From: Greg Kroah-Hartman Date: Mon, 10 Mar 2025 10:52:15 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v5.4.291~64 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e220fb7ca965b989f1cf6d35d1780744a4ded850;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: bus-mhi-host-pci_generic-use-pci_try_reset_function-to-avoid-deadlock.patch drivers-virt-acrn-hsm-use-kzalloc-to-avoid-info-leak-in-pmcmd_ioctl.patch eeprom-digsy_mtc-make-gpio-lookup-table-match-the-device.patch intel_th-pci-add-arrow-lake-support.patch intel_th-pci-add-panther-lake-h-support.patch intel_th-pci-add-panther-lake-p-u-support.patch mei-me-add-panther-lake-p-did.patch slimbus-messaging-free-transaction-id-in-delayed-interrupt-scenario.patch --- diff --git a/queue-5.15/bus-mhi-host-pci_generic-use-pci_try_reset_function-to-avoid-deadlock.patch b/queue-5.15/bus-mhi-host-pci_generic-use-pci_try_reset_function-to-avoid-deadlock.patch new file mode 100644 index 0000000000..132875087d --- /dev/null +++ b/queue-5.15/bus-mhi-host-pci_generic-use-pci_try_reset_function-to-avoid-deadlock.patch @@ -0,0 +1,69 @@ +From a321d163de3d8aa38a6449ab2becf4b1581aed96 Mon Sep 17 00:00:00 2001 +From: Manivannan Sadhasivam +Date: Wed, 8 Jan 2025 19:09:27 +0530 +Subject: bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock + +From: Manivannan Sadhasivam + +commit a321d163de3d8aa38a6449ab2becf4b1581aed96 upstream. + +There are multiple places from where the recovery work gets scheduled +asynchronously. Also, there are multiple places where the caller waits +synchronously for the recovery to be completed. One such place is during +the PM shutdown() callback. + +If the device is not alive during recovery_work, it will try to reset the +device using pci_reset_function(). This function internally will take the +device_lock() first before resetting the device. By this time, if the lock +has already been acquired, then recovery_work will get stalled while +waiting for the lock. And if the lock was already acquired by the caller +which waits for the recovery_work to be completed, it will lead to +deadlock. + +This is what happened on the X1E80100 CRD device when the device died +before shutdown() callback. Driver core calls the driver's shutdown() +callback while holding the device_lock() leading to deadlock. + +And this deadlock scenario can occur on other paths as well, like during +the PM suspend() callback, where the driver core would hold the +device_lock() before calling driver's suspend() callback. And if the +recovery_work was already started, it could lead to deadlock. This is also +observed on the X1E80100 CRD. + +So to fix both issues, use pci_try_reset_function() in recovery_work. This +function first checks for the availability of the device_lock() before +trying to reset the device. If the lock is available, it will acquire it +and reset the device. Otherwise, it will return -EAGAIN. If that happens, +recovery_work will fail with the error message "Recovery failed" as not +much could be done. + +Cc: stable@vger.kernel.org # 5.12 +Reported-by: Johan Hovold +Closes: https://lore.kernel.org/mhi/Z1me8iaK7cwgjL92@hovoldconsulting.com +Fixes: 7389337f0a78 ("mhi: pci_generic: Add suspend/resume/recovery procedure") +Reviewed-by: Johan Hovold +Tested-by: Johan Hovold +Analyzed-by: Johan Hovold +Link: https://lore.kernel.org/mhi/Z2KKjWY2mPen6GPL@hovoldconsulting.com/ +Reviewed-by: Loic Poulain +Link: https://lore.kernel.org/r/20250108-mhi_recovery_fix-v1-1-a0a00a17da46@linaro.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/mhi/host/pci_generic.