From: Sasha Levin Date: Tue, 28 Mar 2023 10:07:00 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v5.15.105~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b146c645e9057b92f2bd00f5e8cb68a1573fd198;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/ca8210-fix-mac_len-negative-array-access.patch b/queue-5.10/ca8210-fix-mac_len-negative-array-access.patch new file mode 100644 index 00000000000..b93176759aa --- /dev/null +++ b/queue-5.10/ca8210-fix-mac_len-negative-array-access.patch @@ -0,0 +1,37 @@ +From cad3325b77fa3e77a7f023f3ff766dff72b128a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 23:25:04 -0500 +Subject: ca8210: fix mac_len negative array access + +From: Alexander Aring + +[ Upstream commit 6c993779ea1d0cccdb3a5d7d45446dd229e610a3 ] + +This patch fixes a buffer overflow access of skb->data if +ieee802154_hdr_peek_addrs() fails. + +Reported-by: lianhui tang +Signed-off-by: Alexander Aring +Link: https://lore.kernel.org/r/20230217042504.3303396-1-aahringo@redhat.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/ca8210.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index 95ef3b6f98dd3..5beb447529f9e 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1956,6 +1956,8 @@ static int ca8210_skb_tx( + * packet + */ + mac_len = ieee802154_hdr_peek_addrs(skb, &header); ++ if (mac_len < 0) ++ return mac_len; + + secspec.security_level = header.sec.level; + secspec.key_id_mode = header.sec.key_id_mode; +-- +2.39.2 + diff --git a/queue-5.10/hid-cp2112-fix-driver-not-registering-gpio-irq-chip-.patch b/queue-5.10/hid-cp2112-fix-driver-not-registering-gpio-irq-chip-.patch new file mode 100644 index 00000000000..f24986ab230 --- /dev/null +++ b/queue-5.10/hid-cp2112-fix-driver-not-registering-gpio-irq-chip-.patch @@ -0,0 +1,37 @@ +From 152418f1400f4f3af4b91d3aa1b4da249cf2f207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 11:00:44 -0600 +Subject: HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded + +From: Danny Kaehn + +[ Upstream commit 37f5b858a66543b2b67c0288280af623985abc29 ] + +The CP2112 generates interrupts from a polling routine on a thread, +and can only support threaded interrupts. This patch configures the +gpiochip irq chip with this flag, disallowing consumers to request +a hard IRQ from this driver, which resulted in a segfault previously. + +Signed-off-by: Danny Kaehn +Link: https://lore.kernel.org/r/20230210170044.11835-1-kaehndan@gmail.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-cp2112.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c +index 172f20e88c6c9..d902fe43cb818 100644 +--- a/drivers/hid/hid-cp2112.c ++++ b/drivers/hid/hid-cp2112.c +@@ -1352,6 +1352,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id) + girq->parents = NULL; + girq->default_type = IRQ_TYPE_NONE; + girq->handler = handle_simple_irq; ++ girq->threaded = true; + + ret = gpiochip_add_data(&dev->gc, dev); + if (ret < 0) { +-- +2.39.2 + diff --git a/queue-5.10/m68k-only-force-030-bus-error-if-pc-not-in-exception.patch b/queue-5.10/m68k-only-force-030-bus-error-if-pc-not-in-exception.patch new file mode 100644 index 00000000000..0c2b6d7b8e9 --- /dev/null +++ b/queue-5.10/m68k-only-force-030-bus-error-if-pc-not-in-exception.patch @@ -0,0 +1,75 @@ +From 62f4cd52e97c96ccfa77c9a6659bd94de67d0c47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 15:11:07 +1300 +Subject: m68k: Only force 030 bus error if PC not in exception table + +From: Michael Schmitz + +[ Upstream commit e36a82bebbf7da814530d5a179bef9df5934b717 ] + +__get_kernel_nofault() does copy data in supervisor mode when +forcing a task backtrace log through /proc/sysrq_trigger. +This is expected cause a bus error exception on e.g. NULL +pointer dereferencing when logging a kernel