From: Greg Kroah-Hartman Date: Sun, 16 Mar 2025 07:55:51 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.6.84~34^2~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c4f5a0073ca679cb22f20766e44548d25a343da8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch drm-atomic-filter-out-redundant-dpms-calls.patch qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch usb-serial-option-add-telit-cinterion-fe990b-compositions.patch usb-serial-option-fix-telit-cinterion-fe990a-name.patch usb-serial-option-match-on-interface-class-for-telit-fn990b.patch x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch --- diff --git a/queue-5.10/drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch b/queue-5.10/drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch new file mode 100644 index 0000000000..c521d7c71b --- /dev/null +++ b/queue-5.10/drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch @@ -0,0 +1,49 @@ +From 79e31396fdd7037c503e6add15af7cb00633ea92 Mon Sep 17 00:00:00 2001 +From: Alex Hung +Date: Thu, 27 Feb 2025 16:36:25 -0700 +Subject: drm/amd/display: Assign normalized_pix_clk when color depth = 14 + +From: Alex Hung + +commit 79e31396fdd7037c503e6add15af7cb00633ea92 upstream. + +[WHY & HOW] +A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 +calculate_phy_pix_clks+0xef/0x100 [amdgpu]" occurs because the +display_color_depth == COLOR_DEPTH_141414 is not handled. This is +observed in Radeon RX 6600 XT. + +It is fixed by assigning pix_clk * (14 * 3) / 24 - same as the rests. + +Also fixes the indentation in get_norm_pix_clk. + +Reviewed-by: Harry Wentland +Signed-off-by: Alex Hung +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 274a87eb389f58eddcbc5659ab0b180b37e92775) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1975,10 +1975,13 @@ static int get_norm_pix_clk(const struct + break; + case COLOR_DEPTH_121212: + normalized_pix_clk = (pix_clk * 36) / 24; +- break; ++ break; ++ case COLOR_DEPTH_141414: ++ normalized_pix_clk = (pix_clk * 42) / 24; ++ break; + case COLOR_DEPTH_161616: + normalized_pix_clk = (pix_clk * 48) / 24; +- break; ++ break; + default: + ASSERT(0); + break; diff --git a/queue-5.10/drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch b/queue-5.10/drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch new file mode 100644 index 0000000000..d6e3ffc593 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch @@ -0,0 +1,41 @@ +From e65e7bea220c3ce8c4c793b4ba35557f4994ab2b Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Fri, 28 Feb 2025 13:18:14 -0600 +Subject: drm/amd/display: Fix slab-use-after-free on hdcp_work + +From: Mario Limonciello + +commit e65e7bea220c3ce8c4c793b4ba35557f4994ab2b upstream. + +[Why] +A slab-use-after-free is reported when HDCP is destroyed but the +property_validate_dwork queue is still running. + +[How] +Cancel the delayed work when destroying workqueue. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4006 +Fixes: da3fd7ac0bcf ("drm/amd/display: Update CP property based on HW query") +Cc: Alex Deucher +Reviewed-by: Alex Hung +Signed-off-by: Mario Limonciello +Signed-off-by: Tom Chung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 725a04ba5a95e89c89633d4322430cfbca7ce128) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +@@ -383,6 +383,7 @@ void hdcp_destroy(struct kobject *kobj, + for (i = 0; i < hdcp_work->max_link; i++) { + cancel_delayed_work_sync(&hdcp_work[i].callback_dwork); + cancel_delayed_work_sync(&hdcp_work[i].watchdog_timer_dwork); ++ cancel_delayed_work_sync(&hdcp_work[i].property_validate_dwork); + } + + sysfs_remove_bin_file(kobj, &hdcp_work[0].attr); diff --git a/queue-5.10/drm-atomic-filter-out-redundant-dpms-calls.patch b/queue-5.10/drm-atomic-filter-out-redundant-dpms-calls.patch new file mode 100644 index 0000000000..27afa8aca5 --- /dev/null +++ b/queue-5.10/drm-atomic-filter-out-redundant-dpms-calls.patch @@ -0,0 +1,63 @@ +From de93ddf88088f7624b589d0ff3af9effb87e8f3b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Wed, 19 Feb 2025 18:02:39 +0200 +Subject: drm/atomic: Filter out redundant DPMS calls +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit de93ddf88088f7624b589d0ff3af9effb87e8f3b upstream. + +Video