From: Sasha Levin Date: Wed, 27 Mar 2024 11:08:40 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.7.12~222 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d2d2340a46cc45b44210f1cba4c406e9f90b0b58;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/ahci-asm1064-asm1166-don-t-limit-reported-ports.patch b/queue-5.15/ahci-asm1064-asm1166-don-t-limit-reported-ports.patch new file mode 100644 index 00000000000..586acb7b53c --- /dev/null +++ b/queue-5.15/ahci-asm1064-asm1166-don-t-limit-reported-ports.patch @@ -0,0 +1,89 @@ +From 442016a65a19012f010e924cb440d2f2e4023948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 22:46:50 +0100 +Subject: ahci: asm1064: asm1166: don't limit reported ports + +From: Conrad Kostecki + +[ Upstream commit 6cd8adc3e18960f6e59d797285ed34ef473cc896 ] + +Previously, patches have been added to limit the reported count of SATA +ports for asm1064 and asm1166 SATA controllers, as those controllers do +report more ports than physically having. + +While it is allowed to report more ports than physically having in CAP.NP, +it is not allowed to report more ports than physically having in the PI +(Ports Implemented) register, which is what these HBAs do. +(This is a AHCI spec violation.) + +Unfortunately, it seems that the PMP implementation in these ASMedia HBAs +is also violating the AHCI and SATA-IO PMP specification. + +What these HBAs do is that they do not report that they support PMP +(CAP.SPM (Supports Port Multiplier) is not set). + +Instead, they have decided to add extra "virtual" ports in the PI register +that is used if a port multiplier is connected to any of the physical +ports of the HBA. + +Enumerating the devices behind the PMP as specified in the AHCI and +SATA-IO specifications, by using PMP READ and PMP WRITE commands to the +physical ports of the HBA is not possible, you have to use the "virtual" +ports. + +This is of course bad, because this gives us no way to detect the device +and vendor ID of the PMP actually connected to the HBA, which means that +we can not apply the proper PMP quirks for the PMP that is connected to +the HBA. + +Limiting the port map will thus stop these controllers from working with +SATA Port Multipliers. + +This patch reverts both patches for asm1064 and asm1166, so old behavior +is restored and SATA PMP will work again, but it will also reintroduce the +(minutes long) extra boot time for the ASMedia controllers that do not +have a PMP connected (either on the PCIe card itself, or an external PMP). + +However, a longer boot time for some, is the lesser evil compared to some +other users not being able to detect their drives at all. + +Fixes: 0077a504e1a4 ("ahci: asm1166: correct count of reported ports") +Fixes: 9815e3961754 ("ahci: asm1064: correct count of reported ports") +Cc: stable@vger.kernel.org +Reported-by: Matt +Signed-off-by: Conrad Kostecki +Reviewed-by: Hans de Goede +[cassel: rewrote commit message] +Signed-off-by: Niklas Cassel +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 2d1f5cede60b2..7807c7b9f37ab 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -666,19 +666,6 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets"); + static void ahci_pci_save_initial_config(struct pci_dev *pdev, + struct ahci_host_priv *hpriv) + { +- if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA) { +- switch (pdev->device) { +- case 0x1166: +- dev_info(&pdev->dev, "ASM1166 has only six ports\n"); +- hpriv->saved_port_map = 0x3f; +- break; +- case 0x1064: +- dev_info(&pdev->dev, "ASM1064 has only four ports\n"); +- hpriv->saved_port_map = 0xf; +- break; +- } +- } +- + if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) { + dev_info(&pdev->dev, "JMB361 has only one port\n"); + hpriv->force_port_map = 1; +-- +2.43.0 + diff --git a/queue-5.15/ahci-asm1064-correct-count-of-reported-ports.patch b/queue-5.15/ahci-asm1064-correct-count-of-reported-ports.patch new file mode 100644 index 00000000000..c4aa5436a8f --- /dev/null +++ b/queue-5.15/ahci-asm1064-correct-count-of-reported-ports.patch @@ -0,0 +1,60 @@ +From 7084d9b4183c0fd23417f5193ceb4b7ed3f63f35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 17:57:57 +0100 +Subject: ahci: asm1064: correct count of reported ports + +From: Andrey Jr. Melnikov + +[ Upstream commit 9815e39617541ef52d0dfac4be274ad378c6dc09 ] + +The ASM1064 SATA host controller always reports wrongly, +that it has 24 ports. But in reality, it only has four ports. + +before: +ahci 0000:04:00.0: SSS flag set, parallel bus scan disabled +ahci 0000:04:00.0: AHCI 0001.0301 32 slots 24 ports 6 Gbps 0xffff0f impl SATA mode +ahci 0000:04:00.0: flags: 64bit ncq sntf stag pm led only pio sxs deso sadm sds apst + +after: +ahci 0000:04:00.0: ASM1064 has only four ports +ahci 0000:04:00.0: forcing port_map 0xffff0f -> 0xf +ahci 0000:04:00.0: SSS flag set, parallel bus scan disabled +ahci 0000:04:00.0: AHCI 0001.0301 32 slots 24 ports 6 Gbps 0xf impl SATA mode +ahci 0000:04:00.0: flags: 64bit ncq sntf stag pm led only pio sxs deso sadm sds apst + +Signed-off-by: "Andrey Jr. Melnikov" +Signed-off-by: Niklas Cassel +Stable-dep-of: 6cd8adc3e189 ("ahci: asm1064: asm1166: don't limit reported ports") +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index b0a8aac008bae..2d1f5cede60b2 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -666,9 +666,17 @@ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets"); + static void ahci_pci_save_initial_config(struct pci_dev *pdev, + struct ahci_host_priv *hpriv) + { +- if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1166) { +- dev_info(&pdev->dev, "ASM1166 has only six ports\n"); +- hpriv->saved_port_map = 0x3f; ++ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA) { ++ switch (pdev->device) { ++ case 0x1166: ++ dev_info(&pdev->dev, "ASM1166 has only six ports\n"); ++ hpriv->saved_port_map = 0x3f; ++ break; ++ case 0x1064: ++ dev_info(&pdev->dev, "ASM1064 has only four ports\n"); ++ hpriv->saved_port_map = 0xf; ++ break; ++ } + } + + if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) { +-- +2.43.0 + diff --git a/queue-5.15/arm-dts-marvell-fix-maxium-maxim-typo-in-brownstone-.patch b/queue-5.15/arm-dts-marvell-fix-maxium-maxim-typo-in-brownstone-.patch new file mode 100644 index 00000000000..c3114e82cf3 --- /dev/null +++ b/queue-5.15/arm-dts-marvell-fix-maxium-maxim-typo-in-brownstone-.patch @@ -0,0 +1,46 @@ +From 8b5dd6664f4b8de9113a9250427b90869bcd8c41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 19:39:32 +0100 +Subject: arm: dts: marvell: Fix maxium->maxim typo in brownstone dts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duje Mihanović + +[ Upstream commit 831e0cd4f9ee15a4f02ae10b67e7fdc10eb2b4fc ] + +Fix an obvious spelling error in the PMIC compatible in the MMP2 +Brownstone DTS file. + +Fixes: 58f1193e6210 ("mfd: max8925: Add dts") +Cc: +Signed-off-by: Duje Mihanović +Reported-by: Krzysztof Kozlowski +Closes: https://lore.kernel.org/linux-devicetree/1410884282-18041-1-git-send-email-k.kozlowski@samsung.com/ +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20240125-brownstone-typo-fix-v2-1-45bc48a0c81c@skole.hr +[krzysztof: Just 10 years to take a patch, not bad! Rephrased commit + msg] +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/mmp2-brownstone.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/mmp2-brownstone.dts b/arch/arm/boot/dts/mmp2-brownstone.dts +index 04f1ae1382e7a..bc64348b82185 100644 +--- a/arch/arm/boot/dts/mmp2-brownstone.dts ++++ b/arch/arm/boot/dts/mmp2-brownstone.dts +@@ -28,7 +28,7 @@ &uart3 { + &twsi1 { + status = "okay"; + pmic: max8925@3c { +- compatible = "maxium,max8925"; ++ compatible = "maxim,max8925"; + reg = <0x3c>; + interrupts = <1>; + interrupt-parent = <&intcmux4>; +-- +2.43.0 + diff --git a/queue-5.15/block-clear-zone-limits-for-a-non-zoned-stacked-queu.patch b/queue-5.15/block-clear-zone-limits-for-a-non-zoned-stacked-queu.patch new file mode 100644 index 00000000000..4cf7fc6ed9c --- /dev/null +++ b/queue-5.15/block-clear-zone-limits-for-a-non-zoned-stacked-queu.patch @@ -0,0 +1,44 @@ +From 8304b9f4efb26ca2f47b8f21e7fa415ec5f68c97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 22:17:23 +0900 +Subject: block: Clear zone limits for a non-zoned stacked queue + +From: Damien Le Moal + +[ Upstream commit c8f6f88d25929ad2f290b428efcae3b526f3eab0 ] + +Device mapper may create a non-zoned mapped device out of a zoned device +(e.g., the dm-zoned target). In such case, some queue limit such as the +max_zone_append_sectors and zone_write_granularity endup being non zero +values for a block device that is not zoned. Avoid this by clearing +these limits in blk_stack_limits() when the stacked zoned limit is +false. + +Fixes: 3093a479727b ("block: inherit the zoned characteristics in blk_stack_limits") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Link: https://lore.kernel.org/r/20240222131724.1803520-1-dlemoal@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 959b5c1e6d3b7..1b92e66249518 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -647,6 +647,10 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b, + t->zone_write_granularity = max(t->zone_write_granularity, + b->zone_write_granularity); + t->zoned = max(t->zoned, b->zoned); ++ if (!t->zoned) { ++ t->zone_write_granularity = 0; ++ t->max_zone_append_sectors = 0; ++ } + return ret; + } + EXPORT_SYMBOL(blk_stack_limits); +-- +2.43.0 + diff --git a/queue-5.15/bounds-support-non-power-of-two-config_nr_cpus.patch b/queue-5.15/bounds-support-non-power-of-two-config_nr_cpus.patch new file mode 100644 index 00000000000..632e0cfb771 --- /dev/null +++ b/queue-5.15/bounds-support-non-power-of-two-config_nr_cpus.patch @@ -0,0 +1,46 @@ +From 10cda473bbe8efc59ec4caa85d18c5e6ee16c32a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Oct 2023 15:55:49 +0100 +Subject: bounds: support non-power-of-two CONFIG_NR_CPUS + +From: Matthew Wilcox (Oracle) + +[ Upstream commit f2d5dcb48f7ba9e3ff249d58fc1fa963d374e66a ] + +ilog2() rounds down, so for example when PowerPC 85xx sets CONFIG_NR_CPUS +to 24, we will only allocate 4 bits to store the number of CPUs instead of +5. Use bits_per() instead, which rounds up. Found by code inspection. +The effect of this would probably be a misaccounting when doing NUMA +balancing, so to a user, it would only be a performance penalty. The +effects may be more wide-spread; it's hard to tell. + +Link: https://lkml.kernel.org/r/20231010145549.1244748-1-willy@infradead.org +Signed-off-by: Matthew Wilcox (Oracle) +Fixes: 90572890d202 ("mm: numa: Change page last {nid,pid} into {cpu,pid}") +Reviewed-by: Rik van Riel +Acked-by: Mel Gorman +Cc: Peter Zijlstra +Cc: Ingo Molnar +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/bounds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bounds.c b/kernel/bounds.c +index 9795d75b09b23..a94e3769347ee 100644 +--- a/kernel/bounds.c ++++ b/kernel/bounds.c +@@ -19,7 +19,7 @@ int main(void) + DEFINE(NR_PAGEFLAGS, __NR_PAGEFLAGS); + DEFINE(MAX_NR_ZONES, __MAX_NR_ZONES); + #ifdef CONFIG_SMP +- DEFINE(NR_CPUS_BITS, ilog2(CONFIG_NR_CPUS)); ++ DEFINE(NR_CPUS_BITS, bits_per(CONFIG_NR_CPUS)); + #endif + DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t)); + /* End of constants */ +-- +2.43.0 + diff --git a/queue-5.15/btrfs-fix-off-by-one-chunk-length-calculation-at-con.patch b/queue-5.15/btrfs-fix-off-by-one-chunk-length-calculation-at-con.patch new file mode 100644 index 00000000000..9d285a5f5cf --- /dev/null +++ b/queue-5.15/btrfs-fix-off-by-one-chunk-length-calculation-at-con.patch @@ -0,0 +1,48 @@ +From 58bee6c1c769a0498edf07ca4ae760ca6d0ffb00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 10:37:04 +0000 +Subject: btrfs: fix off-by-one chunk length calculation at + contains_pending_extent() + +From: Filipe Manana + +[ Upstream commit ae6bd7f9b46a29af52ebfac25d395757e2031d0d ] + +At contains_pending_extent() the value of the end offset of a chunk we +found in the device's allocation state io tree is inclusive, so when +we calculate the length we pass to the in_range() macro, we must sum +1 to the expression "physical_end - physical_offset". + +In practice the wrong calculation should be harmless as chunks sizes +are never 1 byte and we should never have 1 byte ranges of unallocated +space. Nevertheless fix the wrong calculation. + +Reported-by: Alex Lyakas +Link: https://lore.kernel.org/linux-btrfs/CAOcd+r30e-f4R-5x-S7sV22RJPe7+pgwherA6xqN2_qe7o4XTg@mail.gmail.com/ +Fixes: 1c11b63eff2a ("btrfs: replace pending/pinned chunks lists with io tree") +CC: stable@vger.kernel.org # 6.1+ +Reviewed-by: Josef Bacik +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index cc18ba50a61cf..1ce0fa487e5b2 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -1473,7 +1473,7 @@ static bool contains_pending_extent(struct btrfs_device *device, u64 *start, + + if (in_range(physical_start, *start, len) || + in_range(*start, physical_start, +- physical_end - physical_start)) { ++ physical_end + 1 - physical_start)) { + *start = physical_end + 1; + return true; + } +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch b/queue-5.15/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch new file mode 100644 index 00000000000..67f4c675471 --- /dev/null +++ b/queue-5.15/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch @@ -0,0 +1,51 @@ +From 3677d54ed7a7b42d1e7902ae684301e33db6cb1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:47 +0100 +Subject: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit cdbc6e2d8108bc47895e5a901cfcaf799b00ca8d ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-2-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 4c5c7a8f41d08..b9844e41cf99d 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -1557,6 +1557,7 @@ static struct clk_regmap_div nss_ubi0_div_clk_src = { + + static const struct freq_tbl ftbl_pcie_aux_clk_src[] = { + F(24000000, P_XO, 1, 0, 0), ++ { } + }; + + static const struct clk_parent_data gcc_xo_gpll0_core_pi_sleep_clk[] = { +@@ -1737,6 +1738,7 @@ static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = { + F(160000000, P_GPLL0, 5, 0, 0), + F(216000000, P_GPLL6, 5, 0, 0), + F(308570000, P_GPLL6, 3.5, 0, 0), ++ { } + }; + + static const struct clk_parent_data gcc_xo_gpll0_gpll6_gpll0_div2[] = { +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch b/queue-5.15/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch new file mode 100644 index 00000000000..8bde0a41484 --- /dev/null +++ b/queue-5.15/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch @@ -0,0 +1,51 @@ +From a2f764524661f745461af0ceb78013176d04782f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:48 +0100 +Subject: clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit 1040ef5ed95d6fd2628bad387d78a61633e09429 ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: 9607f6224b39 ("clk: qcom: ipq8074: add PCIE, USB and SDCC clocks") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-3-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index 0393154fea2f9..649e75a41f7af 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -972,6 +972,7 @@ static struct clk_rcg2 pcie0_axi_clk_src = { + + static const struct freq_tbl ftbl_pcie_aux_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), ++ { } + }; + + static struct clk_rcg2 pcie0_aux_clk_src = { +@@ -1077,6 +1078,7 @@ static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(160000000, P_GPLL0, 5, 0, 0), + F(308570000, P_GPLL6, 3.5, 0, 0), ++ { } + }; + + static struct clk_rcg2 sdcc1_ice_core_clk_src = { +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-gcc-sdm845-add-soft-dependency-on-rpmhpd.patch b/queue-5.15/clk-qcom-gcc-sdm845-add-soft-dependency-on-rpmhpd.patch new file mode 100644 index 00000000000..e6319bad490 --- /dev/null +++ b/queue-5.15/clk-qcom-gcc-sdm845-add-soft-dependency-on-rpmhpd.patch @@ -0,0 +1,40 @@ +From a4a1e607e6e3d094d60e6a26b744469c999204bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 11:58:14 +0530 +Subject: clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd + +From: Amit Pundir + +[ Upstream commit 1d9054e3a4fd36e2949e616f7360bdb81bcc1921 ] + +With the addition of RPMh power domain to the GCC node in +device tree, we noticed a significant delay in getting the +UFS driver probed on AOSP which futher led to mount failures +because Android do not support rootwait. So adding a soft +dependency on RPMh power domain which informs modprobe to +load rpmhpd module before gcc-sdm845. + +Cc: stable@vger.kernel.org # v5.4+ +Fixes: 4b6ea15c0a11 ("arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC") +Suggested-by: Manivannan Sadhasivam +Signed-off-by: Amit Pundir +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20240123062814.2555649-1-amit.pundir@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sdm845.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c +index 58aa3ec9a7fc3..fffdb480073e7 100644 +--- a/drivers/clk/qcom/gcc-sdm845.c ++++ b/drivers/clk/qcom/gcc-sdm845.c +@@ -3642,3 +3642,4 @@ module_exit(gcc_sdm845_exit); + MODULE_DESCRIPTION("QTI GCC SDM845 Driver"); + MODULE_LICENSE("GPL v2"); + MODULE_ALIAS("platform:gcc-sdm845"); ++MODULE_SOFTDEP("pre: rpmhpd"); +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch b/queue-5.15/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch new file mode 100644 index 00000000000..efd8e6c6b34 --- /dev/null +++ b/queue-5.15/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch @@ -0,0 +1,51 @@ +From f8cb48a4ab889f0f456f4a02c843fcc023331aef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:51 +0100 +Subject: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit a903cfd38d8dee7e754fb89fd1bebed99e28003d ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: 2b46cd23a5a2 ("clk: qcom: Add APQ8084 Multimedia Clock Controller (MMCC) support") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-6-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-apq8084.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c +index fbfcf00067394..c2fd0e8f4bc09 100644 +--- a/drivers/clk/qcom/mmcc-apq8084.c ++++ b/drivers/clk/qcom/mmcc-apq8084.c +@@ -333,6 +333,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = { + F(333430000, P_MMPLL1, 3.5, 0, 0), + F(400000000, P_MMPLL0, 2, 0, 0), + F(466800000, P_MMPLL1, 2.5, 0, 0), ++ { } + }; + + static struct clk_rcg2 mmss_axi_clk_src = { +@@ -357,6 +358,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = { + F(150000000, P_GPLL0, 4, 0, 0), + F(228570000, P_MMPLL0, 3.5, 0, 0), + F(320000000, P_MMPLL0, 2.5, 0, 0), ++ { } + }; + + static struct clk_rcg2 ocmemnoc_clk_src = { +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch b/queue-5.15/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch new file mode 100644 index 00000000000..840f10e949c --- /dev/null +++ b/queue-5.15/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch @@ -0,0 +1,51 @@ +From f1732b7f0d3b6268ad4d2e9ce662e320e7f3af01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 19:07:52 +0100 +Subject: clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays + +From: Gabor Juhos + +[ Upstream commit e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96 ] + +The frequency table arrays are supposed to be terminated with an +empty element. Add such entry to the end of the arrays where it +is missing in order to avoid possible out-of-bound access when +the table is traversed by functions like qcom_find_freq() or +qcom_find_freq_floor(). + +Only compile tested. + +Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)") +Signed-off-by: Gabor Juhos +Reviewed-by: Stephen Boyd +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-7-074334f0905c@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index a1552b6771bc6..26509bcd4f802 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -267,6 +267,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = { + F(291750000, P_MMPLL1, 4, 0, 0), + F(400000000, P_MMPLL0, 2, 0, 0), + F(466800000, P_MMPLL1, 2.5, 0, 0), ++ { } + }; + + static struct clk_rcg2 mmss_axi_clk_src = { +@@ -291,6 +292,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = { + F(150000000, P_GPLL0, 4, 0, 0), + F(291750000, P_MMPLL1, 4, 0, 0), + F(400000000, P_MMPLL0, 2, 0, 0), ++ { } + }; + + static struct clk_rcg2 ocmemnoc_clk_src = { +-- +2.43.0 + diff --git a/queue-5.15/cpufreq-dt-always-allocate-zeroed-cpumask.patch b/queue-5.15/cpufreq-dt-always-allocate-zeroed-cpumask.patch new file mode 100644 index 00000000000..1212a51a3d6 --- /dev/null +++ b/queue-5.15/cpufreq-dt-always-allocate-zeroed-cpumask.patch @@ -0,0 +1,46 @@ +From f56e69fbdc2631babfa406cefe20664f134721f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 13:54:57 +0100 +Subject: cpufreq: dt: always allocate zeroed cpumask + +From: Marek Szyprowski + +[ Upstream commit d2399501c2c081eac703ca9597ceb83c7875a537 ] + +Commit 0499a78369ad ("ARM64: Dynamically allocate cpumasks and increase +supported CPUs to 512") changed the handling of cpumasks on ARM 64bit, +what resulted in the strange issues and warnings during cpufreq-dt +initialization on some big.LITTLE platforms. + +This was caused by mixing OPPs between big and LITTLE cores, because +OPP-sharing information between big and LITTLE cores is computed on +cpumask, which in turn was not zeroed on allocation. Fix this by +switching to zalloc_cpumask_var() call. + +Fixes: dc279ac6e5b4 ("cpufreq: dt: Refactor initialization to handle probe deferral properly") +CC: stable@vger.kernel.org # v5.10+ +Signed-off-by: Marek Szyprowski +Reviewed-by: Christoph Lameter (Ampere) +Reviewed-by: Dhruva Gole +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c +index 8fcaba541539b..1bfdfa7e25c17 100644 +--- a/drivers/cpufreq/cpufreq-dt.c ++++ b/drivers/cpufreq/cpufreq-dt.c +@@ -208,7 +208,7 @@ static int dt_cpufreq_early_init(struct device *dev, int cpu) + if (!priv) + return -ENOMEM; + +- if (!alloc_cpumask_var(&priv->cpus, GFP_KERNEL)) ++ if (!zalloc_cpumask_var(&priv->cpus, GFP_KERNEL)) + return -ENOMEM; + + cpumask_set_cpu(cpu, priv->cpus); +-- +2.43.0 + diff --git a/queue-5.15/crypto-qat-fix-double-free-during-reset.patch b/queue-5.15/crypto-qat-fix-double-free-during-reset.patch new file mode 100644 index 00000000000..56100053e6d --- /dev/null +++ b/queue-5.15/crypto-qat-fix-double-free-during-reset.patch @@ -0,0 +1,42 @@ +From 7bc414c07f3e15d794ef67f575af25c173b94b2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 13:27:19 +0100 +Subject: crypto: qat - fix double free during reset + +From: Svyatoslav Pankratov + +[ Upstream commit 01aed663e6c421aeafc9c330bda630976b50a764 ] + +There is no need to free the reset_data structure if the recovery is +unsuccessful and the reset is synchronous. The function +adf_dev_aer_schedule_reset() handles the cleanup properly. Only +asynchronous resets require such structure to be freed inside the reset +worker. + +Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") +Signed-off-by: Svyatoslav Pankratov +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Stable-dep-of: 7d42e097607c ("crypto: qat - resolve race condition during AER recovery") +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_aer.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_aer.c b/drivers/crypto/qat/qat_common/adf_aer.c +index ed3e40bc56eb2..b3138f8fc3f30 100644 +--- a/drivers/crypto/qat/qat_common/adf_aer.c ++++ b/drivers/crypto/qat/qat_common/adf_aer.c +@@ -95,7 +95,8 @@ static void adf_device_reset_worker(struct work_struct *work) + if (adf_dev_init(accel_dev) || adf_dev_start(accel_dev)) { + /* The device hanged and we can't restart it so stop here */ + dev_err(&GET_DEV(accel_dev), "Restart device failed\n"); +- kfree(reset_data); ++ if (reset_data->mode == ADF_DEV_RESET_ASYNC) ++ kfree(reset_data); + WARN(1, "QAT: device restart failed. Device is unusable\n"); + return; + } +-- +2.43.0 + diff --git a/queue-5.15/crypto-qat-resolve-race-condition-during-aer-recover.patch b/queue-5.15/crypto-qat-resolve-race-condition-during-aer-recover.patch new file mode 100644 index 00000000000..9f9137dcd3b --- /dev/null +++ b/queue-5.15/crypto-qat-resolve-race-condition-during-aer-recover.patch @@ -0,0 +1,92 @@ +From 180e3bb1cd1a9dad981bb24ed5b98e24f6f5cdd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Feb 2024 13:43:42 +0100 +Subject: crypto: qat - resolve race condition during AER recovery + +From: Damian Muszynski + +[ Upstream commit 7d42e097607c4d246d99225bf2b195b6167a210c ] + +During the PCI AER system's error recovery process, the kernel driver +may encounter a race condition with freeing the reset_data structure's +memory. If the device restart will take more than 10 seconds the function +scheduling that restart will exit due to a timeout, and the reset_data +structure will be freed. However, this data structure is used for +completion notification after the restart is completed, which leads +to a UAF bug. + +This results in a KFENCE bug notice. + + BUG: KFENCE: use-after-free read in adf_device_reset_worker+0x38/0xa0 [intel_qat] + Use-after-free read at 0x00000000bc56fddf (in kfence-#142): + adf_device_reset_worker+0x38/0xa0 [intel_qat] + process_one_work+0x173/0x340 + +To resolve this race condition, the memory associated to the container +of the work_struct is freed on the worker if the timeout expired, +otherwise on the function that schedules the worker. +The timeout detection can be done by checking if the caller is +still waiting for completion or not by using completion_done() function. + +Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") +Cc: +Signed-off-by: Damian Muszynski +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_aer.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_aer.c b/drivers/crypto/qat/qat_common/adf_aer.c +index b3138f8fc3f30..040595a6ab75f 100644 +--- a/drivers/crypto/qat/qat_common/adf_aer.c ++++ b/drivers/crypto/qat/qat_common/adf_aer.c +@@ -95,7 +95,8 @@ static void adf_device_reset_worker(struct work_struct *work) + if (adf_dev_init(accel_dev) || adf_dev_start(accel_dev)) { + /* The device hanged and we can't restart it so stop here */ + dev_err(&GET_DEV(accel_dev), "Restart device failed\n"); +- if (reset_data->mode == ADF_DEV_RESET_ASYNC) ++ if (reset_data->mode == ADF_DEV_RESET_ASYNC || ++ completion_done(&reset_data->compl)) + kfree(reset_data); + WARN(1, "QAT: device restart failed. Device is unusable\n"); + return; +@@ -103,11 +104,19 @@ static void adf_device_reset_worker(struct work_struct *work) + adf_dev_restarted_notify(accel_dev); + clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status); + +- /* The dev is back alive. Notify the caller if in sync mode */ +- if (reset_data->mode == ADF_DEV_RESET_SYNC) +- complete(&reset_data->compl); +- else ++ /* ++ * The dev is back alive. Notify the caller if in sync mode ++ * ++ * If device restart will take a more time than expected, ++ * the schedule_reset() function can timeout and exit. This can be ++ * detected by calling the completion_done() function. In this case ++ * the reset_data structure needs to be freed here. ++ */ ++ if (reset_data->mode == ADF_DEV_RESET_ASYNC || ++ completion_done(&reset_data->compl)) + kfree(reset_data); ++ else ++ complete(&reset_data->compl); + } + + static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev, +@@ -140,8 +149,9 @@ static int adf_dev_aer_schedule_reset(struct adf_accel_dev *accel_dev, + dev_err(&GET_DEV(accel_dev), + "Reset device timeout expired\n"); + ret = -EFAULT; ++ } else { ++ kfree(reset_data); + } +- kfree(reset_data); + return ret; + } + return 0; +-- +2.43.0 + diff --git a/queue-5.15/dm-raid-fix-lockdep-waring-in-pers-hot_add_disk.patch b/queue-5.15/dm-raid-fix-lockdep-waring-in-pers-hot_add_disk.patch new file mode 100644 index 00000000000..70177385cef --- /dev/null +++ b/queue-5.15/dm-raid-fix-lockdep-waring-in-pers-hot_add_disk.patch @@ -0,0 +1,49 @@ +From 26a41ac8f4a7cb8cce93b6647df69a7afbe61f54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 15:23:06 +0800 +Subject: dm-raid: fix lockdep waring in "pers->hot_add_disk" + +From: Yu Kuai + +[ Upstream commit 95009ae904b1e9dca8db6f649f2d7c18a6e42c75 ] + +The lockdep assert is added by commit a448af25becf ("md/raid10: remove +rcu protection to access rdev from conf") in print_conf(). And I didn't +notice that dm-raid is calling "pers->hot_add_disk" without holding +'reconfig_mutex'. + +"pers->hot_add_disk" read and write many fields that is protected by +'reconfig_mutex', and raid_resume() already grab the lock in other +contex. Hence fix this problem by protecting "pers->host_add_disk" +with the lock. + +Fixes: 9092c02d9435 ("DM RAID: Add ability to restore transiently failed devices on resume") +Fixes: a448af25becf ("md/raid10: remove rcu protection to access rdev from conf") +Cc: stable@vger.kernel.org # v6.7+ +Signed-off-by: Yu Kuai +Signed-off-by: Xiao Ni +Acked-by: Mike Snitzer +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20240305072306.2562024-10-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/dm-raid.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index 04769fb20cf7f..5d1006142aaed 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -4049,7 +4049,9 @@ static void raid_resume(struct dm_target *ti) + * Take this opportunity to check whether any failed + * devices are reachable again. + */ ++ mddev_lock_nointr(mddev); + attempt_restore_of_faulty_devices(rs); ++ mddev_unlock(mddev); + } + + if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) { +-- +2.43.0 + diff --git a/queue-5.15/dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch b/queue-5.15/dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch new file mode 100644 index 00000000000..544fdbdce5a --- /dev/null +++ b/queue-5.15/dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch @@ -0,0 +1,40 @@ +From 14aa8a42525701537143ad8402d1ac655ce01559 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Mar 2024 18:43:11 +0100 +Subject: dm snapshot: fix lockup in dm_exception_table_exit + +From: Mikulas Patocka + +[ Upstream commit 6e7132ed3c07bd8a6ce3db4bb307ef2852b322dc ] + +There was reported lockup when we exit a snapshot with many exceptions. +Fix this by adding "cond_resched" to the loop that frees the exceptions. + +Reported-by: John Pittman +Cc: stable@vger.kernel.org +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-snap.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index dcf34c6b05ad3..d3716d5c45c23 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -686,8 +686,10 @@ static void dm_exception_table_exit(struct dm_exception_table *et, + for (i = 0; i < size; i++) { + slot = et->table + i; + +- hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) ++ hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) { + kmem_cache_free(mem, ex); ++ cond_resched(); ++ } + } + + kvfree(et->table); +-- +2.43.0 + diff --git a/queue-5.15/drm-amd-display-fix-noise-issue-on-hdmi-av-mute.patch b/queue-5.15/drm-amd-display-fix-noise-issue-on-hdmi-av-mute.patch new file mode 100644 index 00000000000..b7e85f6ce64 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-noise-issue-on-hdmi-av-mute.patch @@ -0,0 +1,59 @@ +From 4919c596bdda383651b9c6dda33c24583ae7e5d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jul 2023 08:35:07 -0400 +Subject: drm/amd/display: Fix noise issue on HDMI AV mute + +From: Leo Ma + +[ Upstream commit 69e3be6893a7e668660b05a966bead82bbddb01d ] + +[Why] +When mode switching is triggered there is momentary noise visible on +some HDMI TV or displays. + +[How] +Wait for 2 frames to make sure we have enough time to send out AV mute +and sink receives a full frame. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Reviewed-by: Wenjing Liu +Acked-by: Wayne Lin +Signed-off-by: Leo Ma +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +index f834573758113..8d8114ee67f67 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +@@ -673,10 +673,20 @@ void dcn30_set_avmute(struct pipe_ctx *pipe_ctx, bool enable) + if (pipe_ctx == NULL) + return; + +- if (dc_is_hdmi_signal(pipe_ctx->stream->signal) && pipe_ctx->stream_res.stream_enc != NULL) ++ if (dc_is_hdmi_signal(pipe_ctx->stream->signal) && pipe_ctx->stream_res.stream_enc != NULL) { + pipe_ctx->stream_res.stream_enc->funcs->set_avmute( + pipe_ctx->stream_res.stream_enc, + enable); ++ ++ /* Wait for two frame to make sure AV mute is sent out */ ++ if (enable) { ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK); ++ pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE); ++ } ++ } + } + + void dcn30_update_info_frame(struct pipe_ctx *pipe_ctx) +-- +2.43.0 + diff --git a/queue-5.15/drm-amd-display-return-the-correct-hdcp-error-code.patch b/queue-5.15/drm-amd-display-return-the-correct-hdcp-error-code.patch new file mode 100644 index 00000000000..43e836d2543 --- /dev/null +++ b/queue-5.15/drm-amd-display-return-the-correct-hdcp-error-code.patch @@ -0,0 +1,42 @@ +From be29a1e77513a655d25679696fe071de5734bd74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 13:29:51 -0700 +Subject: drm/amd/display: Return the correct HDCP error code + +From: Rodrigo Siqueira + +[ Upstream commit e64b3f55e458ce7e2087a0051f47edabf74545e7 ] + +[WHY & HOW] +If the display is null when creating an HDCP session, return a proper +error code. + +Cc: Mario Limonciello +Cc: Alex Deucher +Cc: stable@vger.kernel.org +Acked-by: Alex Hung +Signed-off-by: Rodrigo Siqueira +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c +index be61975f14703..11939be2b46ab 100644 +--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c ++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_psp.c +@@ -509,6 +509,9 @@ enum mod_hdcp_status mod_hdcp_hdcp2_create_session(struct mod_hdcp *hdcp) + hdcp_cmd = (struct ta_hdcp_shared_memory *)psp->hdcp_context.context.mem_context.shared_buf; + memset(hdcp_cmd, 0, sizeof(struct ta_hdcp_shared_memory)); + ++ if (!display) ++ return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND; ++ + hdcp_cmd->in_msg.hdcp2_create_session_v2.display_handle = display->index; + + if (hdcp->connection.link.adjust.hdcp2.force_type == MOD_HDCP_FORCE_TYPE_0) +-- +2.43.0 + diff --git a/queue-5.15/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch b/queue-5.15/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch new file mode 100644 index 00000000000..ec484e0bfd5 --- /dev/null +++ b/queue-5.15/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch @@ -0,0 +1,42 @@ +From 7e44d0b923af204165b9111529c028376bd5556b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 18:07:34 -0400 +Subject: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philip Yang + +[ Upstream commit 6c6064cbe58b43533e3451ad6a8ba9736c109ac3 ] + +Otherwise after the GTT bo is released, the GTT and gart space is freed +but amdgpu_ttm_backend_unbind will not clear the gart page table entry +and leave valid mapping entry pointing to the stale system page. Then +if GPU access the gart address mistakely, it will read undefined value +instead page fault, harder to debug and reproduce the real issue. + +Cc: stable@vger.kernel.org +Signed-off-by: Philip Yang +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index b06fb1fa411b4..9a1b19e3d4378 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -859,6 +859,7 @@ static int amdgpu_ttm_gart_bind(struct amdgpu_device *adev, + r = amdgpu_gart_bind(adev, gtt->offset, ttm->num_pages, + gtt->ttm.dma_address, flags); + } ++ gtt->bound = true; + + gart_bind_fail: + if (r) +-- +2.43.0 + diff --git a/queue-5.15/drm-etnaviv-restore-some-id-values.patch b/queue-5.15/drm-etnaviv-restore-some-id-values.patch new file mode 100644 index 00000000000..5f15f3f9642 --- /dev/null +++ b/queue-5.15/drm-etnaviv-restore-some-id-values.patch @@ -0,0 +1,75 @@ +From b079f6dceae5f98a81ee7a14d72b38fd4e99b5e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 14:28:11 +0100 +Subject: drm/etnaviv: Restore some id values + +From: Christian Gmeiner + +[ Upstream commit b735ee173f84d5d0d0733c53946a83c12d770d05 ] + +The hwdb selection logic as a feature that allows it to mark some fields +as 'don't care'. If we match with such a field we memcpy(..) +the current etnaviv_chip_identity into ident. + +This step can overwrite some id values read from the GPU with the +'don't care' value. + +Fix this issue by restoring the affected values after the memcpy(..). + +As this is crucial for user space to know when this feature works as +expected increment the minor version too. + +Fixes: 4078a1186dd3 ("drm/etnaviv: update hwdb selection logic") +Cc: stable@vger.kernel.org +Signed-off-by: Christian Gmeiner +Reviewed-by: Tomeu Vizoso +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_drv.c | 2 +- + drivers/gpu/drm/etnaviv/etnaviv_hwdb.c | 9 +++++++++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c +index 7dcc6392792df..c45e5158fdff9 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c +@@ -488,7 +488,7 @@ static const struct drm_driver etnaviv_drm_driver = { + .desc = "etnaviv DRM", + .date = "20151214", + .major = 1, +- .minor = 3, ++ .minor = 4, + }; + + /* +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c b/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c +index f2fc645c79569..212e7050c4ba6 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_hwdb.c +@@ -135,6 +135,9 @@ static const struct etnaviv_chip_identity etnaviv_chip_identities[] = { + bool etnaviv_fill_identity_from_hwdb(struct etnaviv_gpu *gpu) + { + struct etnaviv_chip_identity *ident = &gpu->identity; ++ const u32 product_id = ident->product_id; ++ const u32 customer_id = ident->customer_id; ++ const u32 eco_id = ident->eco_id; + int i; + + for (i = 0; i < ARRAY_SIZE(etnaviv_chip_identities); i++) { +@@ -148,6 +151,12 @@ bool etnaviv_fill_identity_from_hwdb(struct etnaviv_gpu *gpu) + etnaviv_chip_identities[i].eco_id == ~0U)) { + memcpy(ident, &etnaviv_chip_identities[i], + sizeof(*ident)); ++ ++ /* Restore some id values as ~0U aka 'don't care' might been used. */ ++ ident->product_id = product_id; ++ ident->customer_id = customer_id; ++ ident->eco_id = eco_id; ++ + return true; + } + } +-- +2.43.0 + diff --git a/queue-5.15/drm-exynos-do-not-return-negative-values-from-.get_m.patch b/queue-5.15/drm-exynos-do-not-return-negative-values-from-.get_m.patch new file mode 100644 index 00000000000..904607925c9 --- /dev/null +++ b/queue-5.15/drm-exynos-do-not-return-negative-values-from-.get_m.patch @@ -0,0 +1,67 @@ +From 7b034aab9b8603276c6ab62d89d06a58cb83a2ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:41 +0200 +Subject: drm/exynos: do not return negative values from .get_modes() + +From: Jani Nikula + +[ Upstream commit 13d5b040363c7ec0ac29c2de9cf661a24a8aa531 ] + +The .get_modes() hooks aren't supposed to return negative error +codes. Return 0 for no modes, whatever the reason. + +Cc: Inki Dae +Cc: Seung-Woo Kim +Cc: Kyungmin Park +Cc: stable@vger.kernel.org +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/d8665f620d9c252aa7d5a4811ff6b16e773903a2.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_vidi.c | 4 ++-- + drivers/gpu/drm/exynos/exynos_hdmi.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c +index e96436e11a36c..e1ffe8a28b649 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c +@@ -315,14 +315,14 @@ static int vidi_get_modes(struct drm_connector *connector) + */ + if (!ctx->raw_edid) { + DRM_DEV_DEBUG_KMS(ctx->dev, "raw_edid is null.\n"); +- return -EFAULT; ++ return 0; + } + + edid_len = (1 + ctx->raw_edid->extensions) * EDID_LENGTH; + edid = kmemdup(ctx->raw_edid, edid_len, GFP_KERNEL); + if (!edid) { + DRM_DEV_DEBUG_KMS(ctx->dev, "failed to allocate edid\n"); +- return -ENOMEM; ++ return 0; + } + + drm_connector_update_edid_property(connector, edid); +diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c +index 42b6b001405a5..35be9f024518d 100644 +--- a/drivers/gpu/drm/exynos/exynos_hdmi.c ++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c +@@ -887,11 +887,11 @@ static int hdmi_get_modes(struct drm_connector *connector) + int ret; + + if (!hdata->ddc_adpt) +- return -ENODEV; ++ return 0; + + edid = drm_get_edid(connector, hdata->ddc_adpt); + if (!edid) +- return -ENODEV; ++ return 0; + + hdata->dvi_mode = !drm_detect_hdmi_monitor(edid); + DRM_DEV_DEBUG_KMS(hdata->dev, "%s : width[%d] x height[%d]\n", +-- +2.43.0 + diff --git a/queue-5.15/drm-imx-ipuv3-do-not-return-negative-values-from-.ge.patch b/queue-5.15/drm-imx-ipuv3-do-not-return-negative-values-from-.ge.patch new file mode 100644 index 00000000000..21af8a7c571 --- /dev/null +++ b/queue-5.15/drm-imx-ipuv3-do-not-return-negative-values-from-.ge.patch @@ -0,0 +1,47 @@ +From f5dc4a451272130334445152e5c7467105ded09c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:43 +0200 +Subject: drm/imx/ipuv3: do not return negative values from .get_modes() + +From: Jani Nikula + +[ Upstream commit c2da9ada64962fcd2e6395ed9987b9874ea032d3 ] + +The .get_modes() hooks aren't supposed to return negative error +codes. Return 0 for no modes, whatever the reason. + +Cc: Philipp Zabel +Cc: stable@vger.kernel.org +Acked-by: Philipp Zabel +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/311f6eec96d47949b16a670529f4d89fcd97aefa.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/parallel-display.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c +index 63ba2ad846791..5423ea4c1ef9a 100644 +--- a/drivers/gpu/drm/imx/parallel-display.c ++++ b/drivers/gpu/drm/imx/parallel-display.c +@@ -70,14 +70,14 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) + int ret; + + if (!mode) +- return -EINVAL; ++ return 0; + + ret = of_get_drm_display_mode(np, &imxpd->mode, + &imxpd->bus_flags, + OF_USE_NATIVE_MODE); + if (ret) { + drm_mode_destroy(connector->dev, mode); +- return ret; ++ return 0; + } + + drm_mode_copy(mode, &imxpd->mode); +-- +2.43.0 + diff --git a/queue-5.15/drm-panel-do-not-return-negative-error-codes-from-dr.patch b/queue-5.15/drm-panel-do-not-return-negative-error-codes-from-dr.patch new file mode 100644 index 00000000000..3b7d8b8cbef --- /dev/null +++ b/queue-5.15/drm-panel-do-not-return-negative-error-codes-from-dr.patch @@ -0,0 +1,74 @@ +From 78525b1e2687163e0946741477d84e8bc2df3186 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:40 +0200 +Subject: drm/panel: do not return negative error codes from + drm_panel_get_modes() + +From: Jani Nikula + +[ Upstream commit fc4e97726530241d96dd7db72eb65979217422c9 ] + +None of the callers of drm_panel_get_modes() expect it to return +negative error codes. Either they propagate the return value in their +struct drm_connector_helper_funcs .get_modes() hook (which is also not +supposed to return negative codes), or add it to other counts leading to +bogus values. + +On the other hand, many of the struct drm_panel_funcs .get_modes() hooks +do return negative error codes, so handle them gracefully instead of +propagating further. + +Return 0 for no modes, whatever the reason. + +Cc: Neil Armstrong +Cc: Jessica Zhang +Cc: Sam Ravnborg +Cc: stable@vger.kernel.org +Reviewed-by: Neil Armstrong +Reviewed-by: Jessica Zhang +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/79f559b72d8c493940417304e222a4b04dfa19c4.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/drm_panel.c b/drivers/gpu/drm/drm_panel.c +index f634371c717a8..7fd3de89ed079 100644 +--- a/drivers/gpu/drm/drm_panel.c ++++ b/drivers/gpu/drm/drm_panel.c +@@ -207,19 +207,24 @@ EXPORT_SYMBOL(drm_panel_disable); + * The modes probed from the panel are automatically added to the connector + * that the panel is attached to. + * +- * Return: The number of modes available from the panel on success or a +- * negative error code on failure. ++ * Return: The number of modes available from the panel on success, or 0 on ++ * failure (no modes). + */ + int drm_panel_get_modes(struct drm_panel *panel, + struct drm_connector *connector) + { + if (!panel) +- return -EINVAL; ++ return 0; + +- if (panel->funcs && panel->funcs->get_modes) +- return panel->funcs->get_modes(panel, connector); ++ if (panel->funcs && panel->funcs->get_modes) { ++ int num; + +- return -EOPNOTSUPP; ++ num = panel->funcs->get_modes(panel, connector); ++ if (num > 0) ++ return num; ++ } ++ ++ return 0; + } + EXPORT_SYMBOL(drm_panel_get_modes); + +-- +2.43.0 + diff --git a/queue-5.15/drm-vc4-hdmi-do-not-return-negative-values-from-.get.patch b/queue-5.15/drm-vc4-hdmi-do-not-return-negative-values-from-.get.patch new file mode 100644 index 00000000000..414be7dbac7 --- /dev/null +++ b/queue-5.15/drm-vc4-hdmi-do-not-return-negative-values-from-.get.patch @@ -0,0 +1,39 @@ +From d7326efa605c72cb74b284d2e7f34cc6f0edca33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 18:03:44 +0200 +Subject: drm/vc4: hdmi: do not return negative values from .get_modes() + +From: Jani Nikula + +[ Upstream commit abf493988e380f25242c1023275c68bd3579c9ce ] + +The .get_modes() hooks aren't supposed to return negative error +codes. Return 0 for no modes, whatever the reason. + +Cc: Maxime Ripard +Cc: stable@vger.kernel.org +Acked-by: Maxime Ripard +Acked-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/dcda6d4003e2c6192987916b35c7304732800e08.1709913674.git.jani.nikula@intel.com +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 7a8353d7ab36a..88aa00a1891b3 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -222,7 +222,7 @@ static int vc4_hdmi_connector_get_modes(struct drm_connector *connector) + edid = drm_get_edid(connector, vc4_hdmi->ddc); + cec_s_phys_addr_from_edid(vc4_hdmi->cec_adap, edid); + if (!edid) +- return -ENODEV; ++ return 0; + + vc4_encoder->hdmi_monitor = drm_detect_hdmi_monitor(edid); + +-- +2.43.0 + diff --git a/queue-5.15/drm-vmwgfx-fix-possible-null-pointer-derefence-with-.patch b/queue-5.15/drm-vmwgfx-fix-possible-null-pointer-derefence-with-.patch new file mode 100644 index 00000000000..cc9d90e6717 --- /dev/null +++ b/queue-5.15/drm-vmwgfx-fix-possible-null-pointer-derefence-with-.patch @@ -0,0 +1,103 @@ +From f20100bb933be2ebb0fea422ee642406f15d0fdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Jan 2024 15:03:05 -0500 +Subject: drm/vmwgfx: Fix possible null pointer derefence with invalid contexts + +From: Zack Rusin + +[ Upstream commit 517621b7060096e48e42f545fa6646fc00252eac ] + +vmw_context_cotable can return either an error or a null pointer and its +usage sometimes went unchecked. Subsequent code would then try to access +either a null pointer or an error value. + +The invalid dereferences were only possible with malformed userspace +apps which never properly initialized the rendering contexts. + +Check the results of vmw_context_cotable to fix the invalid derefs. + +Thanks: +ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab +who was the first person to discover it. +Niels De Graef who reported it and helped to track down the poc. + +Fixes: 9c079b8ce8bf ("drm/vmwgfx: Adapt execbuf to the new validation api") +Cc: # v4.20+ +Reported-by: Niels De Graef +Signed-off-by: Zack Rusin +Cc: Martin Krastev +Cc: Maaz Mombasawala +Cc: Ian Forbes +Cc: Broadcom internal kernel review list +Cc: dri-devel@lists.freedesktop.org +Reviewed-by: Maaz Mombasawala +Reviewed-by: Martin Krastev +Link: https://patchwork.freedesktop.org/patch/msgid/20240110200305.94086-1-zack.rusin@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index b91f8d17404d6..21134c7f18382 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -472,7 +472,7 @@ static int vmw_resource_context_res_add(struct vmw_private *dev_priv, + vmw_res_type(ctx) == vmw_res_dx_context) { + for (i = 0; i < cotable_max; ++i) { + res = vmw_context_cotable(ctx, i); +- if (IS_ERR(res)) ++ if (IS_ERR_OR_NULL(res)) + continue; + + ret = vmw_execbuf_res_noctx_val_add(sw_context, res, +@@ -1277,6 +1277,8 @@ static int vmw_cmd_dx_define_query(struct vmw_private *dev_priv, + return -EINVAL; + + cotable_res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXQUERY); ++ if (IS_ERR_OR_NULL(cotable_res)) ++ return cotable_res ? PTR_ERR(cotable_res) : -EINVAL; + ret = vmw_cotable_notify(cotable_res, cmd->body.queryId); + + return ret; +@@ -2455,6 +2457,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv, + return ret; + + res = vmw_context_cotable(ctx_node->ctx, vmw_view_cotables[view_type]); ++ if (IS_ERR_OR_NULL(res)) ++ return res ? PTR_ERR(res) : -EINVAL; + ret = vmw_cotable_notify(res, cmd->defined_id); + if (unlikely(ret != 0)) + return ret; +@@ -2540,8 +2544,8 @@ static int vmw_cmd_dx_so_define(struct vmw_private *dev_priv, + + so_type = vmw_so_cmd_to_type(header->id); + res = vmw_context_cotable(ctx_node->ctx, vmw_so_cotables[so_type]); +- if (IS_ERR(res)) +- return PTR_ERR(res); ++ if (IS_ERR_OR_NULL(res)) ++ return res ? PTR_ERR(res) : -EINVAL; + cmd = container_of(header, typeof(*cmd), header); + ret = vmw_cotable_notify(res, cmd->defined_id); + +@@ -2660,6 +2664,8 @@ static int vmw_cmd_dx_define_shader(struct vmw_private *dev_priv, + return -EINVAL; + + res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_DXSHADER); ++ if (IS_ERR_OR_NULL(res)) ++ return res ? PTR_ERR(res) : -EINVAL; + ret = vmw_cotable_notify(res, cmd->body.shaderId); + if (ret) + return ret; +@@ -2981,6 +2987,8 @@ static int vmw_cmd_dx_define_streamoutput(struct vmw_private *dev_priv, + } + + res = vmw_context_cotable(ctx_node->ctx, SVGA_COTABLE_STREAMOUTPUT); ++ if (IS_ERR_OR_NULL(res)) ++ return res ? PTR_ERR(res) : -EINVAL; + ret = vmw_cotable_notify(res, cmd->body.soid); + if (ret) + return ret; +-- +2.43.0 + diff --git a/queue-5.15/ext4-correct-best-extent-lstart-adjustment-logic.patch b/queue-5.15/ext4-correct-best-extent-lstart-adjustment-logic.patch new file mode 100644 index 00000000000..0c3fc1f52c7 --- /dev/null +++ b/queue-5.15/ext4-correct-best-extent-lstart-adjustment-logic.patch @@ -0,0 +1,95 @@ +From f8f19642d6b79992c5cf1586b3ee39e79eead938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 22:18:45 +0800 +Subject: ext4: correct best extent lstart adjustment logic + +From: Baokun Li + +[ Upstream commit 4fbf8bc733d14bceb16dda46a3f5e19c6a9621c5 ] + +When yangerkun review commit 93cdf49f6eca ("ext4: Fix best extent lstart +adjustment logic in ext4_mb_new_inode_pa()"), it was found that the best +extent did not completely cover the original request after adjusting the +best extent lstart in ext4_mb_new_inode_pa() as follows: + + original request: 2/10(8) + normalized request: 0/64(64) + best extent: 0/9(9) + +When we check if best ex can be kept at start of goal, ac_o_ex.fe_logical +is 2 less than the adjusted best extent logical end 9, so we think the +adjustment is done. But obviously 0/9(9) doesn't cover 2/10(8), so we +should determine here if the original request logical end is less than or +equal to the adjusted best extent logical end. + +In addition, add a comment stating when adjusted best_ex will not cover +the original request, and remove the duplicate assertion because adjusting +lstart makes no change to b_ex.fe_len. + +Link: https://lore.kernel.org/r/3630fa7f-b432-7afd-5f79-781bc3b2c5ea@huawei.com +Fixes: 93cdf49f6eca ("ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()") +Cc: +Signed-off-by: yangerkun +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Reviewed-by: Ojaswin Mujoo +Link: https://lore.kernel.org/r/20240201141845.1879253-1-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index a254c2ba03576..d13d669f90fd5 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4696,10 +4696,16 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + .fe_len = ac->ac_g_ex.fe_len, + }; + loff_t orig_goal_end = extent_logical_end(sbi, &ex); ++ loff_t o_ex_end = extent_logical_end(sbi, &ac->ac_o_ex); + +- /* we can't allocate as much as normalizer wants. +- * so, found space must get proper lstart +- * to cover original request */ ++ /* ++ * We can't allocate as much as normalizer wants, so we try ++ * to get proper lstart to cover the original request, except ++ * when the goal doesn't cover the original request as below: ++ * ++ * orig_ex:2045/2055(10), isize:8417280 -> normalized:0/2048 ++ * best_ex:0/200(200) -> adjusted: 1848/2048(200) ++ */ + BUG_ON(ac->ac_g_ex.fe_logical > ac->ac_o_ex.fe_logical); + BUG_ON(ac->ac_g_ex.fe_len < ac->ac_o_ex.fe_len); + +@@ -4711,7 +4717,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + * 1. Check if best ex can be kept at end of goal and still + * cover original start + * 2. Else, check if best ex can be kept at start of goal and +- * still cover original start ++ * still cover original end + * 3. Else, keep the best ex at start of original request. + */ + ex.fe_len = ac->ac_b_ex.fe_len; +@@ -4721,7 +4727,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + goto adjust_bex; + + ex.fe_logical = ac->ac_g_ex.fe_logical; +- if (ac->ac_o_ex.fe_logical < extent_logical_end(sbi, &ex)) ++ if (o_ex_end <= extent_logical_end(sbi, &ex)) + goto adjust_bex; + + ex.fe_logical = ac->ac_o_ex.fe_logical; +@@ -4729,7 +4735,6 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac) + ac->ac_b_ex.fe_logical = ex.fe_logical; + + BUG_ON(ac->ac_o_ex.fe_logical < ac->ac_b_ex.fe_logical); +- BUG_ON(ac->ac_o_ex.fe_len > ac->ac_b_ex.fe_len); + BUG_ON(extent_logical_end(sbi, &ex) > orig_goal_end); + } + +-- +2.43.0 + diff --git a/queue-5.15/ext4-fix-corruption-during-on-line-resize.patch b/queue-5.15/ext4-fix-corruption-during-on-line-resize.patch new file mode 100644 index 00000000000..5eee54073a2 --- /dev/null +++ b/queue-5.15/ext4-fix-corruption-during-on-line-resize.patch @@ -0,0 +1,79 @@ +From f9d60f1fee14169216a4bebb4c51b31ccff771cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Feb 2024 15:50:09 +0000 +Subject: ext4: fix corruption during on-line resize + +From: Maximilian Heyne + +[ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] + +We observed a corruption during on-line resize of a file system that is +larger than 16 TiB with 4k block size. With having more then 2^32 blocks +resize_inode is turned off by default by mke2fs. The issue can be +reproduced on a smaller file system for convenience by explicitly +turning off resize_inode. An on-line resize across an 8 GiB boundary (the +size of a meta block group in this setup) then leads to a corruption: + + dev=/dev/ # should be >= 16 GiB + mkdir -p /corruption + /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) + mount -t ext4 $dev /corruption + + dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) + sha1sum /corruption/test + # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test + + /sbin/resize2fs $dev $((2*2**21)) + # drop page cache to force reload the block from disk + echo 1 > /proc/sys/vm/drop_caches + + sha1sum /corruption/test + # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test + +2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per +block group and 2^6 are the number of block groups that make a meta +block group. + +The last checksum might be different depending on how the file is laid +out across the physical blocks. The actual corruption occurs at physical +block 63*2^15 = 2064384 which would be the location of the backup of the +meta block group's block descriptor. During the on-line resize the file +system will be converted to meta_bg starting at s_first_meta_bg which is +2 in the example - meaning all block groups after 16 GiB. However, in +ext4_flex_group_add we might add block groups that are not part of the +first meta block group yet. In the reproducer we achieved this by +substracting the size of a whole block group from the point where the +meta block group would start. This must be considered when updating the +backup block group descriptors to follow the non-meta_bg layout. The fix +is to add a test whether the group to add is already part of the meta +block group or not. + +Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") +Cc: +Signed-off-by: Maximilian Heyne +Tested-by: Srivathsa Dara +Reviewed-by: Srivathsa Dara +Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/resize.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 70d4f6e3aaa7f..4687d5972074d 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1559,7 +1559,8 @@ static int ext4_flex_group_add(struct super_block *sb, + int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); + int gdb_num_end = ((group + flex_gd->count - 1) / + EXT4_DESC_PER_BLOCK(sb)); +- int meta_bg = ext4_has_feature_meta_bg(sb); ++ int meta_bg = ext4_has_feature_meta_bg(sb) && ++ gdb_num >= le32_to_cpu(es->s_first_meta_bg); + sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr - + ext4_group_first_block_no(sb, 0); + sector_t old_gdb = 0; +-- +2.43.0 + diff --git a/queue-5.15/fat-fix-uninitialized-field-in-nostale-filehandles.patch b/queue-5.15/fat-fix-uninitialized-field-in-nostale-filehandles.patch new file mode 100644 index 00000000000..185f8643d6a --- /dev/null +++ b/queue-5.15/fat-fix-uninitialized-field-in-nostale-filehandles.patch @@ -0,0 +1,49 @@ +From 38f18cea9628844b8e4072ba1b67ebae336b1a66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Feb 2024 13:26:26 +0100 +Subject: fat: fix uninitialized field in nostale filehandles + +From: Jan Kara + +[ Upstream commit fde2497d2bc3a063d8af88b258dbadc86bd7b57c ] + +When fat_encode_fh_nostale() encodes file handle without a parent it +stores only first 10 bytes of the file handle. However the length of the +file handle must be a multiple of 4 so the file handle is actually 12 +bytes long and the last two bytes remain uninitialized. This is not +great at we potentially leak uninitialized information with the handle +to userspace. Properly initialize the full handle length. + +Link: https://lkml.kernel.org/r/20240205122626.13701-1-jack@suse.cz +Reported-by: syzbot+3ce5dea5b1539ff36769@syzkaller.appspotmail.com +Fixes: ea3983ace6b7 ("fat: restructure export_operations") +Signed-off-by: Jan Kara +Acked-by: OGAWA Hirofumi +Cc: Amir Goldstein +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/fat/nfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/fat/nfs.c b/fs/fat/nfs.c +index af191371c3529..bab63eeaf9cbc 100644 +--- a/fs/fat/nfs.c ++++ b/fs/fat/nfs.c +@@ -130,6 +130,12 @@ fat_encode_fh_nostale(struct inode *inode, __u32 *fh, int *lenp, + fid->parent_i_gen = parent->i_generation; + type = FILEID_FAT_WITH_PARENT; + *lenp = FAT_FID_SIZE_WITH_PARENT; ++ } else { ++ /* ++ * We need to initialize this field because the fh is actually ++ * 12 bytes long ++ */ ++ fid->parent_i_pos_hi = 0; + } + + return type; +-- +2.43.0 + diff --git a/queue-5.15/fuse-don-t-unhash-root.patch b/queue-5.15/fuse-don-t-unhash-root.patch new file mode 100644 index 00000000000..404bd5d0502 --- /dev/null +++ b/queue-5.15/fuse-don-t-unhash-root.patch @@ -0,0 +1,54 @@ +From cb3e68017eeab61358f6313a558d774e2f490d19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 16:50:49 +0100 +Subject: fuse: don't unhash root + +From: Miklos Szeredi + +[ Upstream commit b1fe686a765e6c0d71811d825b5a1585a202b777 ] + +The root inode is assumed to be always hashed. Do not unhash the root +inode even if it is marked BAD. + +Fixes: 5d069dbe8aaf ("fuse: fix bad inode") +Cc: # v5.11 +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/fuse_i.h | 1 - + fs/fuse/inode.c | 7 +++++-- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index 4b8f094345e12..55b7ca26fb8ab 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -899,7 +899,6 @@ static inline bool fuse_stale_inode(const struct inode *inode, int generation, + + static inline void fuse_make_bad(struct inode *inode) + { +- remove_inode_hash(inode); + set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); + } + +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index 97dc24557bf24..62b4143ccf26c 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -413,8 +413,11 @@ struct inode *fuse_iget(struct super_block *sb, u64 nodeid, + } else if (fuse_stale_inode(inode, generation, attr)) { + /* nodeid was reused, any I/O on the old inode should fail */ + fuse_make_bad(inode); +- iput(inode); +- goto retry; ++ if (inode != d_inode(sb->s_root)) { ++ remove_inode_hash(inode); ++ iput(inode); ++ goto retry; ++ } + } + fi = get_fuse_inode(inode); + spin_lock(&fi->lock); +-- +2.43.0 + diff --git a/queue-5.15/fuse-fix-root-lookup-with-nonzero-generation.patch b/queue-5.15/fuse-fix-root-lookup-with-nonzero-generation.patch new file mode 100644 index 00000000000..257eb1a9855 --- /dev/null +++ b/queue-5.15/fuse-fix-root-lookup-with-nonzero-generation.patch @@ -0,0 +1,48 @@ +From 07de043abd84a85bc408dfbc62933a988d1aed38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 16:50:49 +0100 +Subject: fuse: fix root lookup with nonzero generation + +From: Miklos Szeredi + +[ Upstream commit 68ca1b49e430f6534d0774a94147a823e3b8b26e ] + +The root inode has a fixed nodeid and generation (1, 0). + +Prior to the commit 15db16837a35 ("fuse: fix illegal access to inode with +reused nodeid") generation number on lookup was ignored. After this commit +lookup with the wrong generation number resulted in the inode being +unhashed. This is correct for non-root inodes, but replacing the root +inode is wrong and results in weird behavior. + +Fix by reverting to the old behavior if ignoring the generation for the +root inode, but issuing a warning in dmesg. + +Reported-by: Antonio SJ Musumeci +Closes: https://lore.kernel.org/all/CAOQ4uxhek5ytdN8Yz2tNEOg5ea4NkBb4nk0FGPjPk_9nz-VG3g@mail.gmail.com/ +Fixes: 15db16837a35 ("fuse: fix illegal access to inode with reused nodeid") +Cc: # v5.14 +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/fuse/dir.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index 4ea52906ae150..44d1c8cc58a42 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -390,6 +390,10 @@ int fuse_lookup_name(struct super_block *sb, u64 nodeid, const struct qstr *name + goto out_put_forget; + if (fuse_invalid_attr(&outarg->attr)) + goto out_put_forget; ++ if (outarg->nodeid == FUSE_ROOT_ID && outarg->generation != 0) { ++ pr_warn_once("root generation should be zero\n"); ++ outarg->generation = 0; ++ } + + *inode = fuse_iget(sb, outarg->nodeid, outarg->generation, + &outarg->attr, entry_attr_timeout(outarg), +-- +2.43.0 + diff --git a/queue-5.15/hwmon-amc6821-add-of_match-table.patch b/queue-5.15/hwmon-amc6821-add-of_match-table.patch new file mode 100644 index 00000000000..6237963ec8a --- /dev/null +++ b/queue-5.15/hwmon-amc6821-add-of_match-table.patch @@ -0,0 +1,56 @@ +From 86588c63b6ea8045c4678dba8f393ae3961ecae2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 12:06:58 +0100 +Subject: hwmon: (amc6821) add of_match table + +From: Josua Mayer + +[ Upstream commit 3f003fda98a7a8d5f399057d92e6ed56b468657c ] + +Add of_match table for "ti,amc6821" compatible string. +This fixes automatic driver loading by userspace when using device-tree, +and if built as a module like major linux distributions do. + +While devices probe just fine with i2c_device_id table, userspace can't +match the "ti,amc6821" compatible string from dt with the plain +"amc6821" device id. As a result, the kernel module can not be loaded. + +Cc: stable@vger.kernel.org +Signed-off-by: Josua Mayer +Link: https://lore.kernel.org/r/20240307-amc6821-of-match-v1-1-5f40464a3110@solid-run.com +[groeck: Cleaned up patch description] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/amc6821.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c +index 6b1ce2242c618..60dfdb0f55231 100644 +--- a/drivers/hwmon/amc6821.c ++++ b/drivers/hwmon/amc6821.c +@@ -934,10 +934,21 @@ static const struct i2c_device_id amc6821_id[] = { + + MODULE_DEVICE_TABLE(i2c, amc6821_id); + ++static const struct of_device_id __maybe_unused amc6821_of_match[] = { ++ { ++ .compatible = "ti,amc6821", ++ .data = (void *)amc6821, ++ }, ++ { } ++}; ++ ++MODULE_DEVICE_TABLE(of, amc6821_of_match); ++ + static struct i2c_driver amc6821_driver = { + .class = I2C_CLASS_HWMON, + .driver = { + .name = "amc6821", ++ .of_match_table = of_match_ptr(amc6821_of_match), + }, + .probe_new = amc6821_probe, + .id_table = amc6821_id, +-- +2.43.0 + diff --git a/queue-5.15/isystem-delete-global-isystem-compile-option.patch b/queue-5.15/isystem-delete-global-isystem-compile-option.patch new file mode 100644 index 00000000000..a2aa50682a4 --- /dev/null +++ b/queue-5.15/isystem-delete-global-isystem-compile-option.patch @@ -0,0 +1,210 @@ +From 35d3afe2e727a724d1a96b72b77cace2bbf367ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Aug 2021 23:43:15 +0300 +Subject: isystem: delete global -isystem compile option + +From: Alexey Dobriyan + +[ Upstream commit 04e85bbf71c9072dcf0ad9a7150495d72461105c ] + +Further isolate kernel from userspace, prevent accidental inclusion of +undesireable headers, mainly float.h and stdatomic.h. + +nds32 keeps -isystem globally due to intrinsics used in entrenched header. + +-isystem is selectively reenabled for some files, again, for intrinsics. + +Compile tested on: + +hexagon-defconfig hexagon-allmodconfig +alpha-allmodconfig alpha-allnoconfig alpha-defconfig arm64-allmodconfig +arm64-allnoconfig arm64-defconfig arm-am200epdkit arm-aspeed_g4 +arm-aspeed_g5 arm-assabet arm-at91_dt arm-axm55xx arm-badge4 arm-bcm2835 +arm-cerfcube arm-clps711x arm-cm_x300 arm-cns3420vb arm-colibri_pxa270 +arm-colibri_pxa300 arm-collie arm-corgi arm-davinci_all arm-dove +arm-ep93xx arm-eseries_pxa arm-exynos arm-ezx arm-footbridge arm-gemini +arm-h3600 arm-h5000 arm-hackkit arm-hisi arm-imote2 arm-imx_v4_v5 +arm-imx_v6_v7 arm-integrator arm-iop32x arm-ixp4xx arm-jornada720 +arm-keystone arm-lart arm-lpc18xx arm-lpc32xx arm-lpd270 arm-lubbock +arm-magician arm-mainstone arm-milbeaut_m10v arm-mini2440 arm-mmp2 +arm-moxart arm-mps2 arm-multi_v4t arm-multi_v5 arm-multi_v7 arm-mv78xx0 +arm-mvebu_v5 arm-mvebu_v7 arm-mxs arm-neponset arm-netwinder arm-nhk8815 +arm-omap1 arm-omap2plus arm-orion5x arm-oxnas_v6 arm-palmz72 arm-pcm027 +arm-pleb arm-pxa arm-pxa168 arm-pxa255-idp arm-pxa3xx arm-pxa910 +arm-qcom arm-realview arm-rpc arm-s3c2410 arm-s3c6400 arm-s5pv210 +arm-sama5 arm-shannon arm-shmobile arm-simpad arm-socfpga arm-spear13xx +arm-spear3xx arm-spear6xx arm-spitz arm-stm32 arm-sunxi arm-tct_hammer +arm-tegra arm-trizeps4 arm-u8500 arm-versatile arm-vexpress arm-vf610m4 +arm-viper arm-vt8500_v6_v7 arm-xcep arm-zeus csky-allmodconfig +csky-allnoconfig csky-defconfig h8300-edosk2674 h8300-h8300h-sim +h8300-h8s-sim i386-allmodconfig i386-allnoconfig i386-defconfig +ia64-allmodconfig ia64-allnoconfig ia64-bigsur ia64-generic ia64-gensparse +ia64-tiger ia64-zx1 m68k-amcore m68k-amiga m68k-apollo m68k-atari +m68k-bvme6000 m68k-hp300 m68k-m5208evb m68k-m5249evb m68k-m5272c3 +m68k-m5275evb m68k-m5307c3 m68k-m5407c3 m68k-m5475evb m68k-mac +m68k-multi m68k-mvme147 m68k-mvme16x m68k-q40 m68k-stmark2 m68k-sun3 +m68k-sun3x microblaze-allmodconfig microblaze-allnoconfig microblaze-mmu +mips-ar7 mips-ath25 mips-ath79 mips-bcm47xx mips-bcm63xx mips-bigsur +mips-bmips_be mips-bmips_stb mips-capcella mips-cavium_octeon mips-ci20 +mips-cobalt mips-cu1000-neo mips-cu1830-neo mips-db1xxx mips-decstation +mips-decstation_64 mips-decstation_r4k mips-e55 mips-fuloong2e +mips-gcw0 mips-generic mips-gpr mips-ip22 mips-ip27 mips-ip28 mips-ip32 +mips-jazz mips-jmr3927 mips-lemote2f mips-loongson1b mips-loongson1c +mips-loongson2k mips-loongson3 mips-malta mips-maltaaprp mips-malta_kvm +mips-malta_qemu_32r6 mips-maltasmvp mips-maltasmvp_eva mips-maltaup +mips-maltaup_xpa mips-mpc30x mips-mtx1 mips-nlm_xlp mips-nlm_xlr +mips-omega2p mips-pic32mzda mips-pistachio mips-qi_lb60 mips-rb532 +mips-rbtx49xx mips-rm200 mips-rs90 mips-rt305x mips-sb1250_swarm +mips-tb0219 mips-tb0226 mips-tb0287 mips-vocore2 mips-workpad mips-xway +nds32-allmodconfig nds32-allnoconfig nds32-defconfig nios2-10m50 +nios2-3c120 nios2-allmodconfig nios2-allnoconfig openrisc-allmodconfig +openrisc-allnoconfig openrisc-or1klitex openrisc-or1ksim +openrisc-simple_smp parisc-allnoconfig parisc-generic-32bit +parisc-generic-64bit powerpc-acadia powerpc-adder875 powerpc-akebono +powerpc-amigaone powerpc-arches powerpc-asp8347 powerpc-bamboo +powerpc-bluestone powerpc-canyonlands powerpc-cell powerpc-chrp32 +powerpc-cm5200 powerpc-currituck powerpc-ebony powerpc-eiger +powerpc-ep8248e powerpc-ep88xc powerpc-fsp2 powerpc-g5 powerpc-gamecube +powerpc-ge_imp3a powerpc-holly powerpc-icon powerpc-iss476-smp +powerpc-katmai powerpc-kilauea powerpc-klondike powerpc-kmeter1 +powerpc-ksi8560 powerpc-linkstation powerpc-lite5200b powerpc-makalu +powerpc-maple powerpc-mgcoge powerpc-microwatt powerpc-motionpro +powerpc-mpc512x powerpc-mpc5200 powerpc-mpc7448_hpc2 powerpc-mpc8272_ads +powerpc-mpc8313_rdb powerpc-mpc8315_rdb powerpc-mpc832x_mds +powerpc-mpc832x_rdb powerpc-mpc834x_itx powerpc-mpc834x_itxgp +powerpc-mpc834x_mds powerpc-mpc836x_mds powerpc-mpc836x_rdk +powerpc-mpc837x_mds powerpc-mpc837x_rdb powerpc-mpc83xx +powerpc-mpc8540_ads powerpc-mpc8560_ads powerpc-mpc85xx_cds +powerpc-mpc866_ads powerpc-mpc885_ads powerpc-mvme5100 powerpc-obs600 +powerpc-pasemi powerpc-pcm030 powerpc-pmac32 powerpc-powernv +powerpc-ppa8548 powerpc-ppc40x powerpc-ppc44x powerpc-ppc64 +powerpc-ppc64e powerpc-ppc6xx powerpc-pq2fads powerpc-ps3 +powerpc-pseries powerpc-rainier powerpc-redwood powerpc-sam440ep +powerpc-sbc8548 powerpc-sequoia powerpc-skiroot powerpc-socrates +powerpc-storcenter powerpc-stx_gp3 powerpc-taishan powerpc-tqm5200 +powerpc-tqm8540 powerpc-tqm8541 powerpc-tqm8548 powerpc-tqm8555 +powerpc-tqm8560 powerpc-tqm8xx powerpc-walnut powerpc-warp powerpc-wii +powerpc-xes_mpc85xx riscv-allmodconfig riscv-allnoconfig riscv-nommu_k210 +riscv-nommu_k210_sdcard riscv-nommu_virt riscv-rv32 s390-allmodconfig +s390-allnoconfig s390-debug s390-zfcpdump sh-ap325rxa sh-apsh4a3a +sh-apsh4ad0a sh-dreamcast sh-ecovec24 sh-ecovec24-romimage sh-edosk7705 +sh-edosk7760 sh-espt sh-hp6xx sh-j2 sh-kfr2r09 sh-kfr2r09-romimage +sh-landisk sh-lboxre2 sh-magicpanelr2 sh-microdev sh-migor sh-polaris +sh-r7780mp sh-r7785rp sh-rsk7201 sh-rsk7203 sh-rsk7264 sh-rsk7269 +sh-rts7751r2d1 sh-rts7751r2dplus sh-sdk7780 sh-sdk7786 sh-se7206 sh-se7343 +sh-se7619 sh-se7705 sh-se7712 sh-se7721 sh-se7722 sh-se7724 sh-se7750 +sh-se7751 sh-se7780 sh-secureedge5410 sh-sh03 sh-sh2007 sh-sh7710voipgw +sh-sh7724_generic sh-sh7757lcr sh-sh7763rdp sh-sh7770_generic sh-sh7785lcr +sh-sh7785lcr_32bit sh-shmin sh-shx3 sh-titan sh-ul2 sh-urquell +sparc-allmodconfig sparc-allnoconfig sparc-sparc32 sparc-sparc64 +um-i386-allmodconfig um-i386-allnoconfig um-i386-defconfig +um-x86_64-allmodconfig um-x86_64-allnoconfig x86_64-allmodconfig +x86_64-allnoconfig x86_64-defconfig xtensa-allmodconfig xtensa-allnoconfig +xtensa-audio_kc705 xtensa-cadence_csp xtensa-common xtensa-generic_kc705 +xtensa-iss xtensa-nommu_kc705 xtensa-smp_lx200 xtensa-virt +xtensa-xip_kc705 + +Tested-by: Nathan Chancellor # build (hexagon) +Signed-off-by: Alexey Dobriyan +Acked-by: Ard Biesheuvel +Signed-off-by: Masahiro Yamada +Stable-dep-of: 35f20786c481 ("powerpc: xor_vmx: Add '-mhard-float' to CFLAGS") +Signed-off-by: Sasha Levin +--- + Makefile | 2 +- + arch/arm64/lib/Makefile | 2 ++ + arch/nds32/Makefile | 2 ++ + arch/powerpc/lib/Makefile | 2 ++ + crypto/Makefile | 2 ++ + lib/raid6/Makefile | 4 ++++ + 6 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 07a0f520f2df7..53bfef2e8e03f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1005,7 +1005,7 @@ KBUILD_CFLAGS += -falign-functions=64 + endif + + # arch Makefile may override CC so keep this after arch Makefile is included +-NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include) ++NOSTDINC_FLAGS += -nostdinc + + # warn about C99 declaration after statement + KBUILD_CFLAGS += -Wdeclaration-after-statement +diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile +index 0941180a86d34..29490be2546bf 100644 +--- a/arch/arm64/lib/Makefile ++++ b/arch/arm64/lib/Makefile +@@ -9,6 +9,8 @@ ifeq ($(CONFIG_KERNEL_MODE_NEON), y) + obj-$(CONFIG_XOR_BLOCKS) += xor-neon.o + CFLAGS_REMOVE_xor-neon.o += -mgeneral-regs-only + CFLAGS_xor-neon.o += -ffreestanding ++# Enable ++CFLAGS_xor-neon.o += -isystem $(shell $(CC) -print-file-name=include) + endif + + lib-$(CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE) += uaccess_flushcache.o +diff --git a/arch/nds32/Makefile b/arch/nds32/Makefile +index ccdca71420201..c17fc3a755c38 100644 +--- a/arch/nds32/Makefile ++++ b/arch/nds32/Makefile +@@ -9,6 +9,8 @@ endif + # Avoid generating FPU instructions + arch-y += -mno-ext-fpu-sp -mno-ext-fpu-dp -mfloat-abi=soft + ++# Enable ++KBUILD_CFLAGS += -isystem $(shell $(CC) -print-file-name=include) + KBUILD_CFLAGS += $(call cc-option, -mno-sched-prolog-epilog) + KBUILD_CFLAGS += -mcmodel=large + +diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile +index 6448de85f7380..9b0f5e6ffa3f2 100644 +--- a/arch/powerpc/lib/Makefile ++++ b/arch/powerpc/lib/Makefile +@@ -68,5 +68,7 @@ obj-$(CONFIG_FTR_FIXUP_SELFTEST) += feature-fixups-test.o + + obj-$(CONFIG_ALTIVEC) += xor_vmx.o xor_vmx_glue.o + CFLAGS_xor_vmx.o += -maltivec $(call cc-option,-mabi=altivec) ++# Enable ++CFLAGS_xor_vmx.o += -isystem $(shell $(CC) -print-file-name=include) + + obj-$(CONFIG_PPC64) += $(obj64-y) +diff --git a/crypto/Makefile b/crypto/Makefile +index 429591ffeb5da..fd69bca878e88 100644 +--- a/crypto/Makefile ++++ b/crypto/Makefile +@@ -118,6 +118,8 @@ CFLAGS_aegis128-neon-inner.o += $(aegis128-cflags-y) + CFLAGS_REMOVE_aegis128-neon-inner.o += -mgeneral-regs-only + aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o + endif ++# Enable ++CFLAGS_aegis128-neon-inner.o += -isystem $(shell $(CC) -print-file-name=include) + + obj-$(CONFIG_CRYPTO_PCRYPT) += pcrypt.o + obj-$(CONFIG_CRYPTO_CRYPTD) += cryptd.o +diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile +index c770570bfe4f2..45e17619422b4 100644 +--- a/lib/raid6/Makefile ++++ b/lib/raid6/Makefile +@@ -14,6 +14,8 @@ hostprogs += mktables + + ifeq ($(CONFIG_ALTIVEC),y) + altivec_flags := -maltivec $(call cc-option,-mabi=altivec) ++# Enable ++altivec_flags += -isystem $(shell $(CC) -print-file-name=include) + + ifdef CONFIG_CC_IS_CLANG + # clang ppc port does not yet support -maltivec when -msoft-float is +@@ -34,6 +36,8 @@ endif + # ARM/NEON intrinsics in a non C99-compliant environment (such as the kernel) + ifeq ($(CONFIG_KERNEL_MODE_NEON),y) + NEON_FLAGS := -ffreestanding ++# Enable ++NEON_FLAGS += -isystem $(shell $(CC) -print-file-name=include) + ifeq ($(ARCH),arm) + NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon + endif +-- +2.43.0 + diff --git a/queue-5.15/kasan-test-add-memcpy-test-that-avoids-out-of-bounds.patch b/queue-5.15/kasan-test-add-memcpy-test-that-avoids-out-of-bounds.patch new file mode 100644 index 00000000000..a5a71df6098 --- /dev/null +++ b/queue-5.15/kasan-test-add-memcpy-test-that-avoids-out-of-bounds.patch @@ -0,0 +1,103 @@ +From 78fb0b4c22c41e374374245def3a5cd7200345bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 13:35:56 -0700 +Subject: kasan: test: add memcpy test that avoids out-of-bounds write + +From: Peter Collingbourne + +[ Upstream commit 758cabae312d3aded781aacc6d0c946b299c52df ] + +With HW tag-based KASAN, error checks are performed implicitly by the +load and store instructions in the memcpy implementation. A failed +check results in tag checks being disabled and execution will keep +going. As a result, under HW tag-based KASAN, prior to commit +1b0668be62cf ("kasan: test: disable kmalloc_memmove_invalid_size for +HW_TAGS"), this memcpy would end up corrupting memory until it hits an +inaccessible page and causes a kernel panic. + +This is a pre-existing issue that was revealed by commit 285133040e6c +("arm64: Import latest memcpy()/memmove() implementation") which changed +the memcpy implementation from using signed comparisons (incorrectly, +resulting in the memcpy being terminated early for negative sizes) to +using unsigned comparisons. + +It is unclear how this could be handled by memcpy itself in a reasonable +way. One possibility would be to add an exception handler that would +force memcpy to return if a tag check fault is detected -- this would +make the behavior roughly similar to generic and SW tag-based KASAN. +However, this wouldn't solve the problem for asynchronous mode and also +makes memcpy behavior inconsistent with manually copying data. + +This test was added as a part of a series that taught KASAN to detect +negative sizes in memory operations, see commit 8cceeff48f23 ("kasan: +detect negative size in memory operation function"). Therefore we +should keep testing for negative sizes with generic and SW tag-based +KASAN. But there is some value in testing small memcpy overflows, so +let's add another test with memcpy that does not destabilize the kernel +by performing out-of-bounds writes, and run it in all modes. + +Link: https://linux-review.googlesource.com/id/I048d1e6a9aff766c4a53f989fb0c83de68923882 +Link: https://lkml.kernel.org/r/20210910211356.3603758-1-pcc@google.com +Signed-off-by: Peter Collingbourne +Reviewed-by: Andrey Konovalov +Acked-by: Marco Elver +Cc: Robin Murphy +Cc: Will Deacon +Cc: Catalin Marinas +Cc: Mark Rutland +Cc: Evgenii Stepanov +Cc: Alexander Potapenko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: e10aea105e9e ("kasan/test: avoid gcc warning for intentional overflow") +Signed-off-by: Sasha Levin +--- + lib/test_kasan.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/lib/test_kasan.c b/lib/test_kasan.c +index 89f444cabd4a8..f0b8b05ccf194 100644 +--- a/lib/test_kasan.c ++++ b/lib/test_kasan.c +@@ -500,7 +500,7 @@ static void kmalloc_oob_in_memset(struct kunit *test) + kfree(ptr); + } + +-static void kmalloc_memmove_invalid_size(struct kunit *test) ++static void kmalloc_memmove_negative_size(struct kunit *test) + { + char *ptr; + size_t size = 64; +@@ -522,6 +522,21 @@ static void kmalloc_memmove_invalid_size(struct kunit *test) + kfree(ptr); + } + ++static void kmalloc_memmove_invalid_size(struct kunit *test) ++{ ++ char *ptr; ++ size_t size = 64; ++ volatile size_t invalid_size = size; ++ ++ ptr = kmalloc(size, GFP_KERNEL); ++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); ++ ++ memset((char *)ptr, 0, 64); ++ KUNIT_EXPECT_KASAN_FAIL(test, ++ memmove((char *)ptr, (char *)ptr + 4, invalid_size)); ++ kfree(ptr); ++} ++ + static void kmalloc_uaf(struct kunit *test) + { + char *ptr; +@@ -1139,6 +1154,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { + KUNIT_CASE(kmalloc_oob_memset_4), + KUNIT_CASE(kmalloc_oob_memset_8), + KUNIT_CASE(kmalloc_oob_memset_16), ++ KUNIT_CASE(kmalloc_memmove_negative_size), + KUNIT_CASE(kmalloc_memmove_invalid_size), + KUNIT_CASE(kmalloc_uaf), + KUNIT_CASE(kmalloc_uaf_memset), +-- +2.43.0 + diff --git a/queue-5.15/kasan-test-avoid-gcc-warning-for-intentional-overflo.patch b/queue-5.15/kasan-test-avoid-gcc-warning-for-intentional-overflo.patch new file mode 100644 index 00000000000..18dca732063 --- /dev/null +++ b/queue-5.15/kasan-test-avoid-gcc-warning-for-intentional-overflo.patch @@ -0,0 +1,56 @@ +From 53a37cb948cd0bf77930aa65af70b88b1fc99143 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 12:15:52 +0100 +Subject: kasan/test: avoid gcc warning for intentional overflow + +From: Arnd Bergmann + +[ Upstream commit e10aea105e9ed14b62a11844fec6aaa87c6935a3 ] + +The out-of-bounds test allocates an object that is three bytes too short +in order to validate the bounds checking. Starting with gcc-14, this +causes a compile-time warning as gcc has grown smart enough to understand +the sizeof() logic: + +mm/kasan/kasan_test.c: In function 'kmalloc_oob_16': +mm/kasan/kasan_test.c:443:14: error: allocation of insufficient size '13' for type 'struct ' with size '16' [-Werror=alloc-size] + 443 | ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); + | ^ + +Hide the actual computation behind a RELOC_HIDE() that ensures +the compiler misses the intentional bug. + +Link: https://lkml.kernel.org/r/20240212111609.869266-1-arnd@kernel.org +Fixes: 3f15801cdc23 ("lib: add kasan test module") +Signed-off-by: Arnd Bergmann +Reviewed-by: Andrey Konovalov +Cc: Alexander Potapenko +Cc: Andrey Ryabinin +Cc: Arnd Bergmann +Cc: Dmitry Vyukov +Cc: Marco Elver +Cc: Vincenzo Frascino +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/test_kasan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/test_kasan.c b/lib/test_kasan.c +index f0b8b05ccf194..ffedc34714ba7 100644 +--- a/lib/test_kasan.c ++++ b/lib/test_kasan.c +@@ -403,7 +403,8 @@ static void kmalloc_oob_16(struct kunit *test) + /* This test is specifically crafted for the generic mode. */ + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); + +- ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL); ++ /* RELOC_HIDE to prevent gcc from warning about short alloc */ ++ ptr1 = RELOC_HIDE(kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL), 0); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); + + ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL); +-- +2.43.0 + diff --git a/queue-5.15/kbuild-move-wenum-compare-conditional-enum-conversio.patch b/queue-5.15/kbuild-move-wenum-compare-conditional-enum-conversio.patch new file mode 100644 index 00000000000..ab8f70df175 --- /dev/null +++ b/queue-5.15/kbuild-move-wenum-compare-conditional-enum-conversio.patch @@ -0,0 +1,72 @@ +From c40848a23ccc5044b49a48b8a9c92f5a6ed35afe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 15:12:47 -0700 +Subject: kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 + +From: Nathan Chancellor + +[ Upstream commit 75b5ab134bb5f657ef7979a59106dce0657e8d87 ] + +Clang enables -Wenum-enum-conversion and -Wenum-compare-conditional +under -Wenum-conversion. A recent change in Clang strengthened these +warnings and they appear frequently in common builds, primarily due to +several instances in common headers but there are quite a few drivers +that have individual instances as well. + + include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] + 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + + | ~~~~~~~~~~~~~~~~~~~~~ ^ + 509 | item]; + | ~~~~ + + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c:955:24: warning: conditional expression between different enumeration types ('enum iwl_mac_beacon_flags' and 'enum iwl_mac_beacon_flags_v1') [-Wenum-compare-conditional] + 955 | flags |= is_new_rate ? IWL_MAC_BEACON_CCK + | ^ ~~~~~~~~~~~~~~~~~~ + 956 | : IWL_MAC_BEACON_CCK_V1; + | ~~~~~~~~~~~~~~~~~~~~~ + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c:1120:21: warning: conditional expression between different enumeration types ('enum iwl_mac_beacon_flags' and 'enum iwl_mac_beacon_flags_v1') [-Wenum-compare-conditional] + 1120 | 0) > 10 ? + | ^ + 1121 | IWL_MAC_BEACON_FILS : + | ~~~~~~~~~~~~~~~~~~~ + 1122 | IWL_MAC_BEACON_FILS_V1; + | ~~~~~~~~~~~~~~~~~~~~~~ + +Doing arithmetic between or returning two different types of enums could +be a bug, so each of the instance of the warning needs to be evaluated. +Unfortunately, as mentioned above, there are many instances of this +warning in many different configurations, which can break the build when +CONFIG_WERROR is enabled. + +To avoid introducing new instances of the warnings while cleaning up the +disruption for the majority of users, disable these warnings for the +default build while leaving them on for W=1 builds. + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/2002 +Link: https://github.com/llvm/llvm-project/commit/8c2ae42b3e1c6aa7c18f873edcebff7c0b45a37e +Acked-by: Yonghong Song +Signed-off-by: Nathan Chancellor +Acked-by: Arnd Bergmann +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/Makefile.extrawarn | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn +index f182700e0ac19..6881a0c96bc13 100644 +--- a/scripts/Makefile.extrawarn ++++ b/scripts/Makefile.extrawarn +@@ -53,6 +53,8 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) + KBUILD_CFLAGS += -Wno-tautological-constant-out-of-range-compare + KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access) + KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict) ++KBUILD_CFLAGS += -Wno-enum-compare-conditional ++KBUILD_CFLAGS += -Wno-enum-enum-conversion + endif + + endif +-- +2.43.0 + diff --git a/queue-5.15/ksmbd-retrieve-number-of-blocks-using-vfs_getattr-in.patch b/queue-5.15/ksmbd-retrieve-number-of-blocks-using-vfs_getattr-in.patch new file mode 100644 index 00000000000..b1868b7a4bd --- /dev/null +++ b/queue-5.15/ksmbd-retrieve-number-of-blocks-using-vfs_getattr-in.patch @@ -0,0 +1,61 @@ +From 1d0bbb6737df1beed9e9834bc26e6b577579f872 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 10:58:21 +0100 +Subject: ksmbd: retrieve number of blocks using vfs_getattr in + set_file_allocation_info + +From: Marios Makassikis + +[ Upstream commit 34cd86b6632718b7df3999d96f51e63de41c5e4f ] + +Use vfs_getattr() to retrieve stat information, rather than make +assumptions about how a filesystem fills inode structs. + +Cc: stable@vger.kernel.org +Signed-off-by: Marios Makassikis +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb2pdu.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 0613b8d14409c..14cd86a14012f 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -5759,15 +5759,21 @@ static int set_file_allocation_info(struct ksmbd_work *work, + + loff_t alloc_blks; + struct inode *inode; ++ struct kstat stat; + int rc; + + if (!(fp->daccess & FILE_WRITE_DATA_LE)) + return -EACCES; + ++ rc = vfs_getattr(&fp->filp->f_path, &stat, STATX_BASIC_STATS, ++ AT_STATX_SYNC_AS_STAT); ++ if (rc) ++ return rc; ++ + alloc_blks = (le64_to_cpu(file_alloc_info->AllocationSize) + 511) >> 9; + inode = file_inode(fp->filp); + +- if (alloc_blks > inode->i_blocks) { ++ if (alloc_blks > stat.blocks) { + smb_break_all_levII_oplock(work, fp, 1); + rc = vfs_fallocate(fp->filp, FALLOC_FL_KEEP_SIZE, 0, + alloc_blks * 512); +@@ -5775,7 +5781,7 @@ static int set_file_allocation_info(struct ksmbd_work *work, + pr_err("vfs_fallocate is failed : %d\n", rc); + return rc; + } +- } else if (alloc_blks < inode->i_blocks) { ++ } else if (alloc_blks < stat.blocks) { + loff_t size; + + /* +-- +2.43.0 + diff --git a/queue-5.15/kvm-always-flush-async-pf-workqueue-when-vcpu-is-bei.patch b/queue-5.15/kvm-always-flush-async-pf-workqueue-when-vcpu-is-bei.patch new file mode 100644 index 00000000000..a12a03311ca --- /dev/null +++ b/queue-5.15/kvm-always-flush-async-pf-workqueue-when-vcpu-is-bei.patch @@ -0,0 +1,183 @@ +From 7eed9542c7dc590d70b52e572f555181bc939978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 17:15:30 -0800 +Subject: KVM: Always flush async #PF workqueue when vCPU is being destroyed + +From: Sean Christopherson + +[ Upstream commit 3d75b8aa5c29058a512db29da7cbee8052724157 ] + +Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its +completion queue, e.g. when a VM and all its vCPUs is being destroyed. +KVM must ensure that none of its workqueue callbacks is running when the +last reference to the KVM _module_ is put. Gifting a reference to the +associated VM prevents the workqueue callback from dereferencing freed +vCPU/VM memory, but does not prevent the KVM module from being unloaded +before the callback completes. + +Drop the misguided VM refcount gifting, as calling kvm_put_kvm() from +async_pf_execute() if kvm_put_kvm() flushes the async #PF workqueue will +result in deadlock. async_pf_execute() can't return until kvm_put_kvm() +finishes, and kvm_put_kvm() can't return until async_pf_execute() finishes: + + WARNING: CPU: 8 PID: 251 at virt/kvm/kvm_main.c:1435 kvm_put_kvm+0x2d/0x320 [kvm] + Modules linked in: vhost_net vhost vhost_iotlb tap kvm_intel kvm irqbypass + CPU: 8 PID: 251 Comm: kworker/8:1 Tainted: G W 6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 + Workqueue: events async_pf_execute [kvm] + RIP: 0010:kvm_put_kvm+0x2d/0x320 [kvm] + Call Trace: + + async_pf_execute+0x198/0x260 [kvm] + process_one_work+0x145/0x2d0 + worker_thread+0x27e/0x3a0 + kthread+0xba/0xe0 + ret_from_fork+0x2d/0x50 + ret_from_fork_asm+0x11/0x20 + + ---[ end trace 0000000000000000 ]--- + INFO: task kworker/8:1:251 blocked for more than 120 seconds. + Tainted: G W 6.6.0-rc1-e7af8d17224a-x86/gmem-vm #119 + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + task:kworker/8:1 state:D stack:0 pid:251 ppid:2 flags:0x00004000 + Workqueue: events async_pf_execute [kvm] + Call Trace: + + __schedule+0x33f/0xa40 + schedule+0x53/0xc0 + schedule_timeout+0x12a/0x140 + __wait_for_common+0x8d/0x1d0 + __flush_work.isra.0+0x19f/0x2c0 + kvm_clear_async_pf_completion_queue+0x129/0x190 [kvm] + kvm_arch_destroy_vm+0x78/0x1b0 [kvm] + kvm_put_kvm+0x1c1/0x320 [kvm] + async_pf_execute+0x198/0x260 [kvm] + process_one_work+0x145/0x2d0 + worker_thread+0x27e/0x3a0 + kthread+0xba/0xe0 + ret_from_fork+0x2d/0x50 + ret_from_fork_asm+0x11/0x20 + + +If kvm_clear_async_pf_completion_queue() actually flushes the workqueue, +then there's no need to gift async_pf_execute() a reference because all +invocations of async_pf_execute() will be forced to complete before the +vCPU and its VM are destroyed/freed. And that in turn fixes the module +unloading bug as __fput() won't do module_put() on the last vCPU reference +until the vCPU has been freed, e.g. if closing the vCPU file also puts the +last reference to the KVM module. + +Note that kvm_check_async_pf_completion() may also take the work item off +the completion queue and so also needs to flush the work queue, as the +work will not be seen by kvm_clear_async_pf_completion_queue(). Waiting +on the workqueue could theoretically delay a vCPU due to waiting for the +work to complete, but that's a very, very small chance, and likely a very +small delay. kvm_arch_async_page_present_queued() unconditionally makes a +new request, i.e. will effectively delay entering the guest, so the +remaining work is really just: + + trace_kvm_async_pf_completed(addr, cr2_or_gpa); + + __kvm_vcpu_wake_up(vcpu); + + mmput(mm); + +and mmput() can't drop the last reference to the page tables if the vCPU is +still alive, i.e. the vCPU won't get stuck tearing down page tables. + +Add a helper to do the flushing, specifically to deal with "wakeup all" +work items, as they aren't actually work items, i.e. are never placed in a +workqueue. Trying to flush a bogus workqueue entry rightly makes +__flush_work() complain (kudos to whoever added that sanity check). + +Note, commit 5f6de5cbebee ("KVM: Prevent module exit until all VMs are +freed") *tried* to fix the module refcounting issue by having VMs grab a +reference to the module, but that only made the bug slightly harder to hit +as it gave async_pf_execute() a bit more time to complete before the KVM +module could be unloaded. + +Fixes: af585b921e5d ("KVM: Halt vcpu if page it tries to access is swapped out") +Cc: stable@vger.kernel.org +Cc: David Matlack +Reviewed-by: Xu Yilun +Reviewed-by: Vitaly Kuznetsov +Link: https://lore.kernel.org/r/20240110011533.503302-2-seanjc@google.com +Signed-off-by: Sean Christopherson +Signed-off-by: Sasha Levin +--- + virt/kvm/async_pf.c | 31 ++++++++++++++++++++++++++----- + 1 file changed, 26 insertions(+), 5 deletions(-) + +diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c +index dd777688d14a9..952afb1bc83b4 100644 +--- a/virt/kvm/async_pf.c ++++ b/virt/kvm/async_pf.c +@@ -88,7 +88,27 @@ static void async_pf_execute(struct work_struct *work) + rcuwait_wake_up(&vcpu->wait); + + mmput(mm); +- kvm_put_kvm(vcpu->kvm); ++} ++ ++static void kvm_flush_and_free_async_pf_work(struct kvm_async_pf *work) ++{ ++ /* ++ * The async #PF is "done", but KVM must wait for the work item itself, ++ * i.e. async_pf_execute(), to run to completion. If KVM is a module, ++ * KVM must ensure *no* code owned by the KVM (the module) can be run ++ * after the last call to module_put(). Note, flushing the work item ++ * is always required when the item is taken off the completion queue. ++ * E.g. even if the vCPU handles the item in the "normal" path, the VM ++ * could be terminated before async_pf_execute() completes. ++ * ++ * Wake all events skip the queue and go straight done, i.e. don't ++ * need to be flushed (but sanity check that the work wasn't queued). ++ */ ++ if (work->wakeup_all) ++ WARN_ON_ONCE(work->work.func); ++ else ++ flush_work(&work->work); ++ kmem_cache_free(async_pf_cache, work); + } + + void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu) +@@ -115,7 +135,6 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu) + #else + if (cancel_work_sync(&work->work)) { + mmput(work->mm); +- kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */ + kmem_cache_free(async_pf_cache, work); + } + #endif +@@ -127,7 +146,10 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu) + list_first_entry(&vcpu->async_pf.done, + typeof(*work), link); + list_del(&work->link); +- kmem_cache_free(async_pf_cache, work); ++ ++ spin_unlock(&vcpu->async_pf.lock); ++ kvm_flush_and_free_async_pf_work(work); ++ spin_lock(&vcpu->async_pf.lock); + } + spin_unlock(&vcpu->async_pf.lock); + +@@ -152,7 +174,7 @@ void kvm_check_async_pf_completion(struct kvm_vcpu *vcpu) + + list_del(&work->queue); + vcpu->async_pf.queued--; +- kmem_cache_free(async_pf_cache, work); ++ kvm_flush_and_free_async_pf_work(work); + } + } + +@@ -187,7 +209,6 @@ bool kvm_setup_async_pf(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, + work->arch = *arch; + work->mm = current->mm; + mmget(work->mm); +- kvm_get_kvm(work->vcpu->kvm); + + INIT_WORK(&work->work, async_pf_execute); + +-- +2.43.0 + diff --git a/queue-5.15/landlock-warn-once-if-a-landlock-action-is-requested.patch b/queue-5.15/landlock-warn-once-if-a-landlock-action-is-requested.patch new file mode 100644 index 00000000000..e7a5515aadc --- /dev/null +++ b/queue-5.15/landlock-warn-once-if-a-landlock-action-is-requested.patch @@ -0,0 +1,83 @@ +From dc91a492842eb220476f137897c3d7ca33fbce52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 12:05:50 +0100 +Subject: landlock: Warn once if a Landlock action is requested while disabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 782191c74875cc33b50263e21d76080b1411884d ] + +Because sandboxing can be used as an opportunistic security measure, +user space may not log unsupported features. Let the system +administrator know if an application tries to use Landlock but failed +because it isn't enabled at boot time. This may be caused by boot +loader configurations with outdated "lsm" kernel's command-line +parameter. + +Cc: stable@vger.kernel.org +Fixes: 265885daf3e5 ("landlock: Add syscall implementations") +Reviewed-by: Kees Cook +Reviewed-by: Günther Noack +Link: https://lore.kernel.org/r/20240227110550.3702236-2-mic@digikod.net +Signed-off-by: Mickaël Salaün +Signed-off-by: Sasha Levin +--- + security/landlock/syscalls.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/security/landlock/syscalls.c b/security/landlock/syscalls.c +index 507d43827afed..229a6918b52f3 100644 +--- a/security/landlock/syscalls.c ++++ b/security/landlock/syscalls.c +@@ -32,6 +32,18 @@ + #include "ruleset.h" + #include "setup.h" + ++static bool is_initialized(void) ++{ ++ if (likely(landlock_initialized)) ++ return true; ++ ++ pr_warn_once( ++ "Disabled but requested by user space. " ++ "You should enable Landlock at boot time: " ++ "https://docs.kernel.org/userspace-api/landlock.html#boot-time-configuration\n"); ++ return false; ++} ++ + /** + * copy_min_struct_from_user - Safe future-proof argument copying + * +@@ -165,7 +177,7 @@ SYSCALL_DEFINE3(landlock_create_ruleset, + /* Build-time checks. */ + build_check_abi(); + +- if (!landlock_initialized) ++ if (!is_initialized()) + return -EOPNOTSUPP; + + if (flags) { +@@ -311,7 +323,7 @@ SYSCALL_DEFINE4(landlock_add_rule, const int, ruleset_fd, + struct landlock_ruleset *ruleset; + int res, err; + +- if (!landlock_initialized) ++ if (!is_initialized()) + return -EOPNOTSUPP; + + /* No flag for now. */ +@@ -402,7 +414,7 @@ SYSCALL_DEFINE2(landlock_restrict_self, const int, ruleset_fd, const __u32, + struct landlock_cred_security *new_llcred; + int err; + +- if (!landlock_initialized) ++ if (!is_initialized()) + return -EOPNOTSUPP; + + /* +-- +2.43.0 + diff --git a/queue-5.15/mac802154-fix-llsec-key-resources-release-in-mac8021.patch b/queue-5.15/mac802154-fix-llsec-key-resources-release-in-mac8021.patch new file mode 100644 index 00000000000..77d52cbb477 --- /dev/null +++ b/queue-5.15/mac802154-fix-llsec-key-resources-release-in-mac8021.patch @@ -0,0 +1,134 @@ +From f8af466e42e174a8dcd6c26c197cbfcd57ebbf2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Feb 2024 19:38:39 +0300 +Subject: mac802154: fix llsec key resources release in mac802154_llsec_key_del + +From: Fedor Pchelkin + +[ Upstream commit e8a1e58345cf40b7b272e08ac7b32328b2543e40 ] + +mac802154_llsec_key_del() can free resources of a key directly without +following the RCU rules for waiting before the end of a grace period. This +may lead to use-after-free in case llsec_lookup_key() is traversing the +list of keys in parallel with a key deletion: + +refcount_t: addition on 0; use-after-free. +WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 +Modules linked in: +CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 +RIP: 0010:refcount_warn_saturate+0x162/0x2a0 +Call Trace: + + llsec_lookup_key.isra.0+0x890/0x9e0 + mac802154_llsec_encrypt+0x30c/0x9c0 + ieee802154_subif_start_xmit+0x24/0x1e0 + dev_hard_start_xmit+0x13e/0x690 + sch_direct_xmit+0x2ae/0xbc0 + __dev_queue_xmit+0x11dd/0x3c20 + dgram_sendmsg+0x90b/0xd60 + __sys_sendto+0x466/0x4c0 + __x64_sys_sendto+0xe0/0x1c0 + do_syscall_64+0x45/0xf0 + entry_SYSCALL_64_after_hwframe+0x6e/0x76 + +Also, ieee802154_llsec_key_entry structures are not freed by +mac802154_llsec_key_del(): + +unreferenced object 0xffff8880613b6980 (size 64): + comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) + hex dump (first 32 bytes): + 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... + 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ + backtrace: + [] __kmem_cache_alloc_node+0x1e2/0x2d0 + [] kmalloc_trace+0x25/0xc0 + [] mac802154_llsec_key_add+0xac9/0xcf0 + [] ieee802154_add_llsec_key+0x5a/0x80 + [] nl802154_add_llsec_key+0x426/0x5b0 + [] genl_family_rcv_msg_doit+0x1fe/0x2f0 + [] genl_rcv_msg+0x531/0x7d0 + [] netlink_rcv_skb+0x169/0x440 + [] genl_rcv+0x28/0x40 + [] netlink_unicast+0x53c/0x820 + [] netlink_sendmsg+0x93b/0xe60 + [] ____sys_sendmsg+0xac5/0xca0 + [] ___sys_sendmsg+0x11d/0x1c0 + [] __sys_sendmsg+0xfa/0x1d0 + [] do_syscall_64+0x45/0xf0 + [] entry_SYSCALL_64_after_hwframe+0x6e/0x76 + +Handle the proper resource release in the RCU callback function +mac802154_llsec_key_del_rcu(). + +Note that if llsec_lookup_key() finds a key, it gets a refcount via +llsec_key_get() and locally copies key id from key_entry (which is a +list element). So it's safe to call llsec_key_put() and free the list +entry after the RCU grace period elapses. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: 5d637d5aabd8 ("mac802154: add llsec structures and mutators") +Cc: stable@vger.kernel.org +Signed-off-by: Fedor Pchelkin +Acked-by: Alexander Aring +Message-ID: <20240228163840.6667-1-pchelkin@ispras.ru> +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + include/net/cfg802154.h | 1 + + net/mac802154/llsec.c | 18 +++++++++++++----- + 2 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h +index 6ed07844eb244..5290781abba3d 100644 +--- a/include/net/cfg802154.h ++++ b/include/net/cfg802154.h +@@ -257,6 +257,7 @@ struct ieee802154_llsec_key { + + struct ieee802154_llsec_key_entry { + struct list_head list; ++ struct rcu_head rcu; + + struct ieee802154_llsec_key_id id; + struct ieee802154_llsec_key *key; +diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c +index 55550ead2ced8..a4cc9d077c59c 100644 +--- a/net/mac802154/llsec.c ++++ b/net/mac802154/llsec.c +@@ -265,19 +265,27 @@ int mac802154_llsec_key_add(struct mac802154_llsec *sec, + return -ENOMEM; + } + ++static void mac802154_llsec_key_del_rcu(struct rcu_head *rcu) ++{ ++ struct ieee802154_llsec_key_entry *pos; ++ struct mac802154_llsec_key *mkey; ++ ++ pos = container_of(rcu, struct ieee802154_llsec_key_entry, rcu); ++ mkey = container_of(pos->key, struct mac802154_llsec_key, key); ++ ++ llsec_key_put(mkey); ++ kfree_sensitive(pos); ++} ++ + int mac802154_llsec_key_del(struct mac802154_llsec *sec, + const struct ieee802154_llsec_key_id *key) + { + struct ieee802154_llsec_key_entry *pos; + + list_for_each_entry(pos, &sec->table.keys, list) { +- struct mac802154_llsec_key *mkey; +- +- mkey = container_of(pos->key, struct mac802154_llsec_key, key); +- + if (llsec_key_id_equal(&pos->id, key)) { + list_del_rcu(&pos->list); +- llsec_key_put(mkey); ++ call_rcu(&pos->rcu, mac802154_llsec_key_del_rcu); + return 0; + } + } +-- +2.43.0 + diff --git a/queue-5.15/media-staging-ipu3-imgu-set-fields-before-media_enti.patch b/queue-5.15/media-staging-ipu3-imgu-set-fields-before-media_enti.patch new file mode 100644 index 00000000000..a4d64c8f2c1 --- /dev/null +++ b/queue-5.15/media-staging-ipu3-imgu-set-fields-before-media_enti.patch @@ -0,0 +1,81 @@ +From 1c4842411ca70432710c365c7dc5159fd1c65494 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jan 2024 17:09:09 +0900 +Subject: media: staging: ipu3-imgu: Set fields before media_entity_pads_init() + +From: Hidenori Kobayashi + +[ Upstream commit 87318b7092670d4086bfec115a0280a60c51c2dd ] + +The imgu driver fails to probe with the following message because it +does not set the pad's flags before calling media_entity_pads_init(). + +[ 14.596315] ipu3-imgu 0000:00:05.0: failed initialize subdev media entity (-22) +[ 14.596322] ipu3-imgu 0000:00:05.0: failed to register subdev0 ret (-22) +[ 14.596327] ipu3-imgu 0000:00:05.0: failed to register pipes (-22) +[ 14.596331] ipu3-imgu 0000:00:05.0: failed to create V4L2 devices (-22) + +Fix the initialization order so that the driver probe succeeds. The ops +initialization is also moved together for readability. + +Fixes: a0ca1627b450 ("media: staging/intel-ipu3: Add v4l2 driver based on media framework") +Cc: # 6.7 +Cc: Dan Carpenter +Signed-off-by: Hidenori Kobayashi +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/ipu3/ipu3-v4l2.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c b/drivers/staging/media/ipu3/ipu3-v4l2.c +index ed091418f7e73..5110e95923cc5 100644 +--- a/drivers/staging/media/ipu3/ipu3-v4l2.c ++++ b/drivers/staging/media/ipu3/ipu3-v4l2.c +@@ -1068,6 +1068,11 @@ static int imgu_v4l2_subdev_register(struct imgu_device *imgu, + struct imgu_media_pipe *imgu_pipe = &imgu->imgu_pipe[pipe]; + + /* Initialize subdev media entity */ ++ imgu_sd->subdev.entity.ops = &imgu_media_ops; ++ for (i = 0; i < IMGU_NODE_NUM; i++) { ++ imgu_sd->subdev_pads[i].flags = imgu_pipe->nodes[i].output ? ++ MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE; ++ } + r = media_entity_pads_init(&imgu_sd->subdev.entity, IMGU_NODE_NUM, + imgu_sd->subdev_pads); + if (r) { +@@ -1075,11 +1080,6 @@ static int imgu_v4l2_subdev_register(struct imgu_device *imgu, + "failed initialize subdev media entity (%d)\n", r); + return r; + } +- imgu_sd->subdev.entity.ops = &imgu_media_ops; +- for (i = 0; i < IMGU_NODE_NUM; i++) { +- imgu_sd->subdev_pads[i].flags = imgu_pipe->nodes[i].output ? +- MEDIA_PAD_FL_SINK : MEDIA_PAD_FL_SOURCE; +- } + + /* Initialize subdev */ + v4l2_subdev_init(&imgu_sd->subdev, &imgu_subdev_ops); +@@ -1174,15 +1174,15 @@ static int imgu_v4l2_node_setup(struct imgu_device *imgu, unsigned int pipe, + } + + /* Initialize media entities */ ++ node->vdev_pad.flags = node->output ? ++ MEDIA_PAD_FL_SOURCE : MEDIA_PAD_FL_SINK; ++ vdev->entity.ops = NULL; + r = media_entity_pads_init(&vdev->entity, 1, &node->vdev_pad); + if (r) { + dev_err(dev, "failed initialize media entity (%d)\n", r); + mutex_destroy(&node->lock); + return r; + } +- node->vdev_pad.flags = node->output ? +- MEDIA_PAD_FL_SOURCE : MEDIA_PAD_FL_SINK; +- vdev->entity.ops = NULL; + + /* Initialize vbq */ + vbq->type = node->vdev_fmt.type; +-- +2.43.0 + diff --git a/queue-5.15/media-xc4000-fix-atomicity-violation-in-xc4000_get_f.patch b/queue-5.15/media-xc4000-fix-atomicity-violation-in-xc4000_get_f.patch new file mode 100644 index 00000000000..20befd9ffa6 --- /dev/null +++ b/queue-5.15/media-xc4000-fix-atomicity-violation-in-xc4000_get_f.patch @@ -0,0 +1,79 @@ +From 2df58315090ce55b04d533cdf4d239acb122e6ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Dec 2023 13:50:30 +0800 +Subject: media: xc4000: Fix atomicity violation in xc4000_get_frequency + +From: Gui-Dong Han <2045gemini@gmail.com> + +[ Upstream commit 36d503ad547d1c75758a6fcdbec2806f1b6aeb41 ] + +In xc4000_get_frequency(): + *freq = priv->freq_hz + priv->freq_offset; +The code accesses priv->freq_hz and priv->freq_offset without holding any +lock. + +In xc4000_set_params(): + // Code that updates priv->freq_hz and priv->freq_offset + ... + +xc4000_get_frequency() and xc4000_set_params() may execute concurrently, +risking inconsistent reads of priv->freq_hz and priv->freq_offset. Since +these related data may update during reading, it can result in incorrect +frequency calculation, leading to atomicity violations. + +This possible bug is found by an experimental static analysis tool +developed by our team, BassCheck[1]. This tool analyzes the locking APIs +to extract function pairs that can be concurrently executed, and then +analyzes the instructions in the paired functions to identify possible +concurrency bugs including data races and atomicity violations. The above +possible bug is reported when our tool analyzes the source code of +Linux 6.2. + +To address this issue, it is proposed to add a mutex lock pair in +xc4000_get_frequency() to ensure atomicity. With this patch applied, our +tool no longer reports the possible bug, with the kernel configuration +allyesconfig for x86_64. Due to the lack of associated hardware, we cannot +test the patch in runtime testing, and just verify it according to the +code logic. + +[1] https://sites.google.com/view/basscheck/ + +Fixes: 4c07e32884ab ("[media] xc4000: Fix get_frequency()") +Cc: stable@vger.kernel.org +Reported-by: BassCheck +Signed-off-by: Gui-Dong Han <2045gemini@gmail.com> +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/xc4000.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c +index ef9af052007cb..849df4d1c573c 100644 +--- a/drivers/media/tuners/xc4000.c ++++ b/drivers/media/tuners/xc4000.c +@@ -1517,10 +1517,10 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq) + { + struct xc4000_priv *priv = fe->tuner_priv; + ++ mutex_lock(&priv->lock); + *freq = priv->freq_hz + priv->freq_offset; + + if (debug) { +- mutex_lock(&priv->lock); + if ((priv->cur_fw.type + & (BASE | FM | DTV6 | DTV7 | DTV78 | DTV8)) == BASE) { + u16 snr = 0; +@@ -1531,8 +1531,8 @@ static int xc4000_get_frequency(struct dvb_frontend *fe, u32 *freq) + return 0; + } + } +- mutex_unlock(&priv->lock); + } ++ mutex_unlock(&priv->lock); + + dprintk(1, "%s()\n", __func__); + +-- +2.43.0 + diff --git a/queue-5.15/memtest-use-read-write-_once-in-memory-scanning.patch b/queue-5.15/memtest-use-read-write-_once-in-memory-scanning.patch new file mode 100644 index 00000000000..ea47a2440c4 --- /dev/null +++ b/queue-5.15/memtest-use-read-write-_once-in-memory-scanning.patch @@ -0,0 +1,45 @@ +From 59f25998aa0ad4935ba150db678fb70202176ee6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 16:04:23 +0800 +Subject: memtest: use {READ,WRITE}_ONCE in memory scanning + +From: Qiang Zhang + +[ Upstream commit 82634d7e24271698e50a3ec811e5f50de790a65f ] + +memtest failed to find bad memory when compiled with clang. So use +{WRITE,READ}_ONCE to access memory to avoid compiler over optimization. + +Link: https://lkml.kernel.org/r/20240312080422.691222-1-qiang4.zhang@intel.com +Signed-off-by: Qiang Zhang +Cc: Bill Wendling +Cc: Justin Stitt +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/memtest.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/mm/memtest.c b/mm/memtest.c +index f53ace709ccd8..d407373f225b4 100644 +--- a/mm/memtest.c ++++ b/mm/memtest.c +@@ -46,10 +46,10 @@ static void __init memtest(u64 pattern, phys_addr_t start_phys, phys_addr_t size + last_bad = 0; + + for (p = start; p < end; p++) +- *p = pattern; ++ WRITE_ONCE(*p, pattern); + + for (p = start; p < end; p++, start_phys_aligned += incr) { +- if (*p == pattern) ++ if (READ_ONCE(*p) == pattern) + continue; + if (start_phys_aligned == last_bad + incr) { + last_bad += incr; +-- +2.43.0 + diff --git a/queue-5.15/mm-swap-fix-race-between-free_swap_and_cache-and-swa.patch b/queue-5.15/mm-swap-fix-race-between-free_swap_and_cache-and-swa.patch new file mode 100644 index 00000000000..19e607bfd36 --- /dev/null +++ b/queue-5.15/mm-swap-fix-race-between-free_swap_and_cache-and-swa.patch @@ -0,0 +1,119 @@ +From aeade4e5e77f5bd66946b5975d1d01c72427fb19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 14:03:56 +0000 +Subject: mm: swap: fix race between free_swap_and_cache() and swapoff() + +From: Ryan Roberts + +[ Upstream commit 82b1c07a0af603e3c47b906c8e991dc96f01688e ] + +There was previously a theoretical window where swapoff() could run and +teardown a swap_info_struct while a call to free_swap_and_cache() was +running in another thread. This could cause, amongst other bad +possibilities, swap_page_trans_huge_swapped() (called by +free_swap_and_cache()) to access the freed memory for swap_map. + +This is a theoretical problem and I haven't been able to provoke it from a +test case. But there has been agreement based on code review that this is +possible (see link below). + +Fix it by using get_swap_device()/put_swap_device(), which will stall +swapoff(). There was an extra check in _swap_info_get() to confirm that +the swap entry was not free. This isn't present in get_swap_device() +because it doesn't make sense in general due to the race between getting +the reference and swapoff. So I've added an equivalent check directly in +free_swap_and_cache(). + +Details of how to provoke one possible issue (thanks to David Hildenbrand +for deriving this): + +--8<----- + +__swap_entry_free() might be the last user and result in +"count == SWAP_HAS_CACHE". + +swapoff->try_to_unuse() will stop as soon as soon as si->inuse_pages==0. + +So the question is: could someone reclaim the folio and turn +si->inuse_pages==0, before we completed swap_page_trans_huge_swapped(). + +Imagine the following: 2 MiB folio in the swapcache. Only 2 subpages are +still references by swap entries. + +Process 1 still references subpage 0 via swap entry. +Process 2 still references subpage 1 via swap entry. + +Process 1 quits. Calls free_swap_and_cache(). +-> count == SWAP_HAS_CACHE +[then, preempted in the hypervisor etc.] + +Process 2 quits. Calls free_swap_and_cache(). +-> count == SWAP_HAS_CACHE + +Process 2 goes ahead, passes swap_page_trans_huge_swapped(), and calls +__try_to_reclaim_swap(). + +__try_to_reclaim_swap()->folio_free_swap()->delete_from_swap_cache()-> +put_swap_folio()->free_swap_slot()->swapcache_free_entries()-> +swap_entry_free()->swap_range_free()-> +... +WRITE_ONCE(si->inuse_pages, si->inuse_pages - nr_entries); + +What stops swapoff to succeed after process 2 reclaimed the swap cache +but before process1 finished its call to swap_page_trans_huge_swapped()? + +--8<----- + +Link: https://lkml.kernel.org/r/20240306140356.3974886-1-ryan.roberts@arm.com +Fixes: 7c00bafee87c ("mm/swap: free swap slots in batch") +Closes: https://lore.kernel.org/linux-mm/65a66eb9-41f8-4790-8db2-0c70ea15979f@redhat.com/ +Signed-off-by: Ryan Roberts +Cc: David Hildenbrand +Cc: "Huang, Ying" +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/swapfile.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 8789d27bd90ca..fec3e736a1948 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -1243,6 +1243,11 @@ static unsigned char __swap_entry_free_locked(struct swap_info_struct *p, + * with get_swap_device() and put_swap_device(), unless the swap + * functions call get/put_swap_device() by themselves. + * ++ * Note that when only holding the PTL, swapoff might succeed immediately ++ * after freeing a swap entry. Therefore, immediately after ++ * __swap_entry_free(), the swap info might become stale and should not ++ * be touched without a prior get_swap_device(). ++ * + * Check whether swap entry is valid in the swap device. If so, + * return pointer to swap_info_struct, and keep the swap entry valid + * via preventing the swap device from being swapoff, until +@@ -1768,13 +1773,19 @@ int free_swap_and_cache(swp_entry_t entry) + if (non_swap_entry(entry)) + return 1; + +- p = _swap_info_get(entry); ++ p = get_swap_device(entry); + if (p) { ++ if (WARN_ON(data_race(!p->swap_map[swp_offset(entry)]))) { ++ put_swap_device(p); ++ return 0; ++ } ++ + count = __swap_entry_free(p, entry); + if (count == SWAP_HAS_CACHE && + !swap_page_trans_huge_swapped(p, entry)) + __try_to_reclaim_swap(p, swp_offset(entry), + TTRS_UNMAPPED | TTRS_FULL); ++ put_swap_device(p); + } + return p != NULL; + } +-- +2.43.0 + diff --git a/queue-5.15/mmc-core-fix-switch-on-gp3-partition.patch b/queue-5.15/mmc-core-fix-switch-on-gp3-partition.patch new file mode 100644 index 00000000000..102b5697388 --- /dev/null +++ b/queue-5.15/mmc-core-fix-switch-on-gp3-partition.patch @@ -0,0 +1,86 @@ +From 6846151e457870467915b9f86e32b643f19bbfd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2024 10:44:38 +0900 +Subject: mmc: core: Fix switch on gp3 partition + +From: Dominique Martinet + +[ Upstream commit 4af59a8df5ea930038cd3355e822f5eedf4accc1 ] + +Commit e7794c14fd73 ("mmc: rpmb: fixes pause retune on all RPMB +partitions.") added a mask check for 'part_type', but the mask used was +wrong leading to the code intended for rpmb also being executed for GP3. + +On some MMCs (but not all) this would make gp3 partition inaccessible: +armadillo:~# head -c 1 < /dev/mmcblk2gp3 +head: standard input: I/O error +armadillo:~# dmesg -c +[ 422.976583] mmc2: running CQE recovery +[ 423.058182] mmc2: running CQE recovery +[ 423.137607] mmc2: running CQE recovery +[ 423.137802] blk_update_request: I/O error, dev mmcblk2gp3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 4 prio class 0 +[ 423.237125] mmc2: running CQE recovery +[ 423.318206] mmc2: running CQE recovery +[ 423.397680] mmc2: running CQE recovery +[ 423.397837] blk_update_request: I/O error, dev mmcblk2gp3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 +[ 423.408287] Buffer I/O error on dev mmcblk2gp3, logical block 0, async page read + +the part_type values of interest here are defined as follow: +main 0 +boot0 1 +boot1 2 +rpmb 3 +gp0 4 +gp1 5 +gp2 6 +gp3 7 + +so mask with EXT_CSD_PART_CONFIG_ACC_MASK (7) to correctly identify rpmb + +Fixes: e7794c14fd73 ("mmc: rpmb: fixes pause retune on all RPMB partitions.") +Cc: stable@vger.kernel.org +Cc: Jorge Ramirez-Ortiz +Signed-off-by: Dominique Martinet +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20240306-mmc-partswitch-v1-1-bf116985d950@codewreck.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/block.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index c3202e2e99e82..281794a50d463 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -862,10 +862,11 @@ static const struct block_device_operations mmc_bdops = { + static int mmc_blk_part_switch_pre(struct mmc_card *card, + unsigned int part_type) + { +- const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB; ++ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK; ++ const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB; + int ret = 0; + +- if ((part_type & mask) == mask) { ++ if ((part_type & mask) == rpmb) { + if (card->ext_csd.cmdq_en) { + ret = mmc_cmdq_disable(card); + if (ret) +@@ -880,10 +881,11 @@ static int mmc_blk_part_switch_pre(struct mmc_card *card, + static int mmc_blk_part_switch_post(struct mmc_card *card, + unsigned int part_type) + { +- const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_RPMB; ++ const unsigned int mask = EXT_CSD_PART_CONFIG_ACC_MASK; ++ const unsigned int rpmb = EXT_CSD_PART_CONFIG_ACC_RPMB; + int ret = 0; + +- if ((part_type & mask) == mask) { ++ if ((part_type & mask) == rpmb) { + mmc_retune_unpause(card->host); + if (card->reenable_cmdq && !card->ext_csd.cmdq_en) + ret = mmc_cmdq_enable(card); +-- +2.43.0 + diff --git a/queue-5.15/mmc-tmio-avoid-concurrent-runs-of-mmc_request_done.patch b/queue-5.15/mmc-tmio-avoid-concurrent-runs-of-mmc_request_done.patch new file mode 100644 index 00000000000..0380d0e45e0 --- /dev/null +++ b/queue-5.15/mmc-tmio-avoid-concurrent-runs-of-mmc_request_done.patch @@ -0,0 +1,51 @@ +From 3636d70971e3aad1b21a82985f6b63f9944976db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:42:56 +0100 +Subject: mmc: tmio: avoid concurrent runs of mmc_request_done() + +From: Wolfram Sang + +[ Upstream commit e8d1b41e69d72c62865bebe8f441163ec00b3d44 ] + +With the to-be-fixed commit, the reset_work handler cleared 'host->mrq' +outside of the spinlock protected critical section. That leaves a small +race window during execution of 'tmio_mmc_reset()' where the done_work +handler could grab a pointer to the now invalid 'host->mrq'. Both would +use it to call mmc_request_done() causing problems (see link below). + +However, 'host->mrq' cannot simply be cleared earlier inside the +critical section. That would allow new mrqs to come in asynchronously +while the actual reset of the controller still needs to be done. So, +like 'tmio_mmc_set_ios()', an ERR_PTR is used to prevent new mrqs from +coming in but still avoiding concurrency between work handlers. + +Reported-by: Dirk Behme +Closes: https://lore.kernel.org/all/20240220061356.3001761-1-dirk.behme@de.bosch.com/ +Fixes: df3ef2d3c92c ("mmc: protect the tmio_mmc driver against a theoretical race") +Signed-off-by: Wolfram Sang +Tested-by: Dirk Behme +Reviewed-by: Dirk Behme +Cc: stable@vger.kernel.org # 3.0+ +Link: https://lore.kernel.org/r/20240305104423.3177-2-wsa+renesas@sang-engineering.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/tmio_mmc_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index 437048bb80273..5024cae411d3a 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -259,6 +259,8 @@ static void tmio_mmc_reset_work(struct work_struct *work) + else + mrq->cmd->error = -ETIMEDOUT; + ++ /* No new calls yet, but disallow concurrent tmio_mmc_done_work() */ ++ host->mrq = ERR_PTR(-EBUSY); + host->cmd = NULL; + host->data = NULL; + +-- +2.43.0 + diff --git a/queue-5.15/mtd-rawnand-meson-fix-scrambling-mode-value-in-comma.patch b/queue-5.15/mtd-rawnand-meson-fix-scrambling-mode-value-in-comma.patch new file mode 100644 index 00000000000..0e40b75304c --- /dev/null +++ b/queue-5.15/mtd-rawnand-meson-fix-scrambling-mode-value-in-comma.patch @@ -0,0 +1,39 @@ +From 10a71b0add404274011afba366ec9e98258436fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 00:45:51 +0300 +Subject: mtd: rawnand: meson: fix scrambling mode value in command macro + +From: Arseniy Krasnov + +[ Upstream commit ef6f463599e16924cdd02ce5056ab52879dc008c ] + +Scrambling mode is enabled by value (1 << 19). NFC_CMD_SCRAMBLER_ENABLE +is already (1 << 19), so there is no need to shift it again in CMDRWGEN +macro. + +Signed-off-by: Arseniy Krasnov +Cc: +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20240210214551.441610-1-avkrasnov@salutedevices.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/meson_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index 9d441965321ad..9198d54cb34ee 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -59,7 +59,7 @@ + #define CMDRWGEN(cmd_dir, ran, bch, short_mode, page_size, pages) \ + ( \ + (cmd_dir) | \ +- ((ran) << 19) | \ ++ (ran) | \ + ((bch) << 14) | \ + ((short_mode) << 13) | \ + (((page_size) & 0x7f) << 6) | \ +-- +2.43.0 + diff --git a/queue-5.15/net-hns3-tracing-fix-hclgevf-trace-event-strings.patch b/queue-5.15/net-hns3-tracing-fix-hclgevf-trace-event-strings.patch new file mode 100644 index 00000000000..86c3a7c20d9 --- /dev/null +++ b/queue-5.15/net-hns3-tracing-fix-hclgevf-trace-event-strings.patch @@ -0,0 +1,153 @@ +From dc53f9d3f5273b08c516a714566de4a372481031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 09:34:54 -0400 +Subject: net: hns3: tracing: fix hclgevf trace event strings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steven Rostedt (Google) + +[ Upstream commit 3f9952e8d80cca2da3b47ecd5ad9ec16cfd1a649 ] + +The __string() and __assign_str() helper macros of the TRACE_EVENT() macro +are going through some optimizations where only the source string of +__string() will be used and the __assign_str() source will be ignored and +later removed. + +To make sure that there's no issues, a new check is added between the +__string() src argument and the __assign_str() src argument that does a +strcmp() to make sure they are the same string. + +The hclgevf trace events have: + + __assign_str(devname, &hdev->nic.kinfo.netdev->name); + +Which triggers the warning: + +hclgevf_trace.h:34:39: error: passing argument 1 of ‘strcmp’ from incompatible pointer type [-Werror=incompatible-pointer-types] + 34 | __assign_str(devname, &hdev->nic.kinfo.netdev->name); + [..] +arch/x86/include/asm/string_64.h:75:24: note: expected ‘const char *’ but argument is of type ‘char (*)[16]’ + 75 | int strcmp(const char *cs, const char *ct); + | ~~~~~~~~~~~~^~ + +Because __assign_str() now has: + + WARN_ON_ONCE(__builtin_constant_p(src) ? \ + strcmp((src), __data_offsets.dst##_ptr_) : \ + (src) != __data_offsets.dst##_ptr_); \ + +The problem is the '&' on hdev->nic.kinfo.netdev->name. That's because +that name is: + + char name[IFNAMSIZ] + +Where passing an address '&' of a char array is not compatible with strcmp(). + +The '&' is not necessary, remove it. + +Link: https://lore.kernel.org/linux-trace-kernel/20240313093454.3909afe7@gandalf.local.home + +Cc: netdev +Cc: Yisen Zhuang +Cc: Salil Mehta +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Yufeng Mo +Cc: Huazhong Tan +Cc: stable@vger.kernel.org +Acked-by: Paolo Abeni +Reviewed-by: Jijie Shao +Fixes: d8355240cf8fb ("net: hns3: add trace event support for PF/VF mailbox") +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h | 8 ++++---- + .../net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h +index 8510b88d49820..f3cd5a376eca9 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_trace.h +@@ -24,7 +24,7 @@ TRACE_EVENT(hclge_pf_mbx_get, + __field(u8, code) + __field(u8, subcode) + __string(pciname, pci_name(hdev->pdev)) +- __string(devname, &hdev->vport[0].nic.kinfo.netdev->name) ++ __string(devname, hdev->vport[0].nic.kinfo.netdev->name) + __array(u32, mbx_data, PF_GET_MBX_LEN) + ), + +@@ -33,7 +33,7 @@ TRACE_EVENT(hclge_pf_mbx_get, + __entry->code = req->msg.code; + __entry->subcode = req->msg.subcode; + __assign_str(pciname, pci_name(hdev->pdev)); +- __assign_str(devname, &hdev->vport[0].nic.kinfo.netdev->name); ++ __assign_str(devname, hdev->vport[0].nic.kinfo.netdev->name); + memcpy(__entry->mbx_data, req, + sizeof(struct hclge_mbx_vf_to_pf_cmd)); + ), +@@ -56,7 +56,7 @@ TRACE_EVENT(hclge_pf_mbx_send, + __field(u8, vfid) + __field(u16, code) + __string(pciname, pci_name(hdev->pdev)) +- __string(devname, &hdev->vport[0].nic.kinfo.netdev->name) ++ __string(devname, hdev->vport[0].nic.kinfo.netdev->name) + __array(u32, mbx_data, PF_SEND_MBX_LEN) + ), + +@@ -64,7 +64,7 @@ TRACE_EVENT(hclge_pf_mbx_send, + __entry->vfid = req->dest_vfid; + __entry->code = le16_to_cpu(req->msg.code); + __assign_str(pciname, pci_name(hdev->pdev)); +- __assign_str(devname, &hdev->vport[0].nic.kinfo.netdev->name); ++ __assign_str(devname, hdev->vport[0].nic.kinfo.netdev->name); + memcpy(__entry->mbx_data, req, + sizeof(struct hclge_mbx_pf_to_vf_cmd)); + ), +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h +index 5d4895bb57a17..b259e95dd53c2 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_trace.h +@@ -23,7 +23,7 @@ TRACE_EVENT(hclge_vf_mbx_get, + __field(u8, vfid) + __field(u16, code) + __string(pciname, pci_name(hdev->pdev)) +- __string(devname, &hdev->nic.kinfo.netdev->name) ++ __string(devname, hdev->nic.kinfo.netdev->name) + __array(u32, mbx_data, VF_GET_MBX_LEN) + ), + +@@ -31,7 +31,7 @@ TRACE_EVENT(hclge_vf_mbx_get, + __entry->vfid = req->dest_vfid; + __entry->code = le16_to_cpu(req->msg.code); + __assign_str(pciname, pci_name(hdev->pdev)); +- __assign_str(devname, &hdev->nic.kinfo.netdev->name); ++ __assign_str(devname, hdev->nic.kinfo.netdev->name); + memcpy(__entry->mbx_data, req, + sizeof(struct hclge_mbx_pf_to_vf_cmd)); + ), +@@ -55,7 +55,7 @@ TRACE_EVENT(hclge_vf_mbx_send, + __field(u8, code) + __field(u8, subcode) + __string(pciname, pci_name(hdev->pdev)) +- __string(devname, &hdev->nic.kinfo.netdev->name) ++ __string(devname, hdev->nic.kinfo.netdev->name) + __array(u32, mbx_data, VF_SEND_MBX_LEN) + ), + +@@ -64,7 +64,7 @@ TRACE_EVENT(hclge_vf_mbx_send, + __entry->code = req->msg.code; + __entry->subcode = req->msg.subcode; + __assign_str(pciname, pci_name(hdev->pdev)); +- __assign_str(devname, &hdev->nic.kinfo.netdev->name); ++ __assign_str(devname, hdev->nic.kinfo.netdev->name); + memcpy(__entry->mbx_data, req, + sizeof(struct hclge_mbx_vf_to_pf_cmd)); + ), +-- +2.43.0 + diff --git a/queue-5.15/nfs-fix-uaf-in-direct-writes.patch b/queue-5.15/nfs-fix-uaf-in-direct-writes.patch new file mode 100644 index 00000000000..3a0fa350d94 --- /dev/null +++ b/queue-5.15/nfs-fix-uaf-in-direct-writes.patch @@ -0,0 +1,125 @@ +From 7ab717eacadcc56e0de66520eca6205ed950a3db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 11:49:57 -0500 +Subject: nfs: fix UAF in direct writes + +From: Josef Bacik + +[ Upstream commit 17f46b803d4f23c66cacce81db35fef3adb8f2af ] + +In production we have been hitting the following warning consistently + +------------[ cut here ]------------ +refcount_t: underflow; use-after-free. +WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 +Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] +RIP: 0010:refcount_warn_saturate+0x9c/0xe0 +PKRU: 55555554 +Call Trace: + + ? __warn+0x9f/0x130 + ? refcount_warn_saturate+0x9c/0xe0 + ? report_bug+0xcc/0x150 + ? handle_bug+0x3d/0x70 + ? exc_invalid_op+0x16/0x40 + ? asm_exc_invalid_op+0x16/0x20 + ? refcount_warn_saturate+0x9c/0xe0 + nfs_direct_write_schedule_work+0x237/0x250 [nfs] + process_one_work+0x12f/0x4a0 + worker_thread+0x14e/0x3b0 + ? ZSTD_getCParams_internal+0x220/0x220 + kthread+0xdc/0x120 + ? __btf_name_valid+0xa0/0xa0 + ret_from_fork+0x1f/0x30 + +This is because we're completing the nfs_direct_request twice in a row. + +The source of this is when we have our commit requests to submit, we +process them and send them off, and then in the completion path for the +commit requests we have + +if (nfs_commit_end(cinfo.mds)) + nfs_direct_write_complete(dreq); + +However since we're submitting asynchronous requests we sometimes have +one that completes before we submit the next one, so we end up calling +complete on the nfs_direct_request twice. + +The only other place we use nfs_generic_commit_list() is in +__nfs_commit_inode, which wraps this call in a + +nfs_commit_begin(); +nfs_commit_end(); + +Which is a common pattern for this style of completion handling, one +that is also repeated in the direct code with get_dreq()/put_dreq() +calls around where we process events as well as in the completion paths. + +Fix this by using the same pattern for the commit requests. + +Before with my 200 node rocksdb stress running this warning would pop +every 10ish minutes. With my patch the stress test has been running for +several hours without popping. + +Signed-off-by: Josef Bacik +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/direct.c | 11 +++++++++-- + fs/nfs/write.c | 2 +- + include/linux/nfs_fs.h | 1 + + 3 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index bbe2a5cc49f68..3185899676adf 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -678,10 +678,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) + LIST_HEAD(mds_list); + + nfs_init_cinfo_from_dreq(&cinfo, dreq); ++ nfs_commit_begin(cinfo.mds); + nfs_scan_commit(dreq->inode, &mds_list, &cinfo); + res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo); +- if (res < 0) /* res == -ENOMEM */ +- nfs_direct_write_reschedule(dreq); ++ if (res < 0) { /* res == -ENOMEM */ ++ spin_lock(&dreq->lock); ++ if (dreq->flags == 0) ++ dreq->flags = NFS_ODIRECT_RESCHED_WRITES; ++ spin_unlock(&dreq->lock); ++ } ++ if (nfs_commit_end(cinfo.mds)) ++ nfs_direct_write_complete(dreq); + } + + static void nfs_direct_write_clear_reqs(struct nfs_direct_req *dreq) +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 4231d51fc1add..3d06bad2760da 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1644,7 +1644,7 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) + !atomic_read(&cinfo->rpcs_out)); + } + +-static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) ++void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) + { + atomic_inc(&cinfo->rpcs_out); + } +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index 5ddc30405f7f4..886bfa99a6af4 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -588,6 +588,7 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); + extern int nfs_commit_inode(struct inode *, int); + extern struct nfs_commit_data *nfs_commitdata_alloc(void); + extern void nfs_commit_free(struct nfs_commit_data *data); ++void nfs_commit_begin(struct nfs_mds_commit_info *cinfo); + bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); + + static inline int +-- +2.43.0 + diff --git a/queue-5.15/nfsd-fix-nfsd_clid_class-use-of-__string_len-macro.patch b/queue-5.15/nfsd-fix-nfsd_clid_class-use-of-__string_len-macro.patch new file mode 100644 index 00000000000..75dda37beb0 --- /dev/null +++ b/queue-5.15/nfsd-fix-nfsd_clid_class-use-of-__string_len-macro.patch @@ -0,0 +1,57 @@ +From dc4da6ff6cbca1c0c4b22a3f2e054c88e2aa8750 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Feb 2024 12:28:28 -0500 +Subject: NFSD: Fix nfsd_clid_class use of __string_len() macro + +From: Steven Rostedt (Google) + +[ Upstream commit 9388a2aa453321bcf1ad2603959debea9e6ab6d4 ] + +I'm working on restructuring the __string* macros so that it doesn't need +to recalculate the string twice. That is, it will save it off when +processing __string() and the __assign_str() will not need to do the work +again as it currently does. + +Currently __string_len(item, src, len) doesn't actually use "src", but my +changes will require src to be correct as that is where the __assign_str() +will get its value from. + +The event class nfsd_clid_class has: + + __string_len(name, name, clp->cl_name.len) + +But the second "name" does not exist and causes my changes to fail to +build. That second parameter should be: clp->cl_name.data. + +Link: https://lore.kernel.org/linux-trace-kernel/20240222122828.3d8d213c@gandalf.local.home + +Cc: Neil Brown +Cc: Olga Kornievskaia +Cc: Dai Ngo +Cc: Tom Talpey +Cc: stable@vger.kernel.org +Fixes: d27b74a8675ca ("NFSD: Use new __string_len C macros for nfsd_clid_class") +Acked-by: Chuck Lever +Acked-by: Jeff Layton +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + fs/nfsd/trace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/trace.h b/fs/nfsd/trace.h +index 0fc1fa6f28e0b..7e7d0f1705ed3 100644 +--- a/fs/nfsd/trace.h ++++ b/fs/nfsd/trace.h +@@ -606,7 +606,7 @@ DECLARE_EVENT_CLASS(nfsd_clid_class, + __array(unsigned char, addr, sizeof(struct sockaddr_in6)) + __field(unsigned long, flavor) + __array(unsigned char, verifier, NFS4_VERIFIER_SIZE) +- __string_len(name, name, clp->cl_name.len) ++ __string_len(name, clp->cl_name.data, clp->cl_name.len) + ), + TP_fast_assign( + __entry->cl_boot = clp->cl_clientid.cl_boot; +-- +2.43.0 + diff --git a/queue-5.15/nilfs2-fix-failure-to-detect-dat-corruption-in-btree.patch b/queue-5.15/nilfs2-fix-failure-to-detect-dat-corruption-in-btree.patch new file mode 100644 index 00000000000..6afe54294ba --- /dev/null +++ b/queue-5.15/nilfs2-fix-failure-to-detect-dat-corruption-in-btree.patch @@ -0,0 +1,131 @@ +From 2a7404ff2f2974d8b27ddd174682190ac43d1a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 19:58:26 +0900 +Subject: nilfs2: fix failure to detect DAT corruption in btree and direct + mappings + +From: Ryusuke Konishi + +[ Upstream commit f2f26b4a84a0ef41791bd2d70861c8eac748f4ba ] + +Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". + +This resolves a kernel BUG reported by syzbot. Since there are two +flaws involved, I've made each one a separate patch. + +The first patch alone resolves the syzbot-reported bug, but I think +both fixes should be sent to stable, so I've tagged them as such. + +This patch (of 2): + +Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data +to a nilfs2 file system whose metadata is corrupted. + +There are two flaws involved in this issue. + +The first flaw is that when nilfs_get_block() locates a data block using +btree or direct mapping, if the disk address translation routine +nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata +corruption, it can be passed back to nilfs_get_block(). This causes +nilfs_get_block() to misidentify an existing block as non-existent, +causing both data block lookup and insertion to fail inconsistently. + +The second flaw is that nilfs_get_block() returns a successful status in +this inconsistent state. This causes the caller __block_write_begin_int() +or others to request a read even though the buffer is not mapped, +resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc() +failing. + +This fixes the first issue by changing the return value to code -EINVAL +when a conversion using DAT fails with code -ENOENT, avoiding the +conflicting condition that leads to the kernel bug described above. Here, +code -EINVAL indicates that metadata corruption was detected during the +block lookup, which will be properly handled as a file system error and +converted to -EIO when passing through the nilfs2 bmap layer. + +Link: https://lkml.kernel.org/r/20240313105827.5296-1-konishi.ryusuke@gmail.com +Link: https://lkml.kernel.org/r/20240313105827.5296-2-konishi.ryusuke@gmail.com +Fixes: c3a7abf06ce7 ("nilfs2: support contiguous lookup of blocks") +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+cfed5b56649bddf80d6e@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=cfed5b56649bddf80d6e +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/btree.c | 9 +++++++-- + fs/nilfs2/direct.c | 9 +++++++-- + 2 files changed, 14 insertions(+), 4 deletions(-) + +diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c +index def9121a466ef..385ec71fcdef2 100644 +--- a/fs/nilfs2/btree.c ++++ b/fs/nilfs2/btree.c +@@ -724,7 +724,7 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree, + dat = nilfs_bmap_get_dat(btree); + ret = nilfs_dat_translate(dat, ptr, &blocknr); + if (ret < 0) +- goto out; ++ goto dat_error; + ptr = blocknr; + } + cnt = 1; +@@ -743,7 +743,7 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree, + if (dat) { + ret = nilfs_dat_translate(dat, ptr2, &blocknr); + if (ret < 0) +- goto out; ++ goto dat_error; + ptr2 = blocknr; + } + if (ptr2 != ptr + cnt || ++cnt == maxblocks) +@@ -781,6 +781,11 @@ static int nilfs_btree_lookup_contig(const struct nilfs_bmap *btree, + out: + nilfs_btree_free_path(path); + return ret; ++ ++ dat_error: ++ if (ret == -ENOENT) ++ ret = -EINVAL; /* Notify bmap layer of metadata corruption */ ++ goto out; + } + + static void nilfs_btree_promote_key(struct nilfs_bmap *btree, +diff --git a/fs/nilfs2/direct.c b/fs/nilfs2/direct.c +index f353101955e3b..7faf8c285d6c9 100644 +--- a/fs/nilfs2/direct.c ++++ b/fs/nilfs2/direct.c +@@ -66,7 +66,7 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct, + dat = nilfs_bmap_get_dat(direct); + ret = nilfs_dat_translate(dat, ptr, &blocknr); + if (ret < 0) +- return ret; ++ goto dat_error; + ptr = blocknr; + } + +@@ -79,7 +79,7 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct, + if (dat) { + ret = nilfs_dat_translate(dat, ptr2, &blocknr); + if (ret < 0) +- return ret; ++ goto dat_error; + ptr2 = blocknr; + } + if (ptr2 != ptr + cnt) +@@ -87,6 +87,11 @@ static int nilfs_direct_lookup_contig(const struct nilfs_bmap *direct, + } + *ptrp = ptr; + return cnt; ++ ++ dat_error: ++ if (ret == -ENOENT) ++ ret = -EINVAL; /* Notify bmap layer of metadata corruption */ ++ return ret; + } + + static __u64 +-- +2.43.0 + diff --git a/queue-5.15/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch b/queue-5.15/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch new file mode 100644 index 00000000000..85b5d1a7d58 --- /dev/null +++ b/queue-5.15/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch @@ -0,0 +1,44 @@ +From 15d47d31a6fb2c25f368f3746c0bb79e5c636984 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Mar 2024 19:58:27 +0900 +Subject: nilfs2: prevent kernel bug at submit_bh_wbc() + +From: Ryusuke Konishi + +[ Upstream commit 269cdf353b5bdd15f1a079671b0f889113865f20 ] + +Fix a bug where nilfs_get_block() returns a successful status when +searching and inserting the specified block both fail inconsistently. If +this inconsistent behavior is not due to a previously fixed bug, then an +unexpected race is occurring, so return a temporary error -EAGAIN instead. + +This prevents callers such as __block_write_begin_int() from requesting a +read into a buffer that is not mapped, which would cause the BUG_ON check +for the BH_Mapped flag in submit_bh_wbc() to fail. + +Link: https://lkml.kernel.org/r/20240313105827.5296-3-konishi.ryusuke@gmail.com +Fixes: 1f5abe7e7dbc ("nilfs2: replace BUG_ON and BUG calls triggerable from ioctl") +Signed-off-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c +index 324e23236c341..475fd522c7e3f 100644 +--- a/fs/nilfs2/inode.c ++++ b/fs/nilfs2/inode.c +@@ -112,7 +112,7 @@ int nilfs_get_block(struct inode *inode, sector_t blkoff, + "%s (ino=%lu): a race condition while inserting a data block at offset=%llu", + __func__, inode->i_ino, + (unsigned long long)blkoff); +- err = 0; ++ err = -EAGAIN; + } + nilfs_transaction_abort(inode->i_sb); + goto out; +-- +2.43.0 + diff --git a/queue-5.15/nvmem-meson-efuse-fix-function-pointer-type-mismatch.patch b/queue-5.15/nvmem-meson-efuse-fix-function-pointer-type-mismatch.patch new file mode 100644 index 00000000000..ec6b8b8611b --- /dev/null +++ b/queue-5.15/nvmem-meson-efuse-fix-function-pointer-type-mismatch.patch @@ -0,0 +1,80 @@ +From 5bd3c7c4c912cca7676ea7d1af7913bbb01341c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Feb 2024 11:40:23 +0000 +Subject: nvmem: meson-efuse: fix function pointer type mismatch + +From: Jerome Brunet + +[ Upstream commit cbd38332c140829ab752ba4e727f98be5c257f18 ] + +clang-16 warns about casting functions to incompatible types, as is done +here to call clk_disable_unprepare: + +drivers/nvmem/meson-efuse.c:78:12: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict] + 78 | (void(*)(void *))clk_disable_unprepare, + +The pattern of getting, enabling and setting a disable callback for a +clock can be replaced with devm_clk_get_enabled(), which also fixes +this warning. + +Fixes: 611fbca1c861 ("nvmem: meson-efuse: add peripheral clock") +Cc: Stable@vger.kernel.org +Reported-by: Arnd Bergmann +Signed-off-by: Jerome Brunet +Reviewed-by: Martin Blumenstingl +Acked-by: Arnd Bergmann +Reviewed-by: Justin Stitt +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20240224114023.85535-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/meson-efuse.c | 25 +++---------------------- + 1 file changed, 3 insertions(+), 22 deletions(-) + +diff --git a/drivers/nvmem/meson-efuse.c b/drivers/nvmem/meson-efuse.c +index d6b533497ce1a..ba2714bef8d0e 100644 +--- a/drivers/nvmem/meson-efuse.c ++++ b/drivers/nvmem/meson-efuse.c +@@ -47,7 +47,6 @@ static int meson_efuse_probe(struct platform_device *pdev) + struct nvmem_config *econfig; + struct clk *clk; + unsigned int size; +- int ret; + + sm_np = of_parse_phandle(pdev->dev.of_node, "secure-monitor", 0); + if (!sm_np) { +@@ -60,27 +59,9 @@ static int meson_efuse_probe(struct platform_device *pdev) + if (!fw) + return -EPROBE_DEFER; + +- clk = devm_clk_get(dev, NULL); +- if (IS_ERR(clk)) { +- ret = PTR_ERR(clk); +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "failed to get efuse gate"); +- return ret; +- } +- +- ret = clk_prepare_enable(clk); +- if (ret) { +- dev_err(dev, "failed to enable gate"); +- return ret; +- } +- +- ret = devm_add_action_or_reset(dev, +- (void(*)(void *))clk_disable_unprepare, +- clk); +- if (ret) { +- dev_err(dev, "failed to add disable callback"); +- return ret; +- } ++ clk = devm_clk_get_enabled(dev, NULL); ++ if (IS_ERR(clk)) ++ return dev_err_probe(dev, PTR_ERR(clk), "failed to get efuse gate"); + + if (meson_sm_call(fw, SM_EFUSE_USER_MAX, &size, 0, 0, 0, 0, 0) < 0) { + dev_err(dev, "failed to get max user"); +-- +2.43.0 + diff --git a/queue-5.15/parisc-avoid-clobbering-the-c-b-bits-in-the-psw-with.patch b/queue-5.15/parisc-avoid-clobbering-the-c-b-bits-in-the-psw-with.patch new file mode 100644 index 00000000000..97d0d67420e --- /dev/null +++ b/queue-5.15/parisc-avoid-clobbering-the-c-b-bits-in-the-psw-with.patch @@ -0,0 +1,64 @@ +From a36f9f4493863cf59b150a5344788c09e2e4ee65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Feb 2024 16:40:51 +0100 +Subject: parisc: Avoid clobbering the C/B bits in the PSW with tophys and + tovirt macros + +From: John David Anglin + +[ Upstream commit 4603fbaa76b5e703b38ac8cc718102834eb6e330 ] + +Use add,l to avoid clobbering the C/B bits in the PSW. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org # v5.10+ +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/assembly.h | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/arch/parisc/include/asm/assembly.h b/arch/parisc/include/asm/assembly.h +index fd8c1ebd27470..12b9236effbc4 100644 +--- a/arch/parisc/include/asm/assembly.h ++++ b/arch/parisc/include/asm/assembly.h +@@ -79,26 +79,28 @@ + * version takes two arguments: a src and destination register. + * However, the source and destination registers can not be + * the same register. ++ * ++ * We use add,l to avoid clobbering the C/B bits in the PSW. + */ + + .macro tophys grvirt, grphys +- ldil L%(__PAGE_OFFSET), \grphys +- sub \grvirt, \grphys, \grphys ++ ldil L%(-__PAGE_OFFSET), \grphys ++ addl \grvirt, \grphys, \grphys + .endm +- ++ + .macro tovirt grphys, grvirt + ldil L%(__PAGE_OFFSET), \grvirt +- add \grphys, \grvirt, \grvirt ++ addl \grphys, \grvirt, \grvirt + .endm + + .macro tophys_r1 gr +- ldil L%(__PAGE_OFFSET), %r1 +- sub \gr, %r1, \gr ++ ldil L%(-__PAGE_OFFSET), %r1 ++ addl \gr, %r1, \gr + .endm +- ++ + .macro tovirt_r1 gr + ldil L%(__PAGE_OFFSET), %r1 +- add \gr, %r1, \gr ++ addl \gr, %r1, \gr + .endm + + .macro delay value +-- +2.43.0 + diff --git a/queue-5.15/parisc-fix-csum_ipv6_magic-on-32-bit-systems.patch b/queue-5.15/parisc-fix-csum_ipv6_magic-on-32-bit-systems.patch new file mode 100644 index 00000000000..7d35d68df83 --- /dev/null +++ b/queue-5.15/parisc-fix-csum_ipv6_magic-on-32-bit-systems.patch @@ -0,0 +1,55 @@ +From d999513ecf657d82099e638a104c77aeb03c2dd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 11:15:56 -0800 +Subject: parisc: Fix csum_ipv6_magic on 32-bit systems + +From: Guenter Roeck + +[ Upstream commit 4408ba75e4ba80c91fde7e10bccccf388f5c09be ] + +Calculating the IPv6 checksum on 32-bit systems missed overflows when +adding the proto+len fields into the checksum. This results in the +following unit test failure. + + # test_csum_ipv6_magic: ASSERTION FAILED at lib/checksum_kunit.c:506 + Expected ( u64)csum_result == ( u64)expected, but + ( u64)csum_result == 46722 (0xb682) + ( u64)expected == 46721 (0xb681) + not ok 5 test_csum_ipv6_magic + +This is probably rarely seen in the real world because proto+len are +usually small values which will rarely result in overflows when calculating +the checksum. However, the unit test code uses large values for the length +field, causing the test to fail. + +Fix the problem by adding the missing carry into the final checksum. + +Cc: Palmer Dabbelt +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Tested-by: Charlie Jenkins +Reviewed-by: Charlie Jenkins +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/checksum.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h +index f705e5dd10742..e619e67440db9 100644 +--- a/arch/parisc/include/asm/checksum.h ++++ b/arch/parisc/include/asm/checksum.h +@@ -163,7 +163,8 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr, + " ldw,ma 4(%2), %7\n" /* 4th daddr */ + " addc %6, %0, %0\n" + " addc %7, %0, %0\n" +-" addc %3, %0, %0\n" /* fold in proto+len, catch carry */ ++" addc %3, %0, %0\n" /* fold in proto+len */ ++" addc 0, %0, %0\n" /* add carry */ + + #endif + : "=r" (sum), "=r" (saddr), "=r" (daddr), "=r" (len), +-- +2.43.0 + diff --git a/queue-5.15/parisc-fix-csum_ipv6_magic-on-64-bit-systems.patch b/queue-5.15/parisc-fix-csum_ipv6_magic-on-64-bit-systems.patch new file mode 100644 index 00000000000..f7a5cc93d27 --- /dev/null +++ b/queue-5.15/parisc-fix-csum_ipv6_magic-on-64-bit-systems.patch @@ -0,0 +1,55 @@ +From 7aca7ca1155769bb3a2cf64737105a2047a3e864 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 15:46:31 -0800 +Subject: parisc: Fix csum_ipv6_magic on 64-bit systems + +From: Guenter Roeck + +[ Upstream commit 4b75b12d70506e31fc02356bbca60f8d5ca012d0 ] + +hppa 64-bit systems calculates the IPv6 checksum using 64-bit add +operations. The last add folds protocol and length fields into the 64-bit +result. While unlikely, this operation can overflow. The overflow can be +triggered with a code sequence such as the following. + + /* try to trigger massive overflows */ + memset(tmp_buf, 0xff, sizeof(struct in6_addr)); + csum_result = csum_ipv6_magic((struct in6_addr *)tmp_buf, + (struct in6_addr *)tmp_buf, + 0xffff, 0xff, 0xffffffff); + +Fix the problem by adding any overflows from the final add operation into +the calculated checksum. Fortunately, we can do this without additional +cost by replacing the add operation used to fold the checksum into 32 bit +with "add,dc" to add in the missing carry. + +Cc: Palmer Dabbelt +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Reviewed-by: Charlie Jenkins +Tested-by: Guenter Roeck +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/checksum.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h +index e619e67440db9..c949aa20fa162 100644 +--- a/arch/parisc/include/asm/checksum.h ++++ b/arch/parisc/include/asm/checksum.h +@@ -137,8 +137,8 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr, + " add,dc %3, %0, %0\n" /* fold in proto+len | carry bit */ + " extrd,u %0, 31, 32, %4\n"/* copy upper half down */ + " depdi 0, 31, 32, %0\n"/* clear upper half */ +-" add %4, %0, %0\n" /* fold into 32-bits */ +-" addc 0, %0, %0\n" /* add carry */ ++" add,dc %4, %0, %0\n" /* fold into 32-bits, plus carry */ ++" addc 0, %0, %0\n" /* add final carry */ + + #else + +-- +2.43.0 + diff --git a/queue-5.15/parisc-fix-ip_fast_csum.patch b/queue-5.15/parisc-fix-ip_fast_csum.patch new file mode 100644 index 00000000000..6c2ac704705 --- /dev/null +++ b/queue-5.15/parisc-fix-ip_fast_csum.patch @@ -0,0 +1,66 @@ +From 11907cfe3802582d4569c324a34575f21374c798 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 09:55:26 -0800 +Subject: parisc: Fix ip_fast_csum + +From: Guenter Roeck + +[ Upstream commit a2abae8f0b638c31bb9799d9dd847306e0d005bd ] + +IP checksum unit tests report the following error when run on hppa/hppa64. + + # test_ip_fast_csum: ASSERTION FAILED at lib/checksum_kunit.c:463 + Expected ( u64)csum_result == ( u64)expected, but + ( u64)csum_result == 33754 (0x83da) + ( u64)expected == 10946 (0x2ac2) + not ok 4 test_ip_fast_csum + +0x83da is the expected result if the IP header length is 20 bytes. 0x2ac2 +is the expected result if the IP header length is 24 bytes. The test fails +with an IP header length of 24 bytes. It appears that ip_fast_csum() +always returns the checksum for a 20-byte header, no matter how long +the header actually is. + +Code analysis shows a suspicious assembler sequence in ip_fast_csum(). + + " addc %0, %3, %0\n" + "1: ldws,ma 4(%1), %3\n" + " addib,< 0, %2, 1b\n" <--- + +While my understanding of HPPA assembler is limited, it does not seem +to make much sense to subtract 0 from a register and to expect the result +to ever be negative. Subtracting 1 from the length parameter makes more +sense. On top of that, the operation should be repeated if and only if +the result is still > 0, so change the suspicious instruction to + " addib,> -1, %2, 1b\n" + +The IP checksum unit test passes after this change. + +Cc: Palmer Dabbelt +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Tested-by: Charlie Jenkins +Reviewed-by: Charlie Jenkins +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/checksum.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h +index 3c43baca7b397..f705e5dd10742 100644 +--- a/arch/parisc/include/asm/checksum.h ++++ b/arch/parisc/include/asm/checksum.h +@@ -40,7 +40,7 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl) + " addc %0, %5, %0\n" + " addc %0, %3, %0\n" + "1: ldws,ma 4(%1), %3\n" +-" addib,< 0, %2, 1b\n" ++" addib,> -1, %2, 1b\n" + " addc %0, %3, %0\n" + "\n" + " extru %0, 31, 16, %4\n" +-- +2.43.0 + diff --git a/queue-5.15/parisc-strip-upper-32-bit-of-sum-in-csum_ipv6_magic-.patch b/queue-5.15/parisc-strip-upper-32-bit-of-sum-in-csum_ipv6_magic-.patch new file mode 100644 index 00000000000..72e20e1045a --- /dev/null +++ b/queue-5.15/parisc-strip-upper-32-bit-of-sum-in-csum_ipv6_magic-.patch @@ -0,0 +1,55 @@ +From bea02ef5fdaa91218a8b2fe20159eb3944ea2464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Feb 2024 12:33:51 -0800 +Subject: parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit + builds + +From: Guenter Roeck + +[ Upstream commit 0568b6f0d863643db2edcc7be31165740c89fa82 ] + +IPv6 checksum tests with unaligned addresses on 64-bit builds result +in unexpected failures. + +Expected expected == csum_result, but + expected == 46591 (0xb5ff) + csum_result == 46381 (0xb52d) +with alignment offset 1 + +Oddly enough, the problem disappeared after adding test code into +the beginning of csum_ipv6_magic(). + +As it turns out, the 'sum' parameter of csum_ipv6_magic() is declared as +__wsum, which is a 32-bit variable. However, it is treated as 64-bit +variable in the 64-bit assembler code. Tests showed that the upper 32 bit +of the register used to pass the variable are _not_ cleared when entering +the function. This can result in checksum calculation errors. + +Clearing the upper 32 bit of 'sum' as first operation in the assembler +code fixes the problem. + +Acked-by: Helge Deller +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/checksum.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/parisc/include/asm/checksum.h b/arch/parisc/include/asm/checksum.h +index c949aa20fa162..2aceebcd695c8 100644 +--- a/arch/parisc/include/asm/checksum.h ++++ b/arch/parisc/include/asm/checksum.h +@@ -126,6 +126,7 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr, + ** Try to keep 4 registers with "live" values ahead of the ALU. + */ + ++" depdi 0, 31, 32, %0\n"/* clear upper half of incoming checksum */ + " ldd,ma 8(%1), %4\n" /* get 1st saddr word */ + " ldd,ma 8(%2), %5\n" /* get 1st daddr word */ + " add %4, %0, %0\n" +-- +2.43.0 + diff --git a/queue-5.15/pci-aer-block-runtime-suspend-when-handling-errors.patch b/queue-5.15/pci-aer-block-runtime-suspend-when-handling-errors.patch new file mode 100644 index 00000000000..c07c6ee6f08 --- /dev/null +++ b/queue-5.15/pci-aer-block-runtime-suspend-when-handling-errors.patch @@ -0,0 +1,99 @@ +From 5fa1fa008f92efa3210466050f13d34598e4379c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Feb 2024 13:01:35 +0100 +Subject: PCI/AER: Block runtime suspend when handling errors + +From: Stanislaw Gruszka + +[ Upstream commit 002bf2fbc00e5c4b95fb167287e2ae7d1973281e ] + +PM runtime can be done simultaneously with AER error handling. Avoid that +by using pm_runtime_get_sync() before and pm_runtime_put() after reset in +pcie_do_recovery() for all recovering devices. + +pm_runtime_get_sync() will increase dev->power.usage_count counter to +prevent any possible future request to runtime suspend a device. It will +also resume a device, if it was previously in D3hot state. + +I tested with igc device by doing simultaneous aer_inject and rpm +suspend/resume via /sys/bus/pci/devices/PCI_ID/power/control and can +reproduce: + + igc 0000:02:00.0: not ready 65535ms after bus reset; giving up + pcieport 0000:00:1c.2: AER: Root Port link has been reset (-25) + pcieport 0000:00:1c.2: AER: subordinate device reset failed + pcieport 0000:00:1c.2: AER: device recovery failed + igc 0000:02:00.0: Unable to change power state from D3hot to D0, device inaccessible + +The problem disappears when this patch is applied. + +Link: https://lore.kernel.org/r/20240212120135.146068-1-stanislaw.gruszka@linux.intel.com +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Bjorn Helgaas +Reviewed-by: Kuppuswamy Sathyanarayanan +Acked-by: Rafael J. Wysocki +Cc: +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/err.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c +index b576aa890c76b..410fc44d79ee2 100644 +--- a/drivers/pci/pcie/err.c ++++ b/drivers/pci/pcie/err.c +@@ -13,6 +13,7 @@ + #define dev_fmt(fmt) "AER: " fmt + + #include ++#include + #include + #include + #include +@@ -79,6 +80,18 @@ static int report_error_detected(struct pci_dev *dev, + return 0; + } + ++static int pci_pm_runtime_get_sync(struct pci_dev *pdev, void *data) ++{ ++ pm_runtime_get_sync(&pdev->dev); ++ return 0; ++} ++ ++static int pci_pm_runtime_put(struct pci_dev *pdev, void *data) ++{ ++ pm_runtime_put(&pdev->dev); ++ return 0; ++} ++ + static int report_frozen_detected(struct pci_dev *dev, void *data) + { + return report_error_detected(dev, pci_channel_io_frozen, data); +@@ -195,6 +208,8 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev, + else + bridge = pci_upstream_bridge(dev); + ++ pci_walk_bridge(bridge, pci_pm_runtime_get_sync, NULL); ++ + pci_dbg(bridge, "broadcast error_detected message\n"); + if (state == pci_channel_io_frozen) { + pci_walk_bridge(bridge, report_frozen_detected, &status); +@@ -239,10 +254,15 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev, + pcie_clear_device_status(dev); + pci_aer_clear_nonfatal_status(dev); + } ++ ++ pci_walk_bridge(bridge, pci_pm_runtime_put, NULL); ++ + pci_info(bridge, "device recovery successful\n"); + return status; + + failed: ++ pci_walk_bridge(bridge, pci_pm_runtime_put, NULL); ++ + pci_uevent_ers(bridge, PCI_ERS_RESULT_DISCONNECT); + + /* TODO: Should kernel panic here? */ +-- +2.43.0 + diff --git a/queue-5.15/pci-aspm-make-intel-dg2-l1-acceptable-latency-unlimi.patch b/queue-5.15/pci-aspm-make-intel-dg2-l1-acceptable-latency-unlimi.patch new file mode 100644 index 00000000000..41b35376404 --- /dev/null +++ b/queue-5.15/pci-aspm-make-intel-dg2-l1-acceptable-latency-unlimi.patch @@ -0,0 +1,90 @@ +From efb7b9e3680066f6a36c03cca1ec394d1645ba05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Apr 2022 12:38:10 +0300 +Subject: PCI/ASPM: Make Intel DG2 L1 acceptable latency unlimited + +From: Mika Westerberg + +[ Upstream commit 03038d84ace72678a9944524508f218a00377dc0 ] + +Intel DG2 discrete graphics PCIe endpoints advertise L1 acceptable exit +latency to be < 1us even though they can actually tolerate unlimited exit +latencies just fine. Quirk the L1 acceptable exit latency for these +endpoints to be unlimited so ASPM L1 can be enabled. + +[bhelgaas: use FIELD_GET/FIELD_PREP, wordsmith comment & commit log] +Link: https://lore.kernel.org/r/20220405093810.76613-1-mika.westerberg@linux.intel.com +Signed-off-by: Mika Westerberg +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rodrigo Vivi +Stable-dep-of: 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports") +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 47 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 47 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 50501c10809d2..3217d4aaea598 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -12,6 +12,7 @@ + * file, where their drivers can use them. + */ + ++#include + #include + #include + #include +@@ -5903,3 +5904,49 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1533, rom_bar_overlap_defect); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1536, rom_bar_overlap_defect); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1537, rom_bar_overlap_defect); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1538, rom_bar_overlap_defect); ++ ++#ifdef CONFIG_PCIEASPM ++/* ++ * Several Intel DG2 graphics devices advertise that they can only tolerate ++ * 1us latency when transitioning from L1 to L0, which may prevent ASPM L1 ++ * from being enabled. But in fact these devices can tolerate unlimited ++ * latency. Override their Device Capabilities value to allow ASPM L1 to ++ * be enabled. ++ */ ++static void aspm_l1_acceptable_latency(struct pci_dev *dev) ++{ ++ u32 l1_lat = FIELD_GET(PCI_EXP_DEVCAP_L1, dev->devcap); ++ ++ if (l1_lat < 7) { ++ dev->devcap |= FIELD_PREP(PCI_EXP_DEVCAP_L1, 7); ++ pci_info(dev, "ASPM: overriding L1 acceptable latency from %#x to 0x7\n", ++ l1_lat); ++ } ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f80, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f81, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f82, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f83, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f84, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f85, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f86, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f87, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x4f88, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5690, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5691, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5692, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5693, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5694, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x5695, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56a0, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56a1, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56a2, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56a3, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56a4, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56a5, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56a6, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56b0, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56b1, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56c0, aspm_l1_acceptable_latency); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56c1, aspm_l1_acceptable_latency); ++#endif +-- +2.43.0 + diff --git a/queue-5.15/pci-dpc-quirk-pio-log-size-for-certain-intel-root-po.patch b/queue-5.15/pci-dpc-quirk-pio-log-size-for-certain-intel-root-po.patch new file mode 100644 index 00000000000..d3a0e797c9e --- /dev/null +++ b/queue-5.15/pci-dpc-quirk-pio-log-size-for-certain-intel-root-po.patch @@ -0,0 +1,107 @@ +From e556a1f510c2bce2dd56e44ee3ee658fab1f69cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 13:20:42 +0300 +Subject: PCI/DPC: Quirk PIO log size for certain Intel Root Ports + +From: Mika Westerberg + +[ Upstream commit 5459c0b7046752e519a646e1c2404852bb628459 ] + +Some Root Ports on Intel Tiger Lake and Alder Lake systems support the RP +Extensions for DPC and the RP PIO Log registers but incorrectly advertise +an RP PIO Log Size of zero. This means the kernel complains that: + + DPC: RP PIO log size 0 is invalid + +and if DPC is triggered, the DPC driver will not dump the RP PIO Log +registers when it should. + +This is caused by a BIOS bug and should be fixed the BIOS for future CPUs. + +Add a quirk to set the correct RP PIO Log size for the affected Root Ports. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=209943 +Link: https://lore.kernel.org/r/20220816102042.69125-1-mika.westerberg@linux.intel.com +Signed-off-by: Mika Westerberg +Signed-off-by: Bjorn Helgaas +Reviewed-by: Kuppuswamy Sathyanarayanan +Stable-dep-of: 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports") +Signed-off-by: Sasha Levin +--- + drivers/pci/pcie/dpc.c | 15 ++++++++++----- + drivers/pci/quirks.c | 36 ++++++++++++++++++++++++++++++++++++ + 2 files changed, 46 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c +index cf0d4ba2e157a..ab83f78f3eb1d 100644 +--- a/drivers/pci/pcie/dpc.c ++++ b/drivers/pci/pcie/dpc.c +@@ -335,11 +335,16 @@ void pci_dpc_init(struct pci_dev *pdev) + return; + + pdev->dpc_rp_extensions = true; +- pdev->dpc_rp_log_size = (cap & PCI_EXP_DPC_RP_PIO_LOG_SIZE) >> 8; +- if (pdev->dpc_rp_log_size < 4 || pdev->dpc_rp_log_size > 9) { +- pci_err(pdev, "RP PIO log size %u is invalid\n", +- pdev->dpc_rp_log_size); +- pdev->dpc_rp_log_size = 0; ++ ++ /* Quirks may set dpc_rp_log_size if device or firmware is buggy */ ++ if (!pdev->dpc_rp_log_size) { ++ pdev->dpc_rp_log_size = ++ (cap & PCI_EXP_DPC_RP_PIO_LOG_SIZE) >> 8; ++ if (pdev->dpc_rp_log_size < 4 || pdev->dpc_rp_log_size > 9) { ++ pci_err(pdev, "RP PIO log size %u is invalid\n", ++ pdev->dpc_rp_log_size); ++ pdev->dpc_rp_log_size = 0; ++ } + } + } + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 3217d4aaea598..59b3dd33092bf 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5950,3 +5950,39 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56b1, aspm_l1_acceptable_latency + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56c0, aspm_l1_acceptable_latency); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56c1, aspm_l1_acceptable_latency); + #endif ++ ++#ifdef CONFIG_PCIE_DPC ++/* ++ * Intel Tiger Lake and Alder Lake BIOS has a bug that clears the DPC ++ * RP PIO Log Size of the integrated Thunderbolt PCIe Root Ports. ++ */ ++static void dpc_log_size(struct pci_dev *dev) ++{ ++ u16 dpc, val; ++ ++ dpc = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_DPC); ++ if (!dpc) ++ return; ++ ++ pci_read_config_word(dev, dpc + PCI_EXP_DPC_CAP, &val); ++ if (!(val & PCI_EXP_DPC_CAP_RP_EXT)) ++ return; ++ ++ if (!((val & PCI_EXP_DPC_RP_PIO_LOG_SIZE) >> 8)) { ++ pci_info(dev, "Overriding RP PIO Log Size to 4\n"); ++ dev->dpc_rp_log_size = 4; ++ } ++} ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x461f, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x462f, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x463f, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x466e, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a23, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a25, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a27, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a29, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2b, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2d, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2f, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a31, dpc_log_size); ++#endif +-- +2.43.0 + diff --git a/queue-5.15/pci-dpc-quirk-pio-log-size-for-intel-raptor-lake-roo.patch b/queue-5.15/pci-dpc-quirk-pio-log-size-for-intel-raptor-lake-roo.patch new file mode 100644 index 00000000000..525029bd3d7 --- /dev/null +++ b/queue-5.15/pci-dpc-quirk-pio-log-size-for-intel-raptor-lake-roo.patch @@ -0,0 +1,53 @@ +From 6b319410d6da3d6ec6a9efe6642fd4b4f47c4905 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 12:30:56 +0100 +Subject: PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports + +From: Paul Menzel + +[ Upstream commit 627c6db20703b5d18d928464f411d0d4ec327508 ] + +Commit 5459c0b70467 ("PCI/DPC: Quirk PIO log size for certain Intel Root +Ports") and commit 3b8803494a06 ("PCI/DPC: Quirk PIO log size for Intel Ice +Lake Root Ports") add quirks for Ice, Tiger and Alder Lake Root Ports. +System firmware for Raptor Lake still has the bug, so Linux logs the +warning below on several Raptor Lake systems like Dell Precision 3581 with +Intel Raptor Lake processor (0W18NX) system firmware/BIOS version 1.10.1. + + pci 0000:00:07.0: [8086:a76e] type 01 class 0x060400 + pci 0000:00:07.0: DPC: RP PIO log size 0 is invalid + pci 0000:00:07.1: [8086:a73f] type 01 class 0x060400 + pci 0000:00:07.1: DPC: RP PIO log size 0 is invalid + +Apply the quirk for Raptor Lake Root Ports as well. + +This also enables the DPC driver to dump the RP PIO Log registers when DPC +is triggered. + +Link: https://lore.kernel.org/r/20240305113057.56468-1-pmenzel@molgen.mpg.de +Reported-by: Niels van Aert +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218560 +Signed-off-by: Paul Menzel +Signed-off-by: Bjorn Helgaas +Cc: +Cc: Mika Westerberg +Cc: Niels van Aert +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 59b3dd33092bf..43e120b828169 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5985,4 +5985,6 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2b, dpc_log_size); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2d, dpc_log_size); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a2f, dpc_log_size); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x9a31, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa73f, dpc_log_size); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0xa76e, dpc_log_size); + #endif +-- +2.43.0 + diff --git a/queue-5.15/pci-drop-pci_device_remove-test-of-pci_dev-driver.patch b/queue-5.15/pci-drop-pci_device_remove-test-of-pci_dev-driver.patch new file mode 100644 index 00000000000..13b1a2a1515 --- /dev/null +++ b/queue-5.15/pci-drop-pci_device_remove-test-of-pci_dev-driver.patch @@ -0,0 +1,58 @@ +From 7bc7bd18993b5a91fe8034eca55b4bd2785f5c49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 14:59:25 +0200 +Subject: PCI: Drop pci_device_remove() test of pci_dev->driver +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 097d9d414433315122f759ee6c2d8a7417a8ff0f ] + +When the driver core calls pci_device_remove(), there is a driver bound +to the device, so pci_dev->driver is never NULL. + +Remove the unnecessary test of pci_dev->driver. + +Link: https://lore.kernel.org/r/20211004125935.2300113-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Bjorn Helgaas +Reviewed-by: Christoph Hellwig +Stable-dep-of: 9d5286d4e7f6 ("PCI/PM: Drain runtime-idle callbacks before driver removal") +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index f44c0667a83c6..3a9c49b0d05b0 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -459,16 +459,14 @@ static void pci_device_remove(struct device *dev) + struct pci_dev *pci_dev = to_pci_dev(dev); + struct pci_driver *drv = pci_dev->driver; + +- if (drv) { +- if (drv->remove) { +- pm_runtime_get_sync(dev); +- drv->remove(pci_dev); +- pm_runtime_put_noidle(dev); +- } +- pcibios_free_irq(pci_dev); +- pci_dev->driver = NULL; +- pci_iov_remove(pci_dev); ++ if (drv->remove) { ++ pm_runtime_get_sync(dev); ++ drv->remove(pci_dev); ++ pm_runtime_put_noidle(dev); + } ++ pcibios_free_irq(pci_dev); ++ pci_dev->driver = NULL; ++ pci_iov_remove(pci_dev); + + /* Undo the runtime PM settings in local_pci_probe() */ + pm_runtime_put_sync(dev); +-- +2.43.0 + diff --git a/queue-5.15/pci-dwc-endpoint-fix-advertised-resizable-bar-size.patch b/queue-5.15/pci-dwc-endpoint-fix-advertised-resizable-bar-size.patch new file mode 100644 index 00000000000..6fd2526b7e4 --- /dev/null +++ b/queue-5.15/pci-dwc-endpoint-fix-advertised-resizable-bar-size.patch @@ -0,0 +1,75 @@ +From cfd1fca9e85950b15aabf42bf1604ba94264e049 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 12:15:20 +0100 +Subject: PCI: dwc: endpoint: Fix advertised resizable BAR size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Cassel + +[ Upstream commit 72e34b8593e08a0ee759b7a038e0b178418ea6f8 ] + +The commit message in commit fc9a77040b04 ("PCI: designware-ep: Configure +Resizable BAR cap to advertise the smallest size") claims that it modifies +the Resizable BAR capability to only advertise support for 1 MB size BARs. + +However, the commit writes all zeroes to PCI_REBAR_CAP (the register which +contains the possible BAR sizes that a BAR be resized to). + +According to the spec, it is illegal to not have a bit set in +PCI_REBAR_CAP, and 1 MB is the smallest size allowed. + +Set bit 4 in PCI_REBAR_CAP, so that we actually advertise support for a +1 MB BAR size. + +Before: + Capabilities: [2e8 v1] Physical Resizable BAR + BAR 0: current size: 1MB + BAR 1: current size: 1MB + BAR 2: current size: 1MB + BAR 3: current size: 1MB + BAR 4: current size: 1MB + BAR 5: current size: 1MB +After: + Capabilities: [2e8 v1] Physical Resizable BAR + BAR 0: current size: 1MB, supported: 1MB + BAR 1: current size: 1MB, supported: 1MB + BAR 2: current size: 1MB, supported: 1MB + BAR 3: current size: 1MB, supported: 1MB + BAR 4: current size: 1MB, supported: 1MB + BAR 5: current size: 1MB, supported: 1MB + +Fixes: fc9a77040b04 ("PCI: designware-ep: Configure Resizable BAR cap to advertise the smallest size") +Link: https://lore.kernel.org/linux-pci/20240307111520.3303774-1-cassel@kernel.org +Signed-off-by: Niklas Cassel +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Manivannan Sadhasivam +Cc: # 5.2 +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-ep.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c +index fcb1fdb22ffbc..fc92d30a0ad99 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-ep.c ++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c +@@ -658,8 +658,13 @@ int dw_pcie_ep_init_complete(struct dw_pcie_ep *ep) + nbars = (reg & PCI_REBAR_CTRL_NBAR_MASK) >> + PCI_REBAR_CTRL_NBAR_SHIFT; + ++ /* ++ * PCIe r6.0, sec 7.8.6.2 require us to support at least one ++ * size in the range from 1 MB to 512 GB. Advertise support ++ * for 1 MB BAR size only. ++ */ + for (i = 0; i < nbars; i++, offset += PCI_REBAR_CTRL) +- dw_pcie_writel_dbi(pci, offset + PCI_REBAR_CAP, 0x0); ++ dw_pcie_writel_dbi(pci, offset + PCI_REBAR_CAP, BIT(4)); + } + + dw_pcie_setup(pci); +-- +2.43.0 + diff --git a/queue-5.15/pci-pm-drain-runtime-idle-callbacks-before-driver-re.patch b/queue-5.15/pci-pm-drain-runtime-idle-callbacks-before-driver-re.patch new file mode 100644 index 00000000000..0b46629d443 --- /dev/null +++ b/queue-5.15/pci-pm-drain-runtime-idle-callbacks-before-driver-re.patch @@ -0,0 +1,76 @@ +From 878622ad09e8feba6709de91cefc2a9ddab571ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 11:45:38 +0100 +Subject: PCI/PM: Drain runtime-idle callbacks before driver removal + +From: Rafael J. Wysocki + +[ Upstream commit 9d5286d4e7f68beab450deddbb6a32edd5ecf4bf ] + +A race condition between the .runtime_idle() callback and the .remove() +callback in the rtsx_pcr PCI driver leads to a kernel crash due to an +unhandled page fault [1]. + +The problem is that rtsx_pci_runtime_idle() is not expected to be running +after pm_runtime_get_sync() has been called, but the latter doesn't really +guarantee that. It only guarantees that the suspend and resume callbacks +will not be running when it returns. + +However, if a .runtime_idle() callback is already running when +pm_runtime_get_sync() is called, the latter will notice that the runtime PM +status of the device is RPM_ACTIVE and it will return right away without +waiting for the former to complete. In fact, it cannot wait for +.runtime_idle() to complete because it may be called from that callback (it +arguably does not make much sense to do that, but it is not strictly +prohibited). + +Thus in general, whoever is providing a .runtime_idle() callback needs +to protect it from running in parallel with whatever code runs after +pm_runtime_get_sync(). [Note that .runtime_idle() will not start after +pm_runtime_get_sync() has returned, but it may continue running then if it +has started earlier.] + +One way to address that race condition is to call pm_runtime_barrier() +after pm_runtime_get_sync() (not before it, because a nonzero value of the +runtime PM usage counter is necessary to prevent runtime PM callbacks from +being invoked) to wait for the .runtime_idle() callback to complete should +it be running at that point. A suitable place for doing that is in +pci_device_remove() which calls pm_runtime_get_sync() before removing the +driver, so it may as well call pm_runtime_barrier() subsequently, which +will prevent the race in question from occurring, not just in the rtsx_pcr +driver, but in any PCI drivers providing .runtime_idle() callbacks. + +Link: https://lore.kernel.org/lkml/20240229062201.49500-1-kai.heng.feng@canonical.com/ # [1] +Link: https://lore.kernel.org/r/5761426.DvuYhMxLoT@kreacher +Reported-by: Kai-Heng Feng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Bjorn Helgaas +Tested-by: Ricky Wu +Acked-by: Kai-Heng Feng +Cc: +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 3a9c49b0d05b0..46b82bacaff68 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -461,6 +461,13 @@ static void pci_device_remove(struct device *dev) + + if (drv->remove) { + pm_runtime_get_sync(dev); ++ /* ++ * If the driver provides a .runtime_idle() callback and it has ++ * started to run already, it may continue to run in parallel ++ * with the code below, so wait until all of the runtime PM ++ * activity has completed. ++ */ ++ pm_runtime_barrier(dev); + drv->remove(pci_dev); + pm_runtime_put_noidle(dev); + } +-- +2.43.0 + diff --git a/queue-5.15/pci-work-around-intel-i210-rom-bar-overlap-defect.patch b/queue-5.15/pci-work-around-intel-i210-rom-bar-overlap-defect.patch new file mode 100644 index 00000000000..2e7f6852d1c --- /dev/null +++ b/queue-5.15/pci-work-around-intel-i210-rom-bar-overlap-defect.patch @@ -0,0 +1,105 @@ +From 40314321ad3b4c40ada4f04948220f3c9b3ad911 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Dec 2021 10:45:07 -0600 +Subject: PCI: Work around Intel I210 ROM BAR overlap defect + +From: Bjorn Helgaas + +[ Upstream commit 500b55b05d0a21c4adddf4c3b29ee6f32b502046 ] + +Per PCIe r5, sec 7.5.1.2.4, a device must not claim accesses to its +Expansion ROM unless both the Memory Space Enable and the Expansion ROM +Enable bit are set. But apparently some Intel I210 NICs don't work +correctly if the ROM BAR overlaps another BAR, even if the Expansion ROM is +disabled. + +Michael reported that on a Kontron SMARC-sAL28 ARM64 system with U-Boot +v2021.01-rc3, the ROM BAR overlaps BAR 3, and networking doesn't work at +all: + + BAR 0: 0x40000000 (32-bit, non-prefetchable) [size=1M] + BAR 3: 0x40200000 (32-bit, non-prefetchable) [size=16K] + ROM: 0x40200000 (disabled) [size=1M] + + NETDEV WATCHDOG: enP2p1s0 (igb): transmit queue 0 timed out + Hardware name: Kontron SMARC-sAL28 (Single PHY) on SMARC Eval 2.0 carrier (DT) + igb 0002:01:00.0 enP2p1s0: Reset adapter + +Previously, pci_std_update_resource() wrote the assigned ROM address to the +BAR only when the ROM was enabled. This meant that the I210 ROM BAR could +be left with an address assigned by firmware, which might overlap with +other BARs. + +Quirk these I210 devices so pci_std_update_resource() always writes the +assigned address to the ROM BAR, whether or not the ROM is enabled. + +Link: https://lore.kernel.org/r/20211223163754.GA1267351@bhelgaas +Link: https://lore.kernel.org/r/20201230185317.30915-1-michael@walle.cc +Link: https://bugzilla.kernel.org/show_bug.cgi?id=211105 +Reported-by: Michael Walle +Tested-by: Michael Walle +Signed-off-by: Bjorn Helgaas +Stable-dep-of: 627c6db20703 ("PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports") +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 10 ++++++++++ + drivers/pci/setup-res.c | 8 ++++++-- + include/linux/pci.h | 1 + + 3 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 1b6484c906094..50501c10809d2 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5893,3 +5893,13 @@ static void nvidia_ion_ahci_fixup(struct pci_dev *pdev) + pdev->dev_flags |= PCI_DEV_FLAGS_HAS_MSI_MASKING; + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0ab8, nvidia_ion_ahci_fixup); ++ ++static void rom_bar_overlap_defect(struct pci_dev *dev) ++{ ++ pci_info(dev, "working around ROM BAR overlap defect\n"); ++ dev->rom_bar_overlap = 1; ++} ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1533, rom_bar_overlap_defect); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1536, rom_bar_overlap_defect); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1537, rom_bar_overlap_defect); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1538, rom_bar_overlap_defect); +diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c +index 875d50c16f19d..b492e67c3d871 100644 +--- a/drivers/pci/setup-res.c ++++ b/drivers/pci/setup-res.c +@@ -75,12 +75,16 @@ static void pci_std_update_resource(struct pci_dev *dev, int resno) + * as zero when disabled, so don't update ROM BARs unless + * they're enabled. See + * https://lore.kernel.org/r/43147B3D.1030309@vc.cvut.cz/ ++ * But we must update ROM BAR for buggy devices where even a ++ * disabled ROM can conflict with other BARs. + */ +- if (!(res->flags & IORESOURCE_ROM_ENABLE)) ++ if (!(res->flags & IORESOURCE_ROM_ENABLE) && ++ !dev->rom_bar_overlap) + return; + + reg = dev->rom_base_reg; +- new |= PCI_ROM_ADDRESS_ENABLE; ++ if (res->flags & IORESOURCE_ROM_ENABLE) ++ new |= PCI_ROM_ADDRESS_ENABLE; + } else + return; + +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 08d26b58f95ca..25e2e7756b1d8 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -455,6 +455,7 @@ struct pci_dev { + unsigned int link_active_reporting:1;/* Device capable of reporting link active */ + unsigned int no_vf_scan:1; /* Don't scan for VFs after IOV enablement */ + unsigned int no_command_memory:1; /* No PCI_COMMAND_MEMORY */ ++ unsigned int rom_bar_overlap:1; /* ROM BAR disable broken */ + pci_dev_flags_t dev_flags; + atomic_t enable_cnt; /* pci_enable_device has been called */ + +-- +2.43.0 + diff --git a/queue-5.15/pci_iounmap-fix-mmio-mapping-leak.patch b/queue-5.15/pci_iounmap-fix-mmio-mapping-leak.patch new file mode 100644 index 00000000000..4a489092acd --- /dev/null +++ b/queue-5.15/pci_iounmap-fix-mmio-mapping-leak.patch @@ -0,0 +1,44 @@ +From 010435c1902be5b97a08b19248e7bde658759ce6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 10:00:20 +0100 +Subject: pci_iounmap(): Fix MMIO mapping leak + +From: Philipp Stanner + +[ Upstream commit 7626913652cc786c238e2dd7d8740b17d41b2637 ] + +The #ifdef ARCH_HAS_GENERIC_IOPORT_MAP accidentally also guards iounmap(), +which means MMIO mappings are leaked. + +Move the guard so we call iounmap() for MMIO mappings. + +Fixes: 316e8d79a095 ("pci_iounmap'2: Electric Boogaloo: try to make sense of it all") +Link: https://lore.kernel.org/r/20240131090023.12331-2-pstanner@redhat.com +Reported-by: Danilo Krummrich +Suggested-by: Arnd Bergmann +Signed-off-by: Philipp Stanner +Signed-off-by: Bjorn Helgaas +Reviewed-by: Arnd Bergmann +Cc: # v5.15+ +Signed-off-by: Sasha Levin +--- + lib/pci_iomap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/pci_iomap.c b/lib/pci_iomap.c +index ce39ce9f3526e..2829ddb0e316b 100644 +--- a/lib/pci_iomap.c ++++ b/lib/pci_iomap.c +@@ -170,8 +170,8 @@ void pci_iounmap(struct pci_dev *dev, void __iomem *p) + + if (addr >= start && addr < start + IO_SPACE_LIMIT) + return; +- iounmap(p); + #endif ++ iounmap(p); + } + EXPORT_SYMBOL(pci_iounmap); + +-- +2.43.0 + diff --git a/queue-5.15/phy-tegra-xusb-add-api-to-retrieve-the-port-number-o.patch b/queue-5.15/phy-tegra-xusb-add-api-to-retrieve-the-port-number-o.patch new file mode 100644 index 00000000000..a0370d89f91 --- /dev/null +++ b/queue-5.15/phy-tegra-xusb-add-api-to-retrieve-the-port-number-o.patch @@ -0,0 +1,68 @@ +From fafba0b25518daa86fc110551c396f50f9363fbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 11:03:27 +0800 +Subject: phy: tegra: xusb: Add API to retrieve the port number of phy + +From: Wayne Chang + +[ Upstream commit d843f031d9e90462253015bc0bd9e3852d206bf2 ] + +This patch introduces a new API, tegra_xusb_padctl_get_port_number, +to the Tegra XUSB Pad Controller driver. This API is used to identify +the USB port that is associated with a given PHY. + +The function takes a PHY pointer for either a USB2 PHY or USB3 PHY as input +and returns the corresponding port number. If the PHY pointer is invalid, +it returns -ENODEV. + +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20240307030328.1487748-2-waynec@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 13 +++++++++++++ + include/linux/phy/tegra/xusb.h | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index 119e2c039225f..bf7706bf101a6 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -1485,6 +1485,19 @@ int tegra_xusb_padctl_get_usb3_companion(struct tegra_xusb_padctl *padctl, + } + EXPORT_SYMBOL_GPL(tegra_xusb_padctl_get_usb3_companion); + ++int tegra_xusb_padctl_get_port_number(struct phy *phy) ++{ ++ struct tegra_xusb_lane *lane; ++ ++ if (!phy) ++ return -ENODEV; ++ ++ lane = phy_get_drvdata(phy); ++ ++ return lane->index; ++} ++EXPORT_SYMBOL_GPL(tegra_xusb_padctl_get_port_number); ++ + MODULE_AUTHOR("Thierry Reding "); + MODULE_DESCRIPTION("Tegra XUSB Pad Controller driver"); + MODULE_LICENSE("GPL v2"); +diff --git a/include/linux/phy/tegra/xusb.h b/include/linux/phy/tegra/xusb.h +index 3a35e74cdc617..b30343a1f47eb 100644 +--- a/include/linux/phy/tegra/xusb.h ++++ b/include/linux/phy/tegra/xusb.h +@@ -24,6 +24,7 @@ int tegra_xusb_padctl_set_vbus_override(struct tegra_xusb_padctl *padctl, + int tegra_phy_xusb_utmi_port_reset(struct phy *phy); + int tegra_xusb_padctl_get_usb3_companion(struct tegra_xusb_padctl *padctl, + unsigned int port); ++int tegra_xusb_padctl_get_port_number(struct phy *phy); + int tegra_xusb_padctl_enable_phy_sleepwalk(struct tegra_xusb_padctl *padctl, struct phy *phy, + enum usb_device_speed speed); + int tegra_xusb_padctl_disable_phy_sleepwalk(struct tegra_xusb_padctl *padctl, struct phy *phy); +-- +2.43.0 + diff --git a/queue-5.15/pm-sleep-wakeirq-fix-wake-irq-warning-in-system-susp.patch b/queue-5.15/pm-sleep-wakeirq-fix-wake-irq-warning-in-system-susp.patch new file mode 100644 index 00000000000..75e2ee8d94d --- /dev/null +++ b/queue-5.15/pm-sleep-wakeirq-fix-wake-irq-warning-in-system-susp.patch @@ -0,0 +1,59 @@ +From 9efc1c12649767d5afd33fd0611b8aadf70e6a4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2024 17:26:57 +0800 +Subject: PM: sleep: wakeirq: fix wake irq warning in system suspend + +From: Qingliang Li + +[ Upstream commit e7a7681c859643f3f2476b2a28a494877fd89442 ] + +When driver uses pm_runtime_force_suspend() as the system suspend callback +function and registers the wake irq with reverse enable ordering, the wake +irq will be re-enabled when entering system suspend, triggering an +'Unbalanced enable for IRQ xxx' warning. In this scenario, the call +sequence during system suspend is as follows: + suspend_devices_and_enter() + -> dpm_suspend_start() + -> dpm_run_callback() + -> pm_runtime_force_suspend() + -> dev_pm_enable_wake_irq_check() + -> dev_pm_enable_wake_irq_complete() + + -> suspend_enter() + -> dpm_suspend_noirq() + -> device_wakeup_arm_wake_irqs() + -> dev_pm_arm_wake_irq() + +To fix this issue, complete the setting of WAKE_IRQ_DEDICATED_ENABLED flag +in dev_pm_enable_wake_irq_complete() to avoid redundant irq enablement. + +Fixes: 8527beb12087 ("PM: sleep: wakeirq: fix wake irq arming") +Reviewed-by: Dhruva Gole +Signed-off-by: Qingliang Li +Reviewed-by: Johan Hovold +Cc: 5.16+ # 5.16+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/wakeirq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c +index 6f2cdd8643afa..ab6eced7f5762 100644 +--- a/drivers/base/power/wakeirq.c ++++ b/drivers/base/power/wakeirq.c +@@ -362,8 +362,10 @@ void dev_pm_enable_wake_irq_complete(struct device *dev) + return; + + if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED && +- wirq->status & WAKE_IRQ_DEDICATED_REVERSE) ++ wirq->status & WAKE_IRQ_DEDICATED_REVERSE) { + enable_irq(wirq->irq); ++ wirq->status |= WAKE_IRQ_DEDICATED_ENABLED; ++ } + } + + /** +-- +2.43.0 + diff --git a/queue-5.15/pm-suspend-set-mem_sleep_current-during-kernel-comma.patch b/queue-5.15/pm-suspend-set-mem_sleep_current-during-kernel-comma.patch new file mode 100644 index 00000000000..fca3aad2b54 --- /dev/null +++ b/queue-5.15/pm-suspend-set-mem_sleep_current-during-kernel-comma.patch @@ -0,0 +1,42 @@ +From 16f1f9d422c72d7f65002b2052c2c1af083c84a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 12:14:59 +0530 +Subject: PM: suspend: Set mem_sleep_current during kernel command line setup + +From: Maulik Shah + +[ Upstream commit 9bc4ffd32ef8943f5c5a42c9637cfd04771d021b ] + +psci_init_system_suspend() invokes suspend_set_ops() very early during +bootup even before kernel command line for mem_sleep_default is setup. +This leads to kernel command line mem_sleep_default=s2idle not working +as mem_sleep_current gets changed to deep via suspend_set_ops() and never +changes back to s2idle. + +Set mem_sleep_current along with mem_sleep_default during kernel command +line setup as default suspend mode. + +Fixes: faf7ec4a92c0 ("drivers: firmware: psci: add system suspend support") +CC: stable@vger.kernel.org # 5.4+ +Signed-off-by: Maulik Shah +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/suspend.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c +index 13d905dd32675..5d617639e81ed 100644 +--- a/kernel/power/suspend.c ++++ b/kernel/power/suspend.c +@@ -187,6 +187,7 @@ static int __init mem_sleep_default_setup(char *str) + if (mem_sleep_labels[state] && + !strcmp(str, mem_sleep_labels[state])) { + mem_sleep_default = state; ++ mem_sleep_current = state; + break; + } + +-- +2.43.0 + diff --git a/queue-5.15/powerpc-fsl-fix-mfpmr-build-errors-with-newer-binuti.patch b/queue-5.15/powerpc-fsl-fix-mfpmr-build-errors-with-newer-binuti.patch new file mode 100644 index 00000000000..7ef3a09d311 --- /dev/null +++ b/queue-5.15/powerpc-fsl-fix-mfpmr-build-errors-with-newer-binuti.patch @@ -0,0 +1,61 @@ +From d9a23934775a4fbc43d3cde668909b61418d051c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 23:25:19 +1100 +Subject: powerpc/fsl: Fix mfpmr build errors with newer binutils + +From: Michael Ellerman + +[ Upstream commit 5f491356b7149564ab22323ccce79c8d595bfd0c ] + +Binutils 2.38 complains about the use of mfpmr when building +ppc6xx_defconfig: + + CC arch/powerpc/kernel/pmc.o + {standard input}: Assembler messages: + {standard input}:45: Error: unrecognized opcode: `mfpmr' + {standard input}:56: Error: unrecognized opcode: `mtpmr' + +This is because by default the kernel is built with -mcpu=powerpc, and +the mt/mfpmr instructions are not defined. + +It can be avoided by enabling CONFIG_E300C3_CPU, but just adding that to +the defconfig will leave open the possibility of randconfig failures. + +So add machine directives around the mt/mfpmr instructions to tell +binutils how to assemble them. + +Cc: stable@vger.kernel.org +Reported-by: Jan-Benedict Glaw +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240229122521.762431-3-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/reg_fsl_emb.h | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/reg_fsl_emb.h b/arch/powerpc/include/asm/reg_fsl_emb.h +index a21f529c43d96..8359c06d92d9f 100644 +--- a/arch/powerpc/include/asm/reg_fsl_emb.h ++++ b/arch/powerpc/include/asm/reg_fsl_emb.h +@@ -12,9 +12,16 @@ + #ifndef __ASSEMBLY__ + /* Performance Monitor Registers */ + #define mfpmr(rn) ({unsigned int rval; \ +- asm volatile("mfpmr %0," __stringify(rn) \ ++ asm volatile(".machine push; " \ ++ ".machine e300; " \ ++ "mfpmr %0," __stringify(rn) ";" \ ++ ".machine pop; " \ + : "=r" (rval)); rval;}) +-#define mtpmr(rn, v) asm volatile("mtpmr " __stringify(rn) ",%0" : : "r" (v)) ++#define mtpmr(rn, v) asm volatile(".machine push; " \ ++ ".machine e300; " \ ++ "mtpmr " __stringify(rn) ",%0; " \ ++ ".machine pop; " \ ++ : : "r" (v)) + #endif /* __ASSEMBLY__ */ + + /* Freescale Book E Performance Monitor APU Registers */ +-- +2.43.0 + diff --git a/queue-5.15/powerpc-xor_vmx-add-mhard-float-to-cflags.patch b/queue-5.15/powerpc-xor_vmx-add-mhard-float-to-cflags.patch new file mode 100644 index 00000000000..725cc71785d --- /dev/null +++ b/queue-5.15/powerpc-xor_vmx-add-mhard-float-to-cflags.patch @@ -0,0 +1,48 @@ +From 6408ab83bf3d36a17da9dedda3ab314831ab9400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Jan 2024 11:07:43 -0700 +Subject: powerpc: xor_vmx: Add '-mhard-float' to CFLAGS + +From: Nathan Chancellor + +[ Upstream commit 35f20786c481d5ced9283ff42de5c69b65e5ed13 ] + +arch/powerpc/lib/xor_vmx.o is built with '-msoft-float' (from the main +powerpc Makefile) and '-maltivec' (from its CFLAGS), which causes an +error when building with clang after a recent change in main: + + error: option '-msoft-float' cannot be specified with '-maltivec' + make[6]: *** [scripts/Makefile.build:243: arch/powerpc/lib/xor_vmx.o] Error 1 + +Explicitly add '-mhard-float' before '-maltivec' in xor_vmx.o's CFLAGS +to override the previous inclusion of '-msoft-float' (as the last option +wins), which matches how other areas of the kernel use '-maltivec', such +as AMDGPU. + +Cc: stable@vger.kernel.org +Closes: https://github.com/ClangBuiltLinux/linux/issues/1986 +Link: https://github.com/llvm/llvm-project/commit/4792f912b232141ecba4cbae538873be3c28556c +Signed-off-by: Nathan Chancellor +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20240127-ppc-xor_vmx-drop-msoft-float-v1-1-f24140e81376@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/lib/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile +index 9b0f5e6ffa3f2..1d5f6883b6a93 100644 +--- a/arch/powerpc/lib/Makefile ++++ b/arch/powerpc/lib/Makefile +@@ -67,7 +67,7 @@ obj-$(CONFIG_PPC_LIB_RHEAP) += rheap.o + obj-$(CONFIG_FTR_FIXUP_SELFTEST) += feature-fixups-test.o + + obj-$(CONFIG_ALTIVEC) += xor_vmx.o xor_vmx_glue.o +-CFLAGS_xor_vmx.o += -maltivec $(call cc-option,-mabi=altivec) ++CFLAGS_xor_vmx.o += -mhard-float -maltivec $(call cc-option,-mabi=altivec) + # Enable + CFLAGS_xor_vmx.o += -isystem $(shell $(CC) -print-file-name=include) + +-- +2.43.0 + diff --git a/queue-5.15/printk-console-split-out-code-that-enables-default-c.patch b/queue-5.15/printk-console-split-out-code-that-enables-default-c.patch new file mode 100644 index 00000000000..4c7744851c9 --- /dev/null +++ b/queue-5.15/printk-console-split-out-code-that-enables-default-c.patch @@ -0,0 +1,97 @@ +From 5c9a6b37090f29c9cc27b4d86341e72c1326143a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 14:26:45 +0100 +Subject: printk/console: Split out code that enables default console + +From: Petr Mladek + +[ Upstream commit ed758b30d541e9bf713cd58612a4414e57dc6d73 ] + +Put the code enabling a console by default into a separate function +called try_enable_default_console(). + +Rename try_enable_new_console() to try_enable_preferred_console() to +make the purpose of the different variants more clear. + +It is a code refactoring without any functional change. + +Signed-off-by: Petr Mladek +Reviewed-by: Sergey Senozhatsky +Link: https://lore.kernel.org/r/20211122132649.12737-2-pmladek@suse.com +Stable-dep-of: 801410b26a0e ("serial: Lock console when calling into driver before registration") +Signed-off-by: Sasha Levin +--- + kernel/printk/printk.c | 38 +++++++++++++++++++++++--------------- + 1 file changed, 23 insertions(+), 15 deletions(-) + +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 8b110b245d92c..4bef2963284af 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -2888,7 +2888,8 @@ early_param("keep_bootcon", keep_bootcon_setup); + * Care need to be taken with consoles that are statically + * enabled such as netconsole + */ +-static int try_enable_new_console(struct console *newcon, bool user_specified) ++static int try_enable_preferred_console(struct console *newcon, ++ bool user_specified) + { + struct console_cmdline *c; + int i, err; +@@ -2936,6 +2937,23 @@ static int try_enable_new_console(struct console *newcon, bool user_specified) + return -ENOENT; + } + ++/* Try to enable the console unconditionally */ ++static void try_enable_default_console(struct console *newcon) ++{ ++ if (newcon->index < 0) ++ newcon->index = 0; ++ ++ if (newcon->setup && newcon->setup(newcon, NULL) != 0) ++ return; ++ ++ newcon->flags |= CON_ENABLED; ++ ++ if (newcon->device) { ++ newcon->flags |= CON_CONSDEV; ++ has_preferred_console = true; ++ } ++} ++ + /* + * The console driver calls this routine during kernel initialization + * to register the console printing procedure with printk() and to +@@ -2991,25 +3009,15 @@ void register_console(struct console *newcon) + * didn't select a console we take the first one + * that registers here. + */ +- if (!has_preferred_console) { +- if (newcon->index < 0) +- newcon->index = 0; +- if (newcon->setup == NULL || +- newcon->setup(newcon, NULL) == 0) { +- newcon->flags |= CON_ENABLED; +- if (newcon->device) { +- newcon->flags |= CON_CONSDEV; +- has_preferred_console = true; +- } +- } +- } ++ if (!has_preferred_console) ++ try_enable_default_console(newcon); + + /* See if this console matches one we selected on the command line */ +- err = try_enable_new_console(newcon, true); ++ err = try_enable_preferred_console(newcon, true); + + /* If not, try to match against the platform default(s) */ + if (err == -ENOENT) +- err = try_enable_new_console(newcon, false); ++ err = try_enable_preferred_console(newcon, false); + + /* printk() messages are not printed to the Braille console. */ + if (err || newcon->flags & CON_BRL) +-- +2.43.0 + diff --git a/queue-5.15/ring-buffer-do-not-set-shortest_full-when-full-targe.patch b/queue-5.15/ring-buffer-do-not-set-shortest_full-when-full-targe.patch new file mode 100644 index 00000000000..a97bfdbc225 --- /dev/null +++ b/queue-5.15/ring-buffer-do-not-set-shortest_full-when-full-targe.patch @@ -0,0 +1,54 @@ +From 2afdbebbfc856d7597624dd51ac90a7c35af7c53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 11:56:41 -0400 +Subject: ring-buffer: Do not set shortest_full when full target is hit + +From: Steven Rostedt (Google) + +[ Upstream commit 761d9473e27f0c8782895013a3e7b52a37c8bcfc ] + +The rb_watermark_hit() checks if the amount of data in the ring buffer is +above the percentage level passed in by the "full" variable. If it is, it +returns true. + +But it also sets the "shortest_full" field of the cpu_buffer that informs +writers that it needs to call the irq_work if the amount of data on the +ring buffer is above the requested amount. + +The rb_watermark_hit() always sets the shortest_full even if the amount in +the ring buffer is what it wants. As it is not going to wait, because it +has what it wants, there's no reason to set shortest_full. + +Link: https://lore.kernel.org/linux-trace-kernel/20240312115641.6aa8ba08@gandalf.local.home + +Cc: stable@vger.kernel.org +Cc: Mathieu Desnoyers +Fixes: 42fb0a1e84ff5 ("tracing/ring-buffer: Have polling block on watermark") +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 15067de333497..c942c3e990a3d 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -940,9 +940,10 @@ static bool rb_watermark_hit(struct trace_buffer *buffer, int cpu, int full) + pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; + ret = !pagebusy && full_hit(buffer, cpu, full); + +- if (!cpu_buffer->shortest_full || +- cpu_buffer->shortest_full > full) +- cpu_buffer->shortest_full = full; ++ if (!ret && (!cpu_buffer->shortest_full || ++ cpu_buffer->shortest_full > full)) { ++ cpu_buffer->shortest_full = full; ++ } + raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); + } + return ret; +-- +2.43.0 + diff --git a/queue-5.15/ring-buffer-fix-full_waiters_pending-in-poll.patch b/queue-5.15/ring-buffer-fix-full_waiters_pending-in-poll.patch new file mode 100644 index 00000000000..c60f123dda3 --- /dev/null +++ b/queue-5.15/ring-buffer-fix-full_waiters_pending-in-poll.patch @@ -0,0 +1,138 @@ +From 8dc8c13dbd3915cad61d530caf9ee9a7360f00ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 09:19:20 -0400 +Subject: ring-buffer: Fix full_waiters_pending in poll + +From: Steven Rostedt (Google) + +[ Upstream commit 8145f1c35fa648da662078efab299c4467b85ad5 ] + +If a reader of the ring buffer is doing a poll, and waiting for the ring +buffer to hit a specific watermark, there could be a case where it gets +into an infinite ping-pong loop. + +The poll code has: + + rbwork->full_waiters_pending = true; + if (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; + +The writer will see full_waiters_pending and check if the ring buffer is +filled over the percentage of the shortest_full value. If it is, it calls +an irq_work to wake up all the waiters. + +But the code could get into a circular loop: + + CPU 0 CPU 1 + ----- ----- + [ Poll ] + [ shortest_full = 0 ] + rbwork->full_waiters_pending = true; + if (rbwork->full_waiters_pending && + [ buffer percent ] > shortest_full) { + rbwork->wakeup_full = true; + [ queue_irqwork ] + + cpu_buffer->shortest_full = full; + + [ IRQ work ] + if (rbwork->wakeup_full) { + cpu_buffer->shortest_full = 0; + wakeup poll waiters; + [woken] + if ([ buffer percent ] > full) + break; + rbwork->full_waiters_pending = true; + if (rbwork->full_waiters_pending && + [ buffer percent ] > shortest_full) { + rbwork->wakeup_full = true; + [ queue_irqwork ] + + cpu_buffer->shortest_full = full; + + [ IRQ work ] + if (rbwork->wakeup_full) { + cpu_buffer->shortest_full = 0; + wakeup poll waiters; + [woken] + + [ Wash, rinse, repeat! ] + +In the poll, the shortest_full needs to be set before the +full_pending_waiters, as once that is set, the writer will compare the +current shortest_full (which is incorrect) to decide to call the irq_work, +which will reset the shortest_full (expecting the readers to update it). + +Also move the setting of full_waiters_pending after the check if the ring +buffer has the required percentage filled. There's no reason to tell the +writer to wake up waiters if there are no waiters. + +Link: https://lore.kernel.org/linux-trace-kernel/20240312131952.630922155@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Fixes: 42fb0a1e84ff5 ("tracing/ring-buffer: Have polling block on watermark") +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 4d5b942806ba4..4ffedcd255b3e 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -1082,16 +1082,32 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + poll_wait(filp, &rbwork->full_waiters, poll_table); + + raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); +- rbwork->full_waiters_pending = true; + if (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; + raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); +- } else { +- poll_wait(filp, &rbwork->waiters, poll_table); +- rbwork->waiters_pending = true; ++ if (full_hit(buffer, cpu, full)) ++ return EPOLLIN | EPOLLRDNORM; ++ /* ++ * Only allow full_waiters_pending update to be seen after ++ * the shortest_full is set. If the writer sees the ++ * full_waiters_pending flag set, it will compare the ++ * amount in the ring buffer to shortest_full. If the amount ++ * in the ring buffer is greater than the shortest_full ++ * percent, it will call the irq_work handler to wake up ++ * this list. The irq_handler will reset shortest_full ++ * back to zero. That's done under the reader_lock, but ++ * the below smp_mb() makes sure that the update to ++ * full_waiters_pending doesn't leak up into the above. ++ */ ++ smp_mb(); ++ rbwork->full_waiters_pending = true; ++ return 0; + } + ++ poll_wait(filp, &rbwork->waiters, poll_table); ++ rbwork->waiters_pending = true; ++ + /* + * There's a tight race between setting the waiters_pending and + * checking if the ring buffer is empty. Once the waiters_pending bit +@@ -1107,9 +1123,6 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + */ + smp_mb(); + +- if (full) +- return full_hit(buffer, cpu, full) ? EPOLLIN | EPOLLRDNORM : 0; +- + if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) || + (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu))) + return EPOLLIN | EPOLLRDNORM; +-- +2.43.0 + diff --git a/queue-5.15/ring-buffer-fix-resetting-of-shortest_full.patch b/queue-5.15/ring-buffer-fix-resetting-of-shortest_full.patch new file mode 100644 index 00000000000..56af345b176 --- /dev/null +++ b/queue-5.15/ring-buffer-fix-resetting-of-shortest_full.patch @@ -0,0 +1,117 @@ +From 21312dc04841cd2f94414dd1830b3470df48ebf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 15:24:04 -0500 +Subject: ring-buffer: Fix resetting of shortest_full + +From: Steven Rostedt (Google) + +[ Upstream commit 68282dd930ea38b068ce2c109d12405f40df3f93 ] + +The "shortest_full" variable is used to keep track of the waiter that is +waiting for the smallest amount on the ring buffer before being woken up. +When a tasks waits on the ring buffer, it passes in a "full" value that is +a percentage. 