task has no +workqueue associated. This bus error ought to be ignored. + +Our 030 bus error handler is ill equipped to deal with this: + +Whenever ssw indicates a kernel mode access on a data fault, +we don't even attempt to handle the fault and instead always +send a SEGV signal (or panic). As a result, the check +for exception handling at the fault PC (buried in +send_sig_fault() which gets called from do_page_fault() +eventually) is never used. + +In contrast, both 040 and 060 access error handlers do not +care whether a fault happened on supervisor mode access, +and will call do_page_fault() on those, ultimately honoring +the exception table. + +Add a check in bus_error030 to call do_page_fault() in case +we do have an entry for the fault PC in our exception table. + +I had attempted a fix for this earlier in 2019 that did rely +on testing pagefault_disabled() (see link below) to achieve +the same thing, but this patch should be more generic. + +Tested on 030 Atari Falcon. + +Reported-by: Eero Tamminen +Link: https://lore.kernel.org/r/alpine.LNX.2.21.1904091023540.25@nippy.intranet +Link: https://lore.kernel.org/r/63130691-1984-c423-c1f2-73bfd8d3dcd3@gmail.com +Signed-off-by: Michael Schmitz +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230301021107.26307-1-schmitzmic@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/kernel/traps.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c +index b2a31afb998c2..7d42c84649ac2 100644 +--- a/arch/m68k/kernel/traps.c ++++ b/arch/m68k/kernel/traps.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -549,7 +550,8 @@ static inline void bus_error030 (struct frame *fp) + errorcode |= 2; + + if (mmusr & (MMU_I | MMU_WP)) { +- if (ssw & 4) { ++ /* We might have an exception table for this PC */ ++ if (ssw & 4 && !search_exception_tables(fp->ptregs.pc)) { + pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n", + ssw & RW ? "read" : "write", + fp->un.fmtb.daddr, +-- +2.39.2 + diff --git a/queue-5.10/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch b/queue-5.10/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch new file mode 100644 index 00000000000..f8231bac373 --- /dev/null +++ b/queue-5.10/net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch @@ -0,0 +1,39 @@ +From 1016caba0278ecd89d4b5af69e87a67662aceb3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 12:59:33 +0100 +Subject: net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 + +From: Enrico Sau + +[ Upstream commit 418383e6ed6b4624a54ec05c535f13d184fbf33b ] + +Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit FE990 +0x1081 composition in order to avoid bind error. + +Signed-off-by: Enrico Sau +Link: https://lore.kernel.org/r/20230306115933.198259-1-enrico.sau@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/cdc_mbim.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c +index 414341c9cf5ae..6ad1fb00a35cd 100644 +--- a/drivers/net/usb/cdc_mbim.c ++++ b/drivers/net/usb/cdc_mbim.c +@@ -663,6 +663,11 @@ static const struct usb_device_id mbim_devs[] = { + .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, + }, + ++ /* Telit FE990 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1081, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, ++ }, ++ + /* default entry */ + { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&cdc_mbim_info_zlp, +-- +2.39.2 + diff --git a/queue-5.10/net-usb-qmi_wwan-add-telit-0x1080-composition.patch b/queue-5.10/net-usb-qmi_wwan-add-telit-0x1080-composition.patch new file mode 100644 index 00000000000..847b3589bcc --- /dev/null +++ b/queue-5.10/net-usb-qmi_wwan-add-telit-0x1080-composition.patch @@ -0,0 +1,36 @@ +From e95d09b60ac110274072b54dcee724a8ae69c289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 