From 4db259ade455f8030b50d9549c75287a18cc134d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 28 Oct 2024 01:47:25 +0100 Subject: [PATCH] 6.1-stable patches added patches: asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch net-phy-dp83822-fix-reset-pin-definitions.patch --- ...n-asoc_qcom_lpass_cpu_platform_probe.patch | 35 ++++++++++++ ...anity-checks-in-blk_rq_map_user_bvec.patch | 54 +++++++++++++++++++ ...hy-dp83822-fix-reset-pin-definitions.patch | 50 +++++++++++++++++ queue-6.1/series | 3 ++ 4 files changed, 142 insertions(+) create mode 100644 queue-6.1/asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch create mode 100644 queue-6.1/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch create mode 100644 queue-6.1/net-phy-dp83822-fix-reset-pin-definitions.patch diff --git a/queue-6.1/asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch b/queue-6.1/asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch new file mode 100644 index 00000000000..2d73eb38c05 --- /dev/null +++ b/queue-6.1/asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch @@ -0,0 +1,35 @@ +From 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 Mon Sep 17 00:00:00 2001 +From: Zichen Xie +Date: Sun, 6 Oct 2024 15:57:37 -0500 +Subject: ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() + +From: Zichen Xie + +commit 49da1463c9e3d2082276c3e0e2a8b65a88711cd2 upstream. + +A devm_kzalloc() in asoc_qcom_lpass_cpu_platform_probe() could +possibly return NULL pointer. NULL Pointer Dereference may be +triggerred without addtional check. +Add a NULL check for the returned pointer. + +Fixes: b5022a36d28f ("ASoC: qcom: lpass: Use regmap_field for i2sctl and dmactl registers") +Cc: stable@vger.kernel.org +Signed-off-by: Zichen Xie +Link: https://patch.msgid.link/20241006205737.8829-1-zichenxie0106@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/qcom/lpass-cpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -1236,6 +1236,8 @@ int asoc_qcom_lpass_cpu_platform_probe(s + /* Allocation for i2sctl regmap fields */ + drvdata->i2sctl = devm_kzalloc(&pdev->dev, sizeof(struct lpaif_i2sctl), + GFP_KERNEL); ++ if (!drvdata->i2sctl) ++ return -ENOMEM; + + /* Initialize bitfields for dai I2SCTL register */ + ret = lpass_cpu_init_i2sctl_bitfields(dev, drvdata->i2sctl, diff --git a/queue-6.1/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch b/queue-6.1/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch new file mode 100644 index 00000000000..96c52091176 --- /dev/null +++ b/queue-6.1/block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch @@ -0,0 +1,54 @@ +From 2ff949441802a8d076d9013c7761f63e8ae5a9bd Mon Sep 17 00:00:00 2001 +From: Xinyu Zhang +Date: Wed, 23 Oct 2024 15:15:19 -0600 +Subject: block: fix sanity checks in blk_rq_map_user_bvec + +From: Xinyu Zhang + +commit 2ff949441802a8d076d9013c7761f63e8ae5a9bd upstream. + +blk_rq_map_user_bvec contains a check bytes + bv->bv_len > nr_iter which +causes unnecessary failures in NVMe passthrough I/O, reproducible as +follows: + +- register a 2 page, page-aligned buffer against a ring +- use that buffer to do a 1 page io_uring NVMe passthrough read + +The second (i = 1) iteration of the loop in blk_rq_map_user_bvec will +then have nr_iter == 1 page, bytes == 1 page, bv->bv_len == 1 page, so +the check bytes + bv->bv_len > nr_iter will succeed, causing the I/O to +fail. This failure is unnecessary, as when the check succeeds, it means +we've checked the entire buffer that will be used by the request - i.e. +blk_rq_map_user_bvec should complete successfully. Therefore, terminate +the loop early and return successfully when the check bytes + bv->bv_len +> nr_iter succeeds. + +While we're at it, also remove the check that all segments in the bvec +are single-page. While this seems to be true for all users of the +function, it doesn't appear to be required anywhere downstream. + +CC: stable@vger.kernel.org +Signed-off-by: Xinyu Zhang +Co-developed-by: Uday Shankar +Signed-off-by: Uday Shankar +Fixes: 37987547932c ("block: extend functionality to map bvec iterator") +Link: https://lore.kernel.org/r/20241023211519.4177873-1-ushankar@purestorage.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-map.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/block/blk-map.c ++++ b/block/blk-map.c +@@ -597,9 +597,7 @@ static int blk_rq_map_user_bvec(struct r + if (nsegs >= nr_segs || bytes > UINT_MAX - bv->bv_len) + goto put_bio; + if (bytes + bv->bv_len > nr_iter) +- goto put_bio; +- if (bv->bv_offset + bv->bv_len > PAGE_SIZE) +- goto put_bio; ++ break; + + nsegs++; + bytes += bv->bv_len; diff --git a/queue-6.1/net-phy-dp83822-fix-reset-pin-definitions.patch b/queue-6.1/net-phy-dp83822-fix-reset-pin-definitions.patch new file mode 100644 index 00000000000..99ea7edd584 --- /dev/null +++ b/queue-6.1/net-phy-dp83822-fix-reset-pin-definitions.patch @@ -0,0 +1,50 @@ +From de96f6a3003513c796bbe4e23210a446913f5c00 Mon Sep 17 00:00:00 2001 +From: Michel Alex +Date: Wed, 16 Oct 2024 12:11:15 +0000 +Subject: net: phy: dp83822: Fix reset pin definitions + +From: Michel Alex + +commit de96f6a3003513c796bbe4e23210a446913f5c00 upstream. + +This change fixes a rare issue where the PHY fails to detect a link +due to incorrect reset behavior. + +The SW_RESET definition was incorrectly assigned to bit 14, which is the +Digital Restart bit according to the datasheet. This commit corrects +SW_RESET to bit 15 and assigns DIG_RESTART to bit 14 as per the +datasheet specifications. + +The SW_RESET define is only used in the phy_reset function, which fully +re-initializes the PHY after the reset is performed. The change in the +bit definitions should not have any negative impact on the functionality +of the PHY. + +v2: +- added Fixes tag +- improved commit message + +Cc: stable@vger.kernel.org +Fixes: 5dc39fd5ef35 ("net: phy: DP83822: Add ability to advertise Fiber connection") +Signed-off-by: Alex Michel +Reviewed-by: Andrew Lunn +Message-ID: +Signed-off-by: Andrew Lunn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/dp83822.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -40,8 +40,8 @@ + /* Control Register 2 bits */ + #define DP83822_FX_ENABLE BIT(14) + +-#define DP83822_HW_RESET BIT(15) +-#define DP83822_SW_RESET BIT(14) ++#define DP83822_SW_RESET BIT(15) ++#define DP83822_DIG_RESTART BIT(14) + + /* PHY STS bits */ + #define DP83822_PHYSTS_DUPLEX BIT(2) diff --git a/queue-6.1/series b/queue-6.1/series index 8aea0581dcb..29d2c327df6 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -129,3 +129,6 @@ hv_netvsc-fix-vf-namespace-also-in-synthetic-nic-netdev_register-event.patch drm-amd-display-disable-psr-su-on-parade-08-01-tcon-too.patch selinux-improve-error-checking-in-sel_write_load.patch serial-protect-uart_port_dtr_rts-in-uart_shutdown-to.patch +net-phy-dp83822-fix-reset-pin-definitions.patch +block-fix-sanity-checks-in-blk_rq_map_user_bvec.patch +asoc-qcom-fix-null-dereference-in-asoc_qcom_lpass_cpu_platform_probe.patch -- 2.47.2