0 means wake up on any data. 1-100 means wake up from 1% to +100% full buffer. + +As all waiters are on the same wait queue, the wake up happens for the +waiter with the smallest percentage. + +The problem is that the smallest_full on the cpu_buffer that stores the +smallest amount doesn't get reset when all the waiters are woken up. It +does get reset when the ring buffer is reset (echo > /sys/kernel/tracing/trace). + +This means that tasks may be woken up more often then when they want to +be. Instead, have the shortest_full field get reset just before waking up +all the tasks. If the tasks wait again, they will update the shortest_full +before sleeping. + +Also add locking around setting of shortest_full in the poll logic, and +change "work" to "rbwork" to match the variable name for rb_irq_work +structures that are used in other places. + +Link: https://lore.kernel.org/linux-trace-kernel/20240308202431.948914369@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: linke li +Cc: Rabin Vincent +Fixes: 2c2b0a78b3739 ("ring-buffer: Add percentage of ring buffer full to wake up reader") +Signed-off-by: Steven Rostedt (Google) +Stable-dep-of: 8145f1c35fa6 ("ring-buffer: Fix full_waiters_pending in poll") +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 30 +++++++++++++++++++++++------- + 1 file changed, 23 insertions(+), 7 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index c942c3e990a3d..4d5b942806ba4 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -873,8 +873,19 @@ static void rb_wake_up_waiters(struct irq_work *work) + + wake_up_all(&rbwork->waiters); + if (rbwork->full_waiters_pending || rbwork->wakeup_full) { ++ /* Only cpu_buffer sets the above flags */ ++ struct ring_buffer_per_cpu *cpu_buffer = ++ container_of(rbwork, struct ring_buffer_per_cpu, irq_work); ++ ++ /* Called from interrupt context */ ++ raw_spin_lock(&cpu_buffer->reader_lock); + rbwork->wakeup_full = false; + rbwork->full_waiters_pending = false; ++ ++ /* Waking up all waiters, they will reset the shortest full */ ++ cpu_buffer->shortest_full = 0; ++ raw_spin_unlock(&cpu_buffer->reader_lock); ++ + wake_up_all(&rbwork->full_waiters); + } + } +@@ -1052,28 +1063,33 @@ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + struct file *filp, poll_table *poll_table, int full) + { + struct ring_buffer_per_cpu *cpu_buffer; +- struct rb_irq_work *work; ++ struct rb_irq_work *rbwork; + + if (cpu == RING_BUFFER_ALL_CPUS) { +- work = &buffer->irq_work; ++ rbwork = &buffer->irq_work; + full = 0; + } else { + if (!cpumask_test_cpu(cpu, buffer->cpumask)) + return EPOLLERR; + + cpu_buffer = buffer->buffers[cpu]; +- work = &cpu_buffer->irq_work; ++ rbwork = &cpu_buffer->irq_work; + } + + if (full) { +- poll_wait(filp, &work->full_waiters, poll_table); +- work->full_waiters_pending = true; ++ unsigned long flags; ++ ++ poll_wait(filp, &rbwork->full_waiters, poll_table); ++ ++ raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); ++ rbwork->full_waiters_pending = true; + if (!cpu_buffer->shortest_full || + cpu_buffer->shortest_full > full) + cpu_buffer->shortest_full = full; ++ raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); + } else { +- poll_wait(filp, &work->waiters, poll_table); +- work->waiters_pending = true; ++ poll_wait(filp, &rbwork->waiters, poll_table); ++ rbwork->waiters_pending = true; + } + + /* +-- +2.43.0 + diff --git a/queue-5.15/ring-buffer-fix-waking-up-ring-buffer-readers.patch b/queue-5.15/ring-buffer-fix-waking-up-ring-buffer-readers.patch new file mode 100644 index 00000000000..e688e8aecc1 --- /dev/null +++ b/queue-5.15/ring-buffer-fix-waking-up-ring-buffer-readers.patch @@ -0,0 +1,253 @@ +From d8eaa4a5c5caa5069988ca4c67a45060f0babc54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 15:24:03 -0500 +Subject: ring-buffer: Fix waking up ring buffer readers + +From: Steven Rostedt (Google) + +[ Upstream commit b3594573681b53316ec0365332681a30463edfd6 ] + +A task can wait on a ring buffer for when it fills up to a specific +watermark. The writer will check the minimum watermark that waiters are +waiting for and if the ring buffer is past that, it will wake up all the +waiters. + +The waiters are in a wait loop, and will first check if a signal is +pending and then check if the ring buffer is at the desired level where it +should break out of the loop. + +If a file that uses a ring buffer closes, and there's threads waiting on +the ring buffer, it needs to wake up those threads. To do this, a +"wait_index" was used. + +Before entering the wait loop, the waiter will read the wait_index. On +wakeup, it will check if the wait_index is different than when it entered +the loop, and will exit the loop if it is. The waker will only need to +update the wait_index before waking up the waiters. + +This had a couple of bugs. One trivial one and one broken by design. + +The trivial bug was that the waiter checked the wait_index after the +schedule() call. It had to be checked between the prepare_to_wait() and +the schedule() which it was not. + +The main bug is that the first check to set the default wait_index will +always be outside the prepare_to_wait() and the schedule(). That's because +the ring_buffer_wait() doesn't have enough context to know if it should +break out of the loop. + +The loop itself is not needed, because all the callers to the +ring_buffer_wait() also has their own loop, as the callers have a better +sense of what the context is to decide whether to break out of the loop +or not. + +Just have the ring_buffer_wait() block once, and if it gets woken up, exit +the function and let the callers decide what to do next. + +Link: https://lore.kernel.org/all/CAHk-=whs5MdtNjzFkTyaUy=vHi=qwWgPi0JgTe6OYUYMNSRZfg@mail.gmail.com/ +Link: https://lore.kernel.org/linux-trace-kernel/20240308202431.792933613@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: linke li +Cc: Rabin Vincent +Fixes: e30f53aad2202 ("tracing: Do not busy wait in buffer splice") +Signed-off-by: Steven Rostedt (Google) +Stable-dep-of: 761d9473e27f ("ring-buffer: Do not set shortest_full when full target is hit") +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 139 ++++++++++++++++++------------------- + 1 file changed, 68 insertions(+), 71 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index d9bed77f96c1f..15067de333497 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -406,7 +406,6 @@ struct rb_irq_work { + struct irq_work work; + wait_queue_head_t waiters; + wait_queue_head_t full_waiters; +- long wait_index; + bool waiters_pending; + bool full_waiters_pending; + bool wakeup_full; +@@ -915,14 +914,40 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu) + rbwork = &cpu_buffer->irq_work; + } + +- rbwork->wait_index++; +- /* make sure the waiters see the new index */ +- smp_wmb(); +- + /* This can be called in any context */ + irq_work_queue(&rbwork->work); + } + ++static bool rb_watermark_hit(struct trace_buffer *buffer, int cpu, int full) ++{ ++ struct ring_buffer_per_cpu *cpu_buffer; ++ bool ret = false; ++ ++ /* Reads of all CPUs always waits for any data */ ++ if (cpu == RING_BUFFER_ALL_CPUS) ++ return !ring_buffer_empty(buffer); ++ ++ cpu_buffer = buffer->buffers[cpu]; ++ ++ if (!ring_buffer_empty_cpu(buffer, cpu)) { ++ unsigned long flags; ++ bool pagebusy; ++ ++ if (!full) ++ return true; ++ ++ raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); ++ pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; ++ ret = !pagebusy && full_hit(buffer, cpu, full); ++ ++ if (!cpu_buffer->shortest_full || ++ cpu_buffer->shortest_full > full) ++ cpu_buffer->shortest_full = full; ++ raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); ++ } ++ return ret; ++} ++ + /** + * ring_buffer_wait - wait for input to the ring buffer + * @buffer: buffer to wait on +@@ -938,7 +963,6 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + struct ring_buffer_per_cpu *cpu_buffer; + DEFINE_WAIT(wait); + struct rb_irq_work *work; +- long wait_index; + int ret = 0; + + /* +@@ -957,81 +981,54 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + work = &cpu_buffer->irq_work; + } + +- wait_index = READ_ONCE(work->wait_index); +- +- while (true) { +- if (full) +- prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE); +- else +- prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE); +- +- /* +- * The events can happen in critical sections where +- * checking a work queue can cause deadlocks. +- * After adding a task to the queue, this flag is set +- * only to notify events to try to wake up the queue +- * using irq_work. +- * +- * We don't clear it even if the buffer is no longer +- * empty. The flag only causes the next event to run +- * irq_work to do the work queue wake up. The worse +- * that can happen if we race with !trace_empty() is that +- * an event will cause an irq_work to try to wake up +- * an empty queue. +- * +- * There's no reason to protect this flag either, as +- * the work queue and irq_work logic will do the necessary +- * synchronization for the wake ups. The only thing +- * that is necessary is that the wake up happens after +- * a task has been queued. It's OK for spurious wake ups. +- */ +- if (full) +- work->full_waiters_pending = true; +- else +- work->waiters_pending = true; +- +- if (signal_pending(current)) { +- ret = -EINTR; +- break; +- } +- +- if (cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) +- break; +- +- if (cpu != RING_BUFFER_ALL_CPUS && +- !ring_buffer_empty_cpu(buffer, cpu)) { +- unsigned long flags; +- bool pagebusy; +- bool done; +- +- if (!full) +- break; +- +- raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); +- pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page; +- done = !pagebusy && full_hit(buffer, cpu, full); ++ if (full) ++ prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE); ++ else ++ prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE); + +- if (!cpu_buffer->shortest_full || +- cpu_buffer->shortest_full > full) +- cpu_buffer->shortest_full = full; +- raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); +- if (done) +- break; +- } ++ /* ++ * The events can happen in critical sections where ++ * checking a work queue can cause deadlocks. ++ * After adding a task to the queue, this flag is set ++ * only to notify events to try to wake up the queue ++ * using irq_work. ++ * ++ * We don't clear it even if the buffer is no longer ++ * empty. The flag only causes the next event to run ++ * irq_work to do the work queue wake up. The worse ++ * that can happen if we race with !trace_empty() is that ++ * an event will cause an irq_work to try to wake up ++ * an empty queue. ++ * ++ * There's no reason to protect this flag either, as ++ * the work queue and irq_work logic will do the necessary ++ * synchronization for the wake ups. The only thing ++ * that is necessary is that the wake up happens after ++ * a task has been queued. It's OK for spurious wake ups. ++ */ ++ if (full) ++ work->full_waiters_pending = true; ++ else ++ work->waiters_pending = true; + +- schedule(); ++ if (rb_watermark_hit(buffer, cpu, full)) ++ goto out; + +- /* Make sure to see the new wait index */ +- smp_rmb(); +- if (wait_index != work->wait_index) +- break; ++ if (signal_pending(current)) { ++ ret = -EINTR; ++ goto out; + } + ++ schedule(); ++ out: + if (full) + finish_wait(&work->full_waiters, &wait); + else + finish_wait(&work->waiters, &wait); + ++ if (!ret && !rb_watermark_hit(buffer, cpu, full) && signal_pending(current)) ++ ret = -EINTR; ++ + return ret; + } + +-- +2.43.0 + diff --git a/queue-5.15/ring-buffer-use-wait_event_interruptible-in-ring_buf.patch b/queue-5.15/ring-buffer-use-wait_event_interruptible-in-ring_buf.patch new file mode 100644 index 00000000000..b8b3d05109e --- /dev/null +++ b/queue-5.15/ring-buffer-use-wait_event_interruptible-in-ring_buf.patch @@ -0,0 +1,203 @@ +From 4ce30bf6fafce3d0bcad3e99ed5481b912fca4c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2024 08:15:07 -0400 +Subject: ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() + +From: Steven Rostedt (Google) + +[ Upstream commit 7af9ded0c2caac0a95f33df5cb04706b0f502588 ] + +Convert ring_buffer_wait() over to wait_event_interruptible(). The default +condition is to execute the wait loop inside __wait_event() just once. + +This does not change the ring_buffer_wait() prototype yet, but +restructures the code so that it can take a "cond" and "data" parameter +and will call wait_event_interruptible() with a helper function as the +condition. + +The helper function (rb_wait_cond) takes the cond function and data +parameters. It will first check if the buffer hit the watermark defined by +the "full" parameter and then call the passed in condition parameter. If +either are true, it returns true. + +If rb_wait_cond() does not return true, it will set the appropriate +"waiters_pending" flag and returns false. + +Link: https://lore.kernel.org/linux-trace-kernel/CAHk-=wgsNgewHFxZAJiAQznwPMqEtQmi1waeS2O1v6L4c_Um5A@mail.gmail.com/ +Link: https://lore.kernel.org/linux-trace-kernel/20240312121703.399598519@goodmis.org + +Cc: stable@vger.kernel.org +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: linke li +Cc: Rabin Vincent +Fixes: f3ddb74ad0790 ("tracing: Wake up ring buffer waiters on closing of the file") +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + include/linux/ring_buffer.h | 1 + + kernel/trace/ring_buffer.c | 116 +++++++++++++++++++++--------------- + 2 files changed, 69 insertions(+), 48 deletions(-) + +diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h +index 3c7d295746f67..3e7bfc0f65aee 100644 +--- a/include/linux/ring_buffer.h ++++ b/include/linux/ring_buffer.h +@@ -98,6 +98,7 @@ __ring_buffer_alloc(unsigned long size, unsigned flags, struct lock_class_key *k + __ring_buffer_alloc((size), (flags), &__key); \ + }) + ++typedef bool (*ring_buffer_cond_fn)(void *data); + int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full); + __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu, + struct file *filp, poll_table *poll_table, int full); +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 4ffedcd255b3e..80ec515ae81e7 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -960,43 +960,15 @@ static bool rb_watermark_hit(struct trace_buffer *buffer, int cpu, int full) + return ret; + } + +-/** +- * ring_buffer_wait - wait for input to the ring buffer +- * @buffer: buffer to wait on +- * @cpu: the cpu buffer to wait on +- * @full: wait until the percentage of pages are available, if @cpu != RING_BUFFER_ALL_CPUS +- * +- * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon +- * as data is added to any of the @buffer's cpu buffers. Otherwise +- * it will wait for data to be added to a specific cpu buffer. +- */ +-int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) ++static inline bool ++rb_wait_cond(struct rb_irq_work *rbwork, struct trace_buffer *buffer, ++ int cpu, int full, ring_buffer_cond_fn cond, void *data) + { +- struct ring_buffer_per_cpu *cpu_buffer; +- DEFINE_WAIT(wait); +- struct rb_irq_work *work; +- int ret = 0; +- +- /* +- * Depending on what the caller is waiting for, either any +- * data in any cpu buffer, or a specific buffer, put the +- * caller on the appropriate wait queue. +- */ +- if (cpu == RING_BUFFER_ALL_CPUS) { +- work = &buffer->irq_work; +- /* Full only makes sense on per cpu reads */ +- full = 0; +- } else { +- if (!cpumask_test_cpu(cpu, buffer->cpumask)) +- return -ENODEV; +- cpu_buffer = buffer->buffers[cpu]; +- work = &cpu_buffer->irq_work; +- } ++ if (rb_watermark_hit(buffer, cpu, full)) ++ return true; + +- if (full) +- prepare_to_wait(&work->full_waiters, &wait, TASK_INTERRUPTIBLE); +- else +- prepare_to_wait(&work->waiters, &wait, TASK_INTERRUPTIBLE); ++ if (cond(data)) ++ return true; + + /* + * The events can happen in critical sections where +@@ -1019,27 +991,75 @@ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) + * a task has been queued. It's OK for spurious wake ups. + */ + if (full) +- work->full_waiters_pending = true; ++ rbwork->full_waiters_pending = true; + else +- work->waiters_pending = true; ++ rbwork->waiters_pending = true; + +- if (rb_watermark_hit(buffer, cpu, full)) +- goto out; ++ return false; ++} + +- if (signal_pending(current)) { +- ret = -EINTR; +- goto out; ++/* ++ * The default wait condition for ring_buffer_wait() is to just to exit the ++ * wait loop the first time it is woken up. ++ */ ++static bool rb_wait_once(void *data) ++{ ++ long *once = data; ++ ++ /* wait_event() actually calls this twice before scheduling*/ ++ if (*once > 1) ++ return true; ++ ++ (*once)++; ++ return false; ++} ++ ++/** ++ * ring_buffer_wait - wait for input to the ring buffer ++ * @buffer: buffer to wait on ++ * @cpu: the cpu buffer to wait on ++ * @full: wait until the percentage of pages are available, if @cpu != RING_BUFFER_ALL_CPUS ++ * ++ * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon ++ * as data is added to any of the @buffer's cpu buffers. Otherwise ++ * it will wait for data to be added to a specific cpu buffer. ++ */ ++int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full) ++{ ++ struct ring_buffer_per_cpu *cpu_buffer; ++ struct wait_queue_head *waitq; ++ ring_buffer_cond_fn cond; ++ struct rb_irq_work *rbwork; ++ void *data; ++ long once = 0; ++ int ret = 0; ++ ++ cond = rb_wait_once; ++ data = &once; ++ ++ /* ++ * Depending on what the caller is waiting for, either any ++ * data in any cpu buffer, or a specific buffer, put the ++ * caller on the appropriate wait queue. ++ */ ++ if (cpu == RING_BUFFER_ALL_CPUS) { ++ rbwork = &buffer->irq_work; ++ /* Full only makes sense on per cpu reads */ ++ full = 0; ++ } else { ++ if (!cpumask_test_cpu(cpu, buffer->cpumask)) ++ return -ENODEV; ++ cpu_buffer = buffer->buffers[cpu]; ++ rbwork = &cpu_buffer->irq_work; + } + +- schedule(); +- out: + if (full) +- finish_wait(&work->full_waiters, &wait); ++ waitq = &rbwork->full_waiters; + else +- finish_wait(&work->waiters, &wait); ++ waitq = &rbwork->waiters; + +- if (!ret && !rb_watermark_hit(buffer, cpu, full) && signal_pending(current)) +- ret = -EINTR; ++ ret = wait_event_interruptible((*waitq), ++ rb_wait_cond(rbwork, buffer, cpu, full, cond, data)); + + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/s390-zcrypt-fix-reference-counting-on-zcrypt-card-ob.patch b/queue-5.15/s390-zcrypt-fix-reference-counting-on-zcrypt-card-ob.patch new file mode 100644 index 00000000000..7fb65c8c6fa --- /dev/null +++ b/queue-5.15/s390-zcrypt-fix-reference-counting-on-zcrypt-card-ob.patch @@ -0,0 +1,124 @@ +From ece88b76d2ea102c9b98aa46a73eacb146338161 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 15:20:09 +0100 +Subject: s390/zcrypt: fix reference counting on zcrypt card objects + +From: Harald Freudenberger + +[ Upstream commit 50ed48c80fecbe17218afed4f8bed005c802976c ] + +Tests with hot-plugging crytpo cards on KVM guests with debug +kernel build revealed an use after free for the load field of +the struct zcrypt_card. The reason was an incorrect reference +handling of the zcrypt card object which could lead to a free +of the zcrypt card object while it was still in use. + +This is an example of the slab message: + + kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b + kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 + kernel: kmalloc_trace+0x3f2/0x470 + kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] + kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] + kernel: ap_device_probe+0x15c/0x290 + kernel: really_probe+0xd2/0x468 + kernel: driver_probe_device+0x40/0xf0 + kernel: __device_attach_driver+0xc0/0x140 + kernel: bus_for_each_drv+0x8c/0xd0 + kernel: __device_attach+0x114/0x198 + kernel: bus_probe_device+0xb4/0xc8 + kernel: device_add+0x4d2/0x6e0 + kernel: ap_scan_adapter+0x3d0/0x7c0 + kernel: ap_scan_bus+0x5a/0x3b0 + kernel: ap_scan_bus_wq_callback+0x40/0x60 + kernel: process_one_work+0x26e/0x620 + kernel: worker_thread+0x21c/0x440 + kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 + kernel: kfree+0x37e/0x418 + kernel: zcrypt_card_put+0x54/0x80 [zcrypt] + kernel: ap_device_remove+0x4c/0xe0 + kernel: device_release_driver_internal+0x1c4/0x270 + kernel: bus_remove_device+0x100/0x188 + kernel: device_del+0x164/0x3c0 + kernel: device_unregister+0x30/0x90 + kernel: ap_scan_adapter+0xc8/0x7c0 + kernel: ap_scan_bus+0x5a/0x3b0 + kernel: ap_scan_bus_wq_callback+0x40/0x60 + kernel: process_one_work+0x26e/0x620 + kernel: worker_thread+0x21c/0x440 + kernel: kthread+0x150/0x168 + kernel: __ret_from_fork+0x3c/0x58 + kernel: ret_from_fork+0xa/0x30 + kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) + kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 + kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ + kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk + kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. + kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ + kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ + kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 + kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) + kernel: Call Trace: + kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 + kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 + kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 + kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 + kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 + kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 + kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 + kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 + kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 + kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 + kernel: [<00000000c9b919dc>] ext4_htree_fill_tree+0x134/0x400 + kernel: [<00000000c9b4b3d0>] ext4_dx_readdir+0x160/0x2f0 + kernel: [<00000000c9b4bedc>] ext4_readdir+0x5f4/0x760 + kernel: [<00000000c9a7efc4>] iterate_dir+0xb4/0x280 + kernel: [<00000000c9a7f1ea>] __do_sys_getdents64+0x5a/0x120 + kernel: [<00000000ca5d6946>] __do_syscall+0x256/0x310 + kernel: [<00000000ca5eea10>] system_call+0x70/0x98 + kernel: INFO: lockdep is turned off. + kernel: FIX kmalloc-96: Restoring Poison 0x00000000885a7512-0x00000000885a7513=0x6b + kernel: FIX kmalloc-96: Marking all objects used + +The fix is simple: Before use of the queue not only the queue object +but also the card object needs to increase it's reference count +with a call to zcrypt_card_get(). Similar after use of the queue +not only the queue but also the card object's reference count is +decreased with zcrypt_card_put(). + +Signed-off-by: Harald Freudenberger +Reviewed-by: Holger Dengler +Cc: stable@vger.kernel.org +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/zcrypt_api.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c +index 17b3f1ea3a5c2..fb80b7593c592 100644 +--- a/drivers/s390/crypto/zcrypt_api.c ++++ b/drivers/s390/crypto/zcrypt_api.c +@@ -575,6 +575,7 @@ static inline struct zcrypt_queue *zcrypt_pick_queue(struct zcrypt_card *zc, + { + if (!zq || !try_module_get(zq->queue->ap_dev.device.driver->owner)) + return NULL; ++ zcrypt_card_get(zc); + zcrypt_queue_get(zq); + get_device(&zq->queue->ap_dev.device); + atomic_add(weight, &zc->load); +@@ -594,6 +595,7 @@ static inline void zcrypt_drop_queue(struct zcrypt_card *zc, + atomic_sub(weight, &zq->load); + put_device(&zq->queue->ap_dev.device); + zcrypt_queue_put(zq); ++ zcrypt_card_put(zc); + module_put(mod); + } + +-- +2.43.0 + diff --git a/queue-5.15/selftests-mqueue-set-timeout-to-180-seconds.patch b/queue-5.15/selftests-mqueue-set-timeout-to-180-seconds.patch new file mode 100644 index 00000000000..66040abe678 --- /dev/null +++ b/queue-5.15/selftests-mqueue-set-timeout-to-180-seconds.patch @@ -0,0 +1,35 @@ +From 49e711d990de61b5560843343a7b3c804d45652c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Feb 2024 16:08:02 -0800 +Subject: selftests/mqueue: Set timeout to 180 seconds + +From: SeongJae Park + +[ Upstream commit 85506aca2eb4ea41223c91c5fe25125953c19b13 ] + +While mq_perf_tests runs with the default kselftest timeout limit, which +is 45 seconds, the test takes about 60 seconds to complete on i3.metal +AWS instances. Hence, the test always times out. Increase the timeout +to 180 seconds. + +Fixes: 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test") +Cc: # 5.4.x +Signed-off-by: SeongJae Park +Reviewed-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/mqueue/setting | 1 + + 1 file changed, 1 insertion(+) + create mode 100644 tools/testing/selftests/mqueue/setting + +diff --git a/tools/testing/selftests/mqueue/setting b/tools/testing/selftests/mqueue/setting +new file mode 100644 +index 0000000000000..a953c96aa16e1 +--- /dev/null ++++ b/tools/testing/selftests/mqueue/setting +@@ -0,0 +1 @@ ++timeout=180 +-- +2.43.0 + diff --git a/queue-5.15/serial-lock-console-when-calling-into-driver-before-.patch b/queue-5.15/serial-lock-console-when-calling-into-driver-before-.patch new file mode 100644 index 00000000000..0594f66c3fe --- /dev/null +++ b/queue-5.15/serial-lock-console-when-calling-into-driver-before-.patch @@ -0,0 +1,187 @@ +From 55a2cb70ad4b3aa537984140ebab26e2a58661c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2024 13:43:49 -0800 +Subject: serial: Lock console when calling into driver before registration + +From: Peter Collingbourne + +[ Upstream commit 801410b26a0e8b8a16f7915b2b55c9528b69ca87 ] + +During the handoff from earlycon to the real console driver, we have +two separate drivers operating on the same device concurrently. In the +case of the 8250 driver these concurrent accesses cause problems due +to the driver's use of banked registers, controlled by LCR.DLAB. It is +possible for the setup(), config_port(), pm() and set_mctrl() callbacks +to set DLAB, which can cause the earlycon code that intends to access +TX to instead access DLL, leading to missed output and corruption on +the serial line due to unintended modifications to the baud rate. + +In particular, for setup() we have: + +univ8250_console_setup() +-> serial8250_console_setup() +-> uart_set_options() +-> serial8250_set_termios() +-> serial8250_do_set_termios() +-> serial8250_do_set_divisor() + +For config_port() we have: + +serial8250_config_port() +-> autoconfig() + +For pm() we have: + +serial8250_pm() +-> serial8250_do_pm() +-> serial8250_set_sleep() + +For set_mctrl() we have (for some devices): + +serial8250_set_mctrl() +-> omap8250_set_mctrl() +-> __omap8250_set_mctrl() + +To avoid such problems, let's make it so that the console is locked +during pre-registration calls to these callbacks, which will prevent +the earlycon driver from running concurrently. + +Remove the partial solution to this problem in the 8250 driver +that locked the console only during autoconfig_irq(), as this would +result in a deadlock with the new approach. The console continues +to be locked during autoconfig_irq() because it can only be called +through uart_configure_port(). + +Although this patch introduces more locking than strictly necessary +(and in particular it also locks during the call to rs485_config() +which is not affected by this issue as far as I can tell), it follows +the principle that it is the responsibility of the generic console +code to manage the earlycon handoff by ensuring that earlycon and real +console driver code cannot run concurrently, and not the individual +drivers. + +Signed-off-by: Peter Collingbourne +Reviewed-by: John Ogness +Link: https://linux-review.googlesource.com/id/I7cf8124dcebf8618e6b2ee543fa5b25532de55d8 +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240304214350.501253-1-pcc@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_port.c | 6 ------ + drivers/tty/serial/serial_core.c | 12 ++++++++++++ + kernel/printk/printk.c | 21 ++++++++++++++++++--- + 3 files changed, 30 insertions(+), 9 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 4fce318bc83ca..2d595a646bb89 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1366,9 +1366,6 @@ static void autoconfig_irq(struct uart_8250_port *up) + inb_p(ICP); + } + +- if (uart_console(port)) +- console_lock(); +- + /* forget possible initially masked and pending IRQ */ + probe_irq_off(probe_irq_on()); + save_mcr = serial8250_in_MCR(up); +@@ -1399,9 +1396,6 @@ static void autoconfig_irq(struct uart_8250_port *up) + if (port->flags & UPF_FOURPORT) + outb_p(save_ICP, ICP); + +- if (uart_console(port)) +- console_unlock(); +- + port->irq = (irq > 0) ? irq : 0; + } + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 45b721abaa2f5..b638b2fd2d3d2 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2410,7 +2410,12 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, + port->type = PORT_UNKNOWN; + flags |= UART_CONFIG_TYPE; + } ++ /* Synchronize with possible boot console. */ ++ if (uart_console(port)) ++ console_lock(); + port->ops->config_port(port, flags); ++ if (uart_console(port)) ++ console_unlock(); + } + + if (port->type != PORT_UNKNOWN) { +@@ -2418,6 +2423,10 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, + + uart_report_port(drv, port); + ++ /* Synchronize with possible boot console. */ ++ if (uart_console(port)) ++ console_lock(); ++ + /* Power up port for set_mctrl() */ + uart_change_pm(state, UART_PM_STATE_ON); + +@@ -2434,6 +2443,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, + port->rs485_config(port, &port->rs485); + spin_unlock_irqrestore(&port->lock, flags); + ++ if (uart_console(port)) ++ console_unlock(); ++ + /* + * If this driver supports console, and it hasn't been + * successfully registered yet, try to re-register it. +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 4bef2963284af..df4d07af6d1e2 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -2879,6 +2879,21 @@ static int __init keep_bootcon_setup(char *str) + + early_param("keep_bootcon", keep_bootcon_setup); + ++static int console_call_setup(struct console *newcon, char *options) ++{ ++ int err; ++ ++ if (!newcon->setup) ++ return 0; ++ ++ /* Synchronize with possible boot console. */ ++ console_lock(); ++ err = newcon->setup(newcon, options); ++ console_unlock(); ++ ++ return err; ++} ++ + /* + * This is called by register_console() to try to match + * the newly registered console with any of the ones selected +@@ -2914,8 +2929,8 @@ static int try_enable_preferred_console(struct console *newcon, + if (_braille_register_console(newcon, c)) + return 0; + +- if (newcon->setup && +- (err = newcon->setup(newcon, c->options)) != 0) ++ err = console_call_setup(newcon, c->options); ++ if (err) + return err; + } + newcon->flags |= CON_ENABLED; +@@ -2943,7 +2958,7 @@ static void try_enable_default_console(struct console *newcon) + if (newcon->index < 0) + newcon->index = 0; + +- if (newcon->setup && newcon->setup(newcon, NULL) != 0) ++ if (console_call_setup(newcon, NULL) != 0) + return; + + newcon->flags |= CON_ENABLED; +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index 03b1d78bc13..d6051941db1 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -4,3 +4,114 @@ x86-bugs-use-sysfs_emit.patch kvm-x86-update-kvm-only-leaf-handling-to-allow-for-100-kvm-only-leafs.patch kvm-x86-advertise-cpuid.-eax-7-ecx-2-edx-to-userspace.patch kvm-x86-use-a-switch-statement-and-macros-in-__feature_translate.patch +timers-update-kernel-doc-for-various-functions.patch +timers-use-del_timer_sync-even-on-up.patch +timers-rename-del_timer_sync-to-timer_delete_sync.patch +wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch +media-staging-ipu3-imgu-set-fields-before-media_enti.patch +clk-qcom-gcc-sdm845-add-soft-dependency-on-rpmhpd.patch +smack-set-smack64transmute-only-for-dirs-in-smack_in.patch +smack-handle-smack64transmute-in-smack_inode_setsecu.patch +arm-dts-marvell-fix-maxium-maxim-typo-in-brownstone-.patch +drm-vmwgfx-fix-possible-null-pointer-derefence-with-.patch +pci_iounmap-fix-mmio-mapping-leak.patch +media-xc4000-fix-atomicity-violation-in-xc4000_get_f.patch +kvm-always-flush-async-pf-workqueue-when-vcpu-is-bei.patch +sparc64-nmi-watchdog-fix-return-value-of-__setup-han.patch +sparc-vdso-fix-return-value-of-__setup-handler.patch +crypto-qat-fix-double-free-during-reset.patch +crypto-qat-resolve-race-condition-during-aer-recover.patch +selftests-mqueue-set-timeout-to-180-seconds.patch +ext4-correct-best-extent-lstart-adjustment-logic.patch +block-clear-zone-limits-for-a-non-zoned-stacked-queu.patch +kasan-test-add-memcpy-test-that-avoids-out-of-bounds.patch +kasan-test-avoid-gcc-warning-for-intentional-overflo.patch +bounds-support-non-power-of-two-config_nr_cpus.patch +fat-fix-uninitialized-field-in-nostale-filehandles.patch +ubifs-set-page-uptodate-in-the-correct-place.patch +ubi-check-for-too-small-leb-size-in-vtbl-code.patch +ubi-correct-the-calculation-of-fastmap-size.patch +mtd-rawnand-meson-fix-scrambling-mode-value-in-comma.patch +parisc-avoid-clobbering-the-c-b-bits-in-the-psw-with.patch +parisc-fix-ip_fast_csum.patch +parisc-fix-csum_ipv6_magic-on-32-bit-systems.patch +parisc-fix-csum_ipv6_magic-on-64-bit-systems.patch +parisc-strip-upper-32-bit-of-sum-in-csum_ipv6_magic-.patch +pm-suspend-set-mem_sleep_current-during-kernel-comma.patch +clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch +clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch +clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch +clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch +usb-xhci-add-error-handling-in-xhci_map_urb_for_dma.patch +powerpc-fsl-fix-mfpmr-build-errors-with-newer-binuti.patch +usb-serial-ftdi_sio-add-support-for-gmc-z216c-adapte.patch +usb-serial-add-device-id-for-verifone-adapter.patch +usb-serial-cp210x-add-id-for-mgp-instruments-pds100.patch +usb-serial-option-add-meig-smart-slm320-product.patch +usb-serial-cp210x-add-pid-vid-for-tdk-nc0110013m-and.patch +pm-sleep-wakeirq-fix-wake-irq-warning-in-system-susp.patch +mmc-tmio-avoid-concurrent-runs-of-mmc_request_done.patch +fuse-fix-root-lookup-with-nonzero-generation.patch +fuse-don-t-unhash-root.patch +usb-typec-ucsi-clean-up-ucsi_cable_prop-macros.patch +printk-console-split-out-code-that-enables-default-c.patch +serial-lock-console-when-calling-into-driver-before-.patch +btrfs-fix-off-by-one-chunk-length-calculation-at-con.patch +pci-drop-pci_device_remove-test-of-pci_dev-driver.patch +pci-pm-drain-runtime-idle-callbacks-before-driver-re.patch +pci-work-around-intel-i210-rom-bar-overlap-defect.patch +pci-aspm-make-intel-dg2-l1-acceptable-latency-unlimi.patch +pci-dpc-quirk-pio-log-size-for-certain-intel-root-po.patch +pci-dpc-quirk-pio-log-size-for-intel-raptor-lake-roo.patch +dm-raid-fix-lockdep-waring-in-pers-hot_add_disk.patch +isystem-delete-global-isystem-compile-option.patch +powerpc-xor_vmx-add-mhard-float-to-cflags.patch +mac802154-fix-llsec-key-resources-release-in-mac8021.patch +swap-comments-get_swap_device-with-usage-rule.patch +mm-swap-fix-race-between-free_swap_and_cache-and-swa.patch +mmc-core-fix-switch-on-gp3-partition.patch +drm-etnaviv-restore-some-id-values.patch +landlock-warn-once-if-a-landlock-action-is-requested.patch +hwmon-amc6821-add-of_match-table.patch +ext4-fix-corruption-during-on-line-resize.patch +nvmem-meson-efuse-fix-function-pointer-type-mismatch.patch +slimbus-core-remove-usage-of-the-deprecated-ida_simp.patch +phy-tegra-xusb-add-api-to-retrieve-the-port-number-o.patch +usb-gadget-tegra-xudc-fix-usb3-phy-retrieval-logic.patch +speakup-fix-8bit-characters-from-direct-synth.patch +pci-aer-block-runtime-suspend-when-handling-errors.patch +nfs-fix-uaf-in-direct-writes.patch +kbuild-move-wenum-compare-conditional-enum-conversio.patch +pci-dwc-endpoint-fix-advertised-resizable-bar-size.patch +vfio-platform-disable-virqfds-on-cleanup.patch +ksmbd-retrieve-number-of-blocks-using-vfs_getattr-in.patch +ring-buffer-fix-waking-up-ring-buffer-readers.patch +ring-buffer-do-not-set-shortest_full-when-full-targe.patch +ring-buffer-fix-resetting-of-shortest_full.patch +ring-buffer-fix-full_waiters_pending-in-poll.patch +ring-buffer-use-wait_event_interruptible-in-ring_buf.patch +soc-fsl-qbman-always-disable-interrupts-when-taking-.patch +soc-fsl-qbman-add-helper-for-sanity-checking-cgr-ops.patch +soc-fsl-qbman-add-cgr-update-function.patch +soc-fsl-qbman-use-raw-spinlock-for-cgr_lock.patch +s390-zcrypt-fix-reference-counting-on-zcrypt-card-ob.patch +drm-panel-do-not-return-negative-error-codes-from-dr.patch +drm-exynos-do-not-return-negative-values-from-.get_m.patch +drm-imx-ipuv3-do-not-return-negative-values-from-.ge.patch +drm-vc4-hdmi-do-not-return-negative-values-from-.get.patch +memtest-use-read-write-_once-in-memory-scanning.patch +nilfs2-fix-failure-to-detect-dat-corruption-in-btree.patch +nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch +cpufreq-dt-always-allocate-zeroed-cpumask.patch +x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch +nfsd-fix-nfsd_clid_class-use-of-__string_len-macro.patch +net-hns3-tracing-fix-hclgevf-trace-event-strings.patch +wireguard-netlink-check-for-dangling-peer-via-is_dea.patch +wireguard-netlink-access-device-through-ctx-instead-.patch +ahci-asm1064-correct-count-of-reported-ports.patch +ahci-asm1064-asm1166-don-t-limit-reported-ports.patch +drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch +drm-amd-display-return-the-correct-hdcp-error-code.patch +drm-amd-display-fix-noise-issue-on-hdmi-av-mute.patch +dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch +x86-pm-work-around-false-positive-kmemleak-report-in.patch diff --git a/queue-5.15/slimbus-core-remove-usage-of-the-deprecated-ida_simp.patch b/queue-5.15/slimbus-core-remove-usage-of-the-deprecated-ida_simp.patch new file mode 100644 index 00000000000..54bcc8d89cd --- /dev/null +++ b/queue-5.15/slimbus-core-remove-usage-of-the-deprecated-ida_simp.patch @@ -0,0 +1,45 @@ +From c224eb452ebf60413823de1aa8cef2e01005cb8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Feb 2024 11:41:37 +0000 +Subject: slimbus: core: Remove usage of the deprecated ida_simple_xx() API + +From: Christophe JAILLET + +[ Upstream commit 89ffa4cccec54467446f141a79b9e36893079fb8 ] + +ida_alloc() and ida_free() should be preferred to the deprecated +ida_simple_get() and ida_simple_remove(). + +Note that the upper limit of ida_simple_get() is exclusive, but the one of +ida_alloc_range() is inclusive. So change this change allows one more +device. Previously address 0xFE was never used. + +Fixes: 46a2bb5a7f7e ("slimbus: core: Add slim controllers support") +Cc: Stable@vger.kernel.org +Signed-off-by: Christophe JAILLET +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20240224114137.85781-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c +index 78480e332ab8f..d1e3de844812e 100644 +--- a/drivers/slimbus/core.c ++++ b/drivers/slimbus/core.c +@@ -436,8 +436,8 @@ static int slim_device_alloc_laddr(struct slim_device *sbdev, + if (ret < 0) + goto err; + } else if (report_present) { +- ret = ida_simple_get(&ctrl->laddr_ida, +- 0, SLIM_LA_MANAGER - 1, GFP_KERNEL); ++ ret = ida_alloc_max(&ctrl->laddr_ida, ++ SLIM_LA_MANAGER - 1, GFP_KERNEL); + if (ret < 0) + goto err; + +-- +2.43.0 + diff --git a/queue-5.15/smack-handle-smack64transmute-in-smack_inode_setsecu.patch b/queue-5.15/smack-handle-smack64transmute-in-smack_inode_setsecu.patch new file mode 100644 index 00000000000..a31099bf736 --- /dev/null +++ b/queue-5.15/smack-handle-smack64transmute-in-smack_inode_setsecu.patch @@ -0,0 +1,44 @@ +From fefd62dba4d8aaef69f64fd9de12417205b39e33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 10:01:22 +0100 +Subject: smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() + +From: Roberto Sassu + +[ Upstream commit ac02f007d64eb2769d0bde742aac4d7a5fc6e8a5 ] + +If the SMACK64TRANSMUTE xattr is provided, and the inode is a directory, +update the in-memory inode flags by setting SMK_INODE_TRANSMUTE. + +Cc: stable@vger.kernel.org +Fixes: 5c6d1125f8db ("Smack: Transmute labels on specified directories") # v2.6.38.x +Signed-off-by: Roberto Sassu +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smack_lsm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index c45f0d61447c7..c6f211758f4e3 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2721,6 +2721,15 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name, + if (value == NULL || size > SMK_LONGLABEL || size == 0) + return -EINVAL; + ++ if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) { ++ if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE || ++ strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) ++ return -EINVAL; ++ ++ nsp->smk_flags |= SMK_INODE_TRANSMUTE; ++ return 0; ++ } ++ + skp = smk_import_entry(value, size); + if (IS_ERR(skp)) + return PTR_ERR(skp); +-- +2.43.0 + diff --git a/queue-5.15/smack-set-smack64transmute-only-for-dirs-in-smack_in.patch b/queue-5.15/smack-set-smack64transmute-only-for-dirs-in-smack_in.patch new file mode 100644 index 00000000000..24193027b83 --- /dev/null +++ b/queue-5.15/smack-set-smack64transmute-only-for-dirs-in-smack_in.patch @@ -0,0 +1,38 @@ +From 2d29558a7670eee5c7d15b781dd826b93cbeba09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Nov 2023 10:01:21 +0100 +Subject: smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() + +From: Roberto Sassu + +[ Upstream commit 9c82169208dde516510aaba6bbd8b13976690c5d ] + +Since the SMACK64TRANSMUTE xattr makes sense only for directories, enforce +this restriction in smack_inode_setxattr(). + +Cc: stable@vger.kernel.org +Fixes: 5c6d1125f8db ("Smack: Transmute labels on specified directories") # v2.6.38.x +Signed-off-by: Roberto Sassu +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smack_lsm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index a5a78aef6403a..c45f0d61447c7 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -1264,7 +1264,8 @@ static int smack_inode_setxattr(struct user_namespace *mnt_userns, + check_star = 1; + } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { + check_priv = 1; +- if (size != TRANS_TRUE_SIZE || ++ if (!S_ISDIR(d_backing_inode(dentry)->i_mode) || ++ size != TRANS_TRUE_SIZE || + strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) + rc = -EINVAL; + } else +-- +2.43.0 + diff --git a/queue-5.15/soc-fsl-qbman-add-cgr-update-function.patch b/queue-5.15/soc-fsl-qbman-add-cgr-update-function.patch new file mode 100644 index 00000000000..7648874d5db --- /dev/null +++ b/queue-5.15/soc-fsl-qbman-add-cgr-update-function.patch @@ -0,0 +1,107 @@ +From 129184212f1c1e8d240d1e7e831b6d2fbda6553a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 17:57:35 -0400 +Subject: soc: fsl: qbman: Add CGR update function + +From: Sean Anderson + +[ Upstream commit 914f8b228ede709274b8c80514b352248ec9da00 ] + +This adds a function to update a CGR with new parameters. qman_create_cgr +can almost be used for this (with flags=0), but it's not suitable because +it also registers the callback function. The _safe variant was modeled off +of qman_cgr_delete_safe. However, we handle multiple arguments and a return +value. + +Signed-off-by: Sean Anderson +Acked-by: Camelia Groza +Signed-off-by: David S. Miller +Stable-dep-of: fbec4e7fed89 ("soc: fsl: qbman: Use raw spinlock for cgr_lock") +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qbman/qman.c | 48 ++++++++++++++++++++++++++++++++++++ + include/soc/fsl/qman.h | 9 +++++++ + 2 files changed, 57 insertions(+) + +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index 30c6c09d9d00c..1bf1f1ea67f00 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -2568,6 +2568,54 @@ void qman_delete_cgr_safe(struct qman_cgr *cgr) + } + EXPORT_SYMBOL(qman_delete_cgr_safe); + ++static int qman_update_cgr(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts) ++{ ++ int ret; ++ unsigned long irqflags; ++ struct qman_portal *p = qman_cgr_get_affine_portal(cgr); ++ ++ if (!p) ++ return -EINVAL; ++ ++ spin_lock_irqsave(&p->cgr_lock, irqflags); ++ ret = qm_modify_cgr(cgr, 0, opts); ++ spin_unlock_irqrestore(&p->cgr_lock, irqflags); ++ put_affine_portal(); ++ return ret; ++} ++ ++struct update_cgr_params { ++ struct qman_cgr *cgr; ++ struct qm_mcc_initcgr *opts; ++ int ret; ++}; ++ ++static void qman_update_cgr_smp_call(void *p) ++{ ++ struct update_cgr_params *params = p; ++ ++ params->ret = qman_update_cgr(params->cgr, params->opts); ++} ++ ++int qman_update_cgr_safe(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts) ++{ ++ struct update_cgr_params params = { ++ .cgr = cgr, ++ .opts = opts, ++ }; ++ ++ preempt_disable(); ++ if (qman_cgr_cpus[cgr->cgrid] != smp_processor_id()) ++ smp_call_function_single(qman_cgr_cpus[cgr->cgrid], ++ qman_update_cgr_smp_call, ¶ms, ++ true); ++ else ++ params.ret = qman_update_cgr(cgr, opts); ++ preempt_enable(); ++ return params.ret; ++} ++EXPORT_SYMBOL(qman_update_cgr_safe); ++ + /* Cleanup FQs */ + + static int _qm_mr_consume_and_match_verb(struct qm_portal *p, int v) +diff --git a/include/soc/fsl/qman.h b/include/soc/fsl/qman.h +index 59eeba31c1928..0d3d6beb7fdbd 100644 +--- a/include/soc/fsl/qman.h ++++ b/include/soc/fsl/qman.h +@@ -1171,6 +1171,15 @@ int qman_delete_cgr(struct qman_cgr *cgr); + */ + void qman_delete_cgr_safe(struct qman_cgr *cgr); + ++/** ++ * qman_update_cgr_safe - Modifies a congestion group object from any CPU ++ * @cgr: the 'cgr' object to modify ++ * @opts: state of the CGR settings ++ * ++ * This will select the proper CPU and modify the CGR settings. ++ */ ++int qman_update_cgr_safe(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts); ++ + /** + * qman_query_cgr_congested - Queries CGR's congestion status + * @cgr: the 'cgr' object to query +-- +2.43.0 + diff --git a/queue-5.15/soc-fsl-qbman-add-helper-for-sanity-checking-cgr-ops.patch b/queue-5.15/soc-fsl-qbman-add-helper-for-sanity-checking-cgr-ops.patch new file mode 100644 index 00000000000..659f6195725 --- /dev/null +++ b/queue-5.15/soc-fsl-qbman-add-helper-for-sanity-checking-cgr-ops.patch @@ -0,0 +1,80 @@ +From 3dc3c450a13777f8d6571178bb970a0e5ade0e3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 17:57:34 -0400 +Subject: soc: fsl: qbman: Add helper for sanity checking cgr ops + +From: Sean Anderson + +[ Upstream commit d0e17a4653cebc2c8a20251c837dd1fcec5014d9 ] + +This breaks out/combines get_affine_portal and the cgr sanity check in +preparation for the next commit. No functional change intended. + +Signed-off-by: Sean Anderson +Acked-by: Camelia Groza +Signed-off-by: David S. Miller +Stable-dep-of: fbec4e7fed89 ("soc: fsl: qbman: Use raw spinlock for cgr_lock") +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qbman/qman.c | 29 +++++++++++++++++++---------- + 1 file changed, 19 insertions(+), 10 deletions(-) + +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index d04a1a39dc286..30c6c09d9d00c 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -2483,13 +2483,8 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + } + EXPORT_SYMBOL(qman_create_cgr); + +-int qman_delete_cgr(struct qman_cgr *cgr) ++static struct qman_portal *qman_cgr_get_affine_portal(struct qman_cgr *cgr) + { +- unsigned long irqflags; +- struct qm_mcr_querycgr cgr_state; +- struct qm_mcc_initcgr local_opts; +- int ret = 0; +- struct qman_cgr *i; + struct qman_portal *p = get_affine_portal(); + + if (cgr->chan != p->config->channel) { +@@ -2497,10 +2492,25 @@ int qman_delete_cgr(struct qman_cgr *cgr) + dev_err(p->config->dev, "CGR not owned by current portal"); + dev_dbg(p->config->dev, " create 0x%x, delete 0x%x\n", + cgr->chan, p->config->channel); +- +- ret = -EINVAL; +- goto put_portal; ++ put_affine_portal(); ++ return NULL; + } ++ ++ return p; ++} ++ ++int qman_delete_cgr(struct qman_cgr *cgr) ++{ ++ unsigned long irqflags; ++ struct qm_mcr_querycgr cgr_state; ++ struct qm_mcc_initcgr local_opts; ++ int ret = 0; ++ struct qman_cgr *i; ++ struct qman_portal *p = qman_cgr_get_affine_portal(cgr); ++ ++ if (!p) ++ return -EINVAL; ++ + memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr)); + spin_lock_irqsave(&p->cgr_lock, irqflags); + list_del(&cgr->node); +@@ -2528,7 +2538,6 @@ int qman_delete_cgr(struct qman_cgr *cgr) + list_add(&cgr->node, &p->cgr_cbs); + release_lock: + spin_unlock_irqrestore(&p->cgr_lock, irqflags); +-put_portal: + put_affine_portal(); + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/soc-fsl-qbman-always-disable-interrupts-when-taking-.patch b/queue-5.15/soc-fsl-qbman-always-disable-interrupts-when-taking-.patch new file mode 100644 index 00000000000..ef8a5c6b599 --- /dev/null +++ b/queue-5.15/soc-fsl-qbman-always-disable-interrupts-when-taking-.patch @@ -0,0 +1,73 @@ +From b4b2a6e97fa2604288080e104c5b085355fc4f7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 12:38:29 -0400 +Subject: soc: fsl: qbman: Always disable interrupts when taking cgr_lock + +From: Sean Anderson + +[ Upstream commit 584c2a9184a33a40fceee838f856de3cffa19be3 ] + +smp_call_function_single disables IRQs when executing the callback. To +prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere. +This is already done by qman_update_cgr and qman_delete_cgr; fix the +other lockers. + +Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()") +CC: stable@vger.kernel.org +Signed-off-by: Sean Anderson +Reviewed-by: Camelia Groza +Tested-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qbman/qman.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index fde4edd83c14c..d04a1a39dc286 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -1456,11 +1456,11 @@ static void qm_congestion_task(struct work_struct *work) + union qm_mc_result *mcr; + struct qman_cgr *cgr; + +- spin_lock(&p->cgr_lock); ++ spin_lock_irq(&p->cgr_lock); + qm_mc_start(&p->p); + qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION); + if (!qm_mc_result_timeout(&p->p, &mcr)) { +- spin_unlock(&p->cgr_lock); ++ spin_unlock_irq(&p->cgr_lock); + dev_crit(p->config->dev, "QUERYCONGESTION timeout\n"); + qman_p_irqsource_add(p, QM_PIRQ_CSCI); + return; +@@ -1476,7 +1476,7 @@ static void qm_congestion_task(struct work_struct *work) + list_for_each_entry(cgr, &p->cgr_cbs, node) + if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid)) + cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid)); +- spin_unlock(&p->cgr_lock); ++ spin_unlock_irq(&p->cgr_lock); + qman_p_irqsource_add(p, QM_PIRQ_CSCI); + } + +@@ -2440,7 +2440,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + preempt_enable(); + + cgr->chan = p->config->channel; +- spin_lock(&p->cgr_lock); ++ spin_lock_irq(&p->cgr_lock); + + if (opts) { + struct qm_mcc_initcgr local_opts = *opts; +@@ -2477,7 +2477,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) + cgr->cb(p, cgr, 1); + out: +- spin_unlock(&p->cgr_lock); ++ spin_unlock_irq(&p->cgr_lock); + put_affine_portal(); + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/soc-fsl-qbman-use-raw-spinlock-for-cgr_lock.patch b/queue-5.15/soc-fsl-qbman-use-raw-spinlock-for-cgr_lock.patch new file mode 100644 index 00000000000..ffffcbd6c9d --- /dev/null +++ b/queue-5.15/soc-fsl-qbman-use-raw-spinlock-for-cgr_lock.patch @@ -0,0 +1,132 @@ +From 399ccc006a7625fa638eaa12bfd4d47b410e1f31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Mar 2024 12:38:30 -0400 +Subject: soc: fsl: qbman: Use raw spinlock for cgr_lock + +From: Sean Anderson + +[ Upstream commit fbec4e7fed89b579f2483041fabf9650fb0dd6bc ] + +smp_call_function always runs its callback in hard IRQ context, even on +PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock +for cgr_lock to ensure we aren't waiting on a sleeping task. + +Although this bug has existed for a while, it was not apparent until +commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") +which invokes smp_call_function_single via qman_update_cgr_safe every +time a link goes up or down. + +Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()") +CC: stable@vger.kernel.org +Reported-by: Vladimir Oltean +Closes: https://lore.kernel.org/all/20230323153935.nofnjucqjqnz34ej@skbuf/ +Reported-by: Steffen Trumtrar +Closes: https://lore.kernel.org/linux-arm-kernel/87wmsyvclu.fsf@pengutronix.de/ +Signed-off-by: Sean Anderson +Reviewed-by: Camelia Groza +Tested-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qbman/qman.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index 1bf1f1ea67f00..7e9074519ad22 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -991,7 +991,7 @@ struct qman_portal { + /* linked-list of CSCN handlers. */ + struct list_head cgr_cbs; + /* list lock */ +- spinlock_t cgr_lock; ++ raw_spinlock_t cgr_lock; + struct work_struct congestion_work; + struct work_struct mr_work; + char irqname[MAX_IRQNAME]; +@@ -1281,7 +1281,7 @@ static int qman_create_portal(struct qman_portal *portal, + /* if the given mask is NULL, assume all CGRs can be seen */ + qman_cgrs_fill(&portal->cgrs[0]); + INIT_LIST_HEAD(&portal->cgr_cbs); +- spin_lock_init(&portal->cgr_lock); ++ raw_spin_lock_init(&portal->cgr_lock); + INIT_WORK(&portal->congestion_work, qm_congestion_task); + INIT_WORK(&portal->mr_work, qm_mr_process_task); + portal->bits = 0; +@@ -1456,11 +1456,14 @@ static void qm_congestion_task(struct work_struct *work) + union qm_mc_result *mcr; + struct qman_cgr *cgr; + +- spin_lock_irq(&p->cgr_lock); ++ /* ++ * FIXME: QM_MCR_TIMEOUT is 10ms, which is too long for a raw spinlock! ++ */ ++ raw_spin_lock_irq(&p->cgr_lock); + qm_mc_start(&p->p); + qm_mc_commit(&p->p, QM_MCC_VERB_QUERYCONGESTION); + if (!qm_mc_result_timeout(&p->p, &mcr)) { +- spin_unlock_irq(&p->cgr_lock); ++ raw_spin_unlock_irq(&p->cgr_lock); + dev_crit(p->config->dev, "QUERYCONGESTION timeout\n"); + qman_p_irqsource_add(p, QM_PIRQ_CSCI); + return; +@@ -1476,7 +1479,7 @@ static void qm_congestion_task(struct work_struct *work) + list_for_each_entry(cgr, &p->cgr_cbs, node) + if (cgr->cb && qman_cgrs_get(&c, cgr->cgrid)) + cgr->cb(p, cgr, qman_cgrs_get(&rr, cgr->cgrid)); +- spin_unlock_irq(&p->cgr_lock); ++ raw_spin_unlock_irq(&p->cgr_lock); + qman_p_irqsource_add(p, QM_PIRQ_CSCI); + } + +@@ -2440,7 +2443,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + preempt_enable(); + + cgr->chan = p->config->channel; +- spin_lock_irq(&p->cgr_lock); ++ raw_spin_lock_irq(&p->cgr_lock); + + if (opts) { + struct qm_mcc_initcgr local_opts = *opts; +@@ -2477,7 +2480,7 @@ int qman_create_cgr(struct qman_cgr *cgr, u32 flags, + qman_cgrs_get(&p->cgrs[1], cgr->cgrid)) + cgr->cb(p, cgr, 1); + out: +- spin_unlock_irq(&p->cgr_lock); ++ raw_spin_unlock_irq(&p->cgr_lock); + put_affine_portal(); + return ret; + } +@@ -2512,7 +2515,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) + return -EINVAL; + + memset(&local_opts, 0, sizeof(struct qm_mcc_initcgr)); +- spin_lock_irqsave(&p->cgr_lock, irqflags); ++ raw_spin_lock_irqsave(&p->cgr_lock, irqflags); + list_del(&cgr->node); + /* + * If there are no other CGR objects for this CGRID in the list, +@@ -2537,7 +2540,7 @@ int qman_delete_cgr(struct qman_cgr *cgr) + /* add back to the list */ + list_add(&cgr->node, &p->cgr_cbs); + release_lock: +- spin_unlock_irqrestore(&p->cgr_lock, irqflags); ++ raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags); + put_affine_portal(); + return ret; + } +@@ -2577,9 +2580,9 @@ static int qman_update_cgr(struct qman_cgr *cgr, struct qm_mcc_initcgr *opts) + if (!p) + return -EINVAL; + +- spin_lock_irqsave(&p->cgr_lock, irqflags); ++ raw_spin_lock_irqsave(&p->cgr_lock, irqflags); + ret = qm_modify_cgr(cgr, 0, opts); +- spin_unlock_irqrestore(&p->cgr_lock, irqflags); ++ raw_spin_unlock_irqrestore(&p->cgr_lock, irqflags); + put_affine_portal(); + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/sparc-vdso-fix-return-value-of-__setup-handler.patch b/queue-5.15/sparc-vdso-fix-return-value-of-__setup-handler.patch new file mode 100644 index 00000000000..9b07c3c9338 --- /dev/null +++ b/queue-5.15/sparc-vdso-fix-return-value-of-__setup-handler.patch @@ -0,0 +1,57 @@ +From 0ce48924053f19b4bff9d461d0515e9e5300405e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 21:28:08 -0800 +Subject: sparc: vDSO: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit 5378f00c935bebb846b1fdb0e79cb76c137c56b5 ] + +__setup() handlers should return 1 to obsolete_checksetup() in +init/main.c to indicate that the boot option has been handled. +A return of 0 causes the boot option/value to be listed as an Unknown +kernel parameter and added to init's (limited) argument or environment +strings. Also, error return codes don't mean anything to +obsolete_checksetup() -- only non-zero (usually 1) or zero. +So return 1 from vdso_setup(). + +Fixes: 9a08862a5d2e ("vDSO for sparc") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Cc: "David S. Miller" +Cc: sparclinux@vger.kernel.org +Cc: Dan Carpenter +Cc: Nick Alcock +Cc: Sam Ravnborg +Cc: Andrew Morton +Cc: stable@vger.kernel.org +Cc: Arnd Bergmann +Cc: Andreas Larsson +Signed-off-by: Andreas Larsson +Link: https://lore.kernel.org/r/20240211052808.22635-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/sparc/vdso/vma.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/sparc/vdso/vma.c b/arch/sparc/vdso/vma.c +index cc19e09b0fa1e..b073153c711ad 100644 +--- a/arch/sparc/vdso/vma.c ++++ b/arch/sparc/vdso/vma.c +@@ -449,9 +449,8 @@ static __init int vdso_setup(char *s) + unsigned long val; + + err = kstrtoul(s, 10, &val); +- if (err) +- return err; +- vdso_enabled = val; +- return 0; ++ if (!err) ++ vdso_enabled = val; ++ return 1; + } + __setup("vdso=", vdso_setup); +-- +2.43.0 + diff --git a/queue-5.15/sparc64-nmi-watchdog-fix-return-value-of-__setup-han.patch b/queue-5.15/sparc64-nmi-watchdog-fix-return-value-of-__setup-han.patch new file mode 100644 index 00000000000..3a3a8af4aeb --- /dev/null +++ b/queue-5.15/sparc64-nmi-watchdog-fix-return-value-of-__setup-han.patch @@ -0,0 +1,51 @@ +From 39c368bb49b73ea6d833346f576c30d0a3432aa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Feb 2024 21:28:02 -0800 +Subject: sparc64: NMI watchdog: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit 3ed7c61e49d65dacb96db798c0ab6fcd55a1f20f ] + +__setup() handlers should return 1 to obsolete_checksetup() in +init/main.c to indicate that the boot option has been handled. +A return of 0 causes the boot option/value to be listed as an Unknown +kernel parameter and added to init's (limited) argument or environment +strings. Also, error return codes don't mean anything to +obsolete_checksetup() -- only non-zero (usually 1) or zero. +So return 1 from setup_nmi_watchdog(). + +Fixes: e5553a6d0442 ("sparc64: Implement NMI watchdog on capable cpus.") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Cc: "David S. Miller" +Cc: sparclinux@vger.kernel.org +Cc: Sam Ravnborg +Cc: Andrew Morton +Cc: stable@vger.kernel.org +Cc: Arnd Bergmann +Cc: Andreas Larsson +Signed-off-by: Andreas Larsson +Link: https://lore.kernel.org/r/20240211052802.22612-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/nmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c +index 060fff95a305c..fbf25e926f67c 100644 +--- a/arch/sparc/kernel/nmi.c ++++ b/arch/sparc/kernel/nmi.c +@@ -274,7 +274,7 @@ static int __init setup_nmi_watchdog(char *str) + if (!strncmp(str, "panic", 5)) + panic_on_timeout = 1; + +- return 0; ++ return 1; + } + __setup("nmi_watchdog=", setup_nmi_watchdog); + +-- +2.43.0 + diff --git a/queue-5.15/speakup-fix-8bit-characters-from-direct-synth.patch b/queue-5.15/speakup-fix-8bit-characters-from-direct-synth.patch new file mode 100644 index 00000000000..e916b8ba338 --- /dev/null +++ b/queue-5.15/speakup-fix-8bit-characters-from-direct-synth.patch @@ -0,0 +1,49 @@ +From 3b7115a28503b0e96e792f855010c3fae57da45c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Feb 2024 16:57:36 +0100 +Subject: speakup: Fix 8bit characters from direct synth + +From: Samuel Thibault + +[ Upstream commit b6c8dafc9d86eb77e502bb018ec4105e8d2fbf78 ] + +When userland echoes 8bit characters to /dev/synth with e.g. + +echo -e '\xe9' > /dev/synth + +synth_write would get characters beyond 0x7f, and thus negative when +char is signed. When given to synth_buffer_add which takes a u16, this +would sign-extend and produce a U+ffxy character rather than U+xy. +Users thus get garbled text instead of accents in their output. + +Let's fix this by making sure that we read unsigned characters. + +Signed-off-by: Samuel Thibault +Fixes: 89fc2ae80bb1 ("speakup: extend synth buffer to 16bit unicode characters") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20240204155736.2oh4ot7tiaa2wpbh@begin +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/accessibility/speakup/synth.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/accessibility/speakup/synth.c b/drivers/accessibility/speakup/synth.c +index 2b8699673bace..1e10f3c9567b8 100644 +--- a/drivers/accessibility/speakup/synth.c ++++ b/drivers/accessibility/speakup/synth.c +@@ -208,8 +208,10 @@ void spk_do_flush(void) + wake_up_process(speakup_task); + } + +-void synth_write(const char *buf, size_t count) ++void synth_write(const char *_buf, size_t count) + { ++ const unsigned char *buf = (const unsigned char *) _buf; ++ + while (count--) + synth_buffer_add(*buf++); + synth_start(); +-- +2.43.0 + diff --git a/queue-5.15/swap-comments-get_swap_device-with-usage-rule.patch b/queue-5.15/swap-comments-get_swap_device-with-usage-rule.patch new file mode 100644 index 00000000000..eb56d4f2bdc --- /dev/null +++ b/queue-5.15/swap-comments-get_swap_device-with-usage-rule.patch @@ -0,0 +1,73 @@ +From 54735f24deaa7df0346e24514e19f3b0e03cfa6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 14:13:55 +0800 +Subject: swap: comments get_swap_device() with usage rule + +From: Huang Ying + +[ Upstream commit a95722a047724ef75567381976a36f0e44230bd9 ] + +The general rule to use a swap entry is as follows. + +When we get a swap entry, if there aren't some other ways to prevent +swapoff, such as the folio in swap cache is locked, page table lock is +held, etc., the swap entry may become invalid because of swapoff. +Then, we need to enclose all swap related functions with +get_swap_device() and put_swap_device(), unless the swap functions +call get/put_swap_device() by themselves. + +Add the rule as comments of get_swap_device(). + +Link: https://lkml.kernel.org/r/20230529061355.125791-6-ying.huang@intel.com +Signed-off-by: "Huang, Ying" +Reviewed-by: David Hildenbrand +Reviewed-by: Yosry Ahmed +Reviewed-by: Chris Li (Google) +Cc: Hugh Dickins +Cc: Johannes Weiner +Cc: Matthew Wilcox +Cc: Michal Hocko +Cc: Minchan Kim +Cc: Tim Chen +Cc: Yang Shi +Cc: Yu Zhao +Signed-off-by: Andrew Morton +Stable-dep-of: 82b1c07a0af6 ("mm: swap: fix race between free_swap_and_cache() and swapoff()") +Signed-off-by: Sasha Levin +--- + mm/swapfile.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/mm/swapfile.c b/mm/swapfile.c +index b7e1620adee62..8789d27bd90ca 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -1236,6 +1236,13 @@ static unsigned char __swap_entry_free_locked(struct swap_info_struct *p, + } + + /* ++ * When we get a swap entry, if there aren't some other ways to ++ * prevent swapoff, such as the folio in swap cache is locked, page ++ * table lock is held, etc., the swap entry may become invalid because ++ * of swapoff. Then, we need to enclose all swap related functions ++ * with get_swap_device() and put_swap_device(), unless the swap ++ * functions call get/put_swap_device() by themselves. ++ * + * Check whether swap entry is valid in the swap device. If so, + * return pointer to swap_info_struct, and keep the swap entry valid + * via preventing the swap device from being swapoff, until +@@ -1244,9 +1251,8 @@ static unsigned char __swap_entry_free_locked(struct swap_info_struct *p, + * Notice that swapoff or swapoff+swapon can still happen before the + * percpu_ref_tryget_live() in get_swap_device() or after the + * percpu_ref_put() in put_swap_device() if there isn't any other way +- * to prevent swapoff, such as page lock, page table lock, etc. The +- * caller must be prepared for that. For example, the following +- * situation is possible. ++ * to prevent swapoff. The caller must be prepared for that. For ++ * example, the following situation is possible. + * + * CPU1 CPU2 + * do_swap_page() +-- +2.43.0 + diff --git a/queue-5.15/timers-rename-del_timer_sync-to-timer_delete_sync.patch b/queue-5.15/timers-rename-del_timer_sync-to-timer_delete_sync.patch new file mode 100644 index 00000000000..6bdc39e57ac --- /dev/null +++ b/queue-5.15/timers-rename-del_timer_sync-to-timer_delete_sync.patch @@ -0,0 +1,130 @@ +From a2b605e13665b722f6ae41b22a80cb9d5790593d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 21:18:44 +0100 +Subject: timers: Rename del_timer_sync() to timer_delete_sync() + +From: Thomas Gleixner + +[ Upstream commit 9b13df3fb64ee95e2397585404e442afee2c7d4f ] + +The timer related functions do not have a strict timer_ prefixed namespace +which is really annoying. + +Rename del_timer_sync() to timer_delete_sync() and provide del_timer_sync() +as a wrapper. Document that del_timer_sync() is not for new code. + +Signed-off-by: Thomas Gleixner +Tested-by: Guenter Roeck +Reviewed-by: Steven Rostedt (Google) +Reviewed-by: Jacob Keller +Reviewed-by: Anna-Maria Behnsen +Link: https://lore.kernel.org/r/20221123201624.954785441@linutronix.de +Stable-dep-of: 0f7352557a35 ("wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach") +Signed-off-by: Sasha Levin +--- + include/linux/timer.h | 15 ++++++++++++++- + kernel/time/timer.c | 18 +++++++++--------- + 2 files changed, 23 insertions(+), 10 deletions(-) + +diff --git a/include/linux/timer.h b/include/linux/timer.h +index 2e6f50b342662..e78521bce565a 100644 +--- a/include/linux/timer.h ++++ b/include/linux/timer.h +@@ -183,7 +183,20 @@ extern int timer_reduce(struct timer_list *timer, unsigned long expires); + extern void add_timer(struct timer_list *timer); + + extern int try_to_del_timer_sync(struct timer_list *timer); +-extern int del_timer_sync(struct timer_list *timer); ++extern int timer_delete_sync(struct timer_list *timer); ++ ++/** ++ * del_timer_sync - Delete a pending timer and wait for a running callback ++ * @timer: The timer to be deleted ++ * ++ * See timer_delete_sync() for detailed explanation. ++ * ++ * Do not use in new code. Use timer_delete_sync() instead. ++ */ ++static inline int del_timer_sync(struct timer_list *timer) ++{ ++ return timer_delete_sync(timer); ++} + + #define del_singleshot_timer_sync(t) del_timer_sync(t) + +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index 2c0e26718c7a9..d4ce3ebe2c8cf 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -1030,7 +1030,7 @@ __mod_timer(struct timer_list *timer, unsigned long expires, unsigned int option + /* + * We are trying to schedule the timer on the new base. + * However we can't change timer's base while it is running, +- * otherwise del_timer_sync() can't detect that the timer's ++ * otherwise timer_delete_sync() can't detect that the timer's + * handler yet has not finished. This also guarantees that the + * timer is serialized wrt itself. + */ +@@ -1206,7 +1206,7 @@ EXPORT_SYMBOL_GPL(add_timer_on); + * @timer: The timer to be deactivated + * + * The function only deactivates a pending timer, but contrary to +- * del_timer_sync() it does not take into account whether the timer's ++ * timer_delete_sync() it does not take into account whether the timer's + * callback function is concurrently executed on a different CPU or not. + * It neither prevents rearming of the timer. If @timer can be rearmed + * concurrently then the return value of this function is meaningless. +@@ -1342,7 +1342,7 @@ static inline void del_timer_wait_running(struct timer_list *timer) { } + #endif + + /** +- * del_timer_sync - Deactivate a timer and wait for the handler to finish. ++ * timer_delete_sync - Deactivate a timer and wait for the handler to finish. + * @timer: The timer to be deactivated + * + * Synchronization rules: Callers must prevent restarting of the timer, +@@ -1364,10 +1364,10 @@ static inline void del_timer_wait_running(struct timer_list *timer) { } + * spin_lock_irq(somelock); + * + * spin_lock(somelock); +- * del_timer_sync(mytimer); ++ * timer_delete_sync(mytimer); + * while (base->running_timer == mytimer); + * +- * Now del_timer_sync() will never return and never release somelock. ++ * Now timer_delete_sync() will never return and never release somelock. + * The interrupt on the other CPU is waiting to grab somelock but it has + * interrupted the softirq that CPU0 is waiting to finish. + * +@@ -1380,7 +1380,7 @@ static inline void del_timer_wait_running(struct timer_list *timer) { } + * * %0 - The timer was not pending + * * %1 - The timer was pending and deactivated + */ +-int del_timer_sync(struct timer_list *timer) ++int timer_delete_sync(struct timer_list *timer) + { + int ret; + +@@ -1420,7 +1420,7 @@ int del_timer_sync(struct timer_list *timer) + + return ret; + } +-EXPORT_SYMBOL(del_timer_sync); ++EXPORT_SYMBOL(timer_delete_sync); + + static void call_timer_fn(struct timer_list *timer, + void (*fn)(struct timer_list *), +@@ -1442,8 +1442,8 @@ static void call_timer_fn(struct timer_list *timer, + #endif + /* + * Couple the lock chain with the lock chain at +- * del_timer_sync() by acquiring the lock_map around the fn() +- * call here and in del_timer_sync(). ++ * timer_delete_sync() by acquiring the lock_map around the fn() ++ * call here and in timer_delete_sync(). + */ + lock_map_acquire(&lockdep_map); + +-- +2.43.0 + diff --git a/queue-5.15/timers-update-kernel-doc-for-various-functions.patch b/queue-5.15/timers-update-kernel-doc-for-various-functions.patch new file mode 100644 index 00000000000..9b7e458d0fb --- /dev/null +++ b/queue-5.15/timers-update-kernel-doc-for-various-functions.patch @@ -0,0 +1,265 @@ +From 2d64f8af465cf18f26f89ed7eacbbe6e1537550d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 21:18:40 +0100 +Subject: timers: Update kernel-doc for various functions + +From: Thomas Gleixner + +[ Upstream commit 14f043f1340bf30bc60af127bff39f55889fef26 ] + +The kernel-doc of timer related functions is partially uncomprehensible +word salad. Rewrite it to make it useful. + +Signed-off-by: Thomas Gleixner +Tested-by: Guenter Roeck +Reviewed-by: Jacob Keller +Reviewed-by: Anna-Maria Behnsen +Link: https://lore.kernel.org/r/20221123201624.828703870@linutronix.de +Stable-dep-of: 0f7352557a35 ("wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach") +Signed-off-by: Sasha Levin +--- + kernel/time/timer.c | 148 +++++++++++++++++++++++++++----------------- + 1 file changed, 90 insertions(+), 58 deletions(-) + +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index 9dd2a39cb3b00..f64dd2bd0a84c 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -1068,14 +1068,16 @@ __mod_timer(struct timer_list *timer, unsigned long expires, unsigned int option + } + + /** +- * mod_timer_pending - modify a pending timer's timeout +- * @timer: the pending timer to be modified +- * @expires: new timeout in jiffies ++ * mod_timer_pending - Modify a pending timer's timeout ++ * @timer: The pending timer to be modified ++ * @expires: New absolute timeout in jiffies + * +- * mod_timer_pending() is the same for pending timers as mod_timer(), +- * but will not re-activate and modify already deleted timers. ++ * mod_timer_pending() is the same for pending timers as mod_timer(), but ++ * will not activate inactive timers. + * +- * It is useful for unserialized use of timers. ++ * Return: ++ * * %0 - The timer was inactive and not modified ++ * * %1 - The timer was active and requeued to expire at @expires + */ + int mod_timer_pending(struct timer_list *timer, unsigned long expires) + { +@@ -1084,24 +1086,27 @@ int mod_timer_pending(struct timer_list *timer, unsigned long expires) + EXPORT_SYMBOL(mod_timer_pending); + + /** +- * mod_timer - modify a timer's timeout +- * @timer: the timer to be modified +- * @expires: new timeout in jiffies +- * +- * mod_timer() is a more efficient way to update the expire field of an +- * active timer (if the timer is inactive it will be activated) ++ * mod_timer - Modify a timer's timeout ++ * @timer: The timer to be modified ++ * @expires: New absolute timeout in jiffies + * + * mod_timer(timer, expires) is equivalent to: + * + * del_timer(timer); timer->expires = expires; add_timer(timer); + * ++ * mod_timer() is more efficient than the above open coded sequence. In ++ * case that the timer is inactive, the del_timer() part is a NOP. The ++ * timer is in any case activated with the new expiry time @expires. ++ * + * Note that if there are multiple unserialized concurrent users of the + * same timer, then mod_timer() is the only safe way to modify the timeout, + * since add_timer() cannot modify an already running timer. + * +- * The function returns whether it has modified a pending timer or not. +- * (ie. mod_timer() of an inactive timer returns 0, mod_timer() of an +- * active timer returns 1.) ++ * Return: ++ * * %0 - The timer was inactive and started ++ * * %1 - The timer was active and requeued to expire at @expires or ++ * the timer was active and not modified because @expires did ++ * not change the effective expiry time + */ + int mod_timer(struct timer_list *timer, unsigned long expires) + { +@@ -1112,11 +1117,18 @@ EXPORT_SYMBOL(mod_timer); + /** + * timer_reduce - Modify a timer's timeout if it would reduce the timeout + * @timer: The timer to be modified +- * @expires: New timeout in jiffies ++ * @expires: New absolute timeout in jiffies + * + * timer_reduce() is very similar to mod_timer(), except that it will only +- * modify a running timer if that would reduce the expiration time (it will +- * start a timer that isn't running). ++ * modify an enqueued timer if that would reduce the expiration time. If ++ * @timer is not enqueued it starts the timer. ++ * ++ * Return: ++ * * %0 - The timer was inactive and started ++ * * %1 - The timer was active and requeued to expire at @expires or ++ * the timer was active and not modified because @expires ++ * did not change the effective expiry time such that the ++ * timer would expire earlier than already scheduled + */ + int timer_reduce(struct timer_list *timer, unsigned long expires) + { +@@ -1125,18 +1137,21 @@ int timer_reduce(struct timer_list *timer, unsigned long expires) + EXPORT_SYMBOL(timer_reduce); + + /** +- * add_timer - start a timer +- * @timer: the timer to be added ++ * add_timer - Start a timer ++ * @timer: The timer to be started + * +- * The kernel will do a ->function(@timer) callback from the +- * timer interrupt at the ->expires point in the future. The +- * current time is 'jiffies'. ++ * Start @timer to expire at @timer->expires in the future. @timer->expires ++ * is the absolute expiry time measured in 'jiffies'. When the timer expires ++ * timer->function(timer) will be invoked from soft interrupt context. + * +- * The timer's ->expires, ->function fields must be set prior calling this +- * function. ++ * The @timer->expires and @timer->function fields must be set prior ++ * to calling this function. ++ * ++ * If @timer->expires is already in the past @timer will be queued to ++ * expire at the next timer tick. + * +- * Timers with an ->expires field in the past will be executed in the next +- * timer tick. ++ * This can only operate on an inactive timer. Attempts to invoke this on ++ * an active timer are rejected with a warning. + */ + void add_timer(struct timer_list *timer) + { +@@ -1146,11 +1161,13 @@ void add_timer(struct timer_list *timer) + EXPORT_SYMBOL(add_timer); + + /** +- * add_timer_on - start a timer on a particular CPU +- * @timer: the timer to be added +- * @cpu: the CPU to start it on ++ * add_timer_on - Start a timer on a particular CPU ++ * @timer: The timer to be started ++ * @cpu: The CPU to start it on ++ * ++ * Same as add_timer() except that it starts the timer on the given CPU. + * +- * This is not very scalable on SMP. Double adds are not possible. ++ * See add_timer() for further details. + */ + void add_timer_on(struct timer_list *timer, int cpu) + { +@@ -1185,15 +1202,18 @@ void add_timer_on(struct timer_list *timer, int cpu) + EXPORT_SYMBOL_GPL(add_timer_on); + + /** +- * del_timer - deactivate a timer. +- * @timer: the timer to be deactivated +- * +- * del_timer() deactivates a timer - this works on both active and inactive +- * timers. +- * +- * The function returns whether it has deactivated a pending timer or not. +- * (ie. del_timer() of an inactive timer returns 0, del_timer() of an +- * active timer returns 1.) ++ * del_timer - Deactivate a timer. ++ * @timer: The timer to be deactivated ++ * ++ * The function only deactivates a pending timer, but contrary to ++ * del_timer_sync() it does not take into account whether the timer's ++ * callback function is concurrently executed on a different CPU or not. ++ * It neither prevents rearming of the timer. If @timer can be rearmed ++ * concurrently then the return value of this function is meaningless. ++ * ++ * Return: ++ * * %0 - The timer was not pending ++ * * %1 - The timer was pending and deactivated + */ + int del_timer(struct timer_list *timer) + { +@@ -1215,10 +1235,19 @@ EXPORT_SYMBOL(del_timer); + + /** + * try_to_del_timer_sync - Try to deactivate a timer +- * @timer: timer to delete ++ * @timer: Timer to deactivate ++ * ++ * This function tries to deactivate a timer. On success the timer is not ++ * queued and the timer callback function is not running on any CPU. + * +- * This function tries to deactivate a timer. Upon successful (ret >= 0) +- * exit the timer is not queued and the handler is not running on any CPU. ++ * This function does not guarantee that the timer cannot be rearmed right ++ * after dropping the base lock. That needs to be prevented by the calling ++ * code if necessary. ++ * ++ * Return: ++ * * %0 - The timer was not pending ++ * * %1 - The timer was pending and deactivated ++ * * %-1 - The timer callback function is running on a different CPU + */ + int try_to_del_timer_sync(struct timer_list *timer) + { +@@ -1314,23 +1343,19 @@ static inline void del_timer_wait_running(struct timer_list *timer) { } + + #if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_RT) + /** +- * del_timer_sync - deactivate a timer and wait for the handler to finish. +- * @timer: the timer to be deactivated +- * +- * This function only differs from del_timer() on SMP: besides deactivating +- * the timer it also makes sure the handler has finished executing on other +- * CPUs. ++ * del_timer_sync - Deactivate a timer and wait for the handler to finish. ++ * @timer: The timer to be deactivated + * + * Synchronization rules: Callers must prevent restarting of the timer, + * otherwise this function is meaningless. It must not be called from + * interrupt contexts unless the timer is an irqsafe one. The caller must +- * not hold locks which would prevent completion of the timer's +- * handler. The timer's handler must not call add_timer_on(). Upon exit the +- * timer is not queued and the handler is not running on any CPU. ++ * not hold locks which would prevent completion of the timer's callback ++ * function. The timer's handler must not call add_timer_on(). Upon exit ++ * the timer is not queued and the handler is not running on any CPU. + * +- * Note: For !irqsafe timers, you must not hold locks that are held in +- * interrupt context while calling this function. Even if the lock has +- * nothing to do with the timer in question. Here's why:: ++ * For !irqsafe timers, the caller must not hold locks that are held in ++ * interrupt context. Even if the lock has nothing to do with the timer in ++ * question. Here's why:: + * + * CPU0 CPU1 + * ---- ---- +@@ -1344,10 +1369,17 @@ static inline void del_timer_wait_running(struct timer_list *timer) { } + * while (base->running_timer == mytimer); + * + * Now del_timer_sync() will never return and never release somelock. +- * The interrupt on the other CPU is waiting to grab somelock but +- * it has interrupted the softirq that CPU0 is waiting to finish. ++ * The interrupt on the other CPU is waiting to grab somelock but it has ++ * interrupted the softirq that CPU0 is waiting to finish. ++ * ++ * This function cannot guarantee that the timer is not rearmed again by ++ * some concurrent or preempting code, right after it dropped the base ++ * lock. If there is the possibility of a concurrent rearm then the return ++ * value of the function is meaningless. + * +- * The function returns whether it has deactivated a pending timer or not. ++ * Return: ++ * * %0 - The timer was not pending ++ * * %1 - The timer was pending and deactivated + */ + int del_timer_sync(struct timer_list *timer) + { +-- +2.43.0 + diff --git a/queue-5.15/timers-use-del_timer_sync-even-on-up.patch b/queue-5.15/timers-use-del_timer_sync-even-on-up.patch new file mode 100644 index 00000000000..ab15eae1419 --- /dev/null +++ b/queue-5.15/timers-use-del_timer_sync-even-on-up.patch @@ -0,0 +1,80 @@ +From 0b0906b759416421a9c7a178395c98ebd3b9e6e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 21:18:42 +0100 +Subject: timers: Use del_timer_sync() even on UP + +From: Thomas Gleixner + +[ Upstream commit 168f6b6ffbeec0b9333f3582e4cf637300858db5 ] + +del_timer_sync() is assumed to be pointless on uniprocessor systems and can +be mapped to del_timer() because in theory del_timer() can never be invoked +while the timer callback function is executed. + +This is not entirely true because del_timer() can be invoked from interrupt +context and therefore hit in the middle of a running timer callback. + +Contrary to that del_timer_sync() is not allowed to be invoked from +interrupt context unless the affected timer is marked with TIMER_IRQSAFE. +del_timer_sync() has proper checks in place to detect such a situation. + +Give up on the UP optimization and make del_timer_sync() unconditionally +available. + +Co-developed-by: Steven Rostedt +Signed-off-by: Steven Rostedt +Signed-off-by: Thomas Gleixner +Tested-by: Guenter Roeck +Reviewed-by: Jacob Keller +Reviewed-by: Anna-Maria Behnsen +Link: https://lore.kernel.org/all/20220407161745.7d6754b3@gandalf.local.home +Link: https://lore.kernel.org/all/20221110064101.429013735@goodmis.org +Link: https://lore.kernel.org/r/20221123201624.888306160@linutronix.de +Stable-dep-of: 0f7352557a35 ("wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach") +Signed-off-by: Sasha Levin +--- + include/linux/timer.h | 7 +------ + kernel/time/timer.c | 2 -- + 2 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/include/linux/timer.h b/include/linux/timer.h +index fda13c9d1256c..2e6f50b342662 100644 +--- a/include/linux/timer.h ++++ b/include/linux/timer.h +@@ -183,12 +183,7 @@ extern int timer_reduce(struct timer_list *timer, unsigned long expires); + extern void add_timer(struct timer_list *timer); + + extern int try_to_del_timer_sync(struct timer_list *timer); +- +-#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_RT) +- extern int del_timer_sync(struct timer_list *timer); +-#else +-# define del_timer_sync(t) del_timer(t) +-#endif ++extern int del_timer_sync(struct timer_list *timer); + + #define del_singleshot_timer_sync(t) del_timer_sync(t) + +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index f64dd2bd0a84c..2c0e26718c7a9 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -1341,7 +1341,6 @@ static inline void timer_sync_wait_running(struct timer_base *base) { } + static inline void del_timer_wait_running(struct timer_list *timer) { } + #endif + +-#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_RT) + /** + * del_timer_sync - Deactivate a timer and wait for the handler to finish. + * @timer: The timer to be deactivated +@@ -1422,7 +1421,6 @@ int del_timer_sync(struct timer_list *timer) + return ret; + } + EXPORT_SYMBOL(del_timer_sync); +-#endif + + static void call_timer_fn(struct timer_list *timer, + void (*fn)(struct timer_list *), +-- +2.43.0 + diff --git a/queue-5.15/ubi-check-for-too-small-leb-size-in-vtbl-code.patch b/queue-5.15/ubi-check-for-too-small-leb-size-in-vtbl-code.patch new file mode 100644 index 00000000000..3d6a95e3c2c --- /dev/null +++ b/queue-5.15/ubi-check-for-too-small-leb-size-in-vtbl-code.patch @@ -0,0 +1,45 @@ +From 2261917e41adc0645e06802ee44069bb712c875b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 07:37:02 +0100 +Subject: ubi: Check for too small LEB size in VTBL code + +From: Richard Weinberger + +[ Upstream commit 68a24aba7c593eafa8fd00f2f76407b9b32b47a9 ] + +If the LEB size is smaller than a volume table record we cannot +have volumes. +In this case abort attaching. + +Cc: Chenyuan Yang +Cc: stable@vger.kernel.org +Fixes: 801c135ce73d ("UBI: Unsorted Block Images") +Reported-by: Chenyuan Yang +Closes: https://lore.kernel.org/linux-mtd/1433EB7A-FC89-47D6-8F47-23BE41B263B3@illinois.edu/ +Signed-off-by: Richard Weinberger +Reviewed-by: Zhihao Cheng +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/vtbl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c +index f700f0e4f2ec4..6e5489e233dd2 100644 +--- a/drivers/mtd/ubi/vtbl.c ++++ b/drivers/mtd/ubi/vtbl.c +@@ -791,6 +791,12 @@ int ubi_read_volume_table(struct ubi_device *ubi, struct ubi_attach_info *ai) + * The number of supported volumes is limited by the eraseblock size + * and by the UBI_MAX_VOLUMES constant. + */ ++ ++ if (ubi->leb_size < UBI_VTBL_RECORD_SIZE) { ++ ubi_err(ubi, "LEB size too small for a volume record"); ++ return -EINVAL; ++ } ++ + ubi->vtbl_slots = ubi->leb_size / UBI_VTBL_RECORD_SIZE; + if (ubi->vtbl_slots > UBI_MAX_VOLUMES) + ubi->vtbl_slots = UBI_MAX_VOLUMES; +-- +2.43.0 + diff --git a/queue-5.15/ubi-correct-the-calculation-of-fastmap-size.patch b/queue-5.15/ubi-correct-the-calculation-of-fastmap-size.patch new file mode 100644 index 00000000000..158edbf4864 --- /dev/null +++ b/queue-5.15/ubi-correct-the-calculation-of-fastmap-size.patch @@ -0,0 +1,43 @@ +From c932dd4439a9ac6951506063729a09e351ebe2b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Feb 2024 10:49:03 +0800 +Subject: ubi: correct the calculation of fastmap size + +From: Zhang Yi + +[ Upstream commit 7f174ae4f39e8475adcc09d26c5a43394689ad6c ] + +Now that the calculation of fastmap size in ubi_calc_fm_size() is +incorrect since it miss each user volume's ubi_fm_eba structure and the +Internal UBI volume info. Let's correct the calculation. + +Cc: stable@vger.kernel.org +Signed-off-by: Zhang Yi +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/fastmap.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c +index 6e95c4b1473e6..8081fc760d34f 100644 +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -86,9 +86,10 @@ size_t ubi_calc_fm_size(struct ubi_device *ubi) + sizeof(struct ubi_fm_scan_pool) + + sizeof(struct ubi_fm_scan_pool) + + (ubi->peb_count * sizeof(struct ubi_fm_ec)) + +- (sizeof(struct ubi_fm_eba) + +- (ubi->peb_count * sizeof(__be32))) + +- sizeof(struct ubi_fm_volhdr) * UBI_MAX_VOLUMES; ++ ((sizeof(struct ubi_fm_eba) + ++ sizeof(struct ubi_fm_volhdr)) * ++ (UBI_MAX_VOLUMES + UBI_INT_VOL_COUNT)) + ++ (ubi->peb_count * sizeof(__be32)); + return roundup(size, ubi->leb_size); + } + +-- +2.43.0 + diff --git a/queue-5.15/ubifs-set-page-uptodate-in-the-correct-place.patch b/queue-5.15/ubifs-set-page-uptodate-in-the-correct-place.patch new file mode 100644 index 00000000000..d199217cacb --- /dev/null +++ b/queue-5.15/ubifs-set-page-uptodate-in-the-correct-place.patch @@ -0,0 +1,74 @@ +From ff84b88b9a0fe23cbade3cd32ed471d62eb8cd22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 17:52:44 +0000 +Subject: ubifs: Set page uptodate in the correct place + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 723012cab779eee8228376754e22c6594229bf8f ] + +Page cache reads are lockless, so setting the freshly allocated page +uptodate before we've overwritten it with the data it's supposed to have +in it will allow a simultaneous reader to see old data. Move the call +to SetPageUptodate into ubifs_write_end(), which is after we copied the +new data into the page. + +Fixes: 1e51764a3c2a ("UBIFS: add new flash file system") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/file.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c +index 7cc2abcb70ae8..509144cc41a0f 100644 +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -262,9 +262,6 @@ static int write_begin_slow(struct address_space *mapping, + return err; + } + } +- +- SetPageUptodate(page); +- ClearPageError(page); + } + + if (PagePrivate(page)) +@@ -463,9 +460,6 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping, + return err; + } + } +- +- SetPageUptodate(page); +- ClearPageError(page); + } + + err = allocate_budget(c, page, ui, appending); +@@ -475,10 +469,8 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping, + * If we skipped reading the page because we were going to + * write all of it, then it is not up to date. + */ +- if (skipped_read) { ++ if (skipped_read) + ClearPageChecked(page); +- ClearPageUptodate(page); +- } + /* + * Budgeting failed which means it would have to force + * write-back but didn't, because we set the @fast flag in the +@@ -569,6 +561,9 @@ static int ubifs_write_end(struct file *file, struct address_space *mapping, + goto out; + } + ++ if (len == PAGE_SIZE) ++ SetPageUptodate(page); ++ + if (!PagePrivate(page)) { + attach_page_private(page, (void *)1); + atomic_long_inc(&c->dirty_pg_cnt); +-- +2.43.0 + diff --git a/queue-5.15/usb-gadget-tegra-xudc-fix-usb3-phy-retrieval-logic.patch b/queue-5.15/usb-gadget-tegra-xudc-fix-usb3-phy-retrieval-logic.patch new file mode 100644 index 00000000000..46224bbe464 --- /dev/null +++ b/queue-5.15/usb-gadget-tegra-xudc-fix-usb3-phy-retrieval-logic.patch @@ -0,0 +1,112 @@ +From cd1930b972f866b71fd09a8bf060e7710496a55e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2024 11:03:28 +0800 +Subject: usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic + +From: Wayne Chang + +[ Upstream commit 84fa943d93c31ee978355e6c6c69592dae3c9f59 ] + +This commit resolves an issue in the tegra-xudc USB gadget driver that +incorrectly fetched USB3 PHY instances. The problem stemmed from the +assumption of a one-to-one correspondence between USB2 and USB3 PHY +names and their association with physical USB ports in the device tree. + +Previously, the driver associated USB3 PHY names directly with the USB3 +instance number, leading to mismatches when mapping the physical USB +ports. For instance, if using USB3-1 PHY, the driver expect the +corresponding PHY name as 'usb3-1'. However, the physical USB ports in +the device tree were designated as USB2-0 and USB3-0 as we only have +one device controller, causing a misalignment. + +This commit rectifies the issue by adjusting the PHY naming logic. +Now, the driver correctly correlates the USB2 and USB3 PHY instances, +allowing the USB2-0 and USB3-1 PHYs to form a physical USB port pair +while accurately reflecting their configuration in the device tree by +naming them USB2-0 and USB3-0, respectively. + +The change ensures that the PHY and PHY names align appropriately, +resolving the mismatch between physical USB ports and their associated +names in the device tree. + +Fixes: b4e19931c98a ("usb: gadget: tegra-xudc: Support multiple device modes") +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20240307030328.1487748-3-waynec@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/tegra-xudc.c | 39 ++++++++++++++++++----------- + 1 file changed, 25 insertions(+), 14 deletions(-) + +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index 52996bf2cc705..fdbb9d73aa8e4 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -3480,8 +3480,8 @@ static void tegra_xudc_device_params_init(struct tegra_xudc *xudc) + + static int tegra_xudc_phy_get(struct tegra_xudc *xudc) + { +- int err = 0, usb3; +- unsigned int i; ++ int err = 0, usb3_companion_port; ++ unsigned int i, j; + + xudc->utmi_phy = devm_kcalloc(xudc->dev, xudc->soc->num_phys, + sizeof(*xudc->utmi_phy), GFP_KERNEL); +@@ -3509,7 +3509,7 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc) + if (IS_ERR(xudc->utmi_phy[i])) { + err = PTR_ERR(xudc->utmi_phy[i]); + dev_err_probe(xudc->dev, err, +- "failed to get usb2-%d PHY\n", i); ++ "failed to get PHY for phy-name usb2-%d\n", i); + goto clean_up; + } else if (xudc->utmi_phy[i]) { + /* Get usb-phy, if utmi phy is available */ +@@ -3528,19 +3528,30 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc) + } + + /* Get USB3 phy */ +- usb3 = tegra_xusb_padctl_get_usb3_companion(xudc->padctl, i); +- if (usb3 < 0) ++ usb3_companion_port = tegra_xusb_padctl_get_usb3_companion(xudc->padctl, i); ++ if (usb3_companion_port < 0) + continue; + +- snprintf(phy_name, sizeof(phy_name), "usb3-%d", usb3); +- xudc->usb3_phy[i] = devm_phy_optional_get(xudc->dev, phy_name); +- if (IS_ERR(xudc->usb3_phy[i])) { +- err = PTR_ERR(xudc->usb3_phy[i]); +- dev_err_probe(xudc->dev, err, +- "failed to get usb3-%d PHY\n", usb3); +- goto clean_up; +- } else if (xudc->usb3_phy[i]) +- dev_dbg(xudc->dev, "usb3-%d PHY registered", usb3); ++ for (j = 0; j < xudc->soc->num_phys; j++) { ++ snprintf(phy_name, sizeof(phy_name), "usb3-%d", j); ++ xudc->usb3_phy[i] = devm_phy_optional_get(xudc->dev, phy_name); ++ if (IS_ERR(xudc->usb3_phy[i])) { ++ err = PTR_ERR(xudc->usb3_phy[i]); ++ dev_err_probe(xudc->dev, err, ++ "failed to get PHY for phy-name usb3-%d\n", j); ++ goto clean_up; ++ } else if (xudc->usb3_phy[i]) { ++ int usb2_port = ++ tegra_xusb_padctl_get_port_number(xudc->utmi_phy[i]); ++ int usb3_port = ++ tegra_xusb_padctl_get_port_number(xudc->usb3_phy[i]); ++ if (usb3_port == usb3_companion_port) { ++ dev_dbg(xudc->dev, "USB2 port %d is paired with USB3 port %d for device mode port %d\n", ++ usb2_port, usb3_port, i); ++ break; ++ } ++ } ++ } + } + + return err; +-- +2.43.0 + diff --git a/queue-5.15/usb-serial-add-device-id-for-verifone-adapter.patch b/queue-5.15/usb-serial-add-device-id-for-verifone-adapter.patch new file mode 100644 index 00000000000..a3c52eb02af --- /dev/null +++ b/queue-5.15/usb-serial-add-device-id-for-verifone-adapter.patch @@ -0,0 +1,94 @@ +From 4b1b4c65e8eaf5dc39d57e32083cdb95a1e1dd31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Feb 2024 21:53:29 +0000 +Subject: USB: serial: add device ID for VeriFone adapter + +From: Cameron Williams + +[ Upstream commit cda704809797a8a86284f9df3eef5e62ec8a3175 ] + +Add device ID for a (probably fake) CP2102 UART device. + +lsusb -v output: + +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 1.10 + bDeviceClass 0 [unknown] + bDeviceSubClass 0 [unknown] + bDeviceProtocol 0 + bMaxPacketSize0 64 + idVendor 0x11ca VeriFone Inc + idProduct 0x0212 Verifone USB to Printer + bcdDevice 1.00 + iManufacturer 1 Silicon Labs + iProduct 2 Verifone USB to Printer + iSerial 3 0001 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 0x0020 + bNumInterfaces 1 + bConfigurationValue 1 + iConfiguration 0 + bmAttributes 0x80 + (Bus Powered) + MaxPower 100mA + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 0 [unknown] + bInterfaceProtocol 0 + iInterface 2 Verifone USB to Printer + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 0 +Device Status: 0x0000 + (Bus Powered) + +Signed-off-by: Cameron Williams +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index f47c2f3922929..bd72e9adc497a 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -177,6 +177,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0xF004) }, /* Elan Digital Systems USBcount50 */ + { USB_DEVICE(0x10C5, 0xEA61) }, /* Silicon Labs MobiData GPRS USB Modem */ + { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */ ++ { USB_DEVICE(0x11CA, 0x0212) }, /* Verifone USB to Printer (UART, CP2102) */ + { USB_DEVICE(0x12B8, 0xEC60) }, /* Link G4 ECU */ + { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ + { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ +-- +2.43.0 + diff --git a/queue-5.15/usb-serial-cp210x-add-id-for-mgp-instruments-pds100.patch b/queue-5.15/usb-serial-cp210x-add-id-for-mgp-instruments-pds100.patch new file mode 100644 index 00000000000..96a2697881b --- /dev/null +++ b/queue-5.15/usb-serial-cp210x-add-id-for-mgp-instruments-pds100.patch @@ -0,0 +1,44 @@ +From 56bac8cef00e9709a1b24094e210d1654157496a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Feb 2024 11:47:29 +0100 +Subject: USB: serial: cp210x: add ID for MGP Instruments PDS100 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian Häggström + +[ Upstream commit a0d9d868491a362d421521499d98308c8e3a0398 ] + +The radiation meter has the text MGP Instruments PDS-100G or PDS-100GN +produced by Mirion Technologies. Tested by forcing the driver +association with + + echo 10c4 863c > /sys/bus/usb-serial/drivers/cp210x/new_id + +and then setting the serial port in 115200 8N1 mode. The device +announces ID_USB_VENDOR_ENC=Silicon\x20Labs and ID_USB_MODEL_ENC=PDS100 + +Signed-off-by: Christian Häggström +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index bd72e9adc497a..ff814f9298db0 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -144,6 +144,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ + { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ ++ { USB_DEVICE(0x10C4, 0x863C) }, /* MGP Instruments PDS100 */ + { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ + { USB_DEVICE(0x10C4, 0x87ED) }, /* IMST USB-Stick for Smart Meter */ +-- +2.43.0 + diff --git a/queue-5.15/usb-serial-cp210x-add-pid-vid-for-tdk-nc0110013m-and.patch b/queue-5.15/usb-serial-cp210x-add-pid-vid-for-tdk-nc0110013m-and.patch new file mode 100644 index 00000000000..5f2dfbc0056 --- /dev/null +++ b/queue-5.15/usb-serial-cp210x-add-pid-vid-for-tdk-nc0110013m-and.patch @@ -0,0 +1,36 @@ +From 35609977dcff6b5c06cec1a070f27b19f8aff9ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 08:46:14 +0900 +Subject: USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M + +From: Toru Katagiri + +[ Upstream commit b1a8da9ff1395c4879b4bd41e55733d944f3d613 ] + +TDK NC0110013M and MM0110113M have custom USB IDs for CP210x, +so we need to add them to the driver. + +Signed-off-by: Toru Katagiri +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/cp210x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index ff814f9298db0..4183942a1c195 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -56,6 +56,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x0471, 0x066A) }, /* AKTAKOM ACE-1001 cable */ + { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ + { USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 SIP/GSM Mobile */ ++ { USB_DEVICE(0x04BF, 0x1301) }, /* TDK Corporation NC0110013M - Network Controller */ ++ { USB_DEVICE(0x04BF, 0x1303) }, /* TDK Corporation MM0110113M - i3 Micro Module */ + { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 1000 */ + { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ + { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ +-- +2.43.0 + diff --git a/queue-5.15/usb-serial-ftdi_sio-add-support-for-gmc-z216c-adapte.patch b/queue-5.15/usb-serial-ftdi_sio-add-support-for-gmc-z216c-adapte.patch new file mode 100644 index 00000000000..0e26bf47264 --- /dev/null +++ b/queue-5.15/usb-serial-ftdi_sio-add-support-for-gmc-z216c-adapte.patch @@ -0,0 +1,53 @@ +From 63bc1c467935a5dba3eca5ded1e1848beabbb033 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Feb 2024 15:42:46 +0100 +Subject: USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB + +From: Daniel Vogelbacher + +[ Upstream commit 3fb7bc4f3a98c48981318b87cf553c5f115fd5ca ] + +The GMC IR-USB adapter cable utilizes a FTDI FT232R chip. + +Add VID/PID for this adapter so it can be used as serial device via +ftdi_sio. + +Signed-off-by: Daniel Vogelbacher +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 2345208b7221c..1915b92c388fe 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1055,6 +1055,8 @@ static const struct usb_device_id id_table_combined[] = { + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ /* GMC devices */ ++ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 9a0f9fc991246..b2aec1106678a 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1599,3 +1599,9 @@ + #define UBLOX_VID 0x1546 + #define UBLOX_C099F9P_ZED_PID 0x0502 + #define UBLOX_C099F9P_ODIN_PID 0x0503 ++ ++/* ++ * GMC devices ++ */ ++#define GMC_VID 0x1cd7 ++#define GMC_Z216C_PID 0x0217 /* GMC Z216C Adapter IR-USB */ +-- +2.43.0 + diff --git a/queue-5.15/usb-serial-option-add-meig-smart-slm320-product.patch b/queue-5.15/usb-serial-option-add-meig-smart-slm320-product.patch new file mode 100644 index 00000000000..82ec888270f --- /dev/null +++ b/queue-5.15/usb-serial-option-add-meig-smart-slm320-product.patch @@ -0,0 +1,85 @@ +From 471acba6f979d8d1e90b39e15be5dc7899493427 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jan 2024 18:49:17 +0100 +Subject: USB: serial: option: add MeiG Smart SLM320 product +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Aurélien Jacobs + +[ Upstream commit 46809c51565b83881aede6cdf3b0d25254966a41 ] + +Update the USB serial option driver to support MeiG Smart SLM320. + +ID 2dee:4d41 UNISOC UNISOC-8910 + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2dee ProdID=4d41 Rev=00.00 +S: Manufacturer=UNISOC +S: Product=UNISOC-8910 +C: #Ifs= 8 Cfg#= 1 Atr=e0 MxPwr=400mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Tested successfully a PPP LTE connection using If#= 0. +Not sure of the purpose of every other serial interfaces. + +Signed-off-by: Aurélien Jacobs +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index c0a0cca65437f..1a3e5a9414f07 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -613,6 +613,11 @@ static void option_instat_callback(struct urb *urb); + /* Luat Air72*U series based on UNISOC UIS8910 uses UNISOC's vendor ID */ + #define LUAT_PRODUCT_AIR720U 0x4e00 + ++/* MeiG Smart Technology products */ ++#define MEIGSMART_VENDOR_ID 0x2dee ++/* MeiG Smart SLM320 based on UNISOC UIS8910 */ ++#define MEIGSMART_PRODUCT_SLM320 0x4d41 ++ + /* Device flags */ + + /* Highest interface number which can be used with NCTRL() and RSVD() */ +@@ -2282,6 +2287,7 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +-- +2.43.0 + diff --git a/queue-5.15/usb-typec-ucsi-clean-up-ucsi_cable_prop-macros.patch b/queue-5.15/usb-typec-ucsi-clean-up-ucsi_cable_prop-macros.patch new file mode 100644 index 00000000000..6005778003f --- /dev/null +++ b/queue-5.15/usb-typec-ucsi-clean-up-ucsi_cable_prop-macros.patch @@ -0,0 +1,47 @@ +From 9ab6f03e30105af693d3076c6171ed0d8f928c45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Mar 2024 02:58:01 +0000 +Subject: usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros + +From: Jameson Thies + +[ Upstream commit 4d0a5a9915793377c0fe1a8d78de6bcd92cea963 ] + +Clean up UCSI_CABLE_PROP macros by fixing a bitmask shifting error for +plug type and updating the modal support macro for consistent naming. + +Fixes: 3cf657f07918 ("usb: typec: ucsi: Remove all bit-fields") +Cc: stable@vger.kernel.org +Reviewed-by: Benson Leung +Reviewed-by: Prashant Malani +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Jameson Thies +Link: https://lore.kernel.org/r/20240305025804.1290919-2-jthies@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/ucsi/ucsi.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h +index cee666790907e..3dc3da8dbbdf8 100644 +--- a/drivers/usb/typec/ucsi/ucsi.h ++++ b/drivers/usb/typec/ucsi/ucsi.h +@@ -220,12 +220,12 @@ struct ucsi_cable_property { + #define UCSI_CABLE_PROP_FLAG_VBUS_IN_CABLE BIT(0) + #define UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE BIT(1) + #define UCSI_CABLE_PROP_FLAG_DIRECTIONALITY BIT(2) +-#define UCSI_CABLE_PROP_FLAG_PLUG_TYPE(_f_) ((_f_) & GENMASK(3, 0)) ++#define UCSI_CABLE_PROP_FLAG_PLUG_TYPE(_f_) (((_f_) & GENMASK(4, 3)) >> 3) + #define UCSI_CABLE_PROPERTY_PLUG_TYPE_A 0 + #define UCSI_CABLE_PROPERTY_PLUG_TYPE_B 1 + #define UCSI_CABLE_PROPERTY_PLUG_TYPE_C 2 + #define UCSI_CABLE_PROPERTY_PLUG_OTHER 3 +-#define UCSI_CABLE_PROP_MODE_SUPPORT BIT(5) ++#define UCSI_CABLE_PROP_FLAG_MODE_SUPPORT BIT(5) + u8 latency; + } __packed; + +-- +2.43.0 + diff --git a/queue-5.15/usb-xhci-add-error-handling-in-xhci_map_urb_for_dma.patch b/queue-5.15/usb-xhci-add-error-handling-in-xhci_map_urb_for_dma.patch new file mode 100644 index 00000000000..668821c5e89 --- /dev/null +++ b/queue-5.15/usb-xhci-add-error-handling-in-xhci_map_urb_for_dma.patch @@ -0,0 +1,43 @@ +From 03736883b58429b22c459035eb61cb49e55cd42d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Feb 2024 16:14:38 +0200 +Subject: usb: xhci: Add error handling in xhci_map_urb_for_dma + +From: Prashanth K + +[ Upstream commit be95cc6d71dfd0cba66e3621c65413321b398052 ] + +Currently xhci_map_urb_for_dma() creates a temporary buffer and copies +the SG list to the new linear buffer. But if the kzalloc_node() fails, +then the following sg_pcopy_to_buffer() can lead to crash since it +tries to memcpy to NULL pointer. + +So return -ENOMEM if kzalloc returns null pointer. + +Cc: stable@vger.kernel.org # 5.11 +Fixes: 2017a1e58472 ("usb: xhci: Use temporary buffer to consolidate SG") +Signed-off-by: Prashanth K +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20240229141438.619372-10-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 5c9d3be136d2c..2539d97b90c31 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1324,6 +1324,8 @@ static int xhci_map_temp_buffer(struct usb_hcd *hcd, struct urb *urb) + + temp = kzalloc_node(buf_len, GFP_ATOMIC, + dev_to_node(hcd->self.sysdev)); ++ if (!temp) ++ return -ENOMEM; + + if (usb_urb_dir_out(urb)) + sg_pcopy_to_buffer(urb->sg, urb->num_sgs, +-- +2.43.0 + diff --git a/queue-5.15/vfio-platform-disable-virqfds-on-cleanup.patch b/queue-5.15/vfio-platform-disable-virqfds-on-cleanup.patch new file mode 100644 index 00000000000..724ff8157a3 --- /dev/null +++ b/queue-5.15/vfio-platform-disable-virqfds-on-cleanup.patch @@ -0,0 +1,44 @@ +From 8752a6493f98a92e1829cde06d66eac06360540c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Mar 2024 16:05:26 -0700 +Subject: vfio/platform: Disable virqfds on cleanup + +From: Alex Williamson + +[ Upstream commit fcdc0d3d40bc26c105acf8467f7d9018970944ae ] + +irqfds for mask and unmask that are not specifically disabled by the +user are leaked. Remove any irqfds during cleanup + +Cc: Eric Auger +Cc: +Fixes: a7fa7c77cf15 ("vfio/platform: implement IRQ masking/unmasking via an eventfd") +Reviewed-by: Kevin Tian +Reviewed-by: Eric Auger +Link: https://lore.kernel.org/r/20240308230557.805580-6-alex.williamson@redhat.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/platform/vfio_platform_irq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/vfio/platform/vfio_platform_irq.c b/drivers/vfio/platform/vfio_platform_irq.c +index c5b09ec0a3c98..f2893f2fcaabd 100644 +--- a/drivers/vfio/platform/vfio_platform_irq.c ++++ b/drivers/vfio/platform/vfio_platform_irq.c +@@ -321,8 +321,11 @@ void vfio_platform_irq_cleanup(struct vfio_platform_device *vdev) + { + int i; + +- for (i = 0; i < vdev->num_irqs; i++) ++ for (i = 0; i < vdev->num_irqs; i++) { ++ vfio_virqfd_disable(&vdev->irqs[i].mask); ++ vfio_virqfd_disable(&vdev->irqs[i].unmask); + vfio_set_trigger(vdev, i, -1, NULL); ++ } + + vdev->num_irqs = 0; + kfree(vdev->irqs); +-- +2.43.0 + diff --git a/queue-5.15/wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch b/queue-5.15/wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch new file mode 100644 index 00000000000..16f76bfcfb6 --- /dev/null +++ b/queue-5.15/wifi-brcmfmac-fix-use-after-free-bug-in-brcmf_cfg802.patch @@ -0,0 +1,77 @@ +From 1fe51822192f0864cb3afe2e99191105af2f001b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 08:25:04 +0100 +Subject: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach + +From: Zheng Wang + +[ Upstream commit 0f7352557a35ab7888bc7831411ec8a3cbe20d78 ] + +This is the candidate patch of CVE-2023-47233 : +https://nvd.nist.gov/vuln/detail/CVE-2023-47233 + +In brcm80211 driver,it starts with the following invoking chain +to start init a timeout worker: + +->brcmf_usb_probe + ->brcmf_usb_probe_cb + ->brcmf_attach + ->brcmf_bus_started + ->brcmf_cfg80211_attach + ->wl_init_priv + ->brcmf_init_escan + ->INIT_WORK(&cfg->escan_timeout_work, + brcmf_cfg80211_escan_timeout_worker); + +If we disconnect the USB by hotplug, it will call +brcmf_usb_disconnect to make cleanup. The invoking chain is : + +brcmf_usb_disconnect + ->brcmf_usb_disconnect_cb + ->brcmf_detach + ->brcmf_cfg80211_detach + ->kfree(cfg); + +While the timeout woker may still be running. This will cause +a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. + +Fix it by deleting the timer and canceling the worker in +brcmf_cfg80211_detach. + +Fixes: e756af5b30b0 ("brcmfmac: add e-scan support.") +Signed-off-by: Zheng Wang +Cc: stable@vger.kernel.org +[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free] +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://msgid.link/20240107072504.392713-1-arend.vanspriel@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index b14c54da56ed9..1c95e8f75916f 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -790,8 +790,7 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg, + scan_request = cfg->scan_request; + cfg->scan_request = NULL; + +- if (timer_pending(&cfg->escan_timeout)) +- del_timer_sync(&cfg->escan_timeout); ++ timer_delete_sync(&cfg->escan_timeout); + + if (fw_abort) { + /* Do a scan abort to stop the driver's scan engine */ +@@ -7781,6 +7780,7 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg) + brcmf_btcoex_detach(cfg); + wiphy_unregister(cfg->wiphy); + wl_deinit_priv(cfg); ++ cancel_work_sync(&cfg->escan_timeout_work); + brcmf_free_wiphy(cfg->wiphy); + kfree(cfg); + } +-- +2.43.0 + diff --git a/queue-5.15/wireguard-netlink-access-device-through-ctx-instead-.patch b/queue-5.15/wireguard-netlink-access-device-through-ctx-instead-.patch new file mode 100644 index 00000000000..67f049874ae --- /dev/null +++ b/queue-5.15/wireguard-netlink-access-device-through-ctx-instead-.patch @@ -0,0 +1,44 @@ +From c0f62d178805adce24bb7275bb623213247fd084 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 16:49:10 -0600 +Subject: wireguard: netlink: access device through ctx instead of peer + +From: Jason A. Donenfeld + +[ Upstream commit 71cbd32e3db82ea4a74e3ef9aeeaa6971969c86f ] + +The previous commit fixed a bug that led to a NULL peer->device being +dereferenced. It's actually easier and faster performance-wise to +instead get the device from ctx->wg. This semantically makes more sense +too, since ctx->wg->peer_allowedips.seq is compared with +ctx->allowedips_seq, basing them both in ctx. This also acts as a +defence in depth provision against freed peers. + +Cc: stable@vger.kernel.org +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Jiri Pirko +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/netlink.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c +index 6523f9d5a1527..9dc02fa51ed09 100644 +--- a/drivers/net/wireguard/netlink.c ++++ b/drivers/net/wireguard/netlink.c +@@ -164,8 +164,8 @@ get_peer(struct wg_peer *peer, struct sk_buff *skb, struct dump_ctx *ctx) + if (!allowedips_node) + goto no_allowedips; + if (!ctx->allowedips_seq) +- ctx->allowedips_seq = peer->device->peer_allowedips.seq; +- else if (ctx->allowedips_seq != peer->device->peer_allowedips.seq) ++ ctx->allowedips_seq = ctx->wg->peer_allowedips.seq; ++ else if (ctx->allowedips_seq != ctx->wg->peer_allowedips.seq) + goto no_allowedips; + + allowedips_nest = nla_nest_start(skb, WGPEER_A_ALLOWEDIPS); +-- +2.43.0 + diff --git a/queue-5.15/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch b/queue-5.15/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch new file mode 100644 index 00000000000..af1244bf519 --- /dev/null +++ b/queue-5.15/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch @@ -0,0 +1,90 @@ +From d47b99a234581028930292d626c3840b4af8ed78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 16:49:09 -0600 +Subject: wireguard: netlink: check for dangling peer via is_dead instead of + empty list + +From: Jason A. Donenfeld + +[ Upstream commit 55b6c738673871c9b0edae05d0c97995c1ff08c4 ] + +If all peers are removed via wg_peer_remove_all(), rather than setting +peer_list to empty, the peer is added to a temporary list with a head on +the stack of wg_peer_remove_all(). If a netlink dump is resumed and the +cursored peer is one that has been removed via wg_peer_remove_all(), it +will iterate from that peer and then attempt to dump freed peers. + +Fix this by instead checking peer->is_dead, which was explictly created +for this purpose. Also move up the device_update_lock lockdep assertion, +since reading is_dead relies on that. + +It can be reproduced by a small script like: + + echo "Setting config..." + ip link add dev wg0 type wireguard + wg setconf wg0 /big-config + ( + while true; do + echo "Showing config..." + wg showconf wg0 > /dev/null + done + ) & + sleep 4 + wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n") + +Resulting in: + + BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20 + Read of size 8 at addr ffff88811956ec70 by task wg/59 + CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5 + Call Trace: + + dump_stack_lvl+0x47/0x70 + print_address_description.constprop.0+0x2c/0x380 + print_report+0xab/0x250 + kasan_report+0xba/0xf0 + __lock_acquire+0x182a/0x1b20 + lock_acquire+0x191/0x4b0 + down_read+0x80/0x440 + get_peer+0x140/0xcb0 + wg_get_device_dump+0x471/0x1130 + +Cc: stable@vger.kernel.org +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Reported-by: Lillian Berry +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Jiri Pirko +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/netlink.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c +index f5bc279c9a8c2..6523f9d5a1527 100644 +--- a/drivers/net/wireguard/netlink.c ++++ b/drivers/net/wireguard/netlink.c +@@ -255,17 +255,17 @@ static int wg_get_device_dump(struct sk_buff *skb, struct netlink_callback *cb) + if (!peers_nest) + goto out; + ret = 0; +- /* If the last cursor was removed via list_del_init in peer_remove, then ++ lockdep_assert_held(&wg->device_update_lock); ++ /* If the last cursor was removed in peer_remove or peer_remove_all, then + * we just treat this the same as there being no more peers left. The + * reason is that seq_nr should indicate to userspace that this isn't a + * coherent dump anyway, so they'll try again. + */ + if (list_empty(&wg->peer_list) || +- (ctx->next_peer && list_empty(&ctx->next_peer->peer_list))) { ++ (ctx->next_peer && ctx->next_peer->is_dead)) { + nla_nest_cancel(skb, peers_nest); + goto out; + } +- lockdep_assert_held(&wg->device_update_lock); + peer = list_prepare_entry(ctx->next_peer, &wg->peer_list, peer_list); + list_for_each_entry_continue(peer, &wg->peer_list, peer_list) { + if (get_peer(peer, skb, ctx)) { +-- +2.43.0 + diff --git a/queue-5.15/x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch b/queue-5.15/x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch new file mode 100644 index 00000000000..00196afb11f --- /dev/null +++ b/queue-5.15/x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch @@ -0,0 +1,44 @@ +From 4f1230a3aa120bf662051b03d3d7ebdb39ece452 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Mar 2024 22:42:27 +0100 +Subject: x86/CPU/AMD: Update the Zenbleed microcode revisions + +From: Borislav Petkov (AMD) + +[ Upstream commit 5c84b051bd4e777cf37aaff983277e58c99618d5 ] + +Update them to the correct revision numbers. + +Fixes: 522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix") +Signed-off-by: Borislav Petkov (AMD) +Cc: +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/amd.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index dba7fe7ecea91..9fb890574f36b 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -1021,11 +1021,11 @@ static bool cpu_has_zenbleed_microcode(void) + u32 good_rev = 0; + + switch (boot_cpu_data.x86_model) { +- case 0x30 ... 0x3f: good_rev = 0x0830107a; break; +- case 0x60 ... 0x67: good_rev = 0x0860010b; break; +- case 0x68 ... 0x6f: good_rev = 0x08608105; break; +- case 0x70 ... 0x7f: good_rev = 0x08701032; break; +- case 0xa0 ... 0xaf: good_rev = 0x08a00008; break; ++ case 0x30 ... 0x3f: good_rev = 0x0830107b; break; ++ case 0x60 ... 0x67: good_rev = 0x0860010c; break; ++ case 0x68 ... 0x6f: good_rev = 0x08608107; break; ++ case 0x70 ... 0x7f: good_rev = 0x08701033; break; ++ case 0xa0 ... 0xaf: good_rev = 0x08a00009; break; + + default: + return false; +-- +2.43.0 + diff --git a/queue-5.15/x86-pm-work-around-false-positive-kmemleak-report-in.patch b/queue-5.15/x86-pm-work-around-false-positive-kmemleak-report-in.patch new file mode 100644 index 00000000000..0a86d5c3538 --- /dev/null +++ b/queue-5.15/x86-pm-work-around-false-positive-kmemleak-report-in.patch @@ -0,0 +1,102 @@ +From 228fc7f0b3defd4e252c978bd1e67611bd8a367e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 14:26:56 +0000 +Subject: x86/pm: Work around false positive kmemleak report in + msr_build_context() + +From: Anton Altaparmakov + +[ Upstream commit e3f269ed0accbb22aa8f25d2daffa23c3fccd407 ] + +Since: + + 7ee18d677989 ("x86/power: Make restore_processor_context() sane") + +kmemleak reports this issue: + + unreferenced object 0xf68241e0 (size 32): + comm "swapper/0", pid 1, jiffies 4294668610 (age 68.432s) + hex dump (first 32 bytes): + 00 cc cc cc 29 10 01 c0 00 00 00 00 00 00 00 00 ....)........... + 00 42 82 f6 cc cc cc cc cc cc cc cc cc cc cc cc .B.............. + backtrace: + [<461c1d50>] __kmem_cache_alloc_node+0x106/0x260 + [] __kmalloc+0x54/0x160 + [] msr_build_context.constprop.0+0x35/0x100 + [<46635aff>] pm_check_save_msr+0x63/0x80 + [<6b6bb938>] do_one_initcall+0x41/0x1f0 + [<3f3add60>] kernel_init_freeable+0x199/0x1e8 + [<3b538fde>] kernel_init+0x1a/0x110 + [<938ae2b2>] ret_from_fork+0x1c/0x28 + +Which is a false positive. + +Reproducer: + + - Run rsync of whole kernel tree (multiple times if needed). + - start a kmemleak scan + - Note this is just an example: a lot of our internal tests hit these. + +The root cause is similar to the fix in: + + b0b592cf0836 x86/pm: Fix false positive kmemleak report in msr_build_context() + +ie. the alignment within the packed struct saved_context +which has everything unaligned as there is only "u16 gs;" at start of +struct where in the past there were four u16 there thus aligning +everything afterwards. The issue is with the fact that Kmemleak only +searches for pointers that are aligned (see how pointers are scanned in +kmemleak.c) so when the struct members are not aligned it doesn't see +them. + +Testing: + +We run a lot of tests with our CI, and after applying this fix we do not +see any kmemleak issues any more whilst without it we see hundreds of +the above report. From a single, simple test run consisting of 416 individual test +cases on kernel 5.10 x86 with kmemleak enabled we got 20 failures due to this, +which is quite a lot. With this fix applied we get zero kmemleak related failures. + +Fixes: 7ee18d677989 ("x86/power: Make restore_processor_context() sane") +Signed-off-by: Anton Altaparmakov +Signed-off-by: Ingo Molnar +Acked-by: "Rafael J. Wysocki" +Cc: stable@vger.kernel.org +Cc: Linus Torvalds +Link: https://lore.kernel.org/r/20240314142656.17699-1-anton@tuxera.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/suspend_32.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h +index a800abb1a9925..d8416b3bf832e 100644 +--- a/arch/x86/include/asm/suspend_32.h ++++ b/arch/x86/include/asm/suspend_32.h +@@ -12,11 +12,6 @@ + + /* image of the saved processor state */ + struct saved_context { +- /* +- * On x86_32, all segment registers except gs are saved at kernel +- * entry in pt_regs. +- */ +- u16 gs; + unsigned long cr0, cr2, cr3, cr4; + u64 misc_enable; + struct saved_msrs saved_msrs; +@@ -27,6 +22,11 @@ struct saved_context { + unsigned long tr; + unsigned long safety; + unsigned long return_address; ++ /* ++ * On x86_32, all segment registers except gs are saved at kernel ++ * entry in pt_regs. ++ */ ++ u16 gs; + bool misc_enable_saved; + } __attribute__((packed)); + +-- +2.43.0 +