From: Greg Kroah-Hartman Date: Mon, 4 Apr 2022 10:20:50 +0000 (+0200) Subject: 5.17-stable patches X-Git-Tag: v5.17.2~70 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a72500f83e453a781710556c2dde04e2f3559d2b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.17-stable patches added patches: bpf-adjust-bpf-stack-helper-functions-to-accommodate-skip-0.patch bpf-fix-comment-for-helper-bpf_current_task_under_cgroup.patch dt-bindings-memory-mtk-smi-correct-minitems-to-2-for-the-gals-clocks.patch dt-bindings-memory-mtk-smi-no-need-mediatek-larb-id-for-mt8167.patch dt-bindings-memory-mtk-smi-rename-clock-to-clocks.patch dt-bindings-mtd-nand-controller-fix-a-comment-in-the-examples.patch dt-bindings-mtd-nand-controller-fix-the-reg-property-description.patch dt-bindings-pinctrl-mt8195-fix-bias-pull-up-down-checks.patch dt-bindings-pinctrl-pinctrl-microchip-sgpio-fix-example.patch dt-bindings-spi-mxic-the-interrupt-property-is-not-mandatory.patch media-dt-binding-media-hynix-hi846-use-defs-port-base-port-description.patch media-dt-bindings-media-hynix-hi846-add-link-frequencies-description.patch mmc-rtsx-use-pm_runtime_-get-put-to-handle-runtime-pm.patch nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_add.patch ubi-fastmap-return-error-code-if-memory-allocation-fails-in-add_aeb.patch --- diff --git a/queue-5.17/bpf-adjust-bpf-stack-helper-functions-to-accommodate-skip-0.patch b/queue-5.17/bpf-adjust-bpf-stack-helper-functions-to-accommodate-skip-0.patch new file mode 100644 index 00000000000..7e837436418 --- /dev/null +++ b/queue-5.17/bpf-adjust-bpf-stack-helper-functions-to-accommodate-skip-0.patch @@ -0,0 +1,201 @@ +From ee2a098851bfbe8bcdd964c0121f4246f00ff41e Mon Sep 17 00:00:00 2001 +From: Namhyung Kim +Date: Mon, 14 Mar 2022 11:20:41 -0700 +Subject: bpf: Adjust BPF stack helper functions to accommodate skip > 0 + +From: Namhyung Kim + +commit ee2a098851bfbe8bcdd964c0121f4246f00ff41e upstream. + +Let's say that the caller has storage for num_elem stack frames. Then, +the BPF stack helper functions walk the stack for only num_elem frames. +This means that if skip > 0, one keeps only 'num_elem - skip' frames. + +This is because it sets init_nr in the perf_callchain_entry to the end +of the buffer to save num_elem entries only. I believe it was because +the perf callchain code unwound the stack frames until it reached the +global max size (sysctl_perf_event_max_stack). + +However it now has perf_callchain_entry_ctx.max_stack to limit the +iteration locally. This simplifies the code to handle init_nr in the +BPF callstack entries and removes the confusion with the perf_event's +__PERF_SAMPLE_CALLCHAIN_EARLY which sets init_nr to 0. + +Also change the comment on bpf_get_stack() in the header file to be +more explicit what the return value means. + +Fixes: c195651e565a ("bpf: add bpf_get_stack helper") +Signed-off-by: Namhyung Kim +Signed-off-by: Alexei Starovoitov +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/30a7b5d5-6726-1cc2-eaee-8da2828a9a9c@oracle.com +Link: https://lore.kernel.org/bpf/20220314182042.71025-1-namhyung@kernel.org +Signed-off-by: Greg Kroah-Hartman + +Based-on-patch-by: Eugene Loh +--- + include/uapi/linux/bpf.h | 8 +++--- + kernel/bpf/stackmap.c | 56 ++++++++++++++++++++--------------------------- + 2 files changed, 28 insertions(+), 36 deletions(-) + +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -2975,8 +2975,8 @@ union bpf_attr { + * + * # sysctl kernel.perf_event_max_stack= + * Return +- * A non-negative value equal to or less than *size* on success, +- * or a negative error in case of failure. ++ * The non-negative copied *buf* length equal to or less than ++ * *size* on success, or a negative error in case of failure. + * + * long bpf_skb_load_bytes_relative(const void *skb, u32 offset, void *to, u32 len, u32 start_header) + * Description +@@ -4279,8 +4279,8 @@ union bpf_attr { + * + * # sysctl kernel.perf_event_max_stack= + * Return +- * A non-negative value equal to or less than *size* on success, +- * or a negative error in case of failure. ++ * The non-negative copied *buf* length equal to or less than ++ * *size* on success, or a negative error in case of failure. + * + * long bpf_load_hdr_opt(struct bpf_sock_ops *skops, void *searchby_res, u32 len, u64 flags) + * Description +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -166,7 +166,7 @@ static void stack_map_get_build_id_offse + } + + static struct perf_callchain_entry * +-get_callchain_entry_for_task(struct task_struct *task, u32 init_nr) ++get_callchain_entry_for_task(struct task_struct *task, u32 max_depth) + { + #ifdef CONFIG_STACKTRACE + struct perf_callchain_entry *entry; +@@ -177,9 +177,8 @@ get_callchain_entry_for_task(struct task + if (!entry) + return NULL; + +- entry->nr = init_nr + +- stack_trace_save_tsk(task, (unsigned long *)(entry->ip + init_nr), +- sysctl_perf_event_max_stack - init_nr, 0); ++ entry->nr = stack_trace_save_tsk(task, (unsigned long *)entry->ip, ++ max_depth, 0); + + /* stack_trace_save_tsk() works on unsigned long array, while + * perf_callchain_entry uses u64 array. For 32-bit systems, it is +@@ -191,7 +190,7 @@ get_callchain_entry_for_task(struct task + int i; + + /* copy data from the end to avoid using extra buffer */ +- for (i = entry->nr - 1; i >= (int)init_nr; i--) ++ for (i = entry->nr - 1; i >= 0; i--) + to[i] = (u64)(from[i]); + } + +@@ -208,27 +207,19 @@ static long __bpf_get_stackid(struct bpf + { + struct bpf_stack_map *smap = container_of(map, struct bpf_stack_map, map); + struct stack_map_bucket *bucket, *new_bucket, *old_bucket; +- u32 max_depth = map->value_size / stack_map_data_size(map); +- /* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */ +- u32 init_nr = sysctl_perf_event_max_stack - max_depth; + u32 skip = flags & BPF_F_SKIP_FIELD_MASK; + u32 hash, id, trace_nr, trace_len; + bool user = flags & BPF_F_USER_STACK; + u64 *ips; + bool hash_matches; + +- /* get_perf_callchain() guarantees that trace->nr >= init_nr +- * and trace-nr <= sysctl_perf_event_max_stack, so trace_nr <= max_depth +- */ +- trace_nr = trace->nr - init_nr; +- +- if (trace_nr <= skip) ++ if (trace->nr <= skip) + /* skipping more than usable stack trace */ + return -EFAULT; + +- trace_nr -= skip; ++ trace_nr = trace->nr - skip; + trace_len = trace_nr * sizeof(u64); +- ips = trace->ip + skip + init_nr; ++ ips = trace->ip + skip; + hash = jhash2((u32 *)ips, trace_len / sizeof(u32), 0); + id = hash & (smap->n_buckets - 1); + bucket = READ_ONCE(smap->buckets[id]); +@@ -285,8 +276,7 @@ BPF_CALL_3(bpf_get_stackid, struct pt_re + u64, flags) + { + u32 max_depth = map->value_size / stack_map_data_size(map); +- /* stack_map_alloc() checks that max_depth <= sysctl_perf_event_max_stack */ +- u32 init_nr = sysctl_perf_event_max_stack - max_depth; ++ u32 skip = flags & BPF_F_SKIP_FIELD_MASK; + bool user = flags & BPF_F_USER_STACK; + struct perf_callchain_entry *trace; + bool kernel = !user; +@@ -295,8 +285,12 @@ BPF_CALL_3(bpf_get_stackid, struct pt_re + BPF_F_FAST_STACK_CMP | BPF_F_REUSE_STACKID))) + return -EINVAL; + +- trace = get_perf_callchain(regs, init_nr, kernel, user, +- sysctl_perf_event_max_stack, false, false); ++ max_depth += skip; ++ if (max_depth > sysctl_perf_event_max_stack) ++ max_depth = sysctl_perf_event_max_stack; ++ ++ trace = get_perf_callchain(regs, 0, kernel, user, max_depth, ++ false, false); + + if (unlikely(!trace)) + /* couldn't fetch the stack trace */ +@@ -387,7 +381,7 @@ static long __bpf_get_stack(struct pt_re + struct perf_callchain_entry *trace_in, + void *buf, u32 size, u64 flags) + { +- u32 init_nr, trace_nr, copy_len, elem_size, num_elem; ++ u32 trace_nr, copy_len, elem_size, num_elem, max_depth; + bool user_build_id = flags & BPF_F_USER_BUILD_ID; + u32 skip = flags & BPF_F_SKIP_FIELD_MASK; + bool user = flags & BPF_F_USER_STACK; +@@ -412,30 +406,28 @@ static long __bpf_get_stack(struct pt_re + goto err_fault; + + num_elem = size / elem_size; +- if (sysctl_perf_event_max_stack < num_elem) +- init_nr = 0; +- else +- init_nr = sysctl_perf_event_max_stack - num_elem; ++ max_depth = num_elem + skip; ++ if (sysctl_perf_event_max_stack < max_depth) ++ max_depth = sysctl_perf_event_max_stack; + + if (trace_in) + trace = trace_in; + else if (kernel && task) +- trace = get_callchain_entry_for_task(task, init_nr); ++ trace = get_callchain_entry_for_task(task, max_depth); + else +- trace = get_perf_callchain(regs, init_nr, kernel, user, +- sysctl_perf_event_max_stack, ++ trace = get_perf_callchain(regs, 0, kernel, user, max_depth, + false, false); + if (unlikely(!trace)) + goto err_fault; + +- trace_nr = trace->nr - init_nr; +- if (trace_nr < skip) ++ if (trace->nr < skip) + goto err_fault; + +- trace_nr -= skip; ++ trace_nr = trace->nr - skip; + trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem; + copy_len = trace_nr * elem_size; +- ips = trace->ip + skip + init_nr; ++ ++ ips = trace->ip + skip; + if (user && user_build_id) + stack_map_get_build_id_offset(buf, ips, trace_nr, user); + else diff --git a/queue-5.17/bpf-fix-comment-for-helper-bpf_current_task_under_cgroup.patch b/queue-5.17/bpf-fix-comment-for-helper-bpf_current_task_under_cgroup.patch new file mode 100644 index 00000000000..49d9d55200d --- /dev/null +++ b/queue-5.17/bpf-fix-comment-for-helper-bpf_current_task_under_cgroup.patch @@ -0,0 +1,48 @@ +From 58617014405ad5c9f94f464444f4972dabb71ca7 Mon Sep 17 00:00:00 2001 +From: Hengqi Chen +Date: Thu, 10 Mar 2022 23:53:35 +0800 +Subject: bpf: Fix comment for helper bpf_current_task_under_cgroup() + +From: Hengqi Chen + +commit 58617014405ad5c9f94f464444f4972dabb71ca7 upstream. + +Fix the descriptions of the return values of helper bpf_current_task_under_cgroup(). + +Fixes: c6b5fb8690fa ("bpf: add documentation for eBPF helpers (42-50)") +Signed-off-by: Hengqi Chen +Signed-off-by: Daniel Borkmann +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20220310155335.1278783-1-hengqi.chen@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/bpf.h | 4 ++-- + tools/include/uapi/linux/bpf.