From: Greg Kroah-Hartman Date: Sun, 24 Mar 2024 16:51:06 +0000 (+0100) Subject: 6.7-stable patches X-Git-Tag: v6.8.2~71 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a5bf8413f58d35ef8069fac0f7410c2f02eca33f;p=thirdparty%2Fkernel%2Fstable-queue.git 6.7-stable patches added patches: comedi-comedi_8255-correct-error-in-subdevice-initialization.patch comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch mei-gsc_proxy-match-component-when-gsc-is-on-different-bus.patch --- diff --git a/queue-6.7/comedi-comedi_8255-correct-error-in-subdevice-initialization.patch b/queue-6.7/comedi-comedi_8255-correct-error-in-subdevice-initialization.patch new file mode 100644 index 00000000000..47c6e91bf4d --- /dev/null +++ b/queue-6.7/comedi-comedi_8255-correct-error-in-subdevice-initialization.patch @@ -0,0 +1,116 @@ +From cfa9ba1ae0bef0681833a22d326174fe633caab5 Mon Sep 17 00:00:00 2001 +From: Frej Drejhammar +Date: Sun, 11 Feb 2024 18:58:22 +0100 +Subject: comedi: comedi_8255: Correct error in subdevice initialization + +From: Frej Drejhammar + +commit cfa9ba1ae0bef0681833a22d326174fe633caab5 upstream. + +The refactoring done in commit 5c57b1ccecc7 ("comedi: comedi_8255: Rework +subdevice initialization functions") to the initialization of the io +field of struct subdev_8255_private broke all cards using the +drivers/comedi/drivers/comedi_8255.c module. + +Prior to 5c57b1ccecc7, __subdev_8255_init() initialized the io field +in the newly allocated struct subdev_8255_private to the non-NULL +callback given to the function, otherwise it used a flag parameter to +select between subdev_8255_mmio and subdev_8255_io. The refactoring +removed that logic and the flag, as subdev_8255_mm_init() and +subdev_8255_io_init() now explicitly pass subdev_8255_mmio and +subdev_8255_io respectively to __subdev_8255_init(), only +__subdev_8255_init() never sets spriv->io to the supplied +callback. That spriv->io is NULL leads to a later BUG: + +BUG: kernel NULL pointer dereference, address: 0000000000000000 +PGD 0 P4D 0 +Oops: 0010 [#1] SMP PTI +CPU: 1 PID: 1210 Comm: systemd-udevd Not tainted 6.7.3-x86_64 #1 +Hardware name: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +RIP: 0010:0x0 +Code: Unable to access opcode bytes at 0xffffffffffffffd6. +RSP: 0018:ffffa3f1c02d7b78 EFLAGS: 00010202 +RAX: 0000000000000000 RBX: ffff91f847aefd00 RCX: 000000000000009b +RDX: 0000000000000003 RSI: 0000000000000001 RDI: ffff91f840f6fc00 +RBP: ffff91f840f6fc00 R08: 0000000000000000 R09: 0000000000000001 +R10: 0000000000000000 R11: 000000000000005f R12: 0000000000000000 +R13: 0000000000000000 R14: ffffffffc0102498 R15: ffff91f847ce6ba8 +FS: 00007f72f4e8f500(0000) GS:ffff91f8d5c80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffffffffffffffd6 CR3: 000000010540e000 CR4: 00000000000406f0 +Call Trace: + + ? __die_body+0x15/0x57 + ? page_fault_oops+0x2ef/0x33c + ? insert_vmap_area.constprop.0+0xb6/0xd5 + ? alloc_vmap_area+0x529/0x5ee + ? exc_page_fault+0x15a/0x489 + ? asm_exc_page_fault+0x22/0x30 + __subdev_8255_init+0x79/0x8d [comedi_8255] + pci_8255_auto_attach+0x11a/0x139 [8255_pci] + comedi_auto_config+0xac/0x117 [comedi] + ? __pfx___driver_attach+0x10/0x10 + pci_device_probe+0x88/0xf9 + really_probe+0x101/0x248 + __driver_probe_device+0xbb/0xed + driver_probe_device+0x1a/0x72 + __driver_attach+0xd4/0xed + bus_for_each_dev+0x76/0xb8 + bus_add_driver+0xbe/0x1be + driver_register+0x9a/0xd8 + comedi_pci_driver_register+0x28/0x48 [comedi_pci] + ? __pfx_pci_8255_driver_init+0x10/0x10 [8255_pci] + do_one_initcall+0x72/0x183 + do_init_module+0x5b/0x1e8 + init_module_from_file+0x86/0xac + __do_sys_finit_module+0x151/0x218 + do_syscall_64+0x72/0xdb + entry_SYSCALL_64_after_hwframe+0x6e/0x76 +RIP: 0033:0x7f72f50a0cb9 +Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 47 71 0c 00 f7 d8 64 89 01 48 +RSP: 002b:00007ffd47e512d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +RAX: ffffffffffffffda RBX: 0000562dd06ae070 RCX: 00007f72f50a0cb9 +RDX: 0000000000000000 RSI: 00007f72f52d32df RDI: 000000000000000e +RBP: 0000000000000000 R08: 00007f72f5168b20 R09: 0000000000000000 +R10: 0000000000000050 R11: 0000000000000246 R12: 00007f72f52d32df +R13: 0000000000020000 R14: 0000562dd06785c0 R15: 0000562dcfd0e9a8 + +Modules linked in: 8255_pci(+) comedi_8255 comedi_pci comedi intel_gtt e100(+) acpi_cpufreq rtc_cmos usbhid +CR2: 0000000000000000 +---[ end trace 0000000000000000 ]--- +RIP: 0010:0x0 +Code: Unable to access opcode bytes at 0xffffffffffffffd6. +RSP: 0018:ffffa3f1c02d7b78 EFLAGS: 00010202 +RAX: 0000000000000000 RBX: ffff91f847aefd00 RCX: 000000000000009b +RDX: 0000000000000003 RSI: 0000000000000001 RDI: ffff91f840f6fc00 +RBP: ffff91f840f6fc00 R08: 0000000000000000 R09: 0000000000000001 +R10: 0000000000000000 R11: 000000000000005f R12: 0000000000000000 +R13: 0000000000000000 R14: ffffffffc0102498 R15: ffff91f847ce6ba8 +FS: 00007f72f4e8f500(0000) GS:ffff91f8d5c80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffffffffffffffd6 CR3: 000000010540e000 CR4: 00000000000406f0 + +This patch simply corrects the above mistake by initializing spriv->io +to the given io callback. + +Fixes: 5c57b1ccecc7 ("comedi: comedi_8255: Rework subdevice initialization functions") +Signed-off-by: Frej Drejhammar +Cc: stable@vger.kernel.org +Acked-by: Ian Abbott +Reviewed-by: Ian Abbott +Link: https://lore.kernel.org/r/20240211175822.1357-1-frej.drejhammar@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/comedi/drivers/comedi_8255.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/comedi/drivers/comedi_8255.c ++++ b/drivers/comedi/drivers/comedi_8255.c +@@ -159,6 +159,7 @@ static int __subdev_8255_init(struct com + return -ENOMEM; + + spriv->context = context; ++ spriv->io = io; + + s->type = COMEDI_SUBD_DIO; + s->subdev_flags = SDF_READABLE | SDF_WRITABLE; diff --git a/queue-6.7/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch b/queue-6.7/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch new file mode 100644 index 00000000000..088f6740fd2 --- /dev/null +++ b/queue-6.7/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch @@ -0,0 +1,123 @@ +From f53641a6e849034a44bf80f50245a75d7a376025 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 14 Feb 2024 10:07:25 +0000 +Subject: comedi: comedi_test: Prevent timers rescheduling during deletion + +From: Ian Abbott + +commit f53641a6e849034a44bf80f50245a75d7a376025 upstream. + +The comedi_test devices have a couple of timers (ai_timer and ao_timer) +that can be started to simulate hardware interrupts. Their expiry +functions normally reschedule the timer. The driver code calls either +del_timer_sync() or del_timer() to delete the timers from the queue, but +does not currently prevent the timers from rescheduling themselves so +synchronized deletion may be ineffective. + +Add a couple of boolean members (one for each timer: ai_timer_enable and +ao_timer_enable) to the device private data structure to indicate +whether the timers are allowed to reschedule themselves. Set the member +to true when adding the timer to the queue, and to false when deleting +the timer from the queue in the waveform_ai_cancel() and +waveform_ao_cancel() functions. + +The del_timer_sync() function is also called from the waveform_detach() +function, but the timer enable members will already be set to false when +that function is called, so no change is needed there. + +Fixes: 403fe7f34e33 ("staging: comedi: comedi_test: fix timer race conditions") +Cc: stable@vger.kernel.org # 4.4+ +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20240214100747.16203-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/comedi/drivers/comedi_test.c | 30 ++++++++++++++++++++++++++---- + 1 file changed, 26 insertions(+), 4 deletions(-) + +--- a/drivers/comedi/drivers/comedi_test.c ++++ b/drivers/comedi/drivers/comedi_test.c +@@ -87,6 +87,8 @@ struct waveform_private { + struct comedi_device *dev; /* parent comedi device */ + u64 ao_last_scan_time; /* time of previous AO scan in usec */ + unsigned int ao_scan_period; /* AO scan period in usec */ ++ bool ai_timer_enable:1; /* should AI timer be running? */ ++ bool ao_timer_enable:1; /* should AO timer be running? */ + unsigned short ao_loopbacks[N_CHANS]; + }; + +@@ -236,8 +238,12 @@ static void waveform_ai_timer(struct tim + time_increment = devpriv->ai_convert_time - now; + else + time_increment = 1; +- mod_timer(&devpriv->ai_timer, +- jiffies + usecs_to_jiffies(time_increment)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ai_timer_enable) { ++ mod_timer(&devpriv->ai_timer, ++ jiffies + usecs_to_jiffies(time_increment)); ++ } ++ spin_unlock(&dev->spinlock); + } + + overrun: +@@ -393,9 +399,12 @@ static int waveform_ai_cmd(struct comedi + * Seem to need an extra jiffy here, otherwise timer expires slightly + * early! + */ ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = true; + devpriv->ai_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1; + add_timer(&devpriv->ai_timer); ++ spin_unlock_bh(&dev->spinlock); + return 0; + } + +@@ -404,6 +413,9 @@ static int waveform_ai_cancel(struct com + { + struct waveform_private *devpriv = dev->private; + ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ai_timer); +@@ -495,8 +507,12 @@ static void waveform_ao_timer(struct tim + unsigned int time_inc = devpriv->ao_last_scan_time + + devpriv->ao_scan_period - now; + +- mod_timer(&devpriv->ao_timer, +- jiffies + usecs_to_jiffies(time_inc)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ao_timer_enable) { ++ mod_timer(&devpriv->ao_timer, ++ jiffies + usecs_to_jiffies(time_inc)); ++ } ++ spin_unlock(&dev->spinlock); + } + + underrun: +@@ -517,9 +533,12 @@ static int waveform_ao_inttrig_start(str + async->inttrig = NULL; + + devpriv->ao_last_scan_time = ktime_to_us(ktime_get()); ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = true; + devpriv->ao_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ao_scan_period); + add_timer(&devpriv->ao_timer); ++ spin_unlock_bh(&dev->spinlock); + + return 1; + } +@@ -604,6 +623,9 @@ static int waveform_ao_cancel(struct com + struct waveform_private *devpriv = dev->private; + + s->async->inttrig = NULL; ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ao_timer); diff --git a/queue-6.7/mei-gsc_proxy-match-component-when-gsc-is-on-different-bus.patch b/queue-6.7/mei-gsc_proxy-match-component-when-gsc-is-on-different-bus.patch new file mode 100644 index 00000000000..e4f83cd0dd2 --- /dev/null +++ b/queue-6.7/mei-gsc_proxy-match-component-when-gsc-is-on-different-bus.patch @@ -0,0 +1,62 @@ +From a0776c214d47ea4f7aaef138095beaa41cff03ef Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Tue, 20 Feb 2024 22:00:20 +0200 +Subject: mei: gsc_proxy: match component when GSC is on different bus + +From: Alexander Usyskin + +commit a0776c214d47ea4f7aaef138095beaa41cff03ef upstream. + +On Arrow Lake S systems, MEI is no longer strictly connected to bus 0, +while graphics remain exclusively on bus 0. Adapt the component +matching logic to accommodate this change: + +Original behavior: Required both MEI and graphics to be on the same +bus 0. + +New behavior: Only enforces graphics to be on bus 0 (integrated), +allowing MEI to reside on any bus. +This ensures compatibility with Arrow Lake S and maintains functionality +for the legacy systems. + +Fixes: 1dd924f6885b ("mei: gsc_proxy: add gsc proxy driver") +Cc: stable@vger.kernel.org # v6.3+ +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20240220200020.231192-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/gsc_proxy/mei_gsc_proxy.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/misc/mei/gsc_proxy/mei_gsc_proxy.c ++++ b/drivers/misc/mei/gsc_proxy/mei_gsc_proxy.c +@@ -96,7 +96,8 @@ static const struct component_master_ops + * + * The function checks if the device is pci device and + * Intel VGA adapter, the subcomponent is SW Proxy +- * and the parent of MEI PCI and the parent of VGA are the same PCH device. ++ * and the VGA is on the bus 0 reserved for built-in devices ++ * to reject discrete GFX. + * + * @dev: master device + * @subcomponent: subcomponent to match (I915_COMPONENT_SWPROXY) +@@ -123,7 +124,8 @@ static int mei_gsc_proxy_component_match + if (subcomponent != I915_COMPONENT_GSC_PROXY) + return 0; + +- return component_compare_dev(dev->parent, ((struct device *)data)->parent); ++ /* Only built-in GFX */ ++ return (pdev->bus->number == 0); + } + + static int mei_gsc_proxy_probe(struct mei_cl_device *cldev, +@@ -146,7 +148,7 @@ static int mei_gsc_proxy_probe(struct me + } + + component_match_add_typed(&cldev->dev, &master_match, +- mei_gsc_proxy_component_match, cldev->dev.parent); ++ mei_gsc_proxy_component_match, NULL); + if (IS_ERR_OR_NULL(master_match)) { + ret = -ENOMEM; + goto err_exit; diff --git a/queue-6.7/series b/queue-6.7/series index 57fe8610a8a..bcf8f8f994c 100644 --- a/queue-6.7/series +++ b/queue-6.7/series @@ -631,3 +631,6 @@ bcachefs-install-fd-later-to-avoid-race-with-close.patch bcachefs-check-for-failure-to-downgrade.patch bcachefs-fix-simulateously-upgrading-downgrading.patch bcachefs-fix-btree_iter_filter_snapshots-on-inodes-btree.patch +comedi-comedi_8255-correct-error-in-subdevice-initialization.patch +comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch +mei-gsc_proxy-match-component-when-gsc-is-on-different-bus.patch