From 69a4ff8d9cea6be38a73f8bd112d2b9e6a33a888 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 30 Mar 2023 07:50:32 -0400 Subject: [PATCH] Fixes for 6.2 Signed-off-by: Sasha Levin --- ...-check-if-the-input-of-level-and-typ.patch | 97 +++++++++ ...acklight-native-dmi-quirk-for-dell-v.patch | 41 ++++ ...p-i2c-clients-quirk-for-acer-iconia-.patch | 51 +++++ ...p-i2c-clients-quirk-for-lenovo-yoga-.patch | 52 +++++ ...ce-an-acpi_quirk_skip_gpio_event_han.patch | 151 ++++++++++++++ ...-asihpi-check-pao-in-control_message.patch | 72 +++++++ ...fixup-buffer-overrun-at-tuning_ctl_s.patch | 62 ++++++ ...acro-fix-for-kasan-slab-out-of-bound.patch | 93 +++++++++ ...only-startup-shutdown-on-supported-s.patch | 65 ++++++ ...a7219-explicitly-define-codec-format.patch | 66 ++++++ ...ax98357a-explicitly-define-codec-for.patch | 74 +++++++ ...tel-avs-nau8825-adjust-clock-control.patch | 54 +++++ ...t5682-explicitly-define-codec-format.patch | 67 ++++++ ...ntel-avs-ssm4567-remove-nau8825-bits.patch | 80 ++++++++ ...da-ctrl-re-add-sleep-after-entering-.patch | 55 +++++ ...da-dsp-harden-d0i3-programming-seque.patch | 61 ++++++ ...ci-tng-revert-invalid-bar-size-setti.patch | 60 ++++++ ...eck-for-upper-size-limit-for-the-rec.patch | 45 +++++ ...pology-fix-incorrect-sample-rate-pri.patch | 39 ++++ ...date-gain-ipc-msg-definition-to-alig.patch | 103 ++++++++++ ...missing-unload_nls-in-smb2_reconnect.patch | 54 +++++ ...fix-hdcp-failing-to-enable-after-sus.patch | 48 +++++ ...vcn-custom-video-info-caps-for-sriov.patch | 191 ++++++++++++++++++ ...-potential-double-free-in-pqm_create.patch | 39 ++++ ...o-offset-for-multi-vma-page-migratio.patch | 109 ++++++++++ ...rm-amdkfd-fix-potential-kgd_mem-uafs.patch | 98 +++++++++ ...d-kfd_process-cleanup-on-module-exit.patch | 150 ++++++++++++++ ...u1200fb-fix-potential-divide-by-zero.patch | 39 ++++ ...intelfb-fix-potential-divide-by-zero.patch | 39 ++++ ...ev-lxfb-fix-potential-divide-by-zero.patch | 38 ++++ ...-nvidia-fix-potential-divide-by-zero.patch | 40 ++++ ...v-tgafb-fix-potential-divide-by-zero.patch | 44 ++++ ...kport-fix-for-in-place-decompression.patch | 118 +++++++++++ ...-avoid-signed-overflow-in-slot_store.patch | 44 ++++ ...g-netdev_err-message-on-unknown-prp-.patch | 40 ++++ ...maximum-allowed-mtu-in-xsk-to-match-.patch | 72 +++++++ ...nvme_quirk_bogus_nid-for-lexar-nm620.patch | 35 ++++ ...g-memory-leak-in-probe-teardown-path.patch | 34 ++++ ...y-don-t-assume-cpumask_size-is-fully.patch | 82 ++++++++ queue-6.2/series | 46 +++++ ...turbostat-fix-decoding-of-hwp_status.patch | 37 ++++ ...ostat-fix-dev-cpu_dma_latency-warnin.patch | 58 ++++++ ...ng-return-in-kprobe_event_gen_test.c.patch | 53 +++++ ...-mac80211-check-basic-rates-validity.patch | 64 ++++++ ...-pvh-obtain-vga-console-info-in-dom0.patch | 139 +++++++++++++ ...padding-when-dumping-algos-and-encap.patch | 111 ++++++++++ queue-6.2/zstd-fix-definition-of-assert.patch | 39 ++++ 47 files changed, 3249 insertions(+) create mode 100644 queue-6.2/acpi-tools-pfrut-check-if-the-input-of-level-and-typ.patch create mode 100644 queue-6.2/acpi-video-add-backlight-native-dmi-quirk-for-dell-v.patch create mode 100644 queue-6.2/acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch create mode 100644 queue-6.2/acpi-x86-add-skip-i2c-clients-quirk-for-lenovo-yoga-.patch create mode 100644 queue-6.2/acpi-x86-introduce-an-acpi_quirk_skip_gpio_event_han.patch create mode 100644 queue-6.2/alsa-asihpi-check-pao-in-control_message.patch create mode 100644 queue-6.2/alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch create mode 100644 queue-6.2/asoc-codecs-tx-macro-fix-for-kasan-slab-out-of-bound.patch create mode 100644 queue-6.2/asoc-hdmi-codec-only-startup-shutdown-on-supported-s.patch create mode 100644 queue-6.2/asoc-intel-avs-da7219-explicitly-define-codec-format.patch create mode 100644 queue-6.2/asoc-intel-avs-max98357a-explicitly-define-codec-for.patch create mode 100644 queue-6.2/asoc-intel-avs-nau8825-adjust-clock-control.patch create mode 100644 queue-6.2/asoc-intel-avs-rt5682-explicitly-define-codec-format.patch create mode 100644 queue-6.2/asoc-intel-avs-ssm4567-remove-nau8825-bits.patch create mode 100644 queue-6.2/asoc-sof-intel-hda-ctrl-re-add-sleep-after-entering-.patch create mode 100644 queue-6.2/asoc-sof-intel-hda-dsp-harden-d0i3-programming-seque.patch create mode 100644 queue-6.2/asoc-sof-intel-pci-tng-revert-invalid-bar-size-setti.patch create mode 100644 