ubi, &ubi->free, WL_FREE_MAX_DIFF); +@@ -286,20 +308,26 @@ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi) + int ubi_ensure_anchor_pebs(struct ubi_device *ubi) + { + struct ubi_work *wrk; ++ struct ubi_wl_entry *anchor; + + spin_lock(&ubi->wl_lock); + +- /* Do we have a next anchor? */ +- if (!ubi->fm_next_anchor) { +- ubi->fm_next_anchor = ubi_wl_get_fm_peb(ubi, 1); +- if (!ubi->fm_next_anchor) +- /* Tell wear leveling to produce a new anchor PEB */ +- ubi->fm_do_produce_anchor = 1; ++ /* Do we already have an anchor? */ ++ if (ubi->fm_anchor) { ++ spin_unlock(&ubi->wl_lock); ++ return 0; + } + +- /* Do wear leveling to get a new anchor PEB or check the +- * existing next anchor candidate. +- */ ++ /* See if we can find an anchor PEB on the list of free PEBs */ ++ anchor = ubi_wl_get_fm_peb(ubi, 1); ++ if (anchor) { ++ ubi->fm_anchor = anchor; ++ spin_unlock(&ubi->wl_lock); ++ return 0; ++ } ++ ++ ubi->fm_do_produce_anchor = 1; ++ /* No luck, trigger wear leveling to produce a new anchor PEB. */ + if (ubi->wl_scheduled) { + spin_unlock(&ubi->wl_lock); + return 0; +@@ -381,11 +409,6 @@ static void ubi_fastmap_close(struct ubi_device *ubi) + ubi->fm_anchor = NULL; + } + +- if (ubi->fm_next_anchor) { +- return_unused_peb(ubi, ubi->fm_next_anchor); +- ubi->fm_next_anchor = NULL; +- } +- + if (ubi->fm) { + for (i = 0; i < ubi->fm->used_blocks; i++) + kfree(ubi->fm->e[i]); +diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c +index 6b5f1ffd961b..6e95c4b1473e 100644 +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -1230,17 +1230,6 @@ static int ubi_write_fastmap(struct ubi_device *ubi, + fm_pos += sizeof(*fec); + ubi_assert(fm_pos <= ubi->fm_size); + } +- if (ubi->fm_next_anchor) { +- fec = (struct ubi_fm_ec *)(fm_raw + fm_pos); +- +- fec->pnum = cpu_to_be32(ubi->fm_next_anchor->pnum); +- set_seen(ubi, ubi->fm_next_anchor->pnum, seen_pebs); +- fec->ec = cpu_to_be32(ubi->fm_next_anchor->ec); +- +- free_peb_count++; +- fm_pos += sizeof(*fec); +- ubi_assert(fm_pos <= ubi->fm_size); +- } + fmh->free_peb_count = cpu_to_be32(free_peb_count); + + ubi_for_each_used_peb(ubi, wl_e, tmp_rb) { +diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h +index c2da77163f94..da0bee13fe7f 100644 +--- a/drivers/mtd/ubi/ubi.h ++++ b/drivers/mtd/ubi/ubi.h +@@ -491,8 +491,7 @@ struct ubi_debug_info { + * @fm_work: fastmap work queue + * @fm_work_scheduled: non-zero if fastmap work was scheduled + * @fast_attach: non-zero if UBI was attached by fastmap +- * @fm_anchor: The new anchor PEB used during fastmap update +- * @fm_next_anchor: An anchor PEB candidate for the next time fastmap is updated ++ * @fm_anchor: The next anchor PEB to use for fastmap + * @fm_do_produce_anchor: If true produce an anchor PEB in wl + * + * @used: RB-tree of used physical eraseblocks +@@ -603,7 +602,6 @@ struct ubi_device { + int fm_work_scheduled; + int fast_attach; + struct ubi_wl_entry *fm_anchor; +- struct ubi_wl_entry *fm_next_anchor; + int fm_do_produce_anchor; + + /* Wear-leveling sub-system's stuff */ +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index 7847de75a74c..820b5c1c8e8e 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -688,16 +688,16 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, + + #ifdef CONFIG_MTD_UBI_FASTMAP + e1 = find_anchor_wl_entry(&ubi->used); +- if (e1 && ubi->fm_next_anchor && +- (ubi->fm_next_anchor->ec - e1->ec >= UBI_WL_THRESHOLD)) { ++ if (e1 && ubi->fm_anchor && ++ (ubi->fm_anchor->ec - e1->ec >= UBI_WL_THRESHOLD)) { + ubi->fm_do_produce_anchor = 1; +- /* fm_next_anchor is no longer considered a good anchor +- * candidate. ++ /* ++ * fm_anchor is no longer considered a good anchor. + * NULL assignment also prevents multiple wear level checks + * of this PEB. + */ +- wl_tree_add(ubi->fm_next_anchor, &ubi->free); +- ubi->fm_next_anchor = NULL; ++ wl_tree_add(ubi->fm_anchor, &ubi->free); ++ ubi->fm_anchor = NULL; + ubi->free_count++; + } + +@@ -1086,12 +1086,13 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk) + if (!err) { + spin_lock(&ubi->wl_lock); + +- if (!ubi->fm_disabled && !ubi->fm_next_anchor && ++ if (!ubi->fm_disabled && !ubi->fm_anchor && + e->pnum < UBI_FM_MAX_START) { +- /* Abort anchor production, if needed it will be ++ /* ++ * Abort anchor production, if needed it will be + * enabled again in the wear leveling started below. + */ +- ubi->fm_next_anchor = e; ++ ubi->fm_anchor = e; + ubi->fm_do_produce_anchor = 0; + } else { + wl_tree_add(e, &ubi->free); +-- +2.35.1 + diff --git a/queue-5.10/ubi-ubi_create_volume-fix-use-after-free-when-volume.patch b/queue-5.10/ubi-ubi_create_volume-fix-use-after-free-when-volume.patch new file mode 100644 index 00000000000..659625ecd60 --- /dev/null +++ b/queue-5.10/ubi-ubi_create_volume-fix-use-after-free-when-volume.patch @@ -0,0 +1,49 @@ +From cf3ecfe58f9f1a485cb78135c2bff899338f0610 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 20:31:26 +0800 +Subject: ubi: ubi_create_volume: Fix use-after-free when volume creation + failed + +From: Zhihao Cheng + +[ Upstream commit 8c03a1c21d72210f81cb369cc528e3fde4b45411 ] + +There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s +error handling path: + + ubi_eba_replace_table(vol, eba_tbl) + vol->eba_tbl = tbl +out_mapping: + ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' +out_unlock: + put_device(&vol->dev) + vol_release + kfree(tbl->entries) // UAF + +Fix it by removing redundant 'eba_tbl' releasing. +Fetch a reproducer in [Link]. + +Fixes: 493cfaeaa0c9b ("mtd: utilize new cdev_device_add helper function") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215965 +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/vmt.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c +index 1bc7b3a05604..6ea95ade4ca6 100644 +--- a/drivers/mtd/ubi/vmt.c ++++ b/drivers/mtd/ubi/vmt.c +@@ -309,7 +309,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) + ubi->volumes[vol_id] = NULL; + ubi->vol_count -= 1; + spin_unlock(&ubi->volumes_lock); +- ubi_eba_destroy_table(eba_tbl); + out_acc: + spin_lock(&ubi->volumes_lock); + ubi->rsvd_pebs -= vol->reserved_pebs; +-- +2.35.1 + diff --git a/queue-5.10/usb-dwc3-pci-fix-pm_runtime_get_sync-error-checking.patch b/queue-5.10/usb-dwc3-pci-fix-pm_runtime_get_sync-error-checking.patch new file mode 100644 index 00000000000..204a531b915 --- /dev/null +++ b/queue-5.10/usb-dwc3-pci-fix-pm_runtime_get_sync-error-checking.patch @@ -0,0 +1,38 @@ +From 74a955d198852ebcd78d82fcd6e4bc64c1b96d8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 06:26:52 +0000 +Subject: usb: dwc3: pci: Fix pm_runtime_get_sync() error checking + +From: Zheng Yongjun + +[ Upstream commit a03e2ddab8e735e2cc315609b297b300e9cc60d2 ] + +If the device is already in a runtime PM enabled state +pm_runtime_get_sync() will return 1, so a test for negative +value should be used to check for errors. + +Fixes: 8eed00b237a28 ("usb: dwc3: pci: Runtime resume child device from wq") +Signed-off-by: Zheng Yongjun +Link: https://lore.kernel.org/r/20220422062652.10575-1-zhengyongjun3@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 98df8d52c765..a5a8c5712bce 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -213,7 +213,7 @@ static void dwc3_pci_resume_work(struct work_struct *work) + int ret; + + ret = pm_runtime_get_sync(&dwc3->dev); +- if (ret) { ++ if (ret < 0) { + pm_runtime_put_sync_autosuspend(&dwc3->dev); + return; + } +-- +2.35.1 + diff --git a/queue-5.10/usb-musb-fix-missing-of_node_put-in-omap2430_probe.patch b/queue-5.10/usb-musb-fix-missing-of_node_put-in-omap2430_probe.patch new file mode 100644 index 00000000000..d081aec2491 --- /dev/null +++ b/queue-5.10/usb-musb-fix-missing-of_node_put-in-omap2430_probe.patch @@ -0,0 +1,36 @@ +From 6d10ad6fdbc64c00e5af70213ade0350543f078e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 11:10:33 +0000 +Subject: usb: musb: Fix missing of_node_put() in omap2430_probe + +From: Miaoqian Lin + +[ Upstream commit 424bef51fa530389b0b9008c9e144e40c10e8458 ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +Fixes: 8934d3e4d0e7 ("usb: musb: omap2430: Don't use omap_get_control_dev()") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220309111033.24487-1-linmq006@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/omap2430.