From: Greg Kroah-Hartman Date: Tue, 17 Jun 2025 15:07:45 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.6.94~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e71786dd73fc1e51322b393dbb1e78dbb81e08bd;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: calipso-unlock-rcu-before-returning-eafnosupport.patch drm-meson-use-1000ull-when-operating-with-mode-clock.patch net-usb-aqc111-debug-info-before-sanitation.patch regulator-dt-bindings-mt6357-drop-fixed-compatible-requirement.patch --- diff --git a/queue-6.6/calipso-unlock-rcu-before-returning-eafnosupport.patch b/queue-6.6/calipso-unlock-rcu-before-returning-eafnosupport.patch new file mode 100644 index 0000000000..928546c94d --- /dev/null +++ b/queue-6.6/calipso-unlock-rcu-before-returning-eafnosupport.patch @@ -0,0 +1,41 @@ +From 3cae906e1a6184cdc9e4d260e4dbdf9a118d94ad Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 4 Jun 2025 13:38:26 +0000 +Subject: calipso: unlock rcu before returning -EAFNOSUPPORT + +From: Eric Dumazet + +commit 3cae906e1a6184cdc9e4d260e4dbdf9a118d94ad upstream. + +syzbot reported that a recent patch forgot to unlock rcu +in the error path. + +Adopt the convention that netlbl_conn_setattr() is already using. + +Fixes: 6e9f2df1c550 ("calipso: Don't call calipso functions for AF_INET sk.") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Kuniyuki Iwashima +Acked-by: Paul Moore +Link: https://patch.msgid.link/20250604133826.1667664-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/netlabel/netlabel_kapi.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -1140,8 +1140,10 @@ int netlbl_conn_setattr(struct sock *sk, + break; + #if IS_ENABLED(CONFIG_IPV6) + case AF_INET6: +- if (sk->sk_family != AF_INET6) +- return -EAFNOSUPPORT; ++ if (sk->sk_family != AF_INET6) { ++ ret_val = -EAFNOSUPPORT; ++ goto conn_setattr_return; ++ } + + addr6 = (struct sockaddr_in6 *)addr; + entry = netlbl_domhsh_getentry_af6(secattr->domain, diff --git a/queue-6.6/drm-meson-use-1000ull-when-operating-with-mode-clock.patch b/queue-6.6/drm-meson-use-1000ull-when-operating-with-mode-clock.patch new file mode 100644 index 0000000000..69e01af9ae --- /dev/null +++ b/queue-6.6/drm-meson-use-1000ull-when-operating-with-mode-clock.patch @@ -0,0 +1,44 @@ +From eb0851e14432f3b87c77b704c835ac376deda03a Mon Sep 17 00:00:00 2001 +From: I Hsin Cheng +Date: Tue, 6 May 2025 02:43:38 +0800 +Subject: drm/meson: Use 1000ULL when operating with mode->clock + +From: I Hsin Cheng + +commit eb0851e14432f3b87c77b704c835ac376deda03a upstream. + +Coverity scan reported the usage of "mode->clock * 1000" may lead to +integer overflow. Use "1000ULL" instead of "1000" +when utilizing it to avoid potential integer overflow issue. + +Link: https://scan5.scan.coverity.com/#/project-view/10074/10063?selectedIssue=1646759 +Signed-off-by: I Hsin Cheng +Reviewed-by: Martin Blumenstingl +Fixes: 1017560164b6 ("drm/meson: use unsigned long long / Hz for frequency types") +Link: https://lore.kernel.org/r/20250505184338.678540-1-richard120310@gmail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/meson/meson_encoder_hdmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/meson/meson_encoder_hdmi.c ++++ b/drivers/gpu/drm/meson/meson_encoder_hdmi.c +@@ -75,7 +75,7 @@ static void meson_encoder_hdmi_set_vclk( + unsigned long long venc_freq; + unsigned long long hdmi_freq; + +- vclk_freq = mode->clock * 1000; ++ vclk_freq = mode->clock * 1000ULL; + + /* For 420, pixel clock is half unlike venc clock */ + if (encoder_hdmi->output_bus_fmt == MEDIA_BUS_FMT_UYYVYY8_0_5X24) +@@ -123,7 +123,7 @@ static enum drm_mode_status meson_encode + struct meson_encoder_hdmi *encoder_hdmi = bridge_to_meson_encoder_hdmi(bridge); + struct meson_drm *priv = encoder_hdmi->priv; + bool is_hdmi2_sink = display_info->hdmi.scdc.supported; +- unsigned long long clock = mode->clock * 1000; ++ unsigned long long clock = mode->clock * 1000ULL; + unsigned long long phy_freq; + unsigned long long vclk_freq; + unsigned long long venc_freq; diff --git a/queue-6.6/net-usb-aqc111-debug-info-before-sanitation.patch b/queue-6.6/net-usb-aqc111-debug-info-before-sanitation.patch new file mode 100644 index 0000000000..e91febb106 --- /dev/null +++ b/queue-6.6/net-usb-aqc111-debug-info-before-sanitation.patch @@ -0,0 +1,51 @@ +From d3faab9b5a6a0477d69c38bd11c43aa5e936f929 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 28 May 2025 13:03:54 +0200 +Subject: net: usb: aqc111: debug info before sanitation + +From: Oliver Neukum + +commit d3faab9b5a6a0477d69c38bd11c43aa5e936f929 upstream. + +If we sanitize error returns, the debug statements need +to come before that so that we don't lose information. + +Signed-off-by: Oliver Neukum +Fixes: 405b0d610745 ("net: usb: aqc111: fix error handling of usbnet read calls") +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/aqc111.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/usb/aqc111.c ++++ b/drivers/net/usb/aqc111.c +@@ -31,11 +31,11 @@ static int aqc111_read_cmd_nopm(struct u + USB_RECIP_DEVICE, value, index, data, size); + + if (unlikely(ret < size)) { +- ret = ret < 0 ? ret : -ENODATA; +- + netdev_warn(dev->net, + "Failed to read(0x%x) reg index 0x%04x: %d\n", + cmd, index, ret); ++ ++ ret = ret < 0 ? ret : -ENODATA; + } + + return ret; +@@ -50,11 +50,11 @@ static int aqc111_read_cmd(struct usbnet + USB_RECIP_DEVICE, value, index, data, size); + + if (unlikely(ret < size)) { +- ret = ret < 0 ? ret : -ENODATA; +- + netdev_warn(dev->net, + "Failed to read(0x%x) reg index 0x%04x: %d\n", + cmd, index, ret); ++ ++ ret = ret < 0 ? ret : -ENODATA; + } + + return ret; diff --git a/queue-6.6/regulator-dt-bindings-mt6357-drop-fixed-compatible-requirement.patch b/queue-6.6/regulator-dt-bindings-mt6357-drop-fixed-compatible-requirement.patch new file mode 100644 index 0000000000..781143f7a6 --- /dev/null +++ b/queue-6.6/regulator-dt-bindings-mt6357-drop-fixed-compatible-requirement.patch @@ -0,0 +1,124 @@ +From 9cfdd7752ba5f8cc9b8191e8c9aeeec246241fa4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?N=C3=ADcolas=20F=2E=20R=2E=20A=2E=20Prado?= + +Date: Wed, 14 May 2025 08:36:06 -0400 +Subject: regulator: dt-bindings: mt6357: Drop fixed compatible requirement +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +commit 9cfdd7752ba5f8cc9b8191e8c9aeeec246241fa4 upstream. + +Some of the regulators on the MT6357 PMIC currently reference the +fixed-regulator dt-binding, which enforces the presence of a +regulator-fixed compatible. However since all regulators on the MT6357 +PMIC are handled by a single mt6357-regulator driver, probed through +MFD, the compatibles don't serve any purpose. In fact they cause +failures in the DT kselftest since they aren't probed by the fixed +regulator driver as would be expected. Furthermore this is the only +dt-binding in this family like this: mt6359-regulator and +mt6358-regulator don't require those compatibles. + +Commit d77e89b7b03f ("arm64: dts: mediatek: mt6357: Drop regulator-fixed +compatibles") removed the compatibles from Devicetree, but missed +updating the binding, which still requires them, introducing dt-binding +errors. Remove the compatible requirement by referencing the plain +regulator dt-binding instead to fix the dt-binding errors. + +Fixes: d77e89b7b03f ("arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles") +Signed-off-by: Nícolas F. R. A. Prado +Link: https://patch.msgid.link/20250514-mt6357-regulator-fixed-compatibles-removal-bindings-v1-1-2421e9cc6cc7@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml | 12 ---------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +--- a/Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml ++++ b/Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml +@@ -33,7 +33,7 @@ patternProperties: + + "^ldo-v(camio18|aud28|aux18|io18|io28|rf12|rf18|cn18|cn28|fe28)$": + type: object +- $ref: fixed-regulator.yaml# ++ $ref: regulator.yaml# + unevaluatedProperties: false + description: + Properties for single fixed LDO regulator. +@@ -112,7 +112,6 @@ examples: + regulator-enable-ramp-delay = <220>; + }; + mt6357_vfe28_reg: ldo-vfe28 { +- compatible = "regulator-fixed"; + regulator-name = "vfe28"; + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; +@@ -125,14 +124,12 @@ examples: + regulator-enable-ramp-delay = <110>; + }; + mt6357_vrf18_reg: ldo-vrf18 { +- compatible = "regulator-fixed"; + regulator-name = "vrf18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-enable-ramp-delay = <110>; + }; + mt6357_vrf12_reg: ldo-vrf12 { +- compatible = "regulator-fixed"; + regulator-name = "vrf12"; + regulator-min-microvolt = <1200000>; + regulator-max-microvolt = <1200000>; +@@ -157,14 +154,12 @@ examples: + regulator-enable-ramp-delay = <264>; + }; + mt6357_vcn28_reg: ldo-vcn28 { +- compatible = "regulator-fixed"; + regulator-name = "vcn28"; + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; + regulator-enable-ramp-delay = <264>; + }; + mt6357_vcn18_reg: ldo-vcn18 { +- compatible = "regulator-fixed"; + regulator-name = "vcn18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -183,7 +178,6 @@ examples: + regulator-enable-ramp-delay = <264>; + }; + mt6357_vcamio_reg: ldo-vcamio18 { +- compatible = "regulator-fixed"; + regulator-name = "vcamio"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; +@@ -212,28 +206,24 @@ examples: + regulator-always-on; + }; + mt6357_vaux18_reg: ldo-vaux18 { +- compatible = "regulator-fixed"; + regulator-name = "vaux18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-enable-ramp-delay = <264>; + }; + mt6357_vaud28_reg: ldo-vaud28 { +- compatible = "regulator-fixed"; + regulator-name = "vaud28"; + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; + regulator-enable-ramp-delay = <264>; + }; + mt6357_vio28_reg: ldo-vio28 { +- compatible = "regulator-fixed"; + regulator-name = "vio28"; + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; + regulator-enable-ramp-delay = <264>; + }; + mt6357_vio18_reg: ldo-vio18 { +- compatible = "regulator-fixed"; + regulator-name = "vio18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; diff --git a/queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch b/queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch deleted file mode 100644 index a7ac0bf51a..0000000000 --- a/queue-6.6/serial-sh-sci-increment-the-runtime-usage-counter-fo.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 124c1b6097fb77fa32c2202976d004cf8d9269a1 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 11 Jun 2025 08:05:52 +0300 -Subject: serial: sh-sci: Increment the runtime usage counter for the earlycon - device - -From: Claudiu Beznea - -commit 651dee03696e1dfde6d9a7e8664bbdcd9a10ea7f upstream. - -In the sh-sci driver, serial ports are mapped to the sci_ports[] array, -with earlycon mapped at index zero. - -The uart_add_one_port() function eventually calls __device_attach(), -which, in turn, calls pm_request_idle(). The identified code path is as -follows: - -uart_add_one_port() -> - serial_ctrl_register_port() -> - serial_core_register_port() -> - serial_core_port_device_add() -> - serial_base_port_add() -> - device_add() -> - bus_probe_device() -> - device_initial_probe() -> - __device_attach() -> - // ... - if (dev->p->dead) { - // ... - } else if (dev->driver) { - // ... - } else { - // ... - pm_request_idle(dev); - // ... - } - -The earlycon device clocks are enabled by the bootloader. However, the -pm_request_idle() call in __device_attach() disables the SCI port clocks -while earlycon is still active. - -The earlycon write function, serial_console_write(), calls -sci_poll_put_char() via serial_console_putchar(). If the SCI port clocks -are disabled, writing to earlycon may sometimes cause the SR.TDFE bit to -remain unset indefinitely, causing the while loop in sci_poll_put_char() -to never exit. On single-core SoCs, this can result in the system being -blocked during boot when this issue occurs. - -To resolve this, increment the runtime PM usage counter for the earlycon -SCI device before registering the UART port. - -Fixes: 0b0cced19ab1 ("serial: sh-sci: Add CONFIG_SERIAL_EARLYCON support") -Cc: stable@vger.kernel.org -Signed-off-by: Claudiu Beznea -Link: https://lore.kernel.org/r/20250116182249.3828577-6-claudiu.beznea.uj@bp.renesas.com -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Claudiu Beznea -Signed-off-by: Sasha Levin ---- - drivers/tty/serial/sh-sci.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index be7e57e1d1e36..dab5658d9d54a 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -3424,6 +3424,22 @@ static int sci_probe_single(struct platform_device *dev, - } - - if (sci_uart_earlycon && sci_ports[0].port.mapbase == sci_res->start) { -+ /* -+ * In case: -+ * - this is the earlycon port (mapped on index 0 in sci_ports[]) and -+ * - it now maps to an alias other than zero and -+ * - the earlycon is still alive (e.g., "earlycon keep_bootcon" is -+ * available in bootargs) -+ * -+ * we need to avoid disabling clocks and PM domains through the runtime -+ * PM APIs called in __device_attach(). For this, increment the runtime -+ * PM reference counter (the clocks and PM domains were already enabled -+ * by the bootloader). Otherwise the earlycon may access the HW when it -+ * has no clocks enabled leading to failures (infinite loop in -+ * sci_poll_put_char()). -+ */ -+ pm_runtime_get_noresume(&dev->dev); -+ - /* - * Skip cleanup the sci_port[0] in early_console_exit(), this - * port is the same as the earlycon one. --- -2.39.5 - diff --git a/queue-6.6/series b/queue-6.6/series index 1e1f1f631f..49f8e190a9 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -287,7 +287,6 @@ arm64-dts-ti-k3-j721e-sk-add-dt-nodes-for-power-regu.patch serial-sh-sci-check-if-tx-data-was-written-to-device.patch serial-sh-sci-move-runtime-pm-enable-to-sci_probe_si.patch serial-sh-sci-clean-sci_ports-0-after-at-earlycon-ex.patch -serial-sh-sci-increment-the-runtime-usage-counter-fo.patch scsi-core-ufs-fix-a-hang-in-the-error-handler.patch bluetooth-hci_core-fix-list_for_each_entry_rcu-usage.patch bluetooth-mgmt-fix-uaf-on-mgmt_remove_adv_monitor_co.patch @@ -351,3 +350,7 @@ usb-flush-altsetting-0-endpoints-before-reinitializating-them-after-reset.patch usb-typec-tcpm-tcpci_maxim-fix-bounds-check-in-process_rx.patch xen-arm-call-uaccess_ttbr0_enable-for-dm_op-hypercall.patch x86-iopl-cure-tif_io_bitmap-inconsistencies.patch +calipso-unlock-rcu-before-returning-eafnosupport.patch +regulator-dt-bindings-mt6357-drop-fixed-compatible-requirement.patch +net-usb-aqc111-debug-info-before-sanitation.patch +drm-meson-use-1000ull-when-operating-with-mode-clock.patch