From: Sasha Levin Date: Thu, 14 Nov 2024 12:39:19 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v4.19.324~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f4679846c1ae55de13b0ee3a20567b96bff1cabb;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/9p-avoid-creating-multiple-slab-caches-with-the-same.patch b/queue-5.15/9p-avoid-creating-multiple-slab-caches-with-the-same.patch new file mode 100644 index 00000000000..2e49f4abead --- /dev/null +++ b/queue-5.15/9p-avoid-creating-multiple-slab-caches-with-the-same.patch @@ -0,0 +1,62 @@ +From 46368c5b195c3396e2875f8525d72f35924df243 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Aug 2024 10:47:25 +0100 +Subject: 9p: Avoid creating multiple slab caches with the same name + +From: Pedro Falcato + +[ Upstream commit 79efebae4afc2221fa814c3cae001bede66ab259 ] + +In the spirit of [1], avoid creating multiple slab caches with the same +name. Instead, add the dev_name into the mix. + +[1]: https://lore.kernel.org/all/20240807090746.2146479-1-pedro.falcato@gmail.com/ + +Signed-off-by: Pedro Falcato +Reported-by: syzbot+3c5d43e97993e1fa612b@syzkaller.appspotmail.com +Message-ID: <20240807094725.2193423-1-pedro.falcato@gmail.com> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/client.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/net/9p/client.c b/net/9p/client.c +index bf29462c919bb..03fb36d938c70 100644 +--- a/net/9p/client.c ++++ b/net/9p/client.c +@@ -1005,6 +1005,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) + int err; + struct p9_client *clnt; + char *client_id; ++ char *cache_name; + + err = 0; + clnt = kmalloc(sizeof(*clnt), GFP_KERNEL); +@@ -1057,15 +1058,22 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) + if (err) + goto close_trans; + ++ cache_name = kasprintf(GFP_KERNEL, "9p-fcall-cache-%s", dev_name); ++ if (!cache_name) { ++ err = -ENOMEM; ++ goto close_trans; ++ } ++ + /* P9_HDRSZ + 4 is the smallest packet header we can have that is + * followed by data accessed from userspace by read + */ + clnt->fcall_cache = +- kmem_cache_create_usercopy("9p-fcall-cache", clnt->msize, ++ kmem_cache_create_usercopy(cache_name, clnt->msize, + 0, 0, P9_HDRSZ + 4, + clnt->msize - (P9_HDRSZ + 4), + NULL); + ++ kfree(cache_name); + return clnt; + + close_trans: +-- +2.43.0 + diff --git a/queue-5.15/block-fix-elevator_get_default-checking-for-null-q-t.patch b/queue-5.15/block-fix-elevator_get_default-checking-for-null-q-t.patch new file mode 100644 index 00000000000..e65c0384686 --- /dev/null +++ b/queue-5.15/block-fix-elevator_get_default-checking-for-null-q-t.patch @@ -0,0 +1,50 @@ +From 978bde441010d035e726eb8f132eefcefa626dcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 16:44:16 +0530 +Subject: block: Fix elevator_get_default() checking for NULL q->tag_set + +From: SurajSonawane2415 + +[ Upstream commit b402328a24ee7193a8ab84277c0c90ae16768126 ] + +elevator_get_default() and elv_support_iosched() both check for whether +or not q->tag_set is non-NULL, however it's not possible for them to be +NULL. This messes up some static checkers, as the checking of tag_set +isn't consistent. + +Remove the checks, which both simplifies the logic and avoids checker +errors. + +Signed-off-by: SurajSonawane2415 +Link: https://lore.kernel.org/r/20241007111416.13814-1-surajsonawane0215@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/elevator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/block/elevator.c b/block/elevator.c +index 1b5e57f6115f3..a98e8356f1b87 100644 +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -620,7 +620,7 @@ int elevator_switch_mq(struct request_queue *q, + static inline bool elv_support_iosched(struct request_queue *q) + { + if (!queue_is_mq(q) || +- (q->tag_set && (q->tag_set->flags & BLK_MQ_F_NO_SCHED))) ++ (q->tag_set->flags & BLK_MQ_F_NO_SCHED)) + return false; + return true; + } +@@ -631,7 +631,7 @@ static inline bool elv_support_iosched(struct request_queue *q) + */ + static struct elevator_type *elevator_get_default(struct request_queue *q) + { +- if (q->tag_set && q->tag_set->flags & BLK_MQ_F_NO_SCHED_BY_DEFAULT) ++ if (q->tag_set->flags & BLK_MQ_F_NO_SCHED_BY_DEFAULT) + return NULL; + + if (q->nr_hw_queues != 1 && +-- +2.43.0 + diff --git a/queue-5.15/bpf-use-kvzmalloc-to-allocate-bpf-verifier-environme.patch b/queue-5.15/bpf-use-kvzmalloc-to-allocate-bpf-verifier-environme.patch new file mode 100644 index 00000000000..12b89c71172 --- /dev/null +++ b/queue-5.15/bpf-use-kvzmalloc-to-allocate-bpf-verifier-environme.patch @@ -0,0 +1,52 @@ +From 40e14beed57c0f0ce7865d5bf9d323141eda52df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 17:07:35 -0400 +Subject: bpf: use kvzmalloc to allocate BPF verifier environment + +From: Rik van Riel + +[ Upstream commit 434247637c66e1be2bc71a9987d4c3f0d8672387 ] + +The kzmalloc call in bpf_check can fail when memory is very fragmented, +which in turn can lead to an OOM kill. + +Use kvzmalloc to fall back to vmalloc when memory is too fragmented to +allocate an order 3 sized bpf verifier environment. + +Admittedly this is not a very common case, and only happens on systems +where memory has already been squeezed close to the limit, but this does +not seem like much of a hot path, and it's a simple enough fix. + +Signed-off-by: Rik van Riel +Reviewed-by: Shakeel Butt +Link: https://lore.kernel.org/r/20241008170735.16766766@imladris.surriel.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 88b38db5f626d..e29c0581f93ad 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -14013,7 +14013,7 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr) + /* 'struct bpf_verifier_env' can be global, but since it's not small, + * allocate/free it every time bpf_check() is called + */ +- env = kzalloc(sizeof(struct bpf_verifier_env), GFP_KERNEL); ++ env = kvzalloc(sizeof(struct bpf_verifier_env), GFP_KERNEL); + if (!env) + return -ENOMEM; + log = &env->log; +@@ -14228,6 +14228,6 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr) + mutex_unlock(&bpf_verifier_lock); + vfree(env->insn_aux_data); + err_free_env: +- kfree(env); ++ kvfree(env); + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/crypto-marvell-cesa-disable-hash-algorithms.patch b/queue-5.15/crypto-marvell-cesa-disable-hash-algorithms.patch new file mode 100644 index 00000000000..e0a418c8dfa --- /dev/null +++ b/queue-5.15/crypto-marvell-cesa-disable-hash-algorithms.patch @@ -0,0 +1,81 @@ +From dfe03c1b3cf2fcbda38632dc3c34432bbde28f93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 16:38:48 +0800 +Subject: crypto: marvell/cesa - Disable hash algorithms + +From: Herbert Xu + +[ Upstream commit e845d2399a00f866f287e0cefbd4fc7d8ef0d2f7 ] + +Disable cesa hash algorithms by lowering the priority because they +appear to be broken when invoked in parallel. This allows them to +still be tested for debugging purposes. + +Reported-by: Klaus Kudielka +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/cesa/hash.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/marvell/cesa/hash.c b/drivers/crypto/marvell/cesa/hash.c +index c72b0672fc710..84c1065092796 100644 +--- a/drivers/crypto/marvell/cesa/hash.c ++++ b/drivers/crypto/marvell/cesa/hash.c +@@ -947,7 +947,7 @@ struct ahash_alg mv_md5_alg = { + .base = { + .cra_name = "md5", + .cra_driver_name = "mv-md5", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1018,7 +1018,7 @@ struct ahash_alg mv_sha1_alg = { + .base = { + .cra_name = "sha1", + .cra_driver_name = "mv-sha1", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1092,7 +1092,7 @@ struct ahash_alg mv_sha256_alg = { + .base = { + .cra_name = "sha256", + .cra_driver_name = "mv-sha256", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1327,7 +1327,7 @@ struct ahash_alg mv_ahmac_md5_alg = { + .base = { + .cra_name = "hmac(md5)", + .cra_driver_name = "mv-hmac-md5", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1398,7 +1398,7 @@ struct ahash_alg mv_ahmac_sha1_alg = { + .base = { + .cra_name = "hmac(sha1)", + .cra_driver_name = "mv-hmac-sha1", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +@@ -1469,7 +1469,7 @@ struct ahash_alg mv_ahmac_sha256_alg = { + .base = { + .cra_name = "hmac(sha256)", + .cra_driver_name = "mv-hmac-sha256", +- .cra_priority = 300, ++ .cra_priority = 0, + .cra_flags = CRYPTO_ALG_ASYNC | + CRYPTO_ALG_ALLOCATES_MEMORY | + CRYPTO_ALG_KERN_DRIVER_ONLY, +-- +2.43.0 + diff --git a/queue-5.15/drm-vmwgfx-limit-display-layout-ioctl-array-size-to-.patch b/queue-5.15/drm-vmwgfx-limit-display-layout-ioctl-array-size-to-.patch new file mode 100644 index 00000000000..87e294a970c --- /dev/null +++ b/queue-5.15/drm-vmwgfx-limit-display-layout-ioctl-array-size-to-.patch @@ -0,0 +1,87 @@ +From 517f786fa61ae8e3c71c768850aafad6fce76c8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2024 15:06:34 -0500 +Subject: drm/vmwgfx: Limit display layout ioctl array size to + VMWGFX_NUM_DISPLAY_UNITS + +From: Ian Forbes + +[ Upstream commit 28a5dfd4f615539fb22fb6d5c219c199c14e6eb6 ] + +Currently the array size is only limited by the largest kmalloc size which +is incorrect. This change will also return a more specific error message +than ENOMEM to userspace. + +Signed-off-by: Ian Forbes +Reviewed-by: Zack Rusin +Reviewed-by: Martin Krastev +Signed-off-by: Zack Rusin +Link: https://patchwork.freedesktop.org/patch/msgid/20240808200634.1074083-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 ++-- + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 4 +++- + drivers/gpu/drm/vmwgfx/vmwgfx_kms.h | 3 --- + 3 files changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +index 7bb7a69321d30..9c60bb2aefe1f 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -59,7 +59,7 @@ + #define VMWGFX_DRIVER_MINOR 19 + #define VMWGFX_DRIVER_PATCHLEVEL 0 + #define VMWGFX_FIFO_STATIC_SIZE (1024*1024) +-#define VMWGFX_MAX_DISPLAYS 16 ++#define VMWGFX_NUM_DISPLAY_UNITS 8 + #define VMWGFX_CMD_BOUNCE_INIT_SIZE 32768 + + #define VMWGFX_PCI_ID_SVGA2 0x0405 +@@ -71,7 +71,7 @@ + #define VMWGFX_NUM_GB_CONTEXT 256 + #define VMWGFX_NUM_GB_SHADER 20000 + #define VMWGFX_NUM_GB_SURFACE 32768 +-#define VMWGFX_NUM_GB_SCREEN_TARGET VMWGFX_MAX_DISPLAYS ++#define VMWGFX_NUM_GB_SCREEN_TARGET VMWGFX_NUM_DISPLAY_UNITS + #define VMWGFX_NUM_DXCONTEXT 256 + #define VMWGFX_NUM_DXQUERY 512 + #define VMWGFX_NUM_MOB (VMWGFX_NUM_GB_CONTEXT +\ +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index 23010d60edfe4..8a9b61920496a 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -2295,7 +2295,7 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, + struct drm_mode_config *mode_config = &dev->mode_config; + struct drm_vmw_update_layout_arg *arg = + (struct drm_vmw_update_layout_arg *)data; +- void __user *user_rects; ++ const void __user *user_rects; + struct drm_vmw_rect *rects; + struct drm_rect *drm_rects; + unsigned rects_size; +@@ -2308,6 +2308,8 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, + def_rect.x2, def_rect.y2); + vmw_du_update_layout(dev_priv, 1, &def_rect); + return 0; ++ } else if (arg->num_outputs > VMWGFX_NUM_DISPLAY_UNITS) { ++ return -E2BIG; + } + + rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect); +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h +index 23c2dc943caf0..85595d0bcfcec 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h +@@ -198,9 +198,6 @@ struct vmw_kms_dirty { + s32 unit_y2; + }; + +-#define VMWGFX_NUM_DISPLAY_UNITS 8 +- +- + #define vmw_framebuffer_to_vfb(x) \ + container_of(x, struct vmw_framebuffer, base) + #define vmw_framebuffer_to_vfbs(x) \ +-- +2.43.0 + diff --git a/queue-5.15/hid-multitouch-add-quirk-for-honor-magicbook-art-14-.patch b/queue-5.15/hid-multitouch-add-quirk-for-honor-magicbook-art-14-.patch new file mode 100644 index 00000000000..7c6b56cf718 --- /dev/null +++ b/queue-5.15/hid-multitouch-add-quirk-for-honor-magicbook-art-14-.patch @@ -0,0 +1,47 @@ +From 3b79e191689806794f97e5af696f4010ddb8aa85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2024 12:08:03 +0800 +Subject: HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad + +From: WangYuli + +[ Upstream commit 7a5ab8071114344f62a8b1e64ed3452a77257d76 ] + +The behavior of HONOR MagicBook Art 14 touchpad is not consistent +after reboots, as sometimes it reports itself as a touchpad, and +sometimes as a mouse. + +Similarly to GLO-GXXX it is possible to call MT_QUIRK_FORCE_GET_FEATURE as a +workaround to force set feature in mt_set_input_mode() for such special touchpad +device. + +[jkosina@suse.com: reword changelog a little bit] +Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/1040 +Signed-off-by: Wentao Guan +Signed-off-by: WangYuli +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 116876d710932..8f6e410af7016 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2087,6 +2087,11 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + 0x347d, 0x7853) }, + ++ /* HONOR MagicBook Art 14 touchpad */ ++ { .driver_data = MT_CLS_VTL, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ 0x35cc, 0x0104) }, ++ + /* Ilitek dual touch panel */ + { .driver_data = MT_CLS_NSMU, + MT_USB_DEVICE(USB_VENDOR_ID_ILITEK, +-- +2.43.0 + diff --git a/queue-5.15/hid-multitouch-add-support-for-b2402fva-track-point.patch b/queue-5.15/hid-multitouch-add-support-for-b2402fva-track-point.patch new file mode 100644 index 00000000000..d0d4ea7c601 --- /dev/null +++ b/queue-5.15/hid-multitouch-add-support-for-b2402fva-track-point.patch @@ -0,0 +1,44 @@ +From b64d6b29ecfa501625f406990108a1e57920a988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2024 10:12:23 +0200 +Subject: HID: multitouch: Add support for B2402FVA track point + +From: Stefan Blum + +[ Upstream commit 1a5cbb526ec4b885177d06a8bc04f38da7dbb1d9 ] + +By default the track point does not work on the Asus Expertbook B2402FVA. + +From libinput record i got the ID of the track point device: + evdev: + # Name: ASUE1201:00 04F3:32AE + # ID: bus 0x18 vendor 0x4f3 product 0x32ae version 0x100 + +I found that the track point is functional, when i set the +MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU class for the reported device. + +Signed-off-by: Stefan Blum +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6a3f4371bd109..116876d710932 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -2017,6 +2017,10 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_ELAN, 0x3148) }, + ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_ELAN, 0x32ae) }, ++ + /* Elitegroup panel */ + { .driver_data = MT_CLS_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_ELITEGROUP, +-- +2.43.0 + diff --git a/queue-5.15/irqchip-ocelot-fix-trigger-register-address.patch b/queue-5.15/irqchip-ocelot-fix-trigger-register-address.patch new file mode 100644 index 00000000000..055c61ef46d --- /dev/null +++ b/queue-5.15/irqchip-ocelot-fix-trigger-register-address.patch @@ -0,0 +1,56 @@ +From a736e9f5adcba55075c57b805d0e97756f632c30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2024 21:44:15 +0300 +Subject: irqchip/ocelot: Fix trigger register address + +From: Sergey Matsievskiy + +[ Upstream commit 9e9c4666abb5bb444dac37e2d7eb5250c8d52a45 ] + +Controllers, supported by this driver, have two sets of registers: + + * (main) interrupt registers control peripheral interrupt sources. + + * device interrupt registers configure per-device (network interface) + interrupts and act as an extra stage before the main interrupt + registers. + +In the driver unmask code, device trigger registers are used in the mask +calculation of the main interrupt sticky register, mixing two kinds of +registers. + +Use the main interrupt trigger register instead. + +Signed-off-by: Sergey Matsievskiy +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/all/20240925184416.54204-2-matsievskiysv@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-mscc-ocelot.