queue-6.2/asoc-sof-ipc3-check-for-upper-size-limit-for-the-rec.patch create mode 100644 queue-6.2/asoc-sof-ipc4-topology-fix-incorrect-sample-rate-pri.patch create mode 100644 queue-6.2/asoc-sof-ipc4-update-gain-ipc-msg-definition-to-alig.patch create mode 100644 queue-6.2/cifs-fix-missing-unload_nls-in-smb2_reconnect.patch create mode 100644 queue-6.2/drm-amd-display-fix-hdcp-failing-to-enable-after-sus.patch create mode 100644 queue-6.2/drm-amdgpu-vcn-custom-video-info-caps-for-sriov.patch create mode 100644 queue-6.2/drm-amdkfd-fix-a-potential-double-free-in-pqm_create.patch create mode 100644 queue-6.2/drm-amdkfd-fix-bo-offset-for-multi-vma-page-migratio.patch create mode 100644 queue-6.2/drm-amdkfd-fix-potential-kgd_mem-uafs.patch create mode 100644 queue-6.2/drm-amdkfd-fixed-kfd_process-cleanup-on-module-exit.patch create mode 100644 queue-6.2/fbdev-au1200fb-fix-potential-divide-by-zero.patch create mode 100644 queue-6.2/fbdev-intelfb-fix-potential-divide-by-zero.patch create mode 100644 queue-6.2/fbdev-lxfb-fix-potential-divide-by-zero.patch create mode 100644 queue-6.2/fbdev-nvidia-fix-potential-divide-by-zero.patch create mode 100644 queue-6.2/fbdev-tgafb-fix-potential-divide-by-zero.patch create mode 100644 queue-6.2/lib-zstd-backport-fix-for-in-place-decompression.patch create mode 100644 queue-6.2/md-avoid-signed-overflow-in-slot_store.patch create mode 100644 queue-6.2/net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch create mode 100644 queue-6.2/net-mlx5e-lower-maximum-allowed-mtu-in-xsk-to-match-.patch create mode 100644 queue-6.2/nvme-pci-add-nvme_quirk_bogus_nid-for-lexar-nm620.patch create mode 100644 queue-6.2/nvme-pci-fixing-memory-leak-in-probe-teardown-path.patch create mode 100644 queue-6.2/sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch create mode 100644 queue-6.2/tools-power-turbostat-fix-decoding-of-hwp_status.patch create mode 100644 queue-6.2/tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch create mode 100644 queue-6.2/tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch create mode 100644 queue-6.2/wifi-mac80211-check-basic-rates-validity.patch create mode 100644 queue-6.2/x86-pvh-obtain-vga-console-info-in-dom0.patch create mode 100644 queue-6.2/xfrm-zero-padding-when-dumping-algos-and-encap.patch create mode 100644 queue-6.2/zstd-fix-definition-of-assert.patch diff --git a/queue-6.2/acpi-tools-pfrut-check-if-the-input-of-level-and-typ.patch b/queue-6.2/acpi-tools-pfrut-check-if-the-input-of-level-and-typ.patch new file mode 100644 index 00000000000..48357be1158 --- /dev/null +++ b/queue-6.2/acpi-tools-pfrut-check-if-the-input-of-level-and-typ.patch @@ -0,0 +1,97 @@ +From 6b4f1447273591251c6d2dcf7ce1edbb9d3395c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 21:23:09 +0800 +Subject: ACPI: tools: pfrut: Check if the input of level and type is in the + right numeric range +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chen Yu + +[ Upstream commit 0bc23d8b2237a104d7f8379d687aa4cb82e2968b ] + +The user provides arbitrary non-numeic value to level and type, +which could bring unexpected behavior. In this case the expected +behavior would be to throw an error. + + pfrut -h +usage: pfrut [OPTIONS] +code injection: +-l, --load +-s, --stage +-a, --activate +-u, --update [stage and activate] +-q, --query +-d, --revid +update telemetry: +-G, --getloginfo +-T, --type(0:execution, 1:history) +-L, --level(0, 1, 2, 4) +-R, --read +-D, --revid log + + pfrut -T A + pfrut -G +log_level:0 +log_type:0 +log_revid:2 +max_data_size:65536 +chunk1_size:0 +chunk2_size:1530 +rollover_cnt:0 +reset_cnt:17 + +Fix this by restricting the input to be in the expected range. + +Reported-by: Hariganesh Govindarajulu +Suggested-by: "Rafael J. Wysocki" +Signed-off-by: Chen Yu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/power/acpi/tools/pfrut/pfrut.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/tools/power/acpi/tools/pfrut/pfrut.c b/tools/power/acpi/tools/pfrut/pfrut.c +index 52aa0351533c3..388c9e3ad0407 100644 +--- a/tools/power/acpi/tools/pfrut/pfrut.c ++++ b/tools/power/acpi/tools/pfrut/pfrut.c +@@ -97,7 +97,7 @@ static struct option long_options[] = { + static void parse_options(int argc, char **argv) + { + int option_index = 0; +- char *pathname; ++ char *pathname, *endptr; + int opt; + + pathname = strdup(argv[0]); +@@ -125,11 +125,23 @@ static void parse_options(int argc, char **argv) + log_getinfo = 1; + break; + case 'T': +- log_type = atoi(optarg); ++ log_type = strtol(optarg, &endptr, 0); ++ if (*endptr || (log_type != 0 && log_type != 1)) { ++ printf("Number expected: type(0:execution, 1:history) - Quit.