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c +index 4232f1ce3fbf..1d435e4ee857 100644 +--- a/drivers/usb/musb/omap2430.c ++++ b/drivers/usb/musb/omap2430.c +@@ -360,6 +360,7 @@ static int omap2430_probe(struct platform_device *pdev) + control_node = of_parse_phandle(np, "ctrl-module", 0); + if (control_node) { + control_pdev = of_find_device_by_node(control_node); ++ of_node_put(control_node); + if (!control_pdev) { + dev_err(&pdev->dev, "Failed to get control device\n"); + ret = -EINVAL; +-- +2.35.1 + diff --git a/queue-5.10/usb-storage-karma-fix-rio_karma_init-return.patch b/queue-5.10/usb-storage-karma-fix-rio_karma_init-return.patch new file mode 100644 index 00000000000..fdb76f198d4 --- /dev/null +++ b/queue-5.10/usb-storage-karma-fix-rio_karma_init-return.patch @@ -0,0 +1,64 @@ +From f556e0f5aa3e94410a9ad5a177d0ab6c3e66024f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 22:43:59 +0800 +Subject: USB: storage: karma: fix rio_karma_init return + +From: Lin Ma + +[ Upstream commit b92ffb1eddd9a66a90defc556dcbf65a43c196c7 ] + +The function rio_karam_init() should return -ENOMEM instead of +value 0 (USB_STOR_TRANSPORT_GOOD) when allocation fails. + +Similarly, it should return -EIO when rio_karma_send_command() fails. + +Fixes: dfe0d3ba20e8 ("USB Storage: add rio karma eject support") +Acked-by: Alan Stern +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20220412144359.28447-1-linma@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/karma.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/storage/karma.c b/drivers/usb/storage/karma.c +index 05cec81dcd3f..38ddfedef629 100644 +--- a/drivers/usb/storage/karma.c ++++ b/drivers/usb/storage/karma.c +@@ -174,24 +174,25 @@ static void rio_karma_destructor(void *extra) + + static int rio_karma_init(struct us_data *us) + { +- int ret = 0; + struct karma_data *data = kzalloc(sizeof(struct karma_data), GFP_NOIO); + + if (!data) +- goto out; ++ return -ENOMEM; + + data->recv = kmalloc(RIO_RECV_LEN, GFP_NOIO); + if (!data->recv) { + kfree(data); +- goto out; ++ return -ENOMEM; + } + + us->extra = data; + us->extra_destructor = rio_karma_destructor; +- ret = rio_karma_send_command(RIO_ENTER_STORAGE, us); +- data->in_storage = (ret == 0); +-out: +- return ret; ++ if (rio_karma_send_command(RIO_ENTER_STORAGE, us)) ++ return -EIO; ++ ++ data->in_storage = 1; ++ ++ return 0; + } + + static struct scsi_host_template karma_host_template; +-- +2.35.1 + diff --git a/queue-5.10/usb-typec-mux-check-dev_set_name-return-value.patch b/queue-5.10/usb-typec-mux-check-dev_set_name-return-value.patch new file mode 100644 index 00000000000..3fc597cee47 --- /dev/null +++ b/queue-5.10/usb-typec-mux-check-dev_set_name-return-value.patch @@ -0,0 +1,58 @@ +From bac214e6961155ca007771585e8655258931e6d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 15:23:47 -0700 +Subject: usb: typec: mux: Check dev_set_name() return value + +From: Bjorn Andersson + +[ Upstream commit b9fa0292490db39d6542f514117333d366ec0011 ] + +It's possible that dev_set_name() returns -ENOMEM, catch and handle this. + +Fixes: 3370db35193b ("usb: typec: Registering real device entries for the muxes") +Reported-by: Andy Shevchenko +Reviewed-by: Andy Shevchenko +Acked-by: Heikki Krogerus +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220422222351.1297276-4-bjorn.andersson@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/mux.