From: Greg Kroah-Hartman Date: Sun, 6 Jul 2025 11:46:33 +0000 (+0200) Subject: 6.15-stable patches X-Git-Tag: v5.15.187~64 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f9490961fe15832c3590a60de382db344d54f960;p=thirdparty%2Fkernel%2Fstable-queue.git 6.15-stable patches added patches: rtc-cmos-use-spin_lock_irqsave-in-cmos_interrupt.patch rtc-pcf2127-add-missing-semicolon-after-statement.patch rtc-pcf2127-fix-spi-command-byte-for-pcf2131.patch series virtio-net-xsk-rx-fix-the-frame-s-length-check.patch --- diff --git a/queue-6.15/rtc-cmos-use-spin_lock_irqsave-in-cmos_interrupt.patch b/queue-6.15/rtc-cmos-use-spin_lock_irqsave-in-cmos_interrupt.patch new file mode 100644 index 0000000000..41960edba2 --- /dev/null +++ b/queue-6.15/rtc-cmos-use-spin_lock_irqsave-in-cmos_interrupt.patch @@ -0,0 +1,80 @@ +From 00a39d8652ff9088de07a6fe6e9e1893452fe0dd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Mateusz=20Jo=C5=84czyk?= +Date: Sat, 7 Jun 2025 23:06:08 +0200 +Subject: rtc: cmos: use spin_lock_irqsave in cmos_interrupt +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mateusz Jończyk + +commit 00a39d8652ff9088de07a6fe6e9e1893452fe0dd upstream. + +cmos_interrupt() can be called in a non-interrupt context, such as in +an ACPI event handler (which runs in an interrupt thread). Therefore, +usage of spin_lock(&rtc_lock) is insecure. Use spin_lock_irqsave() / +spin_unlock_irqrestore() instead. + +Before a misguided +commit 6950d046eb6e ("rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ") +the cmos_interrupt() function used spin_lock_irqsave(). That commit +changed it to spin_lock() and broke locking, which was partially fixed in +commit 13be2efc390a ("rtc: cmos: Disable irq around direct invocation of cmos_interrupt()") + +That second commit did not take account of the ACPI fixed event handler +pathway, however. It introduced local_irq_disable() workarounds in +cmos_check_wkalrm(), which can cause problems on PREEMPT_RT kernels +and are now unnecessary. + +Add an explicit comment so that this change will not be reverted by +mistake. + +Cc: stable@vger.kernel.org +Fixes: 6950d046eb6e ("rtc: cmos: Replace spin_lock_irqsave with spin_lock in hard IRQ") +Signed-off-by: Mateusz Jończyk +Reviewed-by: Sebastian Andrzej Siewior +Tested-by: Chris Bainbridge +Reported-by: Chris Bainbridge +Closes: https://lore.kernel.org/all/aDtJ92foPUYmGheF@debian.local/ +Link: https://lore.kernel.org/r/20250607210608.14835-1-mat.jonczyk@o2.pl +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-cmos.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -692,8 +692,12 @@ static irqreturn_t cmos_interrupt(int ir + { + u8 irqstat; + u8 rtc_control; ++ unsigned long flags; + +- spin_lock(&rtc_lock); ++ /* We cannot use spin_lock() here, as cmos_interrupt() is also called ++ * in a non-irq context. ++ */ ++ spin_lock_irqsave(&rtc_lock, flags); + + /* When the HPET interrupt handler calls us, the interrupt + * status is passed as arg1 instead of the irq number. But +@@ -727,7 +731,7 @@ static irqreturn_t cmos_interrupt(int ir + hpet_mask_rtc_irq_bit(RTC_AIE); + CMOS_READ(RTC_INTR_FLAGS); + } +- spin_unlock(&rtc_lock); ++ spin_unlock_irqrestore(&rtc_lock, flags); + + if (is_intr(irqstat)) { + rtc_update_irq(p, 1, irqstat); +@@ -1295,9 +1299,7 @@ static void cmos_check_wkalrm(struct dev + * ACK the rtc irq here + */ + if (t_now >= cmos->alarm_expires && cmos_use_acpi_alarm()) { +- local_irq_disable(); + cmos_interrupt(0, (void *)cmos->rtc); +- local_irq_enable(); + return; + } + diff --git a/queue-6.15/rtc-pcf2127-add-missing-semicolon-after-statement.patch b/queue-6.15/rtc-pcf2127-add-missing-semicolon-after-statement.patch new file mode 100644 index 0000000000..5c20d86400 --- /dev/null +++ b/queue-6.15/rtc-pcf2127-add-missing-semicolon-after-statement.patch @@ -0,0 +1,34 @@ +From 08d82d0cad51c2b1d454fe41ea1ff96ade676961 Mon Sep 17 00:00:00 2001 +From: Hugo Villeneuve +Date: Thu, 29 May 2025 16:29:22 -0400 +Subject: rtc: pcf2127: add missing semicolon after statement + +From: Hugo Villeneuve + +commit 08d82d0cad51c2b1d454fe41ea1ff96ade676961 upstream. + +Replace comma with semicolon at the end of the statement when setting +config.max_register. + +Fixes: fd28ceb4603f ("rtc: pcf2127: add variant-specific configuration structure") +Cc: stable@vger.kernel.org +Cc: Elena Popa +Signed-off-by: Hugo Villeneuve +Link: https://lore.kernel.org/r/20250529202923.1552560-1-hugo@hugovil.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-pcf2127.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -1538,7 +1538,7 @@ static int pcf2127_spi_probe(struct spi_ + variant = &pcf21xx_cfg[type]; + } + +- config.max_register = variant->max_register, ++ config.max_register = variant->max_register; + + regmap = devm_regmap_init_spi(spi, &config); + if (IS_ERR(regmap)) { diff --git a/queue-6.15/rtc-pcf2127-fix-spi-command-byte-for-pcf2131.patch b/queue-6.15/rtc-pcf2127-fix-spi-command-byte-for-pcf2131.patch new file mode 100644 index 0000000000..50c2101769 --- /dev/null +++ b/queue-6.15/rtc-pcf2127-fix-spi-command-byte-for-pcf2131.patch @@ -0,0 +1,38 @@ +From fa78e9b606a472495ef5b6b3d8b45c37f7727f9d Mon Sep 17 00:00:00 2001 +From: Elena Popa +Date: Fri, 30 May 2025 13:40:00 +0300 +Subject: rtc: pcf2127: fix SPI command byte for PCF2131 + +From: Elena Popa + +commit fa78e9b606a472495ef5b6b3d8b45c37f7727f9d upstream. + +PCF2131 was not responding to read/write operations using SPI. PCF2131 +has a different command byte definition, compared to PCF2127/29. Added +the new command byte definition when PCF2131 is detected. + +Fixes: afc505bf9039 ("rtc: pcf2127: add support for PCF2131 RTC") +Cc: stable@vger.kernel.org +Signed-off-by: Elena Popa +Acked-by: Hugo Villeneuve +Link: https://lore.kernel.org/r/20250530104001.957977-1-elena.popa@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-pcf2127.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -1465,6 +1465,11 @@ static int pcf2127_i2c_probe(struct i2c_ + variant = &pcf21xx_cfg[type]; + } + ++ if (variant->type == PCF2131) { ++ config.read_flag_mask = 0x0; ++ config.write_flag_mask = 0x0; ++ } ++ + config.max_register = variant->max_register, + + regmap = devm_regmap_init(&client->dev, &pcf2127_i2c_regmap, diff --git a/queue-6.15/series b/queue-6.15/series new file mode 100644 index 0000000000..edbcb56f7f --- /dev/null +++ b/queue-6.15/series @@ -0,0 +1,4 @@ +rtc-pcf2127-add-missing-semicolon-after-statement.patch +rtc-pcf2127-fix-spi-command-byte-for-pcf2131.patch +rtc-cmos-use-spin_lock_irqsave-in-cmos_interrupt.patch +virtio-net-xsk-rx-fix-the-frame-s-length-check.patch diff --git a/queue-6.15/virtio-net-xsk-rx-fix-the-frame-s-length-check.patch b/queue-6.15/virtio-net-xsk-rx-fix-the-frame-s-length-check.patch new file mode 100644 index 