\n"); ++ exit(1); ++ } ++ + set_log_type = 1; + break; + case 'L': +- log_level = atoi(optarg); ++ log_level = strtol(optarg, &endptr, 0); ++ if (*endptr || ++ (log_level != 0 && log_level != 1 && ++ log_level != 2 && log_level != 4)) { ++ printf("Number expected: level(0, 1, 2, 4) - Quit.\n"); ++ exit(1); ++ } ++ + set_log_level = 1; + break; + case 'R': +-- +2.39.2 + diff --git a/queue-6.2/acpi-video-add-backlight-native-dmi-quirk-for-dell-v.patch b/queue-6.2/acpi-video-add-backlight-native-dmi-quirk-for-dell-v.patch new file mode 100644 index 00000000000..67e878a0fbb --- /dev/null +++ b/queue-6.2/acpi-video-add-backlight-native-dmi-quirk-for-dell-v.patch @@ -0,0 +1,41 @@ +From d8432d1284945b7c8dee16105a79e0797ec43a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Mar 2023 17:33:00 +0800 +Subject: ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 + +From: Chia-Lin Kao (AceLan) + +[ Upstream commit 89b0411481967a2e8c91190a211a359966cfcf4b ] + +Sometimes the system boots up with a acpi_video0 backlight interface +which doesn't work. So add Dell Vostro 15 3535 into the +video_detect_dmi_table to set it to native explicitly. + +Signed-off-by: Chia-Lin Kao (AceLan) +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/video_detect.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 710ac640267dd..14d6d81e536fe 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -716,6 +716,13 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5515"), + }, + }, ++ { ++ .callback = video_detect_force_native, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 15 3535"), ++ }, ++ }, + + /* + * Desktops which falsely report a backlight and which our heuristics +-- +2.39.2 + diff --git a/queue-6.2/acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch b/queue-6.2/acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch new file mode 100644 index 00000000000..3b4082f5c38 --- /dev/null +++ b/queue-6.2/acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch @@ -0,0 +1,51 @@ +From f88a32f9eefae44d6c903f12bb48ad06846bf0ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 11:04:35 +0100 +Subject: ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750 + +From: Hans de Goede + +[ Upstream commit a5cb0695c5f0ac2ab0cedf2c1c0d75826cb73448 ] + +The Acer Iconia One 7 B1-750 is a x86 tablet which ships with Android x86 +as factory OS. The Android x86 kernel fork ignores I2C devices described +in the DSDT, except for the PMIC and Audio codecs. + +As usual the Acer Iconia One 7 B1-750's DSDT contains a bunch of extra I2C +devices which are not actually there, causing various resource conflicts. +Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Acer Iconia One 7 B1-750 +to the acpi_quirk_skip_dmi_ids table to woraround this. + +The DSDT also contains broken ACPI GPIO event handlers, disable those too. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index 4bf57cce30bbf..b2b0e2701333a 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -280,6 +280,16 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + * need the x86-android-tablets module to properly work. + */ + #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS) ++ { ++ /* Acer Iconia One 7 B1-750 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "VESPA2"), ++ }, ++ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +-- +2.39.2 + diff --git a/queue-6.2/acpi-x86-add-skip-i2c-clients-quirk-for-lenovo-yoga-.patch b/queue-6.2/acpi-x86-add-skip-i2c-clients-quirk-for-lenovo-yoga-.patch new file mode 100644 index 00000000000..92c2731438a --- /dev/null +++ b/queue-6.2/acpi-x86-add-skip-i2c-clients-quirk-for-lenovo-yoga-.patch @@ -0,0 +1,52 @@ +From a96f2e9f8d748ba2cda5b4d8d3bc29946a0a9e9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 11:04:36 +0100 +Subject: ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90 + +From: Hans de Goede + +[ Upstream commit 1a1e7540cf501dd5c8b57a577a155cdd13c7e202 ] + +The Lenovo Yoga Book X90 is a x86 tablet which ships with Android x86 +as factory OS. The Android x86 kernel fork ignores I2C devices described +in the DSDT, except for the PMIC and Audio codecs. + +As usual the Lenovo Yoga Book X90's DSDT contains a bunch of extra I2C +devices which are not actually there, causing various resource conflicts. +Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Lenovo Yoga Book X90 +to the acpi_quirk_skip_dmi_ids table to woraround this. + +The DSDT also contains broken ACPI GPIO event handlers, disable those too. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index b2b0e2701333a..da5727069d851 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -300,6 +300,17 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | + ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, ++ { ++ /* Lenovo Yoga Book X90F/L */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"), ++ }, ++ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), ++ }, + { + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +-- +2.39.2 + diff --git a/queue-6.2/acpi-x86-introduce-an-acpi_quirk_skip_gpio_event_han.patch b/queue-6.2/acpi-x86-introduce-an-acpi_quirk_skip_gpio_event_han.patch new file mode 100644 index 00000000000..214ed20e9fa --- /dev/null +++ b/queue-6.2/acpi-x86-introduce-an-acpi_quirk_skip_gpio_event_han.patch @@ -0,0 +1,151 @@ +From db8d159778bbd2dbe831dcc5a525315412b13c84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 11:04:34 +0100 +Subject: ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper + +From: Hans de Goede + +[ Upstream commit 5adc409340b1fc82bc1175e602d14ac82ac685e3 ] + +x86 ACPI boards which ship with only Android as their factory image usually +have pretty broken ACPI tables, relying on everything being hardcoded in +the factory kernel image and often disabling parts of the ACPI enumeration +kernel code to avoid the broken tables causing issues. + +Part of this broken ACPI code is that sometimes these boards have _AEI +ACPI GPIO event handlers which are broken. + +So far this has been dealt with in the platform/x86/x86-android-tablets.c +module, which contains various workarounds for these devices, by it calling +acpi_gpiochip_free_interrupts() on gpiochip-s with troublesome handlers to +disable the handlers. + +But in some cases this is too late, if the handlers are of the edge type +then gpiolib-acpi.c's code will already have run them at boot. +This can cause issues such as GPIOs ending up as owned by "ACPI:OpRegion", +making them unavailable for drivers which actually need them. + +Boards with these broken ACPI tables are already listed in +drivers/acpi/x86/utils.c for e.g. acpi_quirk_skip_i2c_client_enumeration(). +Extend the quirks mechanism for a new acpi_quirk_skip_gpio_event_handlers() +helper, this re-uses the DMI-ids rather then having to duplicate the same +DMI table in gpiolib-acpi.c . + +Also add the new ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS quirk to existing +boards with troublesome ACPI gpio event handlers, so that the current +acpi_gpiochip_free_interrupts() hack can be removed from +x86-android-tablets.c . + +Signed-off-by: Hans de Goede +Acked-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/utils.c | 24 +++++++++++++++++++++--- + drivers/gpio/gpiolib-acpi.c | 3 +++ + include/acpi/acpi_bus.h | 5 +++++ + 3 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c +index e45285d4e62a4..4bf57cce30bbf 100644 +--- a/drivers/acpi/x86/utils.c ++++ b/drivers/acpi/x86/utils.c +@@ -251,6 +251,7 @@ bool force_storage_d3(void) + #define ACPI_QUIRK_UART1_TTY_UART2_SKIP BIT(1) + #define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY BIT(2) + #define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY BIT(3) ++#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS BIT(4) + + static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + /* +@@ -286,7 +287,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | + ACPI_QUIRK_UART1_TTY_UART2_SKIP | +- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, + { + .matches = { +@@ -294,7 +296,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "TF103C"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | +- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, + { + /* Lenovo Yoga Tablet 2 1050F/L */ +@@ -336,7 +339,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "M890BAP"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | +- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), ++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), + }, + { + /* Whitelabel (sold as various brands) TM800A550L */ +@@ -413,6 +417,20 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *s + return 0; + } + EXPORT_SYMBOL_GPL(acpi_quirk_skip_serdev_enumeration); ++ ++bool acpi_quirk_skip_gpio_event_handlers(void) ++{ ++ const struct dmi_system_id *dmi_id; ++ long quirks; ++ ++ dmi_id = dmi_first_match(acpi_quirk_skip_dmi_ids); ++ if (!dmi_id) ++ return false; ++ ++ quirks = (unsigned long)dmi_id->driver_data; ++ return (quirks & ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS); ++} ++EXPORT_SYMBOL_GPL(acpi_quirk_skip_gpio_event_handlers); + #endif + + /* Lists of PMIC ACPI HIDs with an (often better) native charger driver */ +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 34ff048e70d0e..7c9175619a1dc 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -536,6 +536,9 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip) + if (ACPI_FAILURE(status)) + return; + ++ if (acpi_quirk_skip_gpio_event_handlers()) ++ return; ++ + acpi_walk_resources(handle, METHOD_NAME__AEI, + acpi_gpiochip_alloc_event, acpi_gpio); + +diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h +index 0584e9f6e3397..57acb895c0381 100644 +--- a/include/acpi/acpi_bus.h ++++ b/include/acpi/acpi_bus.h +@@ -657,6 +657,7 @@ static inline bool acpi_quirk_skip_acpi_ac_and_battery(void) + #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS) + bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev); + int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip); ++bool acpi_quirk_skip_gpio_event_handlers(void); + #else + static inline bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev) + { +@@ -668,6 +669,10 @@ acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip) + *skip = false; + return 0; + } ++static inline bool acpi_quirk_skip_gpio_event_handlers(void) ++{ ++ return false; ++} + #endif + + #ifdef CONFIG_PM +-- +2.39.2 + diff --git a/queue-6.2/alsa-asihpi-check-pao-in-control_message.patch b/queue-6.2/alsa-asihpi-check-pao-in-control_message.patch new file mode 100644 index 00000000000..5cbe0b09a46 --- /dev/null +++ b/queue-6.2/alsa-asihpi-check-pao-in-control_message.patch @@ -0,0 +1,72 @@ +From 04e6c2e59ea6e3e9f44c068d6409b6c81a52a00a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 00:49:24 +0000 +Subject: ALSA: asihpi: check pao in control_message() + +From: Kuninori Morimoto + +[ Upstream commit 9026c0bf233db53b86f74f4c620715e94eb32a09 ] + +control_message() might be called with pao = NULL. +Here indicates control_message() as sample. + +(B) static void control_message(struct hpi_adapter_obj *pao, ...) + { ^^^ + struct hpi_hw_obj *phw = pao->priv; + ... ^^^ + } + +(A) void _HPI_6205(struct hpi_adapter_obj *pao, ...) + { ^^^ + ... + case HPI_OBJ_CONTROL: +(B) control_message(pao, phm, phr); + break; ^^^ + ... + } + + void HPI_6205(...) + { + ... +(A) _HPI_6205(NULL, phm, phr); + ... ^^^^ + } + +Therefore, We will get too many warning via cppcheck, like below + + sound/pci/asihpi/hpi6205.c:238:27: warning: Possible null pointer dereference: pao [nullPointer] + struct hpi_hw_obj *phw = pao->priv; + ^ + sound/pci/asihpi/hpi6205.c:433:13: note: Calling function '_HPI_6205', 1st argument 'NULL' value is 0 + _HPI_6205(NULL, phm, phr); + ^ + sound/pci/asihpi/hpi6205.c:401:20: note: Calling function 'control_message', 1st argument 'pao' value is 0 + control_message(pao, phm, phr); + ^ +Set phr->error like many functions doing, and don't call _HPI_6205() +with NULL. + +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87ttypeaqz.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/asihpi/hpi6205.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/asihpi/hpi6205.c b/sound/pci/asihpi/hpi6205.c +index 27e11b5f70b97..c7d7eff86727f 100644 +--- a/sound/pci/asihpi/hpi6205.c ++++ b/sound/pci/asihpi/hpi6205.c +@@ -430,7 +430,7 @@ void HPI_6205(struct hpi_message *phm, struct hpi_response *phr) + pao = hpi_find_adapter(phm->adapter_index); + } else { + /* subsys messages don't address an adapter */ +- _HPI_6205(NULL, phm, phr); ++ phr->error = HPI_ERROR_INVALID_OBJ_INDEX; + return; + } + +-- +2.39.2 + diff --git a/queue-6.2/alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch b/queue-6.2/alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch new file mode 100644 index 00000000000..79a8e148161 --- /dev/null +++ b/queue-6.2/alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch @@ -0,0 +1,62 @@ +From 821f946d3b164a33aea991d2b98c663bde6396fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 00:50:28 +0000 +Subject: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() + +From: Kuninori Morimoto + +[ Upstream commit 