From: Greg Kroah-Hartman Date: Tue, 30 Sep 2025 11:08:47 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v5.4.300~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a7faab28dd3a79f2d594a3153880f7c12c34d053;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch gpiolib-extend-software-node-support-to-support-secondary-software-nodes.patch i40e-add-validation-for-ring_len-param.patch i40e-increase-max-descriptors-for-xl710.patch loop-avoid-updating-block-size-under-exclusive-owner.patch --- diff --git a/queue-6.6/drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch b/queue-6.6/drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch new file mode 100644 index 0000000000..c3e0ecc470 --- /dev/null +++ b/queue-6.6/drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch @@ -0,0 +1,45 @@ +From stable+bounces-181948-greg=kroah.com@vger.kernel.org Mon Sep 29 17:51:18 2025 +From: Sasha Levin +Date: Mon, 29 Sep 2025 11:50:10 -0400 +Subject: drm/ast: Use msleep instead of mdelay for edid read +To: stable@vger.kernel.org +Cc: Nirmoy Das , Thomas Zimmermann , csoto@nvidia.com, KuoHsiang Chou , Dave Airlie , Jocelyn Falempe , dri-devel@lists.freedesktop.org, Sasha Levin +Message-ID: <20250929155031.137825-1-sashal@kernel.org> + +From: Nirmoy Das + +[ Upstream commit c7c31f8dc54aa3c9b2c994b5f1ff7e740a654e97 ] + +The busy-waiting in `mdelay()` can cause CPU stalls and kernel timeouts +during boot. + +Signed-off-by: Nirmoy Das +Reviewed-by: Thomas Zimmermann +Tested-by: Carol L Soto csoto@nvidia.com +Fixes: 594e9c04b586 ("drm/ast: Create the driver for ASPEED proprietory Display-Port") +Cc: KuoHsiang Chou +Cc: Thomas Zimmermann +Cc: Dave Airlie +Cc: Jocelyn Falempe +Cc: dri-devel@lists.freedesktop.org +Cc: # v5.19+ +Signed-off-by: Thomas Zimmermann +Link: https://lore.kernel.org/r/20250917194346.2905522-1-nirmoyd@nvidia.com +[ Applied change to ast_astdp_read_edid() instead of ast_astdp_read_edid_block() ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ast/ast_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/ast/ast_dp.c ++++ b/drivers/gpu/drm/ast/ast_dp.c +@@ -62,7 +62,7 @@ int ast_astdp_read_edid(struct drm_devic + * of right-click of mouse. + * 2. The Delays are often longer a lot when system resume from S3/S4. + */ +- mdelay(j+1); ++ msleep(j + 1); + + if (!(ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xD1, + ASTDP_MCU_FW_EXECUTING) && diff --git a/queue-6.6/gpiolib-extend-software-node-support-to-support-secondary-software-nodes.patch b/queue-6.6/gpiolib-extend-software-node-support-to-support-secondary-software-nodes.patch new file mode 100644 index 0000000000..b6320725ae --- /dev/null +++ b/queue-6.6/gpiolib-extend-software-node-support-to-support-secondary-software-nodes.patch @@ -0,0 +1,71 @@ +From stable+bounces-181990-greg=kroah.com@vger.kernel.org Mon Sep 29 20:58:05 2025 +From: Sasha Levin +Date: Mon, 29 Sep 2025 14:57:56 -0400 +Subject: gpiolib: Extend software-node support to support secondary software-nodes +To: stable@vger.kernel.org +Cc: Hans de Goede , Dmitry Torokhov , Bartosz Golaszewski , Sasha Levin +Message-ID: <20250929185756.284707-1-sashal@kernel.org> + +From: Hans de Goede + +[ Upstream commit c6ccc4dde17676dfe617b9a37bd9ba19a8fc87ee ] + +When a software-node gets added to a device which already has another +fwnode as primary node it will become the secondary fwnode for that +device. + +Currently if a software-node with GPIO properties ends up as the secondary +fwnode then gpiod_find_by_fwnode() will fail to find the GPIOs. + +Add a new gpiod_fwnode_lookup() helper which falls back to calling +gpiod_find_by_fwnode() with the secondary fwnode if the GPIO was not +found in the primary fwnode. + +Fixes: e7f9ff5dc90c ("gpiolib: add support for software nodes") +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Reviewed-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/20250920200955.20403-1-hansg@kernel.org +Signed-off-by: Bartosz Golaszewski +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -4022,6 +4022,23 @@ static struct gpio_desc *gpiod_find_by_f + return desc; + } + ++static struct gpio_desc *gpiod_fwnode_lookup(struct fwnode_handle *fwnode, ++ struct device *consumer, ++ const char *con_id, ++ unsigned int idx, ++ enum gpiod_flags *flags, ++ unsigned long *lookupflags) ++{ ++ struct gpio_desc *desc; ++ ++ desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, flags, lookupflags); ++ if (gpiod_not_found(desc) && !IS_ERR_OR_NULL(fwnode)) ++ desc = gpiod_find_by_fwnode(fwnode->secondary, consumer, con_id, ++ idx, flags, lookupflags); ++ ++ return desc; ++} ++ + struct gpio_desc *gpiod_find_and_request(struct device *consumer, + struct fwnode_handle *fwnode, + const char *con_id, +@@ -4034,7 +4051,7 @@ struct gpio_desc *gpiod_find_and_request + struct gpio_desc *desc; + int ret; + +- desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, &flags, &lookupflags); ++ desc = gpiod_fwnode_lookup(fwnode, consumer, con_id, idx, &flags, &lookupflags); + if (gpiod_not_found(desc) && platform_lookup_allowed) { + /* + * Either we are not using DT or ACPI, or their lookup did not diff --git a/queue-6.6/i40e-add-validation-for-ring_len-param.patch b/queue-6.6/i40e-add-validation-for-ring_len-param.patch new file mode 100644 index 0000000000..1901e645f6 --- /dev/null +++ b/queue-6.6/i40e-add-validation-for-ring_len-param.patch @@ -0,0 +1,66 @@ +From stable+bounces-181922-greg=kroah.com@vger.kernel.org Mon Sep 29 16:11:36 2025 +From: Sasha Levin +Date: Mon, 29 Sep 2025 10:11:10 -0400 +Subject: i40e: add validation for ring_len param +To: stable@vger.kernel.org +Cc: Lukasz Czapnik , Aleksandr Loktionov , Przemek Kitszel , Simon Horman , Rafal Romanowski , Tony Nguyen , Sasha Levin +Message-ID: <20250929141110.80651-2-sashal@kernel.org> + +From: Lukasz Czapnik + +[ Upstream commit 55d225670def06b01af2e7a5e0446fbe946289e8 ] + +The `ring_len` parameter provided by the virtual function (VF) +is assigned directly to the hardware memory context (HMC) without +any validation. + +To address this, introduce an upper boundary check for both Tx and Rx +queue lengths. The maximum number of descriptors supported by the +hardware is 8k-32. +Additionally, enforce alignment constraints: Tx rings must be a multiple +of 8, and Rx rings must be a multiple of 32. + +Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") +Cc: stable@vger.kernel.org +Signed-off-by: Lukasz Czapnik +Reviewed-by: Aleksandr Loktionov +Signed-off-by: Przemek Kitszel +Reviewed-by: Simon Horman +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -657,6 +657,13 @@ static int i40e_config_vsi_tx_queue(stru + + /* only set the required fields */ + tx_ctx.base = info->dma_ring_addr / 128; ++ ++ /* ring_len has to be multiple of 8 */ ++ if (!IS_ALIGNED(info->ring_len, 8) || ++ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { ++ ret = -EINVAL; ++ goto error_context; ++ } + tx_ctx.qlen = info->ring_len; + tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]); + tx_ctx.rdylist_act = 0; +@@ -722,6 +729,13 @@ static int i40e_config_vsi_rx_queue(stru + + /* only set the required fields */ + rx_ctx.base = info->dma_ring_addr / 128; ++ ++ /* ring_len has to be multiple of 32 */ ++ if (!IS_ALIGNED(info->ring_len, 32) || ++ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) { ++ ret = -EINVAL; ++ goto error_param; ++ } + rx_ctx.qlen = info->ring_len; + + if (info->splithdr_enabled) { diff --git a/queue-6.6/i40e-increase-max-descriptors-for-xl710.patch b/queue-6.6/i40e-increase-max-descriptors-for-xl710.patch new file mode 100644 index 0000000000..57288baaca --- /dev/null +++ b/queue-6.6/i40e-increase-max-descriptors-for-xl710.patch @@ -0,0 +1,105 @@ +From stable+bounces-181921-greg=kroah.com@vger.kernel.org Mon Sep 29 16:11:23 2025 +From: Sasha Levin +Date: Mon, 29 Sep 2025 10:11:09 -0400 +Subject: i40e: increase max descriptors for XL710 +To: stable@vger.kernel.org +Cc: Justin Bronder , Jacob Keller , Pucha Himasekhar Reddy , Tony Nguyen , Jakub Kicinski , Sasha Levin +Message-ID: <20250929141110.80651-1-sashal@kernel.org> + +From: Justin Bronder + +[ Upstream commit aa6908ca3bd1e713fd6cd8d7193a008f060bf7d9 ] + +In Tables 8-12 and 8-22 in the X710/XXV710/XL710 datasheet, the QLEN +description states that the maximum size of the descriptor queue is 8k +minus 32, or 8160. + +Signed-off-by: Justin Bronder +Reviewed-by: Jacob Keller +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20231113231047.548659-2-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: 55d225670def ("i40e: add validation for ring_len param") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 25 +++++++++++++++++++------ + 2 files changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -23,6 +23,7 @@ + #define I40E_MAX_VEB 16 + + #define I40E_MAX_NUM_DESCRIPTORS 4096 ++#define I40E_MAX_NUM_DESCRIPTORS_XL710 8160 + #define I40E_MAX_CSR_SPACE (4 * 1024 * 1024 - 64 * 1024) + #define I40E_DEFAULT_NUM_DESCRIPTORS 512 + #define I40E_REQ_DESCRIPTOR_MULTIPLE 32 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -2015,6 +2015,18 @@ static void i40e_get_drvinfo(struct net_ + drvinfo->n_priv_flags += I40E_GL_PRIV_FLAGS_STR_LEN; + } + ++static u32 i40e_get_max_num_descriptors(struct i40e_pf *pf) ++{ ++ struct i40e_hw *hw = &pf->hw; ++ ++ switch (hw->mac.type) { ++ case I40E_MAC_XL710: ++ return I40E_MAX_NUM_DESCRIPTORS_XL710; ++ default: ++ return I40E_MAX_NUM_DESCRIPTORS; ++ } ++} ++ + static void i40e_get_ringparam(struct net_device *netdev, + struct ethtool_ringparam *ring, + struct kernel_ethtool_ringparam *kernel_ring, +@@ -2024,8 +2036,8 @@ static void i40e_get_ringparam(struct ne + struct i40e_pf *pf = np->vsi->back; + struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi]; + +- ring->rx_max_pending = I40E_MAX_NUM_DESCRIPTORS; +- ring->tx_max_pending = I40E_MAX_NUM_DESCRIPTORS; ++ ring->rx_max_pending = i40e_get_max_num_descriptors(pf); ++ ring->tx_max_pending = i40e_get_max_num_descriptors(pf); + ring->rx_mini_max_pending = 0; + ring->rx_jumbo_max_pending = 0; + ring->rx_pending = vsi->rx_rings[0]->count; +@@ -2050,12 +2062,12 @@ static int i40e_set_ringparam(struct net + struct kernel_ethtool_ringparam *kernel_ring, + struct netlink_ext_ack *extack) + { ++ u32 new_rx_count, new_tx_count, max_num_descriptors; + struct i40e_ring *tx_rings = NULL, *rx_rings = NULL; + struct i40e_netdev_priv *np = netdev_priv(netdev); + struct i40e_hw *hw = &np->vsi->back->hw; + struct i40e_vsi *vsi = np->vsi; + struct i40e_pf *pf = vsi->back; +- u32 new_rx_count, new_tx_count; + u16 tx_alloc_queue_pairs; + int timeout = 50; + int i, err = 0; +@@ -2063,14 +2075,15 @@ static int i40e_set_ringparam(struct net + if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending)) + return -EINVAL; + +- if (ring->tx_pending > I40E_MAX_NUM_DESCRIPTORS || ++ max_num_descriptors = i40e_get_max_num_descriptors(pf); ++ if (ring->tx_pending > max_num_descriptors || + ring->tx_pending < I40E_MIN_NUM_DESCRIPTORS || +- ring->rx_pending > I40E_MAX_NUM_DESCRIPTORS || ++ ring->rx_pending > max_num_descriptors || + ring->rx_pending < I40E_MIN_NUM_DESCRIPTORS) { + netdev_info(netdev, + "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n", + ring->tx_pending, ring->rx_pending, +- I40E_MIN_NUM_DESCRIPTORS, I40E_MAX_NUM_DESCRIPTORS); ++ I40E_MIN_NUM_DESCRIPTORS, max_num_descriptors); + return -EINVAL; + } + diff --git a/queue-6.6/loop-avoid-updating-block-size-under-exclusive-owner.patch b/queue-6.6/loop-avoid-updating-block-size-under-exclusive-owner.patch new file mode 100644 index 0000000000..cc6450bc99 --- /dev/null +++ b/queue-6.6/loop-avoid-updating-block-size-under-exclusive-owner.patch @@ -0,0 +1,112 @@ +From 7e49538288e523427beedd26993d446afef1a6fb Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Fri, 11 Jul 2025 18:32:03 +0200 +Subject: loop: Avoid