13:05:28 +0100 +Subject: net: usb: qmi_wwan: add Telit 0x1080 composition + +From: Enrico Sau + +[ Upstream commit 382e363d5bed0cec5807b35761d14e55955eee63 ] + +Add the following Telit FE990 composition: + +0x1080: tty, adb, rmnet, tty, tty, tty, tty + +Signed-off-by: Enrico Sau +Link: https://lore.kernel.org/r/20230306120528.198842-1-enrico.sau@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index bce151e3706a0..070910567c44e 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1297,6 +1297,7 @@ static const struct usb_device_id products[] = { + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +-- +2.39.2 + diff --git a/queue-5.10/riscv-bump-command_line_size-value-to-1024.patch b/queue-5.10/riscv-bump-command_line_size-value-to-1024.patch new file mode 100644 index 00000000000..cbb4052f62e --- /dev/null +++ b/queue-5.10/riscv-bump-command_line_size-value-to-1024.patch @@ -0,0 +1,46 @@ +From 8b846d5dde672729e973fc0049d3ccad6cd46d9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 15:34:20 -0400 +Subject: riscv: Bump COMMAND_LINE_SIZE value to 1024 + +From: Alexandre Ghiti + +[ Upstream commit 61fc1ee8be26bc192d691932b0a67eabee45d12f ] + +Increase COMMAND_LINE_SIZE as the current default value is too low +for syzbot kernel command line. + +There has been considerable discussion on this patch that has led to a +larger patch set removing COMMAND_LINE_SIZE from the uapi headers on all +ports. That's not quite done yet, but it's gotten far enough we're +confident this is not a uABI change so this is safe. + +Reported-by: Dmitry Vyukov +Signed-off-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20210316193420.904-1-alex@ghiti.fr +[Palmer: it's not uabi] +Link: https://lore.kernel.org/linux-riscv/874b8076-b0d1-4aaa-bcd8-05d523060152@app.fastmail.com/#t +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/uapi/asm/setup.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + create mode 100644 arch/riscv/include/uapi/asm/setup.h + +diff --git a/arch/riscv/include/uapi/asm/setup.h b/arch/riscv/include/uapi/asm/setup.h +new file mode 100644 +index 0000000000000..66b13a5228808 +--- /dev/null ++++ b/arch/riscv/include/uapi/asm/setup.h +@@ -0,0 +1,8 @@ ++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */ ++ ++#ifndef _UAPI_ASM_RISCV_SETUP_H ++#define _UAPI_ASM_RISCV_SETUP_H ++ ++#define COMMAND_LINE_SIZE 1024 ++ ++#endif /* _UAPI_ASM_RISCV_SETUP_H */ +-- +2.39.2 + diff --git a/queue-5.10/scsi-hisi_sas-check-devm_add_action-return-value.patch b/queue-5.10/scsi-hisi_sas-check-devm_add_action-return-value.patch new file mode 100644 index 00000000000..c4da3866677 --- /dev/null +++ b/queue-5.10/scsi-hisi_sas-check-devm_add_action-return-value.patch @@ -0,0 +1,38 @@ +From 98df366012b36c7e7b6b15cebd19890ffe28ad61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 11:10:30 +0800 +Subject: scsi: hisi_sas: Check devm_add_action() return value + +From: Kang Chen + +[ Upstream commit 06d1a90de60208054cca15ef200138cfdbb642a9 ] + +In case devm_add_action() fails, check it in the caller of +interrupt_preinit_v3_hw(). + +Link: https://lore.kernel.org/r/20230227031030.893324-1-void0red@gmail.com +Signed-off-by: Kang Chen +Acked-by: Xiang Chen +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index cd41dc061d874..65971bd80186b 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2402,8 +2402,7 @@ static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba) + hisi_hba->cq_nvecs = vectors - BASE_VECTORS_V3_HW; + shost->nr_hw_queues = hisi_hba->cq_nvecs; + +- devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev); +- return 0; ++ return devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev); + } + + static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba) +-- +2.39.2 + diff --git a/queue-5.10/scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch b/queue-5.10/scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch new file mode 100644 index 00000000000..4b504871007 --- /dev/null +++ b/queue-5.10/scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch @@ -0,0 +1,61 @@ +From 7add1e025bae196896c528039774bea80db6e3ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 18:19:14 +0100 +Subject: scsi: lpfc: Avoid usage of list iterator variable after loop + +From: Jakob Koschel + +[ Upstream commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e ] + +If the &epd_pool->list is empty when executing +lpfc_get_io_buf_from_expedite_pool() the function would return an invalid +pointer. Even in the case if the list is guaranteed to be populated, the +iterator variable should not be used after the loop to be more robust for +future changes. + +Linus proposed to avoid any use of the list iterator variable after the +loop, in the attempt to move the list iterator variable declaration into +the macro to avoid any potential misuse after the loop [1]. + +Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] +Signed-off-by: Jakob Koschel +Link: https://lore.kernel.org/r/20230301-scsi-lpfc-avoid-list-iterator-after-loop-v1-1-325578ae7561@gmail.com +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 755d68b981602..923ceaba0bf30 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -20816,20 +20816,20 @@ lpfc_get_io_buf_from_private_pool(struct lpfc_hba *phba, + static struct lpfc_io_buf * + lpfc_get_io_buf_from_expedite_pool(struct lpfc_hba *phba) + { +- struct lpfc_io_buf *lpfc_ncmd; ++ struct lpfc_io_buf *lpfc_ncmd = NULL, *iter; + struct lpfc_io_buf *lpfc_ncmd_next; + unsigned long iflag; + struct lpfc_epd_pool *epd_pool; + + epd_pool = &phba->epd_pool; +- lpfc_ncmd = NULL; + + spin_lock_irqsave(&epd_pool->lock, iflag); + if (epd_pool->count > 0) { +- list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next, ++ list_for_each_entry_safe(iter, lpfc_ncmd_next, + &epd_pool->list, list) { +- list_del(&lpfc_ncmd->list); ++ list_del(&iter->list); + epd_pool->count--; ++ lpfc_ncmd = iter; + break; + } + } +-- +2.39.2 + diff --git a/queue-5.10/scsi-storvsc-handle-blocksize-change-in-hyper-v-vhd-.patch b/queue-5.10/scsi-storvsc-handle-blocksize-change-in-hyper-v-vhd-.patch new file mode 100644 index 00000000000..ba3065da74d --- /dev/null +++ b/queue-5.10/scsi-storvsc-handle-blocksize-change-in-hyper-v-vhd-.patch @@ -0,0 +1,89 @@ +From 02f76f0cc725382e5f8e7461722d1770fa9193d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 08:48:34 -0800 +Subject: scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file + +From: Michael Kelley + +[ Upstream commit 11d9874c4204a785f43d899a1ab12f9dc8d9de3e ] + +Hyper-V uses a VHD or VHDX file on the host as the underlying storage for a +virtual disk. The VHD/VHDX file format is a sparse format where real disk +space on the host is assigned in chunks that the VHD/VHDX file format calls +the BlockSize. This BlockSize is not to be confused with the 512-byte (or +4096-byte) sector size of the underlying storage device. The default block +size for a new VHD/VHDX file is 32 Mbytes. When a guest VM touches any +disk space within a 32 Mbyte chunk of the VHD/VHDX file, Hyper-V allocates +32 Mbytes of real disk space for that section of the VHD/VHDX. Similarly, +if a discard operation is done that covers an entire 32 Mbyte chunk, +Hyper-V will free the real disk space for that portion of the VHD/VHDX. +This BlockSize is surfaced in Linux as the "discard_granularity" in +/sys/block/sd/queue, which makes sense. + +Hyper-V also has differencing disks that can overlay a VHD/VHDX file to +capture