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/bus/mhi/host/pci_generic.c ++++ b/drivers/bus/mhi/host/pci_generic.c +@@ -732,8 +732,9 @@ static void mhi_pci_recovery_work(struct + err_unprepare: + mhi_unprepare_after_power_down(mhi_cntrl); + err_try_reset: +- if (pci_reset_function(pdev)) +- dev_err(&pdev->dev, "Recovery failed\n"); ++ err = pci_try_reset_function(pdev); ++ if (err) ++ dev_err(&pdev->dev, "Recovery failed: %d\n", err); + } + + static void health_check(struct timer_list *t) diff --git a/queue-5.15/drivers-virt-acrn-hsm-use-kzalloc-to-avoid-info-leak-in-pmcmd_ioctl.patch b/queue-5.15/drivers-virt-acrn-hsm-use-kzalloc-to-avoid-info-leak-in-pmcmd_ioctl.patch new file mode 100644 index 0000000000..cbf819d0d1 --- /dev/null +++ b/queue-5.15/drivers-virt-acrn-hsm-use-kzalloc-to-avoid-info-leak-in-pmcmd_ioctl.patch @@ -0,0 +1,54 @@ +From 819cec1dc47cdeac8f5dd6ba81c1dbee2a68c3bb Mon Sep 17 00:00:00 2001 +From: Haoyu Li +Date: Thu, 30 Jan 2025 19:58:11 +0800 +Subject: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl + +From: Haoyu Li + +commit 819cec1dc47cdeac8f5dd6ba81c1dbee2a68c3bb upstream. + +In the "pmcmd_ioctl" function, three memory objects allocated by +kmalloc are initialized by "hcall_get_cpu_state", which are then +copied to user space. The initializer is indeed implemented in +"acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of +information leakage due to uninitialized bytes. + +Fixes: 3d679d5aec64 ("virt: acrn: Introduce interfaces to query C-states and P-states allowed by hypervisor") +Signed-off-by: Haoyu Li +Cc: stable +Acked-by: Fei Li +Link: https://lore.kernel.org/r/20250130115811.92424-1-lihaoyu499@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/virt/acrn/hsm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/virt/acrn/hsm.c ++++ b/drivers/virt/acrn/hsm.c +@@ -49,7 +49,7 @@ static int pmcmd_ioctl(u64 cmd, void __u + switch (cmd & PMCMD_TYPE_MASK) { + case ACRN_PMCMD_GET_PX_CNT: + case ACRN_PMCMD_GET_CX_CNT: +- pm_info = kmalloc(sizeof(u64), GFP_KERNEL); ++ pm_info = kzalloc(sizeof(u64), GFP_KERNEL); + if (!pm_info) + return -ENOMEM; + +@@ -64,7 +64,7 @@ static int pmcmd_ioctl(u64 cmd, void __u + kfree(pm_info); + break; + case ACRN_PMCMD_GET_PX_DATA: +- px_data = kmalloc(sizeof(*px_data), GFP_KERNEL); ++ px_data = kzalloc(sizeof(*px_data), GFP_KERNEL); + if (!px_data) + return -ENOMEM; + +@@ -79,7 +79,7 @@ static int pmcmd_ioctl(u64 cmd, void __u + kfree(px_data); + break; + case ACRN_PMCMD_GET_CX_DATA: +- cx_data = kmalloc(sizeof(*cx_data), GFP_KERNEL); ++ cx_data = kzalloc(sizeof(*cx_data), GFP_KERNEL); + if (!cx_data) + return -ENOMEM; + diff --git a/queue-5.15/eeprom-digsy_mtc-make-gpio-lookup-table-match-the-device.patch b/queue-5.15/eeprom-digsy_mtc-make-gpio-lookup-table-match-the-device.patch new file mode 100644 index 0000000000..356e2357fc --- /dev/null +++ b/queue-5.15/eeprom-digsy_mtc-make-gpio-lookup-table-match-the-device.patch @@ -0,0 +1,35 @@ +From 038ef0754aae76f79b147b8867f9250e6a976872 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Fri, 7 Feb 2025 00:03:11 +0200 +Subject: eeprom: digsy_mtc: Make GPIO lookup table match the device + +From: Andy Shevchenko + +commit 038ef0754aae76f79b147b8867f9250e6a976872 upstream. + +The dev_id value in the GPIO lookup table must match to +the device instance name, which in this case is combined +of name and platform device ID, i.e. "spi_gpio.1". But +the table assumed that there was no platform device ID +defined, which is wrong. Fix the dev_id value accordingly. + +Fixes: 9b00bc7b901f ("spi: spi-gpio: Rewrite to use GPIO descriptors") +Cc: stable +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20250206220311.1554075-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/eeprom/digsy_mtc_eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/eeprom/digsy_mtc_eeprom.c ++++ b/drivers/misc/eeprom/digsy_mtc_eeprom.c +@@ -60,7 +60,7 @@ static struct platform_device digsy_mtc_ + }; + + static struct gpiod_lookup_table eeprom_spi_gpiod_table = { +- .dev_id = "spi_gpio", ++ .dev_id = "spi_gpio.1", + .table = { + GPIO_LOOKUP("gpio@b00", GPIO_EEPROM_CLK, + "sck", GPIO_ACTIVE_HIGH), diff --git a/queue-5.15/intel_th-pci-add-arrow-lake-support.patch b/queue-5.15/intel_th-pci-add-arrow-lake-support.patch new file mode 100644 index 0000000000..05c2bb4c7a --- /dev/null +++ b/queue-5.15/intel_th-pci-add-arrow-lake-support.patch @@ -0,0 +1,35 @@ +From b5edccae9f447a92d475267d94c33f4926963eec Mon Sep 17 00:00:00 2001 +From: Pawel Chmielewski +Date: Tue, 11 Feb 2025 20:50:15 +0200 +Subject: intel_th: pci: Add Arrow Lake support + +From: Pawel Chmielewski + +commit b5edccae9f447a92d475267d94c33f4926963eec upstream. + +Add support for the Trace Hub in Arrow Lake. + +Signed-off-by: Pawel Chmielewski +Signed-off-by: Alexander Shishkin +Reviewed-by: Andy Shevchenko +Cc: stable@kernel.org +Link: https://lore.kernel.org/r/20250211185017.1759193-4-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/intel_th/pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -330,6 +330,11 @@ static const struct pci_device_id intel_ + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + { ++ /* Arrow Lake */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7724), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { + /* Alder Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f), + .driver_data = (kernel_ulong_t)&intel_th_2x, diff --git a/queue-5.15/intel_th-pci-add-panther-lake-h-support.patch b/queue-5.15/intel_th-pci-add-panther-lake-h-support.patch new file mode 100644 index 0000000000..748e3ae9e7 --- /dev/null +++ b/queue-5.15/intel_th-pci-add-panther-lake-h-support.patch @@ -0,0 +1,34 @@ +From a70034d6c0d5f3cdee40bb00a578e17fd2ebe426 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Tue, 11 Feb 2025 20:50:16 +0200 +Subject: intel_th: pci: Add Panther Lake-H support + +From: Alexander Shishkin + +commit a70034d6c0d5f3cdee40bb00a578e17fd2ebe426 upstream. + +Add support for the Trace Hub in Panther Lake-H. + +Signed-off-by: Alexander Shishkin +Reviewed-by: Andy Shevchenko +Cc: stable@kernel.org +Link: https://lore.kernel.org/r/20250211185017.1759193-5-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/intel_th/pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -335,6 +335,11 @@ static const struct pci_device_id intel_ + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + { ++ /* Panther Lake-H */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe324), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { + /* Alder Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f), + .driver_data = (kernel_ulong_t)&intel_th_2x, diff --git a/queue-5.15/intel_th-pci-add-panther-lake-p-u-support.patch b/queue-5.15/intel_th-pci-add-panther-lake-p-u-support.patch new file mode 100644 index 0000000000..98128db206 --- /dev/null +++ b/queue-5.15/intel_th-pci-add-panther-lake-p-u-support.patch @@ -0,0 +1,34 @@ +From 49114ff05770264ae233f50023fc64a719a9dcf9 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Tue, 11 Feb 2025 20:50:17 +0200 +Subject: intel_th: pci: Add Panther Lake-P/U support + +From: Alexander Shishkin + +commit 49114ff05770264ae233f50023fc64a719a9dcf9 upstream. + +Add support for the Trace Hub in Panther Lake-P/U. + +Signed-off-by: Alexander Shishkin +Reviewed-by: Andy Shevchenko +Cc: stable@kernel.org +Link: https://lore.kernel.org/r/20250211185017.1759193-6-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/intel_th/pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -340,6 +340,11 @@ static const struct pci_device_id intel_ + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + { ++ /* Panther Lake-P/U */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xe424), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, ++ { + /* Alder Lake CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f), + .driver_data = (kernel_ulong_t)&intel_th_2x, diff --git a/queue-5.15/mei-me-add-panther-lake-p-did.patch b/queue-5.15/mei-me-add-panther-lake-p-did.patch new file mode 100644 index 0000000000..1b35054260 --- /dev/null +++ b/queue-5.15/mei-me-add-panther-lake-p-did.patch @@ -0,0 +1,44 @@ +From a8e8ffcc3afce2ee5fb70162aeaef3f03573ee1e Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Sun, 9 Feb 2025 13:05:50 +0200 +Subject: mei: me: add panther lake P DID + +From: Alexander Usyskin + +commit a8e8ffcc3afce2ee5fb70162aeaef3f03573ee1e upstream. + +Add Panther Lake P device id. + +Cc: stable +Co-developed-by: Tomas Winkler +Signed-off-by: Tomas Winkler +Signed-off-by: Alexander Usyskin +Link: https://lore.kernel.org/r/20250209110550.1582982-1-alexander.usyskin@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/hw-me-regs.h | 2 ++ + drivers/misc/mei/pci-me.