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -2286,8 +2286,8 @@ union bpf_attr { + * Return + * The return value depends on the result of the test, and can be: + * +- * * 0, if current task belongs to the cgroup2. +- * * 1, if current task does not belong to the cgroup2. ++ * * 1, if current task belongs to the cgroup2. ++ * * 0, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + * + * long bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -2286,8 +2286,8 @@ union bpf_attr { + * Return + * The return value depends on the result of the test, and can be: + * +- * * 0, if current task belongs to the cgroup2. +- * * 1, if current task does not belong to the cgroup2. ++ * * 1, if current task belongs to the cgroup2. ++ * * 0, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + * + * long bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) diff --git a/queue-5.17/dt-bindings-memory-mtk-smi-correct-minitems-to-2-for-the-gals-clocks.patch b/queue-5.17/dt-bindings-memory-mtk-smi-correct-minitems-to-2-for-the-gals-clocks.patch new file mode 100644 index 00000000000..37d9cb7e4c9 --- /dev/null +++ b/queue-5.17/dt-bindings-memory-mtk-smi-correct-minitems-to-2-for-the-gals-clocks.patch @@ -0,0 +1,52 @@ +From 996ebc0e332bfb3091395f9bd286d8349a57be62 Mon Sep 17 00:00:00 2001 +From: Yong Wu +Date: Thu, 13 Jan 2022 19:10:53 +0800 +Subject: dt-bindings: memory: mtk-smi: Correct minItems to 2 for the gals clocks + +From: Yong Wu + +commit 996ebc0e332bfb3091395f9bd286d8349a57be62 upstream. + +Mute the warning from "make dtbs_check": + +larb@14017000: clock-names: ['apb', 'smi'] is too short + arch/arm64/boot/dts/mediatek/mt8183-evb.dt.yaml + arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dt.yaml + ... + +larb@16010000: clock-names: ['apb', 'smi'] is too short + arch/arm64/boot/dts/mediatek/mt8183-evb.dt.yaml + arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dt.yaml + +larb@17010000: clock-names: ['apb', 'smi'] is too short + arch/arm64/boot/dts/mediatek/mt8183-evb.dt.yaml + arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-burnet.dt.yaml + +If a platform's larb supports gals, there will be some larbs have one +more "gals" clock while the others still only need "apb"/"smi" clocks, +then the minItems for clocks and clock-names are 2. + +Fixes: 27bb0e42855a ("dt-bindings: memory: mediatek: Convert SMI to DT schema") +Signed-off-by: Yong Wu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220113111057.29918-4-yong.wu@mediatek.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml ++++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml +@@ -80,9 +80,10 @@ allOf: + then: + properties: + clocks: +- minItems: 3 ++ minItems: 2 + maxItems: 3 + clock-names: ++ minItems: 2 + items: + - const: apb + - const: smi diff --git a/queue-5.17/dt-bindings-memory-mtk-smi-no-need-mediatek-larb-id-for-mt8167.patch b/queue-5.17/dt-bindings-memory-mtk-smi-no-need-mediatek-larb-id-for-mt8167.patch new file mode 100644 index 00000000000..607cd5402ce --- /dev/null +++ b/queue-5.17/dt-bindings-memory-mtk-smi-no-need-mediatek-larb-id-for-mt8167.patch @@ -0,0 +1,49 @@ +From ddc3a324889686ec9b358de20fdeec0d2668c7a8 Mon Sep 17 00:00:00 2001 +From: Yong Wu +Date: Thu, 13 Jan 2022 19:10:52 +0800 +Subject: dt-bindings: memory: mtk-smi: No need mediatek,larb-id for mt8167 + +From: Yong Wu + +commit ddc3a324889686ec9b358de20fdeec0d2668c7a8 upstream. + +Mute the warning from "make dtbs_check": + +larb@14016000: 'mediatek,larb-id' is a required property + arch/arm64/boot/dts/mediatek/mt8167-pumpkin.dt.yaml +larb@15001000: 'mediatek,larb-id' is a required property + arch/arm64/boot/dts/mediatek/mt8167-pumpkin.dt.yaml +larb@16010000: 'mediatek,larb-id' is a required property + arch/arm64/boot/dts/mediatek/mt8167-pumpkin.dt.yaml + +As the description of mediatek,larb-id, the property is only +required when the larbid is not consecutive from its IOMMU point of view. + +Also, from the description of mediatek,larbs in +Documentation/devicetree/bindings/iommu/mediatek,iommu.yaml, all the larbs +must sort by the larb index. + +In mt8167, there is only one IOMMU HW and three larbs. The drivers already +know its larb index from the mediatek,larbs property of IOMMU, thus no +need this property. + +Fixes: 27bb0e42855a ("dt-bindings: memory: mediatek: Convert SMI to DT schema") +Signed-off-by: Yong Wu +Acked-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220113111057.29918-3-yong.wu@mediatek.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml | 1 - + 1 file changed, 1 deletion(-) + +--- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml ++++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml +@@ -106,7 +106,6 @@ allOf: + - mediatek,mt2701-smi-larb + - mediatek,mt2712-smi-larb + - mediatek,mt6779-smi-larb +- - mediatek,mt8167-smi-larb + - mediatek,mt8192-smi-larb + - mediatek,mt8195-smi-larb + diff --git a/queue-5.17/dt-bindings-memory-mtk-smi-rename-clock-to-clocks.patch b/queue-5.17/dt-bindings-memory-mtk-smi-rename-clock-to-clocks.patch new file mode 100644 index 00000000000..eedc04483b1 --- /dev/null +++ b/queue-5.17/dt-bindings-memory-mtk-smi-rename-clock-to-clocks.patch @@ -0,0 +1,111 @@ +From 5bf7fa48374eafe29dbb30448a0b0c083853583f Mon Sep 17 00:00:00 2001 +From: Yong Wu +Date: Thu, 13 Jan 2022 19:10:51 +0800 +Subject: dt-bindings: memory: mtk-smi: Rename clock to clocks + +From: Yong Wu + +commit 5bf7fa48374eafe29dbb30448a0b0c083853583f upstream. + +The property "clock" should be rename to "clocks", and delete the "items", +the minItems/maxItems should not be put under "items". + +Fixes: 27bb0e42855a ("dt-bindings: memory: mediatek: Convert SMI to DT schema") +Signed-off-by: Yong Wu +Acked-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220113111057.29918-2-yong.wu@mediatek.