changes to the VHD/VHDX while preserving the original VHD/VHDX. +One example of this differencing functionality is for VM snapshots. When a +snapshot is created, a differencing disk is created. If the snapshot is +rolled back, Hyper-V can just delete the differencing disk, and the VM will +see the original disk contents at the time the snapshot was taken. +Differencing disks are used in other scenarios as well. + +The BlockSize for a differencing disk defaults to 2 Mbytes, not 32 Mbytes. +The smaller default is used because changes to differencing disks are +typically scattered all over, and Hyper-V doesn't want to allocate 32 +Mbytes of real disk space for a stray write here or there. The smaller +BlockSize provides more efficient use of real disk space. + +When a differencing disk is added to a VHD/VHDX, Hyper-V reports +UNIT_ATTENTION with a sense code indicating "Operating parameters have +changed", because the value of discard_granularity should be changed to 2 +Mbytes. When the differencing disk is removed, discard_granularity should +be changed back to 32 Mbytes. However, current code simply reports a +message from scsi_report_sense() and the value of +/sys/block/sd/queue/discard_granularity is not updated. The message +isn't very actionable by a sysadmin. + +Fix this by having the storvsc driver check for the sense code indicating +that the underly VHD/VHDX block size has changed, and do a rescan of the +device to pick up the new discard_granularity. With this change the entire +transition to/from differencing disks is handled automatically and +transparently, with no confusing messages being output. + +Link: https://lore.kernel.org/r/1677516514-86060-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Michael Kelley +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/storvsc_drv.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 3fa8a0c94bdc1..e38aebcabb26f 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1013,6 +1013,22 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + goto do_work; + } + ++ /* ++ * Check for "Operating parameters have changed" ++ * due to Hyper-V changing the VHD/VHDX BlockSize ++ * when adding/removing a differencing disk. This ++ * causes discard_granularity to change, so do a ++ * rescan to pick up the new granularity. We don't ++ * want scsi_report_sense() to output a message ++ * that a sysadmin wouldn't know what to do with. ++ */ ++ if ((asc == 0x3f) && (ascq != 0x03) && ++ (ascq != 0x0e)) { ++ process_err_fn = storvsc_device_scan; ++ set_host_byte(scmnd, DID_REQUEUE); ++ goto do_work; ++ } ++ + /* + * Otherwise, let upper layer deal with the + * error when sense message is present +-- +2.39.2 + diff --git a/queue-5.10/scsi-target-iscsi-fix-an-error-message-in-iscsi_chec.patch b/queue-5.10/scsi-target-iscsi-fix-an-error-message-in-iscsi_chec.patch new file mode 100644 index 00000000000..a11b10a7a71 --- /dev/null +++ b/queue-5.10/scsi-target-iscsi-fix-an-error-message-in-iscsi_chec.patch @@ -0,0 +1,55 @@ +From da6e8fa01422af39b42f1aa0d0150fe63f2cfaae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 15:15:56 +0100 +Subject: scsi: target: iscsi: Fix an error message in iscsi_check_key() + +From: Maurizio Lombardi + +[ Upstream commit 6cc55c969b7ce8d85e09a636693d4126c3676c11 ] + +The first half of the error message is printed by pr_err(), the second half +is printed by pr_debug(). The user will therefore see only the first part +of the message and will miss some useful information. + +Link: https://lore.kernel.org/r/20230214141556.762047-1-mlombard@redhat.com +Signed-off-by: Maurizio Lombardi +Reviewed-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target_parameters.