From: Greg Kroah-Hartman Date: Mon, 28 Oct 2024 00:47:59 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v5.15.170~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bf011d567dd1bea6dc3d4fc05b7338423669ca85;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch net-phy-dp83822-fix-reset-pin-definitions.patch --- diff --git a/queue-6.6/asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch b/queue-6.6/asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch new file mode 100644 index 00000000000..5ab1effc82a --- /dev/null +++ b/queue-6.6/asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch @@ -0,0 +1,35 @@ +From 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 Mon Sep 17 00:00:00 2001 +From: Zichen Xie +Date: Sun, 6 Oct 2024 15:57:37 -0500 +Subject: ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() + +From: Zichen Xie + +commit 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 upstream. + +A devm_kzalloc() in asoc_qcom_lpass_cpu_platform_probe() could +possibly return NULL pointer. NULL Pointer Dereference may be +triggerred without addtional check. +Add a NULL check for the returned pointer. + +Fixes: b5022a36d28f ("ASoC: qcom: lpass: Use regmap_field for i2sctl and dmactl registers") +Cc: stable@vger.kernel.org +Signed-off-by: Zichen Xie +Link: https://patch.msgid.link/20241006205737.8829-1-zichenxie0106@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/qcom/lpass-cpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -1246,6 +1246,8 @@ int asoc_qcom_lpass_cpu_platform_probe(s + /* Allocation for i2sctl regmap fields */ + drvdata->i2sctl = devm_kzalloc(&pdev->dev, sizeof(struct lpaif_i2sctl), + GFP_KERNEL); ++ if (!drvdata->i2sctl) ++ return -ENOMEM; + + /* Initialize bitfields for dai I2SCTL register */ + ret = lpass_cpu_init_i2sctl_bitfields(dev, drvdata->i2sctl, diff --git a/queue-6.6/ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch b/queue-6.6/ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch new file mode 100644 index 00000000000..6e01c210d13 --- /dev/null +++ b/queue-6.6/ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch @@ -0,0 +1,72 @@ +From 8e59a2a5459fd9840dbe2cbde85fe154b11e1727 Mon Sep 17 00:00:00 2001 +From: Niklas Cassel +Date: Wed, 23 Oct 2024 12:55:41 +0200 +Subject: ata: libata: Set DID_TIME_OUT for commands that actually timed out + +From: Niklas Cassel + +commit 8e59a2a5459fd9840dbe2cbde85fe154b11e1727 upstream. + +When ata_qc_complete() schedules a command for EH using +ata_qc_schedule_eh(), blk_abort_request() will be called, which leads to +req->q->mq_ops->timeout() / scsi_timeout() being called. + +scsi_timeout(), if the LLDD has no abort handler (libata has no abort +handler), will set host byte to DID_TIME_OUT, and then call +scsi_eh_scmd_add() to add the command to EH. + +Thus, when commands first enter libata's EH strategy_handler, all the +commands that have been added to EH will have DID_TIME_OUT set. + +Commit e5dd410acb34 ("ata: libata: Clear DID_TIME_OUT for ATA PT commands +with sense data") clears this bogus DID_TIME_OUT flag for all commands +that reached libata's EH strategy_handler. + +libata has its own flag (AC_ERR_TIMEOUT), that it sets for commands that +have not received a completion at the time of entering EH. + +ata_eh_worth_retry() has no special handling for AC_ERR_TIMEOUT, so by +default timed out commands will get flag ATA_QCFLAG_RETRY set, and will be +retried after the port has been reset (ata_eh_link_autopsy() always +triggers a port reset if any command has AC_ERR_TIMEOUT set). + +For a command that has ATA_QCFLAG_RETRY set, while also having an error +flag set (e.g. AC_ERR_TIMEOUT), ata_eh_finish() will not increment +scmd->allowed, so the command will at most be retried scmd->allowed number +of times (which by default is set to 3). + +However, scsi_eh_flush_done_q() will only retry commands for which +scsi_noretry_cmd() returns false. + +For a command that has DID_TIME_OUT set, while also having either the +FAILFAST flag set, or the command being a passthrough command, +scsi_noretry_cmd() will return true. Thus, such a command will never be +retried. + +Thus, make sure that libata sets SCSI's DID_TIME_OUT flag for commands that +actually timed out (libata's AC_ERR_TIMEOUT flag), such that timed out +commands will once again not be retried if they are also a FAILFAST or +passthrough command. + +Cc: stable@vger.kernel.org +Fixes: e5dd410acb34 ("ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense data") +Reported-by: Lai, Yi +Closes: https://lore.kernel.org/linux-ide/ZxYz871I3Blsi30F@ly-workstation/ +Reviewed-by: Damien Le Moal +Link: https://lore.kernel.org/r/20241023105540.1070012-2-cassel@kernel.org +Signed-off-by: Niklas Cassel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-eh.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -636,6 +636,7 @@ void ata_scsi_cmd_error_handler(struct S + /* the scmd has an associated qc */ + if (!