updating block size under exclusive owner + +From: Jan Kara + +commit 7e49538288e523427beedd26993d446afef1a6fb upstream. + +Syzbot came up with a reproducer where a loop device block size is +changed underneath a mounted filesystem. This causes a mismatch between +the block device block size and the block size stored in the superblock +causing confusion in various places such as fs/buffer.c. The particular +issue triggered by syzbot was a warning in __getblk_slow() due to +requested buffer size not matching block device block size. + +Fix the problem by getting exclusive hold of the loop device to change +its block size. This fails if somebody (such as filesystem) has already +an exclusive ownership of the block device and thus prevents modifying +the loop device under some exclusive owner which doesn't expect it. + +Reported-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Tested-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20250711163202.19623-2-jack@suse.cz +Signed-off-by: Jens Axboe +Signed-off-by: Zheng Qixing +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/loop.c | 40 +++++++++++++++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 9 deletions(-) + +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1472,19 +1472,36 @@ static int loop_set_dio(struct loop_devi + return error; + } + +-static int loop_set_block_size(struct loop_device *lo, unsigned long arg) ++static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode, ++ struct block_device *bdev, unsigned long arg) + { + int err = 0; + +- if (lo->lo_state != Lo_bound) +- return -ENXIO; ++ /* ++ * If we don't hold exclusive handle for the device, upgrade to it ++ * here to avoid changing device under exclusive owner. ++ */ ++ if (!(mode & BLK_OPEN_EXCL)) { ++ err = bd_prepare_to_claim(bdev, loop_set_block_size, NULL); ++ if (err) ++ return err; ++ } ++ ++ err = mutex_lock_killable(&lo->lo_mutex); ++ if (err) ++ goto abort_claim; ++ ++ if (lo->lo_state != Lo_bound) { ++ err = -ENXIO; ++ goto unlock; ++ } + + err = blk_validate_block_size(arg); + if (err) +- return err; ++ goto unlock; + + if (lo->lo_queue->limits.logical_block_size == arg) +- return 0; ++ goto unlock; + + sync_blockdev(lo->lo_device); + invalidate_bdev(lo->lo_device); +@@ -1496,6 +1513,11 @@ static int loop_set_block_size(struct lo + loop_update_dio(lo); + blk_mq_unfreeze_queue(lo->lo_queue); + ++unlock: ++ mutex_unlock(&lo->lo_mutex); ++abort_claim: ++ if (!(mode & BLK_OPEN_EXCL)) ++ bd_abort_claiming(bdev, loop_set_block_size); + return err; + } + +@@ -1514,9 +1536,6 @@ static int lo_simple_ioctl(struct loop_d + case LOOP_SET_DIRECT_IO: + err = loop_set_dio(lo, arg); + break; +- case LOOP_SET_BLOCK_SIZE: +- err = loop_set_block_size(lo, arg); +- break; + default: + err = -EINVAL; + } +@@ -1571,9 +1590,12 @@ static int lo_ioctl(struct block_device + break; + case LOOP_GET_STATUS64: + return loop_get_status64(lo, argp); ++ case LOOP_SET_BLOCK_SIZE: ++ if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ return loop_set_block_size(lo, mode, bdev, arg); + case LOOP_SET_CAPACITY: + case LOOP_SET_DIRECT_IO: +- case LOOP_SET_BLOCK_SIZE: + if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) + return -EPERM; + fallthrough; diff --git a/queue-6.6/series b/queue-6.6/series index d4df43fa5c..321708325a 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -72,3 +72,8 @@ s390-cpum_cf-fix-uninitialized-warning-after-backport-of-ce971233242b.patch arm-bcm-select-arm_gic_v3-for-arch_brcmstb.patch mm-migrate_device-use-more-folio-in-migrate_device_finalize.patch mm-migrate_device-don-t-add-folio-to-be-freed-to-lru-in-migrate_device_finalize.patch +loop-avoid-updating-block-size-under-exclusive-owner.patch +gpiolib-extend-software-node-support-to-support-secondary-software-nodes.patch +drm-ast-use-msleep-instead-of-mdelay-for-edid-read.patch +i40e-increase-max-descriptors-for-xl710.patch +i40e-add-validation-for-ring_len-param.patch