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/irqchip/irq-mscc-ocelot.c b/drivers/irqchip/irq-mscc-ocelot.c +index 4d0c3532dbe73..c19ab379e8c5e 100644 +--- a/drivers/irqchip/irq-mscc-ocelot.c ++++ b/drivers/irqchip/irq-mscc-ocelot.c +@@ -37,7 +37,7 @@ static struct chip_props ocelot_props = { + .reg_off_ena_clr = 0x1c, + .reg_off_ena_set = 0x20, + .reg_off_ident = 0x38, +- .reg_off_trigger = 0x5c, ++ .reg_off_trigger = 0x4, + .n_irq = 24, + }; + +@@ -70,7 +70,7 @@ static struct chip_props jaguar2_props = { + .reg_off_ena_clr = 0x1c, + .reg_off_ena_set = 0x20, + .reg_off_ident = 0x38, +- .reg_off_trigger = 0x5c, ++ .reg_off_trigger = 0x4, + .n_irq = 29, + }; + +-- +2.43.0 + diff --git a/queue-5.15/powerpc-powernv-free-name-on-error-in-opal_event_ini.patch b/queue-5.15/powerpc-powernv-free-name-on-error-in-opal_event_ini.patch new file mode 100644 index 00000000000..bccfb03e26e --- /dev/null +++ b/queue-5.15/powerpc-powernv-free-name-on-error-in-opal_event_ini.patch @@ -0,0 +1,39 @@ +From 4cad5eec5d105cd5306560f9b0c328e44006c97c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2024 19:35:20 +1000 +Subject: powerpc/powernv: Free name on error in opal_event_init() + +From: Michael Ellerman + +[ Upstream commit cf8989d20d64ad702a6210c11a0347ebf3852aa7 ] + +In opal_event_init() if request_irq() fails name is not freed, leading +to a memory leak. The code only runs at boot time, there's no way for a +user to trigger it, so there's no security impact. + +Fix the leak by freeing name in the error path. + +Reported-by: 2639161967 <2639161967@qq.com> +Closes: https://lore.kernel.org/linuxppc-dev/87wmjp3wig.fsf@mail.lhotse +Signed-off-by: Michael Ellerman +Link: https://patch.msgid.link/20240920093520.67997-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/opal-irqchip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c +index 391f505352007..e9849d70aee4a 100644 +--- a/arch/powerpc/platforms/powernv/opal-irqchip.c ++++ b/arch/powerpc/platforms/powernv/opal-irqchip.c +@@ -282,6 +282,7 @@ int __init opal_event_init(void) + name, NULL); + if (rc) { + pr_warn("Error %d requesting OPAL irq %d\n", rc, (int)r->start); ++ kfree(name); + continue; + } + } +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..219067a2233 --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,10 @@ +9p-avoid-creating-multiple-slab-caches-with-the-same.patch +irqchip-ocelot-fix-trigger-register-address.patch +block-fix-elevator_get_default-checking-for-null-q-t.patch +hid-multitouch-add-support-for-b2402fva-track-point.patch +hid-multitouch-add-quirk-for-honor-magicbook-art-14-.patch +bpf-use-kvzmalloc-to-allocate-bpf-verifier-environme.patch +crypto-marvell-cesa-disable-hash-algorithms.patch +sound-make-config_snd-depend-on-indirect_iomem-inste.patch +drm-vmwgfx-limit-display-layout-ioctl-array-size-to-.patch +powerpc-powernv-free-name-on-error-in-opal_event_ini.patch diff --git a/queue-5.15/sound-make-config_snd-depend-on-indirect_iomem-inste.patch b/queue-5.15/sound-make-config_snd-depend-on-indirect_iomem-inste.patch new file mode 100644 index 00000000000..64dc6ca1868 --- /dev/null +++ b/queue-5.15/sound-make-config_snd-depend-on-indirect_iomem-inste.patch @@ -0,0 +1,40 @@ +From aa914afd40e930b8291763d0f153c42ff21d92dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2024 14:46:01 +0200 +Subject: sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML + +From: Julian Vetter + +[ Upstream commit ad6639f143a0b42d7fb110ad14f5949f7c218890 ] + +When building for the UM arch and neither INDIRECT_IOMEM=y, nor +HAS_IOMEM=y is selected, it will fall back to the implementations from +asm-generic/io.h for IO memcpy. But these fall-back functions just do a +memcpy. So, instead of depending on UML, add dependency on 'HAS_IOMEM || +INDIRECT_IOMEM'. + +Reviewed-by: Yann Sionneau +Signed-off-by: Julian Vetter +Link: https://patch.msgid.link/20241010124601.700528-1-jvetter@kalrayinc.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/Kconfig b/sound/Kconfig +index 1903c35d799e1..5848eedcc3c9f 100644 +--- a/sound/Kconfig ++++ b/sound/Kconfig +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0-only + menuconfig SOUND + tristate "Sound card support" +- depends on HAS_IOMEM || UML ++ depends on HAS_IOMEM || INDIRECT_IOMEM + help + If you have a sound card in your computer, i.e. if it can say more + than an occasional beep, say Y. +-- +2.43.0 +