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c +index 7a461fbb15668..31cd3c02e5176 100644 +--- a/drivers/target/iscsi/iscsi_target_parameters.c ++++ b/drivers/target/iscsi/iscsi_target_parameters.c +@@ -1262,18 +1262,20 @@ static struct iscsi_param *iscsi_check_key( + return param; + + if (!(param->phase & phase)) { +- pr_err("Key \"%s\" may not be negotiated during ", +- param->name); ++ char *phase_name; ++ + switch (phase) { + case PHASE_SECURITY: +- pr_debug("Security phase.\n"); ++ phase_name = "Security"; + break; + case PHASE_OPERATIONAL: +- pr_debug("Operational phase.\n"); ++ phase_name = "Operational"; + break; + default: +- pr_debug("Unknown phase.\n"); ++ phase_name = "Unknown"; + } ++ pr_err("Key \"%s\" may not be negotiated during %s phase.\n", ++ param->name, phase_name); + return NULL; + } + +-- +2.39.2 + diff --git a/queue-5.10/scsi-ufs-core-add-soft-dependency-on-governor_simple.patch b/queue-5.10/scsi-ufs-core-add-soft-dependency-on-governor_simple.patch new file mode 100644 index 00000000000..9696003f37c --- /dev/null +++ b/queue-5.10/scsi-ufs-core-add-soft-dependency-on-governor_simple.patch @@ -0,0 +1,36 @@ +From f3c2f3311fea26a78164058190e3a618eb416310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 09:07:40 -0500 +Subject: scsi: ufs: core: Add soft dependency on governor_simpleondemand + +From: Adrien Thierry + +[ Upstream commit 2ebe16155dc8bd4e602cad5b5f65458d2eaa1a75 ] + +The ufshcd driver uses simpleondemand governor for devfreq. Add it to the +list of ufshcd softdeps to allow userspace initramfs tools like dracut to +automatically pull the governor module into the initramfs together with UFS +drivers. + +Link: https://lore.kernel.org/r/20230220140740.14379-1-athierry@redhat.com +Signed-off-by: Adrien Thierry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index ea6ceab1a1b25..f3389e9131794 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -9311,5 +9311,6 @@ EXPORT_SYMBOL_GPL(ufshcd_init); + MODULE_AUTHOR("Santosh Yaragnavi "); + MODULE_AUTHOR("Vinayak Holikatti "); + MODULE_DESCRIPTION("Generic UFS host controller driver Core"); ++MODULE_SOFTDEP("pre: governor_simpleondemand"); + MODULE_LICENSE("GPL"); + MODULE_VERSION(UFSHCD_DRIVER_VERSION); +-- +2.39.2 + diff --git a/queue-5.10/selftests-bpf-check-that-modifier-resolves-after-poi.patch b/queue-5.10/selftests-bpf-check-that-modifier-resolves-after-poi.patch new file mode 100644 index 00000000000..cc2fd30266a --- /dev/null +++ b/queue-5.10/selftests-bpf-check-that-modifier-resolves-after-poi.patch @@ -0,0 +1,63 @@ +From 2730c6d3155d7fde875830c6606f02416f8fdd64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:21:38 +0000 +Subject: selftests/bpf: check that modifier resolves after pointer + +From: Lorenz Bauer + +[ Upstream commit dfdd608c3b365f0fd49d7e13911ebcde06b9865b ] + +Add a regression test that ensures that a VAR pointing at a +modifier which follows a PTR (or STRUCT or ARRAY) is resolved +correctly by the datasec validator. + +Signed-off-by: Lorenz Bauer +Link: https://lore.kernel.org/r/20230306112138.155352-3-lmb@isovalent.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/btf.c | 28 ++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c +index 48b01150e703f..28d22265b8253 100644 +--- a/tools/testing/selftests/bpf/prog_tests/btf.c ++++ b/tools/testing/selftests/bpf/prog_tests/btf.c +@@ -882,6 +882,34 @@ static struct btf_raw_test raw_tests[] = { + .btf_load_err = true, + .err_str = "Invalid elem", + }, ++{ ++ .descr = "var after datasec, ptr followed by modifier", ++ .raw_types = { ++ /* .bss section */ /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 2), ++ sizeof(void*)+4), ++ BTF_VAR_SECINFO_ENC(4, 0, sizeof(void*)), ++ BTF_VAR_SECINFO_ENC(6, sizeof(void*), 4), ++ /* int */ /* [2] */ ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), ++ /* int* */ /* [3] */ ++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2), ++ BTF_VAR_ENC(NAME_TBD, 3, 0), /* [4] */ ++ /* const int */ /* [5] */ ++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 2), ++ BTF_VAR_ENC(NAME_TBD, 5, 0), /* [6] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0a\0b\0c\0", ++ .str_sec_size = sizeof("\0a\0b\0c\0"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = ".bss", ++ .key_size = sizeof(int), ++ .value_size = sizeof(void*)+4, ++ .key_type_id = 0, ++ .value_type_id = 1, ++ .max_entries = 1, ++}, + /* Test member exceeds the size of struct. + * + * struct A { +-- +2.39.2 + diff --git a/queue-5.10/series b/queue-5.10/series index 1d45948eb34..5f2fad5a650 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -61,3 +61,16 @@ scsi-qla2xxx-perform-lockless-command-completion-in-abort-path.patch uas-add-us_fl_no_report_opcodes-for-jmicron-jms583gen-2.patch thunderbolt-use-scale-field-when-allocating-usb3-bandwidth.patch thunderbolt-use-const-qualifier-for-ring_interrupt_index.patch +riscv-bump-command_line_size-value-to-1024.patch +hid-cp2112-fix-driver-not-registering-gpio-irq-chip-.patch +ca8210-fix-mac_len-negative-array-access.patch +m68k-only-force-030-bus-error-if-pc-not-in-exception.patch +selftests-bpf-check-that-modifier-resolves-after-poi.patch +scsi-target-iscsi-fix-an-error-message-in-iscsi_chec.patch +scsi-hisi_sas-check-devm_add_action-return-value.patch +scsi-ufs-core-add-soft-dependency-on-governor_simple.patch +scsi-lpfc-avoid-usage-of-list-iterator-variable-afte.patch +scsi-storvsc-handle-blocksize-change-in-hyper-v-vhd-.patch +net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch +net-usb-qmi_wwan-add-telit-0x1080-composition.patch +sh-sanitize-the-flags-on-sigreturn.patch diff --git a/queue-5.10/sh-sanitize-the-flags-on-sigreturn.patch b/queue-5.10/sh-sanitize-the-flags-on-sigreturn.patch new file mode 100644 index 00000000000..d26518b53dc --- /dev/null +++ b/queue-5.10/sh-sanitize-the-flags-on-sigreturn.patch @@ -0,0 +1,58 @@ +From b71b2c61fcae27b65c913e767a7cbbfe14fdce1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 01:20:30 +0000 +Subject: sh: sanitize the flags on sigreturn + +From: Al Viro + +[ Upstream commit 573b22ccb7ce9ab7f0539a2e11a9d3609a8783f5 ] + +We fetch %SR value from sigframe; it might have been modified by signal +handler, so we can't trust it with any bits that are not modifiable in +user mode. + +Signed-off-by: Al Viro +Cc: Rich Felker +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/sh/include/asm/processor_32.h | 1 + + arch/sh/kernel/signal_32.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/arch/sh/include/asm/processor_32.h b/arch/sh/include/asm/processor_32.h +index aa92cc933889d..6c7966e627758 100644 +--- a/arch/sh/include/asm/processor_32.h ++++ b/arch/sh/include/asm/processor_32.h +@@ -50,6 +50,7 @@ + #define SR_FD 0x00008000 + #define SR_MD 0x40000000 + ++#define SR_USER_MASK 0x00000303 // M, Q, S, T bits + /* + * DSP structure and data + */ +diff --git a/arch/sh/kernel/signal_32.c b/arch/sh/kernel/signal_32.c +index dd3092911efad..dc13702003f0f 100644 +--- a/arch/sh/kernel/signal_32.c ++++ b/arch/sh/kernel/signal_32.c +@@ -115,6 +115,7 @@ static int + restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p) + { + unsigned int err = 0; ++ unsigned int sr = regs->sr & ~SR_USER_MASK; + + #define COPY(x) err |= __get_user(regs->x, &sc->sc_##x) + COPY(regs[1]); +@@ -130,6 +131,8 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p + COPY(sr); COPY(pc); + #undef COPY + ++ regs->sr = (regs->sr & SR_USER_MASK) | sr; ++ + #ifdef CONFIG_SH_FPU + if (boot_cpu_data.flags & CPU_HAS_FPU) { + int owned_fp; +-- +2.39.2 +