(qc->flags & ATA_QCFLAG_EH)) { + /* which hasn't failed yet, timeout */ ++ set_host_byte(scmd, DID_TIME_OUT); + qc->err_mask |= AC_ERR_TIMEOUT; + qc->flags |= ATA_QCFLAG_EH; + nr_timedout++; diff --git a/queue-6.6/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch b/queue-6.6/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch new file mode 100644 index 00000000000..b6b39e47c25 --- /dev/null +++ b/queue-6.6/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch @@ -0,0 +1,54 @@ +From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001 +From: Xinyu Zhang +Date: Wed, 23 Oct 2024 15:15:19 -0600 +Subject: block: fix sanity checks in blk_rq_map_user_bvec + +From: Xinyu Zhang + +commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream. + +blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which +causes unnecessary failures in NVMe passthrough I/O, reproducible as +follows: + +- register a 2 page, page-aligned buffer against a ring +- use that buffer to do a 1 page io_uring NVMe passthrough read + +The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will +then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so +the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to +fail. This failure is unnecessary, as when the check succeeds, it means +we've checked the entire buffer that will be used by the request - i.e. +blk_rq_map_user_bvec should complete successfully. Therefore, terminate +the loop early and return successfully when the check bytes + bv->bv_len +> nr_iter succeeds. + +While we're at it, also remove the check that all segments in the bvec +are single-page. While this seems to be true for all users of the +function, it doesn't appear to be required anywhere downstream. + +CC: stable@vger.kernel.org +Signed-off-by: Xinyu Zhang +Co-developed-by: Uday Shankar +Signed-off-by: Uday Shankar +Fixes: 37987547932c ("block: extend functionality to map bvec iterator") +Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-map.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/block/blk-map.c ++++ b/block/blk-map.c +@@ -600,9 +600,7 @@ static int blk_rq_map_user_bvec(struct r + if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len) + goto put_bio; + if (bytes + bv->bv_len > nr_iter) +- goto put_bio; +- if (bv->bv_offset + bv->bv_len > PAGE_SIZE) +- goto put_bio; ++ break; + + nsegs++; + bytes += bv->bv_len; diff --git a/queue-6.6/net-phy-dp83822-fix-reset-pin-definitions.patch b/queue-6.6/net-phy-dp83822-fix-reset-pin-definitions.patch new file mode 100644 index 00000000000..99ea7edd584 --- /dev/null +++ b/queue-6.6/net-phy-dp83822-fix-reset-pin-definitions.patch @@ -0,0 +1,50 @@ +From de96f6a3003513c796bbe4e23210a446913f5c00 Mon Sep 17 00:00:00 2001 +From: Michel Alex +Date: Wed, 16 Oct 2024 12:11:15 +0000 +Subject: net: phy: dp83822: Fix reset pin definitions + +From: Michel Alex + +commit de96f6a3003513c796bbe4e23210a446913f5c00 upstream. + +This change fixes a rare issue where the PHY fails to detect a link +due to incorrect reset behavior. + +The SW_RESET definition was incorrectly assigned to bit 14, which is the +Digital Restart bit according to the datasheet. This commit corrects +SW_RESET to bit 15 and assigns DIG_RESTART to bit 14 as per the +datasheet specifications. + +The SW_RESET define is only used in the phy_reset function, which fully +re-initializes the PHY after the reset is performed. The change in the +bit definitions should not have any negative impact on the functionality +of the PHY. + +v2: +- added Fixes tag +- improved commit message + +Cc: stable@vger.kernel.org +Fixes: 5dc39fd5ef35 ("net: phy: DP83822: Add ability to advertise Fiber connection") +Signed-off-by: Alex Michel +Reviewed-by: Andrew Lunn +Message-ID: +Signed-off-by: Andrew Lunn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/dp83822.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -40,8 +40,8 @@ + /* Control Register 2 bits */ + #define DP83822_FX_ENABLE BIT(14) + +-#define DP83822_HW_RESET BIT(15) +-#define DP83822_SW_RESET BIT(14) ++#define DP83822_SW_RESET BIT(15) ++#define DP83822_DIG_RESTART BIT(14) + + /* PHY STS bits */ + #define DP83822_PHYSTS_DUPLEX BIT(2) diff --git a/queue-6.6/series b/queue-6.6/series index de7fe0079c3..ccb6ee673db 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -195,3 +195,7 @@ xfrm-fix-one-more-kernel-infoleak-in-algo-dumping.patch hv_netvsc-fix-vf-namespace-also-in-synthetic-nic-netdev_register-event.patch drm-amd-display-disable-psr-su-on-parade-08-01-tcon-too.patch selinux-improve-error-checking-in-sel_write_load.patch +net-phy-dp83822-fix-reset-pin-definitions.patch +block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch +ata-libata-set-did_time_out-for-commands-that-actually-timed-out.patch +asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch