From: Greg Kroah-Hartman Date: Mon, 9 May 2022 11:22:27 +0000 (+0200) Subject: drop a bunch of patches X-Git-Tag: v4.9.313~54 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a34e61a9cf0902da70973638103b6cc0d880eb82;p=thirdparty%2Fkernel%2Fstable-queue.git drop a bunch of patches --- diff --git a/queue-5.15/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch b/queue-5.15/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch deleted file mode 100644 index 5e17bcb2652..00000000000 --- a/queue-5.15/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch +++ /dev/null @@ -1,48 +0,0 @@ -From aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a Mon Sep 17 00:00:00 2001 -From: Javier Martinez Canillas -Date: Mon, 2 May 2022 15:50:14 +0200 -Subject: fbdev: Make fb_release() return -ENODEV if fbdev was unregistered - -From: Javier Martinez Canillas - -commit aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a upstream. - -A reference to the framebuffer device struct fb_info is stored in the file -private data, but this reference could no longer be valid and must not be -accessed directly. Instead, the file_fb_info() accessor function must be -used since it does sanity checking to make sure that the fb_info is valid. - -This can happen for example if the registered framebuffer device is for a -driver that just uses a framebuffer provided by the system firmware. In -that case, the fbdev core would unregister the framebuffer device when a -real video driver is probed and ask to remove conflicting framebuffers. - -The bug has been present for a long time but commit 27599aacbaef ("fbdev: -Hot-unplug firmware fb devices on forced removal") unmasked it since the -fbdev core started unregistering the framebuffers' devices associated. - -Fixes: 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal") -Reported-by: Maxime Ripard -Reported-by: Junxiao Chang -Signed-off-by: Javier Martinez Canillas -Reviewed-by: Thomas Zimmermann -Link: https://patchwork.freedesktop.org/patch/msgid/20220502135014.377945-1-javierm@redhat.com -Signed-off-by: Greg Kroah-Hartman ---- - drivers/video/fbdev/core/fbmem.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -1436,7 +1436,10 @@ fb_release(struct inode *inode, struct f - __acquires(&info->lock) - __releases(&info->lock) - { -- struct fb_info * const info = file->private_data; -+ struct fb_info * const info = file_fb_info(file); -+ -+ if (!info) -+ return -ENODEV; - - lock_fb_info(info); - if (info->fbops->fb_release) diff --git a/queue-5.15/gpio-mvebu-drop-pwm-base-assignment.patch b/queue-5.15/gpio-mvebu-drop-pwm-base-assignment.patch deleted file mode 100644 index 5daeecf8df4..00000000000 --- a/queue-5.15/gpio-mvebu-drop-pwm-base-assignment.patch +++ /dev/null @@ -1,43 +0,0 @@ -From e5f6e5d554ac274f9c8ba60078103d0425b93c19 Mon Sep 17 00:00:00 2001 -From: Baruch Siach -Date: Mon, 11 Apr 2022 09:23:40 +0300 -Subject: gpio: mvebu: drop pwm base assignment -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Baruch Siach - -commit e5f6e5d554ac274f9c8ba60078103d0425b93c19 upstream. - -pwmchip_add() unconditionally assigns the base ID dynamically. Commit -f9a8ee8c8bcd1 ("pwm: Always allocate PWM chip base ID dynamically") -dropped all base assignment from drivers under drivers/pwm/. It missed -this driver. Fix that. - -Fixes: f9a8ee8c8bcd1 ("pwm: Always allocate PWM chip base ID dynamically") -Signed-off-by: Baruch Siach -Reviewed-by: Uwe Kleine-König -Acked-by: Linus Walleij -Signed-off-by: Bartosz Golaszewski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/gpio/gpio-mvebu.c | 7 ------- - 1 file changed, 7 deletions(-) - ---- a/drivers/gpio/gpio-mvebu.c -+++ b/drivers/gpio/gpio-mvebu.c -@@ -871,13 +871,6 @@ static int mvebu_pwm_probe(struct platfo - mvpwm->chip.dev = dev; - mvpwm->chip.ops = &mvebu_pwm_ops; - mvpwm->chip.npwm = mvchip->chip.ngpio; -- /* -- * There may already be some PWM allocated, so we can't force -- * mvpwm->chip.base to a fixed point like mvchip->chip.base. -- * So, we let pwmchip_add() do the numbering and take the next free -- * region. -- */ -- mvpwm->chip.base = -1; - - spin_lock_init(&mvpwm->lock); - diff --git a/queue-5.15/series b/queue-5.15/series index 97e2266d2e2..9d4d5c319ce 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -38,7 +38,6 @@ can-grcan-only-use-the-napi-poll-budget-for-rx.patch nfc-replace-improper-check-device_is_registered-in-netlink-related-functions.patch nfc-nfcmrvl-main-reorder-destructive-operations-in-nfcmrvl_nci_unregister_dev-to-avoid-bugs.patch nfc-netlink-fix-sleep-in-atomic-bug-when-firmware-download-timeout.patch -gpio-mvebu-drop-pwm-base-assignment.patch gpio-visconti-fix-fwnode-of-gpio-irq.patch gpio-pca953x-fix-irq_stat-not-updated-when-irq-is-disabled-irq_mask-not-set.patch hwmon-adt7470-fix-warning-on-module-removal.patch @@ -47,7 +46,6 @@ asoc-dmaengine-restore-null-prepare_slave_config-callback.patch asoc-soc-ops-fix-error-handling.patch iommu-vt-d-drop-stop-marker-messages.patch iommu-dart-check-return-value-after-calling-platform_get_resource.patch -fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch net-mlx5e-fix-trust-state-reset-in-reload.patch net-mlx5e-don-t-match-double-vlan-packets-if-cvlan-is-not-set.patch net-mlx5e-ct-fix-queued-up-restore-put-executing-after-relevant-ft-release.patch diff --git a/queue-5.17/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch b/queue-5.17/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch deleted file mode 100644 index 59b646a91c5..00000000000 --- a/queue-5.17/fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch +++ /dev/null @@ -1,48 +0,0 @@ -From aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a Mon Sep 17 00:00:00 2001 -From: Javier Martinez Canillas -Date: Mon, 2 May 2022 15:50:14 +0200 -Subject: fbdev: Make fb_release() return -ENODEV if fbdev was unregistered - -From: Javier Martinez Canillas - -commit aafa025c76dcc7d1a8c8f0bdefcbe4eb480b2f6a upstream. - -A reference to the framebuffer device struct fb_info is stored in the file -private data, but this reference could no longer be valid and must not be -accessed directly. Instead, the file_fb_info() accessor function must be -used since it does sanity checking to make sure that the fb_info is valid. - -This can happen for example if the registered framebuffer device is for a -driver that just uses a framebuffer provided by the system firmware. In -that case, the fbdev core would unregister the framebuffer device when a -real video driver is probed and ask to remove conflicting framebuffers. - -The bug has been present for a long time but commit 27599aacbaef ("fbdev: -Hot-unplug firmware fb devices on forced removal") unmasked it since the -fbdev core started unregistering the framebuffers' devices associated. - -Fixes: 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal") -Reported-by: Maxime Ripard -Reported-by: Junxiao Chang -Signed-off-by: Javier Martinez Canillas -Reviewed-by: Thomas Zimmermann -Link: https://patchwork.freedesktop.org/patch/msgid/20220502135014.377945-1-javierm@redhat.com -Signed-off-by: Greg Kroah-Hartman ---- - drivers/video/fbdev/core/fbmem.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -1438,7 +1438,10 @@ fb_release(struct inode *inode, struct f - __acquires(&info->lock) - __releases(&info->lock) - { -- struct fb_info * const info = file->private_data; -+ struct fb_info * const info = file_fb_info(file); -+ -+ if (!info) -+ return -ENODEV; - - lock_fb_info(info); - if (info->fbops->fb_release) diff --git a/queue-5.17/gpio-mvebu-drop-pwm-base-assignment.patch b/queue-5.17/gpio-mvebu-drop-pwm-base-assignment.patch deleted file mode 100644 index 5daeecf8df4..00000000000 --- a/queue-5.17/gpio-mvebu-drop-pwm-base-assignment.patch +++ /dev/null @@ -1,43 +0,0 @@ -From e5f6e5d554ac274f9c8ba60078103d0425b93c19 Mon Sep 17 00:00:00 2001 -From: Baruch Siach -Date: Mon, 11 Apr 2022 09:23:40 +0300 -Subject: gpio: mvebu: drop pwm base assignment -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Baruch Siach - -commit e5f6e5d554ac274f9c8ba60078103d0425b93c19 upstream. - -pwmchip_add() unconditionally assigns the base ID dynamically. Commit -f9a8ee8c8bcd1 ("pwm: Always allocate PWM chip base ID dynamically") -dropped all base assignment from drivers under drivers/pwm/. It missed -this driver. Fix that. - -Fixes: f9a8ee8c8bcd1 ("pwm: Always allocate PWM chip base ID dynamically") -Signed-off-by: Baruch Siach -Reviewed-by: Uwe Kleine-König -Acked-by: Linus Walleij -Signed-off-by: Bartosz