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -117,6 +117,8 @@ + + #define MEI_DEV_ID_LNL_M 0xA870 /* Lunar Lake Point M */ + ++#define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */ ++ + /* + * MEI HW Section + */ +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -123,6 +123,8 @@ static const struct pci_device_id mei_me + + {MEI_PCI_DEVICE(MEI_DEV_ID_LNL_M, MEI_ME_PCH15_CFG)}, + ++ {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)}, ++ + /* required last entry */ + {0, } + }; diff --git a/queue-5.15/series b/queue-5.15/series index 2cb44500b6..a2bad42962 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -604,3 +604,11 @@ kbuild-userprogs-use-correct-lld-when-linking-through-clang.patch xhci-pci-fix-indentation-in-the-pci-device-id-definitions.patch usb-xhci-enable-the-trb-overfetch-quirk-on-via-vl805.patch squashfs-check-the-inode-number-is-not-the-invalid-value-of-zero.patch +mei-me-add-panther-lake-p-did.patch +intel_th-pci-add-arrow-lake-support.patch +intel_th-pci-add-panther-lake-h-support.patch +intel_th-pci-add-panther-lake-p-u-support.patch +slimbus-messaging-free-transaction-id-in-delayed-interrupt-scenario.patch +bus-mhi-host-pci_generic-use-pci_try_reset_function-to-avoid-deadlock.patch +eeprom-digsy_mtc-make-gpio-lookup-table-match-the-device.patch +drivers-virt-acrn-hsm-use-kzalloc-to-avoid-info-leak-in-pmcmd_ioctl.patch diff --git a/queue-5.15/slimbus-messaging-free-transaction-id-in-delayed-interrupt-scenario.patch b/queue-5.15/slimbus-messaging-free-transaction-id-in-delayed-interrupt-scenario.patch new file mode 100644 index 0000000000..f326806a4b --- /dev/null +++ b/queue-5.15/slimbus-messaging-free-transaction-id-in-delayed-interrupt-scenario.patch @@ -0,0 +1,55 @@ +From dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a Mon Sep 17 00:00:00 2001 +From: Visweswara Tanuku +Date: Fri, 24 Jan 2025 04:57:40 -0800 +Subject: slimbus: messaging: Free transaction ID in delayed interrupt scenario + +From: Visweswara Tanuku + +commit dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a upstream. + +In case of interrupt delay for any reason, slim_do_transfer() +returns timeout error but the transaction ID (TID) is not freed. +This results into invalid memory access inside +qcom_slim_ngd_rx_msgq_cb() due to invalid TID. + +Fix the issue by freeing the TID in slim_do_transfer() before +returning timeout error to avoid invalid memory access. + +Call trace: +__memcpy_fromio+0x20/0x190 +qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] +vchan_complete+0x2a0/0x4a0 +tasklet_action_common+0x274/0x700 +tasklet_action+0x28/0x3c +_stext+0x188/0x620 +run_ksoftirqd+0x34/0x74 +smpboot_thread_fn+0x1d8/0x464 +kthread+0x178/0x238 +ret_from_fork+0x10/0x20 +Code: aa0003e8 91000429 f100044a 3940002b (3800150b) +---[ end trace 0fe00bec2b975c99 ]--- +Kernel panic - not syncing: Oops: Fatal exception in interrupt. + +Fixes: afbdcc7c384b ("slimbus: Add messaging APIs to slimbus framework") +Cc: stable +Signed-off-by: Visweswara Tanuku +Link: https://lore.kernel.org/r/20250124125740.16897-1-quic_vtanuku@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/slimbus/messaging.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/slimbus/messaging.c ++++ b/drivers/slimbus/messaging.c +@@ -147,8 +147,9 @@ int slim_do_transfer(struct slim_control + } + + ret = ctrl->xfer_msg(ctrl, txn); +- +- if (!ret && need_tid && !txn->msg->comp) { ++ if (ret == -ETIMEDOUT) { ++ slim_free_txn_tid(ctrl, txn); ++ } else if (!ret && need_tid && !txn->msg->comp) { + unsigned long ms = txn->rl + HZ; + + timeout = wait_for_completion_timeout(txn->comp,