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c +index b9035c3407b5..a6e5028105d4 100644 +--- a/drivers/usb/typec/mux.c ++++ b/drivers/usb/typec/mux.c +@@ -127,8 +127,11 @@ typec_switch_register(struct device *parent, + sw->dev.class = &typec_mux_class; + sw->dev.type = &typec_switch_dev_type; + sw->dev.driver_data = desc->drvdata; +- dev_set_name(&sw->dev, "%s-switch", +- desc->name ? desc->name : dev_name(parent)); ++ ret = dev_set_name(&sw->dev, "%s-switch", desc->name ? desc->name : dev_name(parent)); ++ if (ret) { ++ put_device(&sw->dev); ++ return ERR_PTR(ret); ++ } + + ret = device_add(&sw->dev); + if (ret) { +@@ -331,8 +334,11 @@ typec_mux_register(struct device *parent, const struct typec_mux_desc *desc) + mux->dev.class = &typec_mux_class; + mux->dev.type = &typec_mux_dev_type; + mux->dev.driver_data = desc->drvdata; +- dev_set_name(&mux->dev, "%s-mux", +- desc->name ? desc->name : dev_name(parent)); ++ ret = dev_set_name(&mux->dev, "%s-mux", desc->name ? desc->name : dev_name(parent)); ++ if (ret) { ++ put_device(&mux->dev); ++ return ERR_PTR(ret); ++ } + + ret = device_add(&mux->dev); + if (ret) { +-- +2.35.1 + diff --git a/queue-5.10/usb-usbip-add-missing-device-lock-on-tweak-configura.patch b/queue-5.10/usb-usbip-add-missing-device-lock-on-tweak-configura.patch new file mode 100644 index 00000000000..e07afd02020 --- /dev/null +++ b/queue-5.10/usb-usbip-add-missing-device-lock-on-tweak-configura.patch @@ -0,0 +1,49 @@ +From e23faeabb5a24bc0809c53765d7e9beb306b211b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 18:50:55 +0200 +Subject: usb: usbip: add missing device lock on tweak configuration cmd + +From: Niels Dossche + +[ Upstream commit d088fabace2ca337b275d1d4b36db4fe7771e44f ] + +The function documentation of usb_set_configuration says that its +callers should hold the device lock. This lock is held for all +callsites except tweak_set_configuration_cmd. The code path can be +executed for example when attaching a remote USB device. +The solution is to surround the call by the device lock. + +This bug was found using my experimental own-developed static analysis +tool, which reported the missing lock on v5.17.2. I manually verified +this bug report by doing code review as well. I runtime checked that +the required lock is not held. I compiled and runtime tested this on +x86_64 with a USB mouse. After applying this patch, my analyser no +longer reports this potential bug. + +Fixes: 2c8c98158946 ("staging: usbip: let client choose device configuration") +Reviewed-by: Shuah Khan +Signed-off-by: Niels Dossche +Link: https://lore.kernel.org/r/20220412165055.257113-1-dossche.niels@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/stub_rx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c +index 325c22008e53..5dd41e8215e0 100644 +--- a/drivers/usb/usbip/stub_rx.c ++++ b/drivers/usb/usbip/stub_rx.c +@@ -138,7 +138,9 @@ static int tweak_set_configuration_cmd(struct urb *urb) + req = (struct usb_ctrlrequest *) urb->setup_packet; + config = le16_to_cpu(req->wValue); + ++ usb_lock_device(sdev->udev); + err = usb_set_configuration(sdev->udev, config); ++ usb_unlock_device(sdev->udev); + if (err && err != -ENODEV) + dev_err(&sdev->udev->dev, "can't set config #%d, error %d\n", + config, err); +-- +2.35.1 + diff --git a/queue-5.10/usb-usbip-fix-a-refcount-leak-in-stub_probe.patch b/queue-5.10/usb-usbip-fix-a-refcount-leak-in-stub_probe.patch new file mode 100644 index 00000000000..6738e7497d3 --- /dev/null +++ b/queue-5.10/usb-usbip-fix-a-refcount-leak-in-stub_probe.patch @@ -0,0 +1,49 @@ +From 36f0b52f85aaaff20bedc7cdeaeded858bc9cdea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 10:02:57 +0800 +Subject: usb: usbip: fix a refcount leak in stub_probe() + +From: Hangyu Hua + +[ Upstream commit 9ec4cbf1cc55d126759051acfe328d489c5d6e60 ] + +usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails +after that, usb_put_dev() needs to be called to release the reference. + +Fix this by moving usb_put_dev() to sdev_free error path handling. + +Find this by code review. + +Fixes: 3ff67445750a ("usbip: fix error handling in stub_probe()") +Reviewed-by: Shuah Khan +Signed-off-by: Hangyu Hua +Link: https://lore.kernel.org/r/20220412020257.9767-1-hbh25y@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/usbip/stub_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c +index d8d3892e5a69..3c6d452e3bf4 100644 +--- a/drivers/usb/usbip/stub_dev.c ++++ b/drivers/usb/usbip/stub_dev.c +@@ -393,7 +393,6 @@ static int stub_probe(struct usb_device *udev) + + err_port: + dev_set_drvdata(&udev->dev, NULL); +- usb_put_dev(udev); + + /* we already have busid_priv, just lock busid_lock */ + spin_lock(&busid_priv->busid_lock); +@@ -408,6 +407,7 @@ static int stub_probe(struct usb_device *udev) + put_busid_priv(busid_priv); + + sdev_free: ++ usb_put_dev(udev); + stub_device_free(sdev); + + return rc; +-- +2.35.1 + diff --git a/queue-5.10/watchdog-rti-wdt-fix-pm_runtime_get_sync-error-check.patch b/queue-5.10/watchdog-rti-wdt-fix-pm_runtime_get_sync-error-check.patch new file mode 100644 index 00000000000..3565a31fe3d --- /dev/null +++ b/queue-5.10/watchdog-rti-wdt-fix-pm_runtime_get_sync-error-check.patch @@ -0,0 +1,40 @@ +From c0a9d08244096d8e5a7f2ff00c7e0fa4e6f8605b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 07:08:23 +0000 +Subject: watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking + +From: Miaoqian Lin + +[ Upstream commit b3ac0c58fa8934926360268f3d89ec7680644d7b ] + +If the device is already in a runtime PM enabled state +pm_runtime_get_sync() will return 1, so a test for negative +value should be used to check for errors. + +Fixes: 2d63908bdbfb ("watchdog: Add K3 RTI watchdog support") +Signed-off-by: Miaoqian Lin +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20220412070824.23708-1-linmq006@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/rti_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c +index ae7f9357bb87..46c2a4bd9ebe 100644 +--- a/drivers/watchdog/rti_wdt.c ++++ b/drivers/watchdog/rti_wdt.c +@@ -227,7 +227,7 @@ static int rti_wdt_probe(struct platform_device *pdev) + + pm_runtime_enable(dev); + ret = pm_runtime_get_sync(dev); +- if (ret) { ++ if (ret < 0) { + pm_runtime_put_noidle(dev); + pm_runtime_disable(&pdev->dev); + return dev_err_probe(dev, ret, "runtime pm failed\n"); +-- +2.35.1 + diff --git a/queue-5.10/watchdog-ts4800_wdt-fix-refcount-leak-in-ts4800_wdt_.patch b/queue-5.10/watchdog-ts4800_wdt-fix-refcount-leak-in-ts4800_wdt_.patch new file mode 100644 index 00000000000..a4f60eda916 --- /dev/null +++ b/queue-5.10/watchdog-ts4800_wdt-fix-refcount-leak-in-ts4800_wdt_.patch @@ -0,0 +1,49 @@ +From 65ca7c9cd278f577652d03e4692e5b635f3f939a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 15:42:03 +0400 +Subject: watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe + +From: Miaoqian Lin + +[ Upstream commit 5d24df3d690809952528e7a19a43d84bc5b99d44 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +Add missing of_node_put() in some error paths. + +Fixes: bf9006399939 ("watchdog: ts4800: add driver for TS-4800 watchdog") +Signed-off-by: Miaoqian Lin +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20220511114203.47420-1-linmq006@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/ts4800_wdt.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/ts4800_wdt.c b/drivers/watchdog/ts4800_wdt.c +index c137ad2bd5c3..0ea554c7cda5 100644 +--- a/drivers/watchdog/ts4800_wdt.c ++++ b/drivers/watchdog/ts4800_wdt.c +@@ -125,13 +125,16 @@ static int ts4800_wdt_probe(struct platform_device *pdev) + ret = of_property_read_u32_index(np, "syscon", 1, ®); + if (ret < 0) { + dev_err(dev, "no offset in syscon\n"); ++ of_node_put(syscon_np); + return ret; + } + + /* allocate memory for watchdog struct */ + wdt = devm_kzalloc(dev, sizeof(*wdt), GFP_KERNEL); +- if (!wdt) ++ if (!wdt) { ++ of_node_put(syscon_np); + return -ENOMEM; ++ } + + /* set regmap and offset to know where to write */ + wdt->feed_offset = reg; +-- +2.35.1 +