Golaszewski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/gpio/gpio-mvebu.c | 7 ------- - 1 file changed, 7 deletions(-) - ---- a/drivers/gpio/gpio-mvebu.c -+++ b/drivers/gpio/gpio-mvebu.c -@@ -871,13 +871,6 @@ static int mvebu_pwm_probe(struct platfo - mvpwm->chip.dev = dev; - mvpwm->chip.ops = &mvebu_pwm_ops; - mvpwm->chip.npwm = mvchip->chip.ngpio; -- /* -- * There may already be some PWM allocated, so we can't force -- * mvpwm->chip.base to a fixed point like mvchip->chip.base. -- * So, we let pwmchip_add() do the numbering and take the next free -- * region. -- */ -- mvpwm->chip.base = -1; - - spin_lock_init(&mvpwm->lock); - diff --git a/queue-5.17/net-rds-acquire-refcount-on-tcp-sockets.patch b/queue-5.17/net-rds-acquire-refcount-on-tcp-sockets.patch deleted file mode 100644 index 10313ded930..00000000000 --- a/queue-5.17/net-rds-acquire-refcount-on-tcp-sockets.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 3a58f13a881ed351198ffab4cf9953cf19d2ab3a Mon Sep 17 00:00:00 2001 -From: Tetsuo Handa -Date: Mon, 2 May 2022 10:40:18 +0900 -Subject: net: rds: acquire refcount on TCP sockets - -From: Tetsuo Handa - -commit 3a58f13a881ed351198ffab4cf9953cf19d2ab3a upstream. - -syzbot is reporting use-after-free read in tcp_retransmit_timer() [1], -for TCP socket used by RDS is accessing sock_net() without acquiring a -refcount on net namespace. Since TCP's retransmission can happen after -a process which created net namespace terminated, we need to explicitly -acquire a refcount. - -Link: https://syzkaller.appspot.com/bug?extid=694120e1002c117747ed [1] -Reported-by: syzbot -Fixes: 26abe14379f8e2fa ("net: Modify sk_alloc to not reference count the netns of kernel sockets.") -Fixes: 8a68173691f03661 ("net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket") -Signed-off-by: Tetsuo Handa -Tested-by: syzbot -Link: https://lore.kernel.org/r/a5fb1fc4-2284-3359-f6a0-e4e390239d7b@I-love.SAKURA.ne.jp -Signed-off-by: Paolo Abeni -Signed-off-by: Greg Kroah-Hartman ---- - net/rds/tcp.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - ---- a/net/rds/tcp.c -+++ b/net/rds/tcp.c -@@ -495,6 +495,14 @@ void rds_tcp_tune(struct socket *sock) - - tcp_sock_set_nodelay(sock->sk); - lock_sock(sk); -+ /* TCP timer functions might access net namespace even after -+ * a process which created this net namespace terminated. -+ */ -+ if (!sk->sk_net_refcnt) { -+ sk->sk_net_refcnt = 1; -+ get_net_track(net, &sk->ns_tracker, GFP_KERNEL); -+ sock_inuse_add(net, 1); -+ } - if (rtn->sndbuf_size > 0) { - sk->sk_sndbuf = rtn->sndbuf_size; - sk->sk_userlocks |= SOCK_SNDBUF_LOCK; diff --git a/queue-5.17/series b/queue-5.17/series index 3ccfd94fe19..4fcccf3817d 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -51,7 +51,6 @@ can-grcan-only-use-the-napi-poll-budget-for-rx.patch nfc-replace-improper-check-device_is_registered-in-netlink-related-functions.patch nfc-nfcmrvl-main-reorder-destructive-operations-in-nfcmrvl_nci_unregister_dev-to-avoid-bugs.patch nfc-netlink-fix-sleep-in-atomic-bug-when-firmware-download-timeout.patch -gpio-mvebu-drop-pwm-base-assignment.patch gpio-visconti-fix-fwnode-of-gpio-irq.patch gpio-pca953x-fix-irq_stat-not-updated-when-irq-is-disabled-irq_mask-not-set.patch hwmon-adt7470-fix-warning-on-module-removal.patch @@ -62,7 +61,6 @@ asoc-meson-axg-card-fix-nonatomic-links.patch asoc-soc-ops-fix-error-handling.patch iommu-vt-d-drop-stop-marker-messages.patch iommu-dart-check-return-value-after-calling-platform_get_resource.patch -fbdev-make-fb_release-return-enodev-if-fbdev-was-unregistered.patch net-mlx5e-fix-trust-state-reset-in-reload.patch net-mlx5-fix-slab-out-of-bounds-while-reading-resource-dump-menu.patch net-mlx5e-fix-wrong-source-vport-matching-on-tunnel-rule.patch @@ -90,7 +88,6 @@ net-stmmac-dwmac-sun8i-add-missing-of_node_put-in-sun8i_dwmac_register_mdio_mux. net-mdio-fix-enomem-return-value-in-bcm6368-mux-bus-controller.patch net-cpsw-add-missing-of_node_put-in-cpsw_probe_dt.patch net-igmp-respect-rcu-rules-in-ip_mc_source-and-ip_mc_msfilter.patch -net-rds-acquire-refcount-on-tcp-sockets.patch net-emaclite-add-error-handling-for-of_address_to_resource.patch selftests-net-so_txtime-fix-parsing-of-start-time-stamp-on-32-bit-systems.patch selftests-net-so_txtime-usage-fix-documentation-of-default-clock.patch