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml | 28 ++++------ + Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml | 14 ++--- + 2 files changed, 18 insertions(+), 24 deletions(-) + +--- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml ++++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-common.yaml +@@ -88,10 +88,9 @@ allOf: + - mediatek,mt2701-smi-common + then: + properties: +- clock: +- items: +- minItems: 3 +- maxItems: 3 ++ clocks: ++ minItems: 3 ++ maxItems: 3 + clock-names: + items: + - const: apb +@@ -108,10 +107,9 @@ allOf: + required: + - mediatek,smi + properties: +- clock: +- items: +- minItems: 3 +- maxItems: 3 ++ clocks: ++ minItems: 3 ++ maxItems: 3 + clock-names: + items: + - const: apb +@@ -133,10 +131,9 @@ allOf: + + then: + properties: +- clock: +- items: +- minItems: 4 +- maxItems: 4 ++ clocks: ++ minItems: 4 ++ maxItems: 4 + clock-names: + items: + - const: apb +@@ -146,10 +143,9 @@ allOf: + + else: # for gen2 HW that don't have gals + properties: +- clock: +- items: +- minItems: 2 +- maxItems: 2 ++ clocks: ++ minItems: 2 ++ maxItems: 2 + clock-names: + items: + - const: apb +--- a/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml ++++ b/Documentation/devicetree/bindings/memory-controllers/mediatek,smi-larb.yaml +@@ -79,10 +79,9 @@ allOf: + + then: + properties: +- clock: +- items: +- minItems: 3 +- maxItems: 3 ++ clocks: ++ minItems: 3 ++ maxItems: 3 + clock-names: + items: + - const: apb +@@ -91,10 +90,9 @@ allOf: + + else: + properties: +- clock: +- items: +- minItems: 2 +- maxItems: 2 ++ clocks: ++ minItems: 2 ++ maxItems: 2 + clock-names: + items: + - const: apb diff --git a/queue-5.17/dt-bindings-mtd-nand-controller-fix-a-comment-in-the-examples.patch b/queue-5.17/dt-bindings-mtd-nand-controller-fix-a-comment-in-the-examples.patch new file mode 100644 index 00000000000..1a621613b03 --- /dev/null +++ b/queue-5.17/dt-bindings-mtd-nand-controller-fix-a-comment-in-the-examples.patch @@ -0,0 +1,33 @@ +From 0e7f1b557974ce297e5e4c9d4245720fbb489886 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Thu, 16 Dec 2021 12:16:28 +0100 +Subject: dt-bindings: mtd: nand-controller: Fix a comment in the examples + +From: Miquel Raynal + +commit 0e7f1b557974ce297e5e4c9d4245720fbb489886 upstream. + +The controller properties should be in the controller 'parent' node, +while properties in the children nodes are specific to the NAND +*chip*. This error was already present during the yaml conversion. + +Fixes: 2d472aba15ff ("mtd: nand: document the NAND controller/NAND chip DT representation") +Signed-off-by: Miquel Raynal +Acked-by: Rob Herring +Link: https://lore.kernel.org/linux-mtd/20211216111654.238086-3-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/mtd/nand-controller.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/mtd/nand-controller.yaml ++++ b/Documentation/devicetree/bindings/mtd/nand-controller.yaml +@@ -184,7 +184,7 @@ examples: + nand-use-soft-ecc-engine; + nand-ecc-algo = "bch"; + +- /* controller specific properties */ ++ /* NAND chip specific properties */ + }; + + nand@1 { diff --git a/queue-5.17/dt-bindings-mtd-nand-controller-fix-the-reg-property-description.patch b/queue-5.17/dt-bindings-mtd-nand-controller-fix-the-reg-property-description.patch new file mode 100644 index 00000000000..bbe954997be --- /dev/null +++ b/queue-5.17/dt-bindings-mtd-nand-controller-fix-the-reg-property-description.patch @@ -0,0 +1,33 @@ +From 93f2ec9e401276fb4ea9903194a5bfcf175f9a2c Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Thu, 16 Dec 2021 12:16:27 +0100 +Subject: dt-bindings: mtd: nand-controller: Fix the reg property description + +From: Miquel Raynal + +commit 93f2ec9e401276fb4ea9903194a5bfcf175f9a2c upstream. + +The reg property of a NAND device always references the chip-selects. +The ready/busy lines are described in the nand-rb property. I believe +this was a harmless copy/paste error during the conversion to yaml. + +Fixes: 212e49693592 ("dt-bindings: mtd: Add YAML schemas for the generic NAND options") +Signed-off-by: Miquel Raynal +Acked-by: Rob Herring +Link: https://lore.kernel.org/linux-mtd/20211216111654.238086-2-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/mtd/nand-controller.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/mtd/nand-controller.yaml ++++ b/Documentation/devicetree/bindings/mtd/nand-controller.yaml +@@ -55,7 +55,7 @@ patternProperties: + properties: + reg: + description: +- Contains the native Ready/Busy IDs. ++ Contains the chip-select IDs. + + nand-ecc-engine: + allOf: diff --git a/queue-5.17/dt-bindings-pinctrl-mt8195-fix-bias-pull-up-down-checks.patch b/queue-5.17/dt-bindings-pinctrl-mt8195-fix-bias-pull-up-down-checks.patch new file mode 100644 index 00000000000..14aadbe019c --- /dev/null +++ b/queue-5.17/dt-bindings-pinctrl-mt8195-fix-bias-pull-up-down-checks.patch @@ -0,0 +1,91 @@ +From c76eeb14ec4e645a23ed8d627c7e38eca048c527 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Wed, 2 Feb 2022 23:35:28 +0800 +Subject: dt-bindings: pinctrl: mt8195: fix bias-pull-{up,down} checks + +From: Chen-Yu Tsai + +commit c76eeb14ec4e645a23ed8d627c7e38eca048c527 upstream. + +When the constraints and description for bias-pull-{up,down} were added, +the constraints were not indented correctly, resulting in them being +parsed as part of the description. This effectively nullified their +purpose. + +Move the constraints out of the description block, make each description +part of the same associative array as the enum its describing, and +reindent them correctly so they take effect. + +Also add "type: boolean" to the list of valid values. This corresponds +to having bias-pull-{up,down} without any arguments. + +Fixes: 91e7edceda96 ("dt-bindings: pinctrl: mt8195: change pull up/down description") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Rob Herring +Link: https://lore.kernel.org/r/20220202153528.707185-1-wenst@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/pinctrl/pinctrl-mt8195.yaml | 30 +++++----- + 1 file changed, 16 insertions(+), 14 deletions(-) + +--- a/Documentation/devicetree/bindings/pinctrl/pinctrl-mt8195.yaml ++++ b/Documentation/devicetree/bindings/pinctrl/pinctrl-mt8195.yaml +@@ -99,6 +99,14 @@ patternProperties: + enum: [2, 4, 6, 8, 10, 12, 14, 16] + + bias-pull-down: ++ oneOf: ++ - type: boolean ++ - enum: [100, 101, 102, 103] ++ description: mt8195 pull down PUPD/R0/R1 type define value. ++ - enum: [200, 201, 202, 203, 204, 205, 206, 207] ++ description: mt8195 pull down RSEL type define value. ++ - enum: [75000, 5000] ++ description: mt8195 pull down RSEL type si unit value(ohm). + description: | + For pull down type is normal, it don't need add RSEL & R1R0 define + and resistance value. +@@ -115,13 +123,6 @@ patternProperties: + & "MTK_PULL_SET_RSEL_110" & "MTK_PULL_SET_RSEL_111" + define in mt8195. It can also support resistance value(ohm) + "75000" & "5000" in mt8195. +- oneOf: +- - enum: [100, 101, 102, 103] +- - description: mt8195 pull down PUPD/R0/R1 type define value. +- - enum: [200, 201, 202, 203, 204, 205, 206, 207] +- - description: mt8195 pull down RSEL type define value. +- - enum: [75000, 5000] +- - description: mt8195 pull down RSEL type si unit value(ohm). + + An example of using RSEL define: + pincontroller { +@@ -146,6 +147,14 @@ patternProperties: + }; + + bias-pull-up: ++ oneOf: ++ - type: boolean ++ - enum: [100, 101, 102, 103] ++ description: mt8195 pull up PUPD/R0/R1 type define value. ++ - enum: [200, 201, 202, 203, 204, 205, 206, 207] ++ description: mt8195 pull up RSEL type define value. ++ - enum: [1000, 1500, 2000, 3000, 4000, 5000, 10000, 75000] ++ description: mt8195 pull up RSEL type si unit value(ohm). + description: | + For pull up type is normal, it don't need add RSEL & R1R0 define + and resistance value. +@@ -163,13 +172,6 @@ patternProperties: + define in mt8195. It can also support resistance value(ohm) + "1000" & "1500" & "2000" & "3000" & "4000" & "5000" & "10000" & + "75000" in mt8195. +- oneOf: +- - enum: [100, 101, 102, 103] +- - description: mt8195 pull up PUPD/R0/R1 type define value. +- - enum: [200, 201, 202, 203, 204, 205, 206, 207] +- - description: mt8195 pull up RSEL type define value. +- - enum: [1000, 1500, 2000, 3000, 4000, 5000, 10000, 75000] +- - description: mt8195 pull up RSEL type si unit value(ohm). + An example of using RSEL define: + pincontroller { + i2c0-pins { diff --git a/queue-5.17/dt-bindings-pinctrl-pinctrl-microchip-sgpio-fix-example.patch b/queue-5.17/dt-bindings-pinctrl-pinctrl-microchip-sgpio-fix-example.patch new file mode 100644 index 00000000000..7e4cfcf550c --- /dev/null +++ b/queue-5.17/dt-bindings-pinctrl-pinctrl-microchip-sgpio-fix-example.patch @@ -0,0 +1,33 @@ +From a6ff90f3fbd4d902aad8777f0329cef3a2768bde Mon Sep 17 00:00:00 2001 +From: Horatiu Vultur +Date: Fri, 4 Feb 2022 16:35:34 +0100 +Subject: dt-bindings: pinctrl: pinctrl-microchip-sgpio: Fix example + +From: Horatiu Vultur + +commit a6ff90f3fbd4d902aad8777f0329cef3a2768bde upstream. + +The blamed commit adds support for irq, but the reqisters for irq are +outside of the memory size. They are at address 0x108. Therefore update +the memory size to cover all the registers used by the device. + +Fixes: 01a9350bdd49fb ("dt-bindings: pinctrl: pinctrl-microchip-sgpio: Add irq support") +Signed-off-by: Horatiu Vultur +Link: https://lore.kernel.org/r/20220204153535.465827-2-horatiu.vultur@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/pinctrl/microchip,sparx5-sgpio.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/pinctrl/microchip,sparx5-sgpio.yaml ++++ b/Documentation/devicetree/bindings/pinctrl/microchip,sparx5-sgpio.yaml +@@ -145,7 +145,7 @@ examples: + clocks = <&sys_clk>; + pinctrl-0 = <&sgpio2_pins>; + pinctrl-names = "default"; +- reg = <0x1101059c 0x100>; ++ reg = <0x1101059c 0x118>; + microchip,sgpio-port-ranges = <0 0>, <16 18>, <28 31>; + bus-frequency = <25000000>; + sgpio_in2: gpio@0 { diff --git a/queue-5.17/dt-bindings-spi-mxic-the-interrupt-property-is-not-mandatory.patch b/queue-5.17/dt-bindings-spi-mxic-the-interrupt-property-is-not-mandatory.patch new file mode 100644 index 00000000000..e8476023cb3 --- /dev/null +++ b/queue-5.17/dt-bindings-spi-mxic-the-interrupt-property-is-not-mandatory.patch @@ -0,0 +1,40 @@ +From 90c204d3195a795f77f5bce767e311dd1c59ca17 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Thu, 16 Dec 2021 12:16:33 +0100 +Subject: dt-bindings: spi: mxic: The interrupt property is not mandatory + +From: Miquel Raynal + +commit 90c204d3195a795f77f5bce767e311dd1c59ca17 upstream. + +The interrupt property is not mandatory at all, this property should not +be part of the required properties list, so move it into the optional +properties list. + +Fixes: 326e5c8d4a87 ("dt-binding: spi: Document Macronix controller bindings") +Signed-off-by: Miquel Raynal +Reviewed-by: Rob Herring +Reviewed-by: Mark Brown +Link: https://lore.kernel.org/linux-mtd/20211216111654.238086-8-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/spi/spi-mxic.txt | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/spi/spi-mxic.txt ++++ b/Documentation/devicetree/bindings/spi/spi-mxic.txt +@@ -8,11 +8,13 @@ Required properties: + - reg: should contain 2 entries, one for the registers and one for the direct + mapping area + - reg-names: should contain "regs" and "dirmap" +-- interrupts: interrupt line connected to the SPI controller + - clock-names: should contain "ps_clk", "send_clk" and "send_dly_clk" + - clocks: should contain 3 entries for the "ps_clk", "send_clk" and + "send_dly_clk" clocks + ++Optional properties: ++- interrupts: interrupt line connected to the SPI controller ++ + Example: + + spi@43c30000 { diff --git a/queue-5.17/media-dt-binding-media-hynix-hi846-use-defs-port-base-port-description.patch b/queue-5.17/media-dt-binding-media-hynix-hi846-use-defs-port-base-port-description.patch new file mode 100644 index 00000000000..347cc42b64e --- /dev/null +++ b/queue-5.17/media-dt-binding-media-hynix-hi846-use-defs-port-base-port-description.patch @@ -0,0 +1,42 @@ +From 6492eba4fafb5a9715ecf78b7155e88f8f88909a Mon Sep 17 00:00:00 2001 +From: Martin Kepplinger +Date: Tue, 11 Jan 2022 14:39:36 +0100 +Subject: media: dt-binding: media: hynix,hi846: use $defs/port-base port description + +From: Martin Kepplinger + +commit 6492eba4fafb5a9715ecf78b7155e88f8f88909a upstream. + +This fixes "make dt_binding_check": + + Documentation/devicetree/bindings/media/i2c/hynix,hi846.example.dt.yaml: +camera@20: port:endpoint: Unevaluated properties are not allowed +('link-frequencies', 'data-lanes' were unexpected) + From schema: Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml + +[Sakari Ailus: Reword commit message] + +Fixes: f3ce7200ca18 ("media: dt-bindings: media: document SK Hynix Hi-846 MIPI CSI-2 8M pixel sensor") +Reported-by: Geert Uytterhoeven +Signed-off-by: Martin Kepplinger +Reviewed-by: Laurent Pinchart +Reviewed-by: Rob Herring +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml ++++ b/Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml +@@ -49,7 +49,8 @@ properties: + description: Definition of the regulator used for the VDDD power supply. + + port: +- $ref: /schemas/graph.yaml#/properties/port ++ $ref: /schemas/graph.yaml#/$defs/port-base ++ unevaluatedProperties: false + + properties: + endpoint: diff --git a/queue-5.17/media-dt-bindings-media-hynix-hi846-add-link-frequencies-description.patch b/queue-5.17/media-dt-bindings-media-hynix-hi846-add-link-frequencies-description.patch new file mode 100644 index 00000000000..b8ef9a54c07 --- /dev/null +++ b/queue-5.17/media-dt-bindings-media-hynix-hi846-add-link-frequencies-description.patch @@ -0,0 +1,37 @@ +From a44b8e8c9b2615ea7cf2361cbca3c1dff8119c87 Mon Sep 17 00:00:00 2001 +From: Martin Kepplinger +Date: Tue, 11 Jan 2022 14:39:37 +0100 +Subject: media: dt-bindings: media: hynix,hi846: add link-frequencies description + +From: Martin Kepplinger + +commit a44b8e8c9b2615ea7cf2361cbca3c1dff8119c87 upstream. + +link-frequencies is required but only mentioned in the example. Add +it to the description. + +Fixes: f3ce7200ca18 ("media: dt-bindings: media: document SK Hynix Hi-846 MIPI CSI-2 8M pixel sensor") +Signed-off-by: Martin Kepplinger +Reviewed-by: Laurent Pinchart +Reviewed-by: Rob Herring +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml ++++ b/Documentation/devicetree/bindings/media/i2c/hynix,hi846.yaml +@@ -69,8 +69,11 @@ properties: + - const: 1 + - const: 2 + ++ link-frequencies: true ++ + required: + - data-lanes ++ - link-frequencies + + required: + - compatible diff --git a/queue-5.17/mmc-rtsx-use-pm_runtime_-get-put-to-handle-runtime-pm.patch b/queue-5.17/mmc-rtsx-use-pm_runtime_-get-put-to-handle-runtime-pm.patch new file mode 100644 index 00000000000..4ee66e56d3d --- /dev/null +++ b/queue-5.17/mmc-rtsx-use-pm_runtime_-get-put-to-handle-runtime-pm.patch @@ -0,0 +1,220 @@ +From 7499b529d97f752124fa62fefa1d6d44b371215a Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Tue, 25 Jan 2022 13:50:06 +0800 +Subject: mmc: rtsx: Use pm_runtime_{get,put}() to handle runtime PM + +From: Kai-Heng Feng + +commit 7499b529d97f752124fa62fefa1d6d44b371215a upstream. + +Commit 5b4258f6721f ("misc: rtsx: rts5249 support runtime PM") doesn't +use pm_runtime_{get,put}() helpers when it should, so the RPM refcount +keeps at zero, hence its parent driver, rtsx_pci, has to do lots of +weird tricks to keep it from runtime suspending. + +So use those helpers at right places to properly manage runtime PM. + +Fixes: 5b4258f6721f ("misc: rtsx: rts5249 support runtime PM") +Cc: Ricky WU +Tested-by: Ricky WU +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20220125055010.1866563-1-kai.heng.feng@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/rtsx_pci_sdmmc.c | 44 ++++++++++++++++++++++++++++---------- + 1 file changed, 33 insertions(+), 11 deletions(-) + +--- a/drivers/mmc/host/rtsx_pci_sdmmc.c ++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c +@@ -806,6 +806,7 @@ static void sd_request(struct work_struc + struct mmc_request *mrq = host->mrq; + struct mmc_command *cmd = mrq->cmd; + struct mmc_data *data = mrq->data; ++ struct device *dev = &host->pdev->dev; + + unsigned int data_size = 0; + int err; +@@ -822,6 +823,7 @@ static void sd_request(struct work_struc + } + + mutex_lock(&pcr->pcr_mutex); ++ pm_runtime_get_sync(dev); + + rtsx_pci_start_run(pcr); + +@@ -858,6 +860,8 @@ static void sd_request(struct work_struc + data->bytes_xfered = data->blocks * data->blksz; + } + ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + mutex_unlock(&pcr->pcr_mutex); + + finish: +@@ -1080,6 +1084,7 @@ static void sdmmc_set_ios(struct mmc_hos + { + struct realtek_pci_sdmmc *host = mmc_priv(mmc); + struct rtsx_pcr *pcr = host->pcr; ++ struct device *dev = &host->pdev->dev; + + if (host->eject) + return; +@@ -1088,6 +1093,7 @@ static void sdmmc_set_ios(struct mmc_hos + return; + + mutex_lock(&pcr->pcr_mutex); ++ pm_runtime_get_sync(dev); + + rtsx_pci_start_run(pcr); + +@@ -1121,6 +1127,8 @@ static void sdmmc_set_ios(struct mmc_hos + rtsx_pci_switch_clock(pcr, ios->clock, host->ssc_depth, + host->initial_mode, host->double_clk, host->vpclk); + ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + mutex_unlock(&pcr->pcr_mutex); + } + +@@ -1128,6 +1136,7 @@ static int sdmmc_get_ro(struct mmc_host + { + struct realtek_pci_sdmmc *host = mmc_priv(mmc); + struct rtsx_pcr *pcr = host->pcr; ++ struct device *dev = &host->pdev->dev; + int ro = 0; + u32 val; + +@@ -1135,6 +1144,7 @@ static int sdmmc_get_ro(struct mmc_host + return -ENOMEDIUM; + + mutex_lock(&pcr->pcr_mutex); ++ pm_runtime_get_sync(dev); + + rtsx_pci_start_run(pcr); + +@@ -1144,6 +1154,8 @@ static int sdmmc_get_ro(struct mmc_host + if (val & SD_WRITE_PROTECT) + ro = 1; + ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + mutex_unlock(&pcr->pcr_mutex); + + return ro; +@@ -1153,6 +1165,7 @@ static int sdmmc_get_cd(struct mmc_host + { + struct realtek_pci_sdmmc *host = mmc_priv(mmc); + struct rtsx_pcr *pcr = host->pcr; ++ struct device *dev = &host->pdev->dev; + int cd = 0; + u32 val; + +@@ -1160,6 +1173,7 @@ static int sdmmc_get_cd(struct mmc_host + return cd; + + mutex_lock(&pcr->pcr_mutex); ++ pm_runtime_get_sync(dev); + + rtsx_pci_start_run(pcr); + +@@ -1169,6 +1183,8 @@ static int sdmmc_get_cd(struct mmc_host + if (val & SD_EXIST) + cd = 1; + ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + mutex_unlock(&pcr->pcr_mutex); + + return cd; +@@ -1251,6 +1267,7 @@ static int sdmmc_switch_voltage(struct m + { + struct realtek_pci_sdmmc *host = mmc_priv(mmc); + struct rtsx_pcr *pcr = host->pcr; ++ struct device *dev = &host->pdev->dev; + int err = 0; + u8 voltage; + +@@ -1265,6 +1282,7 @@ static int sdmmc_switch_voltage(struct m + return err; + + mutex_lock(&pcr->pcr_mutex); ++ pm_runtime_get_sync(dev); + + rtsx_pci_start_run(pcr); + +@@ -1294,6 +1312,8 @@ out: + err = rtsx_pci_write_register(pcr, SD_BUS_STAT, + SD_CLK_TOGGLE_EN | SD_CLK_FORCE_STOP, 0); + ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + mutex_unlock(&pcr->pcr_mutex); + + return err; +@@ -1303,6 +1323,7 @@ static int sdmmc_execute_tuning(struct m + { + struct realtek_pci_sdmmc *host = mmc_priv(mmc); + struct rtsx_pcr *pcr = host->pcr; ++ struct device *dev = &host->pdev->dev; + int err = 0; + + if (host->eject) +@@ -1313,6 +1334,7 @@ static int sdmmc_execute_tuning(struct m + return err; + + mutex_lock(&pcr->pcr_mutex); ++ pm_runtime_get_sync(dev); + + rtsx_pci_start_run(pcr); + +@@ -1345,6 +1367,8 @@ static int sdmmc_execute_tuning(struct m + err = sd_change_phase(host, DDR50_RX_PHASE(pcr), true); + + out: ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); + mutex_unlock(&pcr->pcr_mutex); + + return err; +@@ -1495,12 +1519,12 @@ static int rtsx_pci_sdmmc_drv_probe(stru + + realtek_init_host(host); + +- if (pcr->rtd3_en) { +- pm_runtime_set_autosuspend_delay(&pdev->dev, 5000); +- pm_runtime_use_autosuspend(&pdev->dev); +- pm_runtime_enable(&pdev->dev); +- } +- ++ pm_runtime_no_callbacks(&pdev->dev); ++ pm_runtime_set_active(&pdev->dev); ++ pm_runtime_enable(&pdev->dev); ++ pm_runtime_set_autosuspend_delay(&pdev->dev, 200); ++ pm_runtime_mark_last_busy(&pdev->dev); ++ pm_runtime_use_autosuspend(&pdev->dev); + + mmc_add_host(mmc); + +@@ -1521,11 +1545,6 @@ static int rtsx_pci_sdmmc_drv_remove(str + pcr->slots[RTSX_SD_CARD].card_event = NULL; + mmc = host->mmc; + +- if (pcr->rtd3_en) { +- pm_runtime_dont_use_autosuspend(&pdev->dev); +- pm_runtime_disable(&pdev->dev); +- } +- + cancel_work_sync(&host->work); + + mutex_lock(&host->host_mutex); +@@ -1548,6 +1567,9 @@ static int rtsx_pci_sdmmc_drv_remove(str + + flush_work(&host->work); + ++ pm_runtime_dont_use_autosuspend(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); ++ + mmc_free_host(mmc); + + dev_dbg(&(pdev->dev), diff --git a/queue-5.17/nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_add.patch b/queue-5.17/nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_add.patch new file mode 100644 index 00000000000..257eb25bcd6 --- /dev/null +++ b/queue-5.17/nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_add.patch @@ -0,0 +1,67 @@ +From 6d35d04a9e18990040e87d2bbf72689252669d54 Mon Sep 17 00:00:00 2001 +From: Zhang Wensheng +Date: Thu, 10 Mar 2022 17:32:24 +0800 +Subject: nbd: fix possible overflow on 'first_minor' in nbd_dev_add() + +From: Zhang Wensheng + +commit 6d35d04a9e18990040e87d2bbf72689252669d54 upstream. + +When 'index' is a big numbers, it may become negative which forced +to 'int'. then 'index << part_shift' might overflow to a positive +value that is not greater than '0xfffff', then sysfs might complains +about duplicate creation. Because of this, move the 'index' judgment +to the front will fix it and be better. + +Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices") +Fixes: 940c264984fd ("nbd: fix possible overflow for 'first_minor' in nbd_dev_add()") +Signed-off-by: Zhang Wensheng +Reviewed-by: Josef Bacik +Link: https://lore.kernel.org/r/20220310093224.4002895-1-zhangwensheng5@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/nbd.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1800,17 +1800,6 @@ static struct nbd_device *nbd_dev_add(in + refcount_set(&nbd->refs, 0); + INIT_LIST_HEAD(&nbd->list); + disk->major = NBD_MAJOR; +- +- /* Too big first_minor can cause duplicate creation of +- * sysfs files/links, since index << part_shift might overflow, or +- * MKDEV() expect that the max bits of first_minor is 20. +- */ +- disk->first_minor = index << part_shift; +- if (disk->first_minor < index || disk->first_minor > MINORMASK) { +- err = -EINVAL; +- goto out_free_work; +- } +- + disk->minors = 1 << part_shift; + disk->fops = &nbd_fops; + disk->private_data = nbd; +@@ -1915,8 +1904,19 @@ static int nbd_genl_connect(struct sk_bu + if (!netlink_capable(skb, CAP_SYS_ADMIN)) + return -EPERM; + +- if (info->attrs[NBD_ATTR_INDEX]) ++ if (info->attrs[NBD_ATTR_INDEX]) { + index = nla_get_u32(info->attrs[NBD_ATTR_INDEX]); ++ ++ /* ++ * Too big first_minor can cause duplicate creation of ++ * sysfs files/links, since index << part_shift might overflow, or ++ * MKDEV() expect that the max bits of first_minor is 20. ++ */ ++ if (index < 0 || index > MINORMASK >> part_shift) { ++ printk(KERN_ERR "nbd: illegal input index %d\n", index); ++ return -EINVAL; ++ } ++ } + if (!info->attrs[NBD_ATTR_SOCKETS]) { + printk(KERN_ERR "nbd: must specify at least one socket\n"); + return -EINVAL; diff --git a/queue-5.17/series b/queue-5.17/series index 35cd348f76a..ac453e72bc9 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -1083,4 +1083,19 @@ mm-memcontrol-return-1-from-cgroup.memory-__setup-handler.patch mm-usercopy-return-1-from-hardened_usercopy-__setup-handler.patch af_unix-support-pollpri-for-oob.patch libbpf-define-btf_kind_-constants-in-btf.h-to-avoid-compilation-errors.patch +bpf-adjust-bpf-stack-helper-functions-to-accommodate-skip-0.patch +bpf-fix-comment-for-helper-bpf_current_task_under_cgroup.patch +nbd-fix-possible-overflow-on-first_minor-in-nbd_dev_add.patch +mmc-rtsx-use-pm_runtime_-get-put-to-handle-runtime-pm.patch +dt-bindings-mtd-nand-controller-fix-the-reg-property-description.patch +dt-bindings-mtd-nand-controller-fix-a-comment-in-the-examples.patch +dt-bindings-spi-mxic-the-interrupt-property-is-not-mandatory.patch +media-dt-binding-media-hynix-hi846-use-defs-port-base-port-description.patch +media-dt-bindings-media-hynix-hi846-add-link-frequencies-description.patch +dt-bindings-memory-mtk-smi-rename-clock-to-clocks.patch +dt-bindings-memory-mtk-smi-no-need-mediatek-larb-id-for-mt8167.patch +dt-bindings-memory-mtk-smi-correct-minitems-to-2-for-the-gals-clocks.patch +dt-bindings-pinctrl-mt8195-fix-bias-pull-up-down-checks.patch +dt-bindings-pinctrl-pinctrl-microchip-sgpio-fix-example.patch +ubi-fastmap-return-error-code-if-memory-allocation-fails-in-add_aeb.patch net-preserve-skb_end_offset-in-skb_unclone_keeptruesize.patch diff --git a/queue-5.17/ubi-fastmap-return-error-code-if-memory-allocation-fails-in-add_aeb.patch b/queue-5.17/ubi-fastmap-return-error-code-if-memory-allocation-fails-in-add_aeb.patch new file mode 100644 index 00000000000..03437d1ce66 --- /dev/null +++ b/queue-5.17/ubi-fastmap-return-error-code-if-memory-allocation-fails-in-add_aeb.patch @@ -0,0 +1,86 @@ +From c3c07fc25f37c157fde041b3a0c3dfcb1590cbce Mon Sep 17 00:00:00 2001 +From: Zhihao Cheng +Date: Mon, 27 Dec 2021 11:22:42 +0800 +Subject: ubi: fastmap: Return error code if memory allocation fails in add_aeb() + +From: Zhihao Cheng + +commit c3c07fc25f37c157fde041b3a0c3dfcb1590cbce upstream. + +Abort fastmap scanning and return error code if memory allocation fails +in add_aeb(). Otherwise ubi will get wrong peb statistics information +after scanning. + +Fixes: dbb7d2a88d2a7b ("UBI: Add fastmap core") +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/ubi/fastmap.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -468,7 +468,9 @@ static int scan_pool(struct ubi_device * + if (err == UBI_IO_FF_BITFLIPS) + scrub = 1; + +- add_aeb(ai, free, pnum, ec, scrub); ++ ret = add_aeb(ai, free, pnum, ec, scrub); ++ if (ret) ++ goto out; + continue; + } else if (err == 0 || err == UBI_IO_BITFLIPS) { + dbg_bld("Found non empty PEB:%i in pool", pnum); +@@ -638,8 +640,10 @@ static int ubi_attach_fastmap(struct ubi + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 0); ++ ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 0); ++ if (ret) ++ goto fail; + } + + /* read EC values from used list */ +@@ -649,8 +653,10 @@ static int ubi_attach_fastmap(struct ubi + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 0); ++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 0); ++ if (ret) ++ goto fail; + } + + /* read EC values from scrub list */ +@@ -660,8 +666,10 @@ static int ubi_attach_fastmap(struct ubi + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 1); ++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 1); ++ if (ret) ++ goto fail; + } + + /* read EC values from erase list */ +@@ -671,8 +679,10 @@ static int ubi_attach_fastmap(struct ubi + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 1); ++ ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 1); ++ if (ret) ++ goto fail; + } + + ai->mean_ec = div_u64(ai->ec_sum, ai->ec_count);