players (eg. mpv) do periodic XResetScreenSaver() calls to +keep the screen on while the video playing. The modesetting ddx +plumbs these straight through into the kernel as DPMS setproperty +ioctls, without any filtering whatsoever. When implemented via +atomic these end up as empty commits on the crtc (which will +nonetheless take one full frame), which leads to a dropped +frame every time XResetScreenSaver() is called. + +Let's just filter out redundant DPMS property changes in the +kernel to avoid this issue. + +v2: Explain the resulting commits a bit better (Sima) + Document the behaviour in uapi docs (Sima) + +Cc: stable@vger.kernel.org +Testcase: igt/kms_flip/flip-vs-dpms-on-nop +Reviewed-by: Simona Vetter +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20250219160239.17502-1-ville.syrjala@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_atomic_uapi.c | 4 ++++ + drivers/gpu/drm/drm_connector.c | 4 ++++ + 2 files changed, 8 insertions(+) + +--- a/drivers/gpu/drm/drm_atomic_uapi.c ++++ b/drivers/gpu/drm/drm_atomic_uapi.c +@@ -936,6 +936,10 @@ int drm_atomic_connector_commit_dpms(str + + if (mode != DRM_MODE_DPMS_ON) + mode = DRM_MODE_DPMS_OFF; ++ ++ if (connector->dpms == mode) ++ goto out; ++ + connector->dpms = mode; + + crtc = connector->state->crtc; +--- a/drivers/gpu/drm/drm_connector.c ++++ b/drivers/gpu/drm/drm_connector.c +@@ -990,6 +990,10 @@ static const struct drm_prop_enum_list d + * callback. For atomic drivers the remapping to the "ACTIVE" property is + * implemented in the DRM core. + * ++ * On atomic drivers any DPMS setproperty ioctl where the value does not ++ * change is completely skipped, otherwise a full atomic commit will occur. ++ * On legacy drivers the exact behavior is driver specific. ++ * + * Note that this property cannot be set through the MODE_ATOMIC ioctl, + * userspace must use "ACTIVE" on the CRTC instead. + * diff --git a/queue-5.10/qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch b/queue-5.10/qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch new file mode 100644 index 0000000000..27c802654d --- /dev/null +++ b/queue-5.10/qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch @@ -0,0 +1,51 @@ +From d2b9d97e89c79c95f8b517e4fa43fd100f936acc Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Fri, 7 Mar 2025 17:49:52 +0800 +Subject: qlcnic: fix memory leak issues in qlcnic_sriov_common.c + +From: Haoxiang Li + +commit d2b9d97e89c79c95f8b517e4fa43fd100f936acc upstream. + +Add qlcnic_sriov_free_vlans() in qlcnic_sriov_alloc_vlans() if +any sriov_vlans fails to be allocated. +Add qlcnic_sriov_free_vlans() to free the memory allocated by +qlcnic_sriov_alloc_vlans() if "sriov->allowed_vlans" fails to +be allocated. + +Fixes: 91b7282b613d ("qlcnic: Support VLAN id config.") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Link: https://patch.msgid.link/20250307094952.14874-1-haoxiang_li2024@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -454,8 +454,10 @@ static int qlcnic_sriov_set_guest_vlan_m + + num_vlans = sriov->num_allowed_vlans; + sriov->allowed_vlans = kcalloc(num_vlans, sizeof(u16), GFP_KERNEL); +- if (!sriov->allowed_vlans) ++ if (!sriov->allowed_vlans) { ++ qlcnic_sriov_free_vlans(adapter); + return -ENOMEM; ++ } + + vlans = (u16 *)&cmd->rsp.arg[3]; + for (i = 0; i < num_vlans; i++) +@@ -2173,8 +2175,10 @@ int qlcnic_sriov_alloc_vlans(struct qlcn + vf = &sriov->vf_info[i]; + vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans, + sizeof(*vf->sriov_vlans), GFP_KERNEL); +- if (!vf->sriov_vlans) ++ if (!vf->sriov_vlans) { ++ qlcnic_sriov_free_vlans(adapter); + return -ENOMEM; ++ } + } + + return 0; diff --git a/queue-5.10/series b/queue-5.10/series index 43b283782d..acb8e0994b 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -45,3 +45,12 @@ x86-irq-define-trace-events-conditionally.patch mptcp-safety-check-before-fallback.patch drm-nouveau-do-not-override-forced-connector-status.patch block-fix-kmem_cache-of-name-bio-108-already-exists.patch +usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch +usb-serial-option-add-telit-cinterion-fe990b-compositions.patch +usb-serial-option-fix-telit-cinterion-fe990a-name.patch +usb-serial-option-match-on-interface-class-for-telit-fn990b.patch +x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch +drm-atomic-filter-out-redundant-dpms-calls.patch +drm-amd-display-assign-normalized_pix_clk-when-color-depth-14.patch +drm-amd-display-fix-slab-use-after-free-on-hdcp_work.patch +qlcnic-fix-memory-leak-issues-in-qlcnic_sriov_common.c.patch diff --git a/queue-5.10/usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch b/queue-5.10/usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch new file mode 100644 index 0000000000..18c957e3a5 --- /dev/null +++ b/queue-5.10/usb-serial-ftdi_sio-add-support-for-altera-usb-blaster-3.patch @@ -0,0 +1,88 @@ +From 18e0885bd2ca738407036434418a26a58394a60e Mon Sep 17 00:00:00 2001 +From: Boon Khai Ng +Date: Wed, 12 Mar 2025 11:05:44 +0800 +Subject: USB: serial: ftdi_sio: add support for Altera USB Blaster 3 + +From: Boon Khai Ng + +commit 18e0885bd2ca738407036434418a26a58394a60e upstream. + +The Altera USB Blaster 3, available as both a cable and an on-board +solution, is primarily used for programming and debugging FPGAs. + +It interfaces with host software such as Quartus Programmer, +System Console, SignalTap, and Nios Debugger. The device utilizes +either an FT2232 or FT4232 chip. + +Enabling the support for various configurations of the on-board +USB Blaster 3 by including the appropriate VID/PID pairs, +allowing it to function as a serial device via ftdi_sio. + +Note that this check-in does not include support for the +cable solution, as it does not support UART functionality. +The supported configurations are determined by the +hardware design and include: + +1) PID 0x6022, FT2232, 1 JTAG port (Port A) + Port B as UART +2) PID 0x6025, FT4232, 1 JTAG port (Port A) + Port C as UART +3) PID 0x6026, FT4232, 1 JTAG port (Port A) + Port C, D as UART +4) PID 0x6029, FT4232, 1 JTAG port (Port B) + Port C as UART +5) PID 0x602a, FT4232, 1 JTAG port (Port B) + Port C, D as UART +6) PID 0x602c, FT4232, 1 JTAG port (Port A) + Port B as UART +7) PID 0x602d, FT4232, 1 JTAG port (Port A) + Port B, C as UART +8) PID 0x602e, FT4232, 1 JTAG port (Port A) + Port B, C, D as UART + +These configurations allow for flexibility in how the USB Blaster 3 is +used, depending on the specific needs of the hardware design. + +Signed-off-by: Boon Khai Ng +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 14 ++++++++++++++ + drivers/usb/serial/ftdi_sio_ids.h | 13 +++++++++++++ + 2 files changed, 27 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1057,6 +1057,20 @@ static const struct usb_device_id id_tab + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + /* GMC devices */ + { USB_DEVICE(GMC_VID, GMC_Z216C_PID) }, ++ /* Altera USB Blaster 3 */ ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6022_PID, 1) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6025_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6026_PID, 3) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_6029_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602A_PID, 3) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602C_PID, 1) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 1) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602D_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 1) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 2) }, ++ { USB_DEVICE_INTERFACE_NUMBER(ALTERA_VID, ALTERA_UB3_602E_PID, 3) }, + { } /* Terminating entry */ + }; + +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1605,3 +1605,16 @@ + */ + #define GMC_VID 0x1cd7 + #define GMC_Z216C_PID 0x0217 /* GMC Z216C Adapter IR-USB */ ++ ++/* ++ * Altera USB Blaster 3 (http://www.altera.com). ++ */ ++#define ALTERA_VID 0x09fb ++#define ALTERA_UB3_6022_PID 0x6022 ++#define ALTERA_UB3_6025_PID 0x6025 ++#define ALTERA_UB3_6026_PID 0x6026 ++#define ALTERA_UB3_6029_PID 0x6029 ++#define ALTERA_UB3_602A_PID 0x602a ++#define ALTERA_UB3_602C_PID 0x602c ++#define ALTERA_UB3_602D_PID 0x602d ++#define ALTERA_UB3_602E_PID 0x602e diff --git a/queue-5.10/usb-serial-option-add-telit-cinterion-fe990b-compositions.patch b/queue-5.10/usb-serial-option-add-telit-cinterion-fe990b-compositions.patch new file mode 100644 index 0000000000..c451fa3657 --- /dev/null +++ b/queue-5.10/usb-serial-option-add-telit-cinterion-fe990b-compositions.patch @@ -0,0 +1,209 @@ +From 4981bb50392b7515b765da28cf8768ce624c2670 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Tue, 4 Mar 2025 10:19:38 +0100 +Subject: USB: serial: option: add Telit Cinterion FE990B compositions + +From: Fabio Porcedda + +commit 4981bb50392b7515b765da28cf8768ce624c2670 upstream. + +Add the following Telit Cinterion FE990B40 compositions: + +0x10b0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10b1: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b1 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10b2: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b2 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x10b3: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b3 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Reviewed-by: Daniele Palmas +[ johan: use USB_DEVICE_AND_INTERFACE_INFO() and sort by protocol ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1388,6 +1388,22 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */ ++ .driver_info = NCTRL(5) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x30), /* Telit FE990B (MBIM) */ ++ .driver_info = NCTRL(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b1, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x30), /* Telit FE990B (RNDIS) */ ++ .driver_info = NCTRL(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b2, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x30), /* Telit FE990B (ECM) */ ++ .driver_info = NCTRL(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ diff --git a/queue-5.10/usb-serial-option-fix-telit-cinterion-fe990a-name.patch b/queue-5.10/usb-serial-option-fix-telit-cinterion-fe990a-name.patch new file mode 100644 index 0000000000..9329dcc1cd --- /dev/null +++ b/queue-5.10/usb-serial-option-fix-telit-cinterion-fe990a-name.patch @@ -0,0 +1,40 @@ +From 6232f0d8e100a26275bbd773fc56a60af2c95322 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Tue, 4 Mar 2025 10:19:39 +0100 +Subject: USB: serial: option: fix Telit Cinterion FE990A name + +From: Fabio Porcedda + +commit 6232f0d8e100a26275bbd773fc56a60af2c95322 upstream. + +The correct name for FE990 is FE990A so use it in order to avoid +confusion with FE990B. + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1368,13 +1368,13 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990A (PCIe) */ + .driver_info = RSVD(0) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990 (rmnet) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1080, 0xff), /* Telit FE990A (rmnet) */ + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990 (MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1081, 0xff), /* Telit FE990A (MBIM) */ + .driver_info = NCTRL(0) | RSVD(1) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990 (RNDIS) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1082, 0xff), /* Telit FE990A (RNDIS) */ + .driver_info = NCTRL(2) | RSVD(3) }, +- { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990 (ECM) */ ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff), /* Telit FE990A (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(3) }, diff --git a/queue-5.10/usb-serial-option-match-on-interface-class-for-telit-fn990b.patch b/queue-5.10/usb-serial-option-match-on-interface-class-for-telit-fn990b.patch new file mode 100644 index 0000000000..9ffdf5cc2f --- /dev/null +++ b/queue-5.10/usb-serial-option-match-on-interface-class-for-telit-fn990b.patch @@ -0,0 +1,63 @@ +From 9a665fe3d967fe46edb4fd2497c7a5cc2dac2f55 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 6 Mar 2025 11:44:41 +0100 +Subject: USB: serial: option: match on interface class for Telit FN990B + +From: Johan Hovold + +commit 9a665fe3d967fe46edb4fd2497c7a5cc2dac2f55 upstream. + +The device id entries for Telit FN990B ended up matching only on the +interface protocol. While this works, the protocol is qualified by the +interface class (and subclass) which should have been included. + +Switch to matching using USB_DEVICE_AND_INTERFACE_INFO() while keeping +the entries sorted also by protocol for consistency. + +Link: https://lore.kernel.org/20250227110655.3647028-2-fabio.porcedda@gmail.com/ +Cc: Fabio Porcedda +Cc: Daniele Palmas +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1410,22 +1410,22 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ + .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x60) }, /* Telit FN990B (rmnet) */ +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x40) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d0, 0x30), ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ + .driver_info = NCTRL(5) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x60) }, /* Telit FN990B (MBIM) */ +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x40) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d1, 0x30), ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ + .driver_info = NCTRL(6) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x60) }, /* Telit FN990B (RNDIS) */ +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x40) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d2, 0x30), ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x30), /* Telit FN990B (RNDIS) */ + .driver_info = NCTRL(6) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x60) }, /* Telit FN990B (ECM) */ +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x40) }, +- { USB_DEVICE_INTERFACE_PROTOCOL(TELIT_VENDOR_ID, 0x10d3, 0x30), ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d2, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x30), /* Telit FN990B (ECM) */ + .driver_info = NCTRL(6) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d3, 0xff, 0xff, 0x60) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/queue-5.10/x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch b/queue-5.10/x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch new file mode 100644 index 0000000000..49a8403f69 --- /dev/null +++ b/queue-5.10/x86-microcode-amd-fix-out-of-bounds-on-systems-with-cpu-less-numa-nodes.patch @@ -0,0 +1,74 @@ +From e3e89178a9f4a80092578af3ff3c8478f9187d59 Mon Sep 17 00:00:00 2001 +From: Florent Revest +Date: Mon, 10 Mar 2025 15:42:43 +0100 +Subject: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes + +From: Florent Revest + +commit e3e89178a9f4a80092578af3ff3c8478f9187d59 upstream. + +Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their +CPU masks and unconditionally accesses per-CPU data for the first CPU of each +mask. + +According to Documentation/admin-guide/mm/numaperf.rst: + + "Some memory may share the same node as a CPU, and others are provided as + memory only nodes." + +Therefore, some node CPU masks may be empty and wouldn't have a "first CPU". + +On a machine with far memory (and therefore CPU-less NUMA nodes): +- cpumask_of_node(nid) is 0 +- cpumask_first(0) is CONFIG_NR_CPUS +- cpu_data(CONFIG_NR_CPUS) accesses the cpu_info per-CPU array at an + index that is 1 out of bounds + +This does not have any security implications since flashing microcode is +a privileged operation but I believe this has reliability implications by +potentially corrupting memory while flashing a microcode update. + +When booting with CONFIG_UBSAN_BOUNDS=y on an AMD machine that flashes +a microcode update. I get the following splat: + + UBSAN: array-index-out-of-bounds in arch/x86/kernel/cpu/microcode/amd.c:X:Y + index 512 is out of range for type 'unsigned long[512]' + [...] + Call Trace: + dump_stack + __ubsan_handle_out_of_bounds + load_microcode_amd + request_microcode_amd + reload_store + kernfs_fop_write_iter + vfs_write + ksys_write + do_syscall_64 + entry_SYSCALL_64_after_hwframe + +Change the loop to go over only NUMA nodes which have CPUs before determining +whether the first CPU on the respective node needs microcode update. + + [ bp: Massage commit message, fix typo. ] + +Fixes: 7ff6edf4fef3 ("x86/microcode/AMD: Fix mixed steppings support") +Signed-off-by: Florent Revest +Signed-off-by: Borislav Petkov (AMD) +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250310144243.861978-1-revest@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/microcode/amd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -862,7 +862,7 @@ static enum ucode_state load_microcode_a + return ret; + } + +- for_each_node(nid) { ++ for_each_node_with_cpus(nid) { + cpu = cpumask_first(cpumask_of_node(nid)); + c = &cpu_data(cpu); +