From: Greg Kroah-Hartman Date: Fri, 20 Jun 2025 07:43:42 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.295~174 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d41d60afaa0ffe5995c3d3f29d617bd32d8778b1;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: media-gspca-add-error-handling-for-stv06xx_read_sensor.patch media-v4l2-dev-fix-error-handling-in-__video_register_device.patch nfsd-nfsd4_spo_must_allow-must-check-this-is-a-v4-compound-request.patch wifi-rtlwifi-disable-aspm-for-rtl8723be-with-subsystem-id-11ad-1723.patch --- diff --git a/queue-5.4/media-gspca-add-error-handling-for-stv06xx_read_sensor.patch b/queue-5.4/media-gspca-add-error-handling-for-stv06xx_read_sensor.patch new file mode 100644 index 0000000000..411b38df86 --- /dev/null +++ b/queue-5.4/media-gspca-add-error-handling-for-stv06xx_read_sensor.patch @@ -0,0 +1,41 @@ +From 398a1b33f1479af35ca915c5efc9b00d6204f8fa Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Tue, 22 Apr 2025 11:07:39 +0800 +Subject: media: gspca: Add error handling for stv06xx_read_sensor() + +From: Wentao Liang + +commit 398a1b33f1479af35ca915c5efc9b00d6204f8fa upstream. + +In hdcs_init(), the return value of stv06xx_read_sensor() needs to be +checked. A proper implementation can be found in vv6410_dump(). Add a +check in loop condition and propergate error code to fix this issue. + +Fixes: 4c98834addfe ("V4L/DVB (10048): gspca - stv06xx: New subdriver.") +Cc: stable@vger.kernel.org # v2.6+ +Signed-off-by: Wentao Liang +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c ++++ b/drivers/media/usb/gspca/stv06xx/stv06xx_hdcs.c +@@ -520,12 +520,13 @@ static int hdcs_init(struct sd *sd) + static int hdcs_dump(struct sd *sd) + { + u16 reg, val; ++ int err = 0; + + pr_info("Dumping sensor registers:\n"); + +- for (reg = HDCS_IDENT; reg <= HDCS_ROWEXPH; reg++) { +- stv06xx_read_sensor(sd, reg, &val); ++ for (reg = HDCS_IDENT; reg <= HDCS_ROWEXPH && !err; reg++) { ++ err = stv06xx_read_sensor(sd, reg, &val); + pr_info("reg 0x%02x = 0x%02x\n", reg, val); + } +- return 0; ++ return (err < 0) ? err : 0; + } diff --git a/queue-5.4/media-v4l2-dev-fix-error-handling-in-__video_register_device.patch b/queue-5.4/media-v4l2-dev-fix-error-handling-in-__video_register_device.patch new file mode 100644 index 0000000000..78227b4804 --- /dev/null +++ b/queue-5.4/media-v4l2-dev-fix-error-handling-in-__video_register_device.patch @@ -0,0 +1,66 @@ +From 2a934fdb01db6458288fc9386d3d8ceba6dd551a Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Wed, 19 Mar 2025 16:02:48 +0800 +Subject: media: v4l2-dev: fix error handling in __video_register_device() + +From: Ma Ke + +commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a upstream. + +Once device_register() failed, we should call put_device() to +decrement reference count for cleanup. Or it could cause memory leak. +And move callback function v4l2_device_release() and v4l2_device_get() +before put_device(). + +As comment of device_register() says, 'NOTE: _Never_ directly free +@dev after calling this function, even if it returned an error! Always +use put_device() to give up the reference initialized in this function +instead.' + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: dc93a70cc7f9 ("V4L/DVB (9973): v4l2-dev: use the release callback from device instead of cdev") +Signed-off-by: Ma Ke +Reviewed-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/v4l2-core/v4l2-dev.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/media/v4l2-core/v4l2-dev.c ++++ b/drivers/media/v4l2-core/v4l2-dev.c +@@ -1010,25 +1010,25 @@ int __video_register_device(struct video + vdev->dev.class = &video_class; + vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor); + vdev->dev.parent = vdev->dev_parent; ++ vdev->dev.release = v4l2_device_release; + dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num); ++ ++ /* Increase v4l2_device refcount */ ++ v4l2_device_get(vdev->v4l2_dev); ++ + mutex_lock(&videodev_lock); + ret = device_register(&vdev->dev); + if (ret < 0) { + mutex_unlock(&videodev_lock); + pr_err("%s: device_register failed\n", __func__); +- goto cleanup; ++ put_device(&vdev->dev); ++ return ret; + } +- /* Register the release callback that will be called when the last +- reference to the device goes away. */ +- vdev->dev.release = v4l2_device_release; + + if (nr != -1 && nr != vdev->num && warn_if_nr_in_use) + pr_warn("%s: requested %s%d, got %s\n", __func__, + name_base, nr, video_device_node_name(vdev)); + +- /* Increase v4l2_device refcount */ +- v4l2_device_get(vdev->v4l2_dev); +- + /* Part 5: Register the entity. */ + ret = video_register_media_controller(vdev); + diff --git a/queue-5.4/nfsd-nfsd4_spo_must_allow-must-check-this-is-a-v4-compound-request.patch b/queue-5.4/nfsd-nfsd4_spo_must_allow-must-check-this-is-a-v4-compound-request.patch