0000000000..4cd546a66c --- /dev/null +++ b/queue-6.15/virtio-net-xsk-rx-fix-the-frame-s-length-check.patch @@ -0,0 +1,104 @@ +From 5177373c31318c3c6a190383bfd232e6cf565c36 Mon Sep 17 00:00:00 2001 +From: Bui Quang Minh +Date: Mon, 30 Jun 2025 22:13:14 +0700 +Subject: virtio-net: xsk: rx: fix the frame's length check + +From: Bui Quang Minh + +commit 5177373c31318c3c6a190383bfd232e6cf565c36 upstream. + +When calling buf_to_xdp, the len argument is the frame data's length +without virtio header's length (vi->hdr_len). We check that len with + + xsk_pool_get_rx_frame_size() + vi->hdr_len + +to ensure the provided len does not larger than the allocated chunk +size. The additional vi->hdr_len is because in virtnet_add_recvbuf_xsk, +we use part of XDP_PACKET_HEADROOM for virtio header and ask the vhost +to start placing data from + + hard_start + XDP_PACKET_HEADROOM - vi->hdr_len +not + hard_start + XDP_PACKET_HEADROOM + +But the first buffer has virtio_header, so the maximum frame's length in +the first buffer can only be + + xsk_pool_get_rx_frame_size() +not + xsk_pool_get_rx_frame_size() + vi->hdr_len + +like in the current check. + +This commit adds an additional argument to buf_to_xdp differentiate +between the first buffer and other ones to correctly calculate the maximum +frame's length. + +Cc: stable@vger.kernel.org +Reviewed-by: Xuan Zhuo +Fixes: a4e7ba702701 ("virtio_net: xsk: rx: support recv small mode") +Signed-off-by: Bui Quang Minh +Link: https://patch.msgid.link/20250630151315.86722-2-minhquangbui99@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/virtio_net.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index ecd3f46deb5d..50ff9a309ddc 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1147,15 +1147,29 @@ static void check_sq_full_and_disable(struct virtnet_info *vi, + } + } + ++/* Note that @len is the length of received data without virtio header */ + static struct xdp_buff *buf_to_xdp(struct virtnet_info *vi, +- struct receive_queue *rq, void *buf, u32 len) ++ struct receive_queue *rq, void *buf, ++ u32 len, bool first_buf) + { + struct xdp_buff *xdp; + u32 bufsize; + + xdp = (struct xdp_buff *)buf; + +- bufsize = xsk_pool_get_rx_frame_size(rq->xsk_pool) + vi->hdr_len; ++ /* In virtnet_add_recvbuf_xsk, we use part of XDP_PACKET_HEADROOM for ++ * virtio header and ask the vhost to fill data from ++ * hard_start + XDP_PACKET_HEADROOM - vi->hdr_len ++ * The first buffer has virtio header so the remaining region for frame ++ * data is ++ * xsk_pool_get_rx_frame_size() ++ * While other buffers than the first one do not have virtio header, so ++ * the maximum frame data's length can be ++ * xsk_pool_get_rx_frame_size() + vi->hdr_len ++ */ ++ bufsize = xsk_pool_get_rx_frame_size(rq->xsk_pool); ++ if (!first_buf) ++ bufsize += vi->hdr_len; + + if (unlikely(len > bufsize)) { + pr_debug("%s: rx error: len %u exceeds truesize %u\n", +@@ -1280,7 +1294,7 @@ static int xsk_append_merge_buffer(struct virtnet_info *vi, + + u64_stats_add(&stats->bytes, len); + +- xdp = buf_to_xdp(vi, rq, buf, len); ++ xdp = buf_to_xdp(vi, rq, buf, len, false); + if (!xdp) + goto err; + +@@ -1378,7 +1392,7 @@ static void virtnet_receive_xsk_buf(struct virtnet_info *vi, struct receive_queu + + u64_stats_add(&stats->bytes, len); + +- xdp = buf_to_xdp(vi, rq, buf, len); ++ xdp = buf_to_xdp(vi, rq, buf, len, true); + if (!xdp) + return; + +-- +2.50.0 +