new file mode 100644 index 0000000000..3d2d81891c --- /dev/null +++ b/queue-5.4/nfsd-nfsd4_spo_must_allow-must-check-this-is-a-v4-compound-request.patch @@ -0,0 +1,37 @@ +From 1244f0b2c3cecd3f349a877006e67c9492b41807 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Fri, 28 Mar 2025 11:05:59 +1100 +Subject: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request + +From: NeilBrown + +commit 1244f0b2c3cecd3f349a877006e67c9492b41807 upstream. + +If the request being processed is not a v4 compound request, then +examining the cstate can have undefined results. + +This patch adds a check that the rpc procedure being executed +(rq_procinfo) is the NFSPROC4_COMPOUND procedure. + +Reported-by: Olga Kornievskaia +Cc: stable@vger.kernel.org +Reviewed-by: Jeff Layton +Signed-off-by: NeilBrown +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4proc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -2750,7 +2750,8 @@ bool nfsd4_spo_must_allow(struct svc_rqs + struct nfs4_op_map *allow = &cstate->clp->cl_spo_must_allow; + u32 opiter; + +- if (!cstate->minorversion) ++ if (rqstp->rq_procinfo != &nfsd_version4.vs_proc[NFSPROC4_COMPOUND] || ++ cstate->minorversion == 0) + return false; + + if (cstate->spo_must_allowed == true) diff --git a/queue-5.4/series b/queue-5.4/series index eeb64e06c1..0a7a680902 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -102,3 +102,7 @@ net-usb-aqc111-debug-info-before-sanitation.patch configfs-do-not-override-creating-attribute-file-failure-in-populate_attrs.patch gfs2-move-msleep-to-sleepable-context.patch wifi-p54-prevent-buffer-overflow-in-p54_rx_eeprom_readback.patch +nfsd-nfsd4_spo_must_allow-must-check-this-is-a-v4-compound-request.patch +wifi-rtlwifi-disable-aspm-for-rtl8723be-with-subsystem-id-11ad-1723.patch +media-gspca-add-error-handling-for-stv06xx_read_sensor.patch +media-v4l2-dev-fix-error-handling-in-__video_register_device.patch diff --git a/queue-5.4/wifi-rtlwifi-disable-aspm-for-rtl8723be-with-subsystem-id-11ad-1723.patch b/queue-5.4/wifi-rtlwifi-disable-aspm-for-rtl8723be-with-subsystem-id-11ad-1723.patch new file mode 100644 index 0000000000..c23b4518f1 --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-disable-aspm-for-rtl8723be-with-subsystem-id-11ad-1723.patch @@ -0,0 +1,64 @@ +From 77a6407c6ab240527166fb19ee96e95f5be4d3cd Mon Sep 17 00:00:00 2001 +From: Mingcong Bai +Date: Tue, 22 Apr 2025 14:17:54 +0800 +Subject: wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723 + +From: Mingcong Bai + +commit 77a6407c6ab240527166fb19ee96e95f5be4d3cd upstream. + +RTL8723BE found on some ASUSTek laptops, such as F441U and X555UQ with +subsystem ID 11ad:1723 are known to output large amounts of PCIe AER +errors during and after boot up, causing heavy lags and at times lock-ups: + + pcieport 0000:00:1c.5: AER: Correctable error message received from 0000:00:1c.5 + pcieport 0000:00:1c.5: PCIe Bus Error: severity=Correctable, type=Physical Layer, (Receiver ID) + pcieport 0000:00:1c.5: device [8086:9d15] error status/mask=00000001/00002000 + pcieport 0000:00:1c.5: [ 0] RxErr + +Disable ASPM on this combo as a quirk. + +This patch is a revision of a previous patch (linked below) which +attempted to disable ASPM for RTL8723BE on all Intel Skylake and Kaby Lake +PCIe bridges. I take a more conservative approach as all known reports +point to ASUSTek laptops of these two generations with this particular +wireless card. + +Please note, however, before the rtl8723be finishes probing, the AER +errors remained. After the module finishes probing, all AER errors would +indeed be eliminated, along with heavy lags, poor network throughput, +and/or occasional lock-ups. + +Cc: +Fixes: a619d1abe20c ("rtlwifi: rtl8723be: Add new driver") +Reported-by: Liangliang Zou +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218127 +Link: https://lore.kernel.org/lkml/05390e0b-27fd-4190-971e-e70a498c8221@lwfinger.net/T/ +Tested-by: Liangliang Zou +Signed-off-by: Mingcong Bai +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20250422061755.356535-1-jeffbai@aosc.io +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -155,6 +155,16 @@ static void _rtl_pci_update_default_sett + if (rtlpriv->rtlhal.hw_type == HARDWARE_TYPE_RTL8192SE && + init_aspm == 0x43) + ppsc->support_aspm = false; ++ ++ /* RTL8723BE found on some ASUSTek laptops, such as F441U and ++ * X555UQ with subsystem ID 11ad:1723 are known to output large ++ * amounts of PCIe AER errors during and after boot up, causing ++ * heavy lags, poor network throughput, and occasional lock-ups. ++ */ ++ if (rtlpriv->rtlhal.hw_type == HARDWARE_TYPE_RTL8723BE && ++ (rtlpci->pdev->subsystem_vendor == 0x11ad && ++ rtlpci->pdev->subsystem_device == 0x1723)) ++ ppsc->support_aspm = false; + } + + static bool _rtl_pci_platform_switch_device_pci_aspm(