98e5eb110095ec77cb6d775051d181edbf9cd3cf ] + +tuning_ctl_set() might have buffer overrun at (X) if it didn't break +from loop by matching (A). + + static int tuning_ctl_set(...) + { + for (i = 0; i < TUNING_CTLS_COUNT; i++) +(A) if (nid == ca0132_tuning_ctls[i].nid) + break; + + snd_hda_power_up(...); +(X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); + snd_hda_power_down(...); ^ + + return 1; + } + +We will get below error by cppcheck + + sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 + for (i = 0; i < TUNING_CTLS_COUNT; i++) + ^ + sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds + dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, + ^ +This patch cares non match case. + +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87sfe9eap7.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_ca0132.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index acde4cd58785e..099722ebaed83 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -4228,8 +4228,10 @@ static int tuning_ctl_set(struct hda_codec *codec, hda_nid_t nid, + + for (i = 0; i < TUNING_CTLS_COUNT; i++) + if (nid == ca0132_tuning_ctls[i].nid) +- break; ++ goto found; + ++ return -EINVAL; ++found: + snd_hda_power_up(codec); + dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, + ca0132_tuning_ctls[i].req, +-- +2.39.2 + diff --git a/queue-6.2/asoc-codecs-tx-macro-fix-for-kasan-slab-out-of-bound.patch b/queue-6.2/asoc-codecs-tx-macro-fix-for-kasan-slab-out-of-bound.patch new file mode 100644 index 00000000000..918441e3ca1 --- /dev/null +++ b/queue-6.2/asoc-codecs-tx-macro-fix-for-kasan-slab-out-of-bound.patch @@ -0,0 +1,93 @@ +From c390ddb8655532d0a9f1b85dff46dd42a64042da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Mar 2023 13:37:02 +0530 +Subject: ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds + +From: Ravulapati Vishnu Vardhan Rao + +[ Upstream commit e5e7e398f6bb7918dab0612eb6991f7bae95520d ] + +When we run syzkaller we get below Out of Bound. + "KASAN: slab-out-of-bounds Read in regcache_flat_read" + + Below is the backtrace of the issue: + + dump_backtrace+0x0/0x4c8 + show_stack+0x34/0x44 + dump_stack_lvl+0xd8/0x118 + print_address_description+0x30/0x2d8 + kasan_report+0x158/0x198 + __asan_report_load4_noabort+0x44/0x50 + regcache_flat_read+0x10c/0x110 + regcache_read+0xf4/0x180 + _regmap_read+0xc4/0x278 + _regmap_update_bits+0x130/0x290 + regmap_update_bits_base+0xc0/0x15c + snd_soc_component_update_bits+0xa8/0x22c + snd_soc_component_write_field+0x68/0xd4 + tx_macro_digital_mute+0xec/0x140 + + Actually There is no need to have decimator with 32 bits. + By limiting the variable with short type u8 issue is resolved. + +Signed-off-by: Ravulapati Vishnu Vardhan Rao +Link: https://lore.kernel.org/r/20230304080702.609-1-quic_visr@quicinc.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-tx-macro.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index 2449a2df66df0..8facdb922f076 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -242,7 +242,7 @@ enum { + + struct tx_mute_work { + struct tx_macro *tx; +- u32 decimator; ++ u8 decimator; + struct delayed_work dwork; + }; + +@@ -635,7 +635,7 @@ static int tx_macro_mclk_enable(struct tx_macro *tx, + return 0; + } + +-static bool is_amic_enabled(struct snd_soc_component *component, int decimator) ++static bool is_amic_enabled(struct snd_soc_component *component, u8 decimator) + { + u16 adc_mux_reg, adc_reg, adc_n; + +@@ -849,7 +849,7 @@ static int tx_macro_enable_dec(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) + { + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); +- unsigned int decimator; ++ u8 decimator; + u16 tx_vol_ctl_reg, dec_cfg_reg, hpf_gate_reg, tx_gain_ctl_reg; + u8 hpf_cut_off_freq; + int hpf_delay = TX_MACRO_DMIC_HPF_DELAY_MS; +@@ -1064,7 +1064,8 @@ static int tx_macro_hw_params(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct snd_soc_component *component = dai->component; +- u32 decimator, sample_rate; ++ u32 sample_rate; ++ u8 decimator; + int tx_fs_rate; + struct tx_macro *tx = snd_soc_component_get_drvdata(component); + +@@ -1128,7 +1129,7 @@ static int tx_macro_digital_mute(struct snd_soc_dai *dai, int mute, int stream) + { + struct snd_soc_component *component = dai->component; + struct tx_macro *tx = snd_soc_component_get_drvdata(component); +- u16 decimator; ++ u8 decimator; + + /* active decimator not set yet */ + if (tx->active_decimator[dai->id] == -1) +-- +2.39.2 + diff --git a/queue-6.2/asoc-hdmi-codec-only-startup-shutdown-on-supported-s.patch b/queue-6.2/asoc-hdmi-codec-only-startup-shutdown-on-supported-s.patch new file mode 100644 index 00000000000..ba9cfc1e833 --- /dev/null +++ b/queue-6.2/asoc-hdmi-codec-only-startup-shutdown-on-supported-s.patch @@ -0,0 +1,65 @@ +From aa11ea032fee5c0c59f01bacc82872346ce5d0a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 06:54:41 +0000 +Subject: ASoC: hdmi-codec: only startup/shutdown on supported streams + +From: Emil Abildgaard Svendsen + +[ Upstream commit e041a2a550582106cba6a7c862c90dfc2ad14492 ] + +Currently only one stream is supported. This isn't usally a problem +until you have a multi codec audio card. Because the audio card will run +startup and shutdown on both capture and playback streams. So if your +hdmi-codec only support either playback or capture. Then ALSA can't open +for playback and capture. + +This patch will ignore if startup and shutdown are called with a non +supported stream. Thus, allowing an audio card like this: + + +-+ + cpu1 <--@-| |-> codec1 (HDMI-CODEC) + | |<- codec2 (NOT HDMI-CODEC) + +-+ + +Signed-off-by: Emil Svendsen +Link: https://lore.kernel.org/r/20230309065432.4150700-2-emas@bang-olufsen.dk +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdmi-codec.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c +index 74cbbe16f9aec..a22f2ec95901f 100644 +--- a/sound/soc/codecs/hdmi-codec.c ++++ b/sound/soc/codecs/hdmi-codec.c +@@ -428,8 +428,13 @@ static int hdmi_codec_startup(struct snd_pcm_substream *substream, + { + struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai); + bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; ++ bool has_capture = !hcp->hcd.no_i2s_capture; ++ bool has_playback = !hcp->hcd.no_i2s_playback; + int ret = 0; + ++ if (!((has_playback && tx) || (has_capture && !tx))) ++ return 0; ++ + mutex_lock(&hcp->lock); + if (hcp->busy) { + dev_err(dai->dev, "Only one simultaneous stream supported!\n"); +@@ -468,6 +473,12 @@ static void hdmi_codec_shutdown(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai); ++ bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK; ++ bool has_capture = !hcp->hcd.no_i2s_capture; ++ bool has_playback = !hcp->hcd.no_i2s_playback; ++ ++ if (!((has_playback && tx) || (has_capture && !tx))) ++ return; + + hcp->chmap_idx = HDMI_CODEC_CHMAP_IDX_UNKNOWN; + hcp->hcd.ops->audio_shutdown(dai->dev->parent, hcp->hcd.data); +-- +2.39.2 + diff --git a/queue-6.2/asoc-intel-avs-da7219-explicitly-define-codec-format.patch b/queue-6.2/asoc-intel-avs-da7219-explicitly-define-codec-format.patch new file mode 100644 index 00000000000..86dfe5c19cb --- /dev/null +++ b/queue-6.2/asoc-intel-avs-da7219-explicitly-define-codec-format.patch @@ -0,0 +1,66 @@ +From 5536388a6727c6ba5f5cf8679acb24f3672d8bda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 14:48:51 +0100 +Subject: ASoC: Intel: avs: da7219: Explicitly define codec format +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 61f368624fe4d0c25c6e9c917574b8ace51d776e ] + +da7219 is headset codec configured in 48000/2/S24_LE format regardless +of front end format, so force it to be so. + +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-3-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/boards/da7219.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/sound/soc/intel/avs/boards/da7219.c b/sound/soc/intel/avs/boards/da7219.c +index acd43b6108e99..1a1d572cc1d02 100644 +--- a/sound/soc/intel/avs/boards/da7219.c ++++ b/sound/soc/intel/avs/boards/da7219.c +@@ -117,6 +117,26 @@ static void avs_da7219_codec_exit(struct snd_soc_pcm_runtime *rtd) + snd_soc_component_set_jack(asoc_rtd_to_codec(rtd, 0)->component, NULL, NULL); + } + ++static int ++avs_da7219_be_fixup(struct snd_soc_pcm_runtime *runrime, struct snd_pcm_hw_params *params) ++{ ++ struct snd_interval *rate, *channels; ++ struct snd_mask *fmt; ++ ++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE); ++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS); ++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); ++ ++ /* The ADSP will convert the FE rate to 48k, stereo */ ++ rate->min = rate->max = 48000; ++ channels->min = channels->max = 2; ++ ++ /* set SSP0 to 24 bit */ ++ snd_mask_none(fmt); ++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE); ++ return 0; ++} ++ + static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port, + struct snd_soc_dai_link **dai_link) + { +@@ -148,6 +168,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in + dl->num_platforms = 1; + dl->id = 0; + dl->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS; ++ dl->be_hw_params_fixup = avs_da7219_be_fixup; + dl->init = avs_da7219_codec_init; + dl->exit = avs_da7219_codec_exit; + dl->nonatomic = 1; +-- +2.39.2 + diff --git a/queue-6.2/asoc-intel-avs-max98357a-explicitly-define-codec-for.patch b/queue-6.2/asoc-intel-avs-max98357a-explicitly-define-codec-for.patch new file mode 100644 index 00000000000..9cbb1df5a69 --- /dev/null +++ b/queue-6.2/asoc-intel-avs-max98357a-explicitly-define-codec-for.patch @@ -0,0 +1,74 @@ +From 99291b981e49238971c746eb6c672ce3d680814e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 14:48:50 +0100 +Subject: ASoC: Intel: avs: max98357a: Explicitly define codec format +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit d16c893425d07ada1fdd817ec06d322efcf69480 ] + +max98357a is speaker codec configured in 48000/2/S16_LE format +regardless of front end format, so force it to be so. + +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-2-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/boards/max98357a.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/sound/soc/intel/avs/boards/max98357a.c b/sound/soc/intel/avs/boards/max98357a.c +index 921f42caf7e09..183123d08c5a3 100644 +--- a/sound/soc/intel/avs/boards/max98357a.c ++++ b/sound/soc/intel/avs/boards/max98357a.c +@@ -8,6 +8,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -24,6 +25,26 @@ static const struct snd_soc_dapm_route card_base_routes[] = { + { "Spk", NULL, "Speaker" }, + }; + ++static int ++avs_max98357a_be_fixup(struct snd_soc_pcm_runtime *runrime, struct snd_pcm_hw_params *params) ++{ ++ struct snd_interval *rate, *channels; ++ struct snd_mask *fmt; ++ ++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE); ++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS); ++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); ++ ++ /* The ADSP will convert the FE rate to 48k, stereo */ ++ rate->min = rate->max = 48000; ++ channels->min = channels->max = 2; ++ ++ /* set SSP0 to 16 bit */ ++ snd_mask_none(fmt); ++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE); ++ return 0; ++} ++ + static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port, + struct snd_soc_dai_link **dai_link) + { +@@ -55,6 +76,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in + dl->num_platforms = 1; + dl->id = 0; + dl->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS; ++ dl->be_hw_params_fixup = avs_max98357a_be_fixup; + dl->nonatomic = 1; + dl->no_pcm = 1; + dl->dpcm_playback = 1; +-- +2.39.2 + diff --git a/queue-6.2/asoc-intel-avs-nau8825-adjust-clock-control.patch b/queue-6.2/asoc-intel-avs-nau8825-adjust-clock-control.patch new file mode 100644 index 00000000000..f1a0928d677 --- /dev/null +++ b/queue-6.2/asoc-intel-avs-nau8825-adjust-clock-control.patch @@ -0,0 +1,54 @@ +From 8bd2f652f65879286be3692f7e49c2f651f249a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 14:48:54 +0100 +Subject: ASoC: Intel: avs: nau8825: Adjust clock control +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cezary Rojewski + +[ Upstream commit 6206b2e787da2ed567922c37bb588a44f6fb6705 ] + +Internal clock shall be adjusted also in cases when DAPM event other +than 'ON' is triggered. + +Signed-off-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-6-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/boards/nau8825.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/intel/avs/boards/nau8825.c b/sound/soc/intel/avs/boards/nau8825.c +index 6731d8a490767..49438a67a77c6 100644 +--- a/sound/soc/intel/avs/boards/nau8825.c ++++ b/sound/soc/intel/avs/boards/nau8825.c +@@ -33,15 +33,15 @@ avs_nau8825_clock_control(struct snd_soc_dapm_widget *w, struct snd_kcontrol *co + return -EINVAL; + } + +- if (!SND_SOC_DAPM_EVENT_ON(event)) { ++ if (SND_SOC_DAPM_EVENT_ON(event)) ++ ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_MCLK, 24000000, ++ SND_SOC_CLOCK_IN); ++ else + ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_INTERNAL, 0, SND_SOC_CLOCK_IN); +- if (ret < 0) { +- dev_err(card->dev, "set sysclk err = %d\n", ret); +- return ret; +- } +- } ++ if (ret < 0) ++ dev_err(card->dev, "Set sysclk failed: %d\n", ret); + +- return 0; ++ return ret; + } + + static const struct snd_kcontrol_new card_controls[] = { +-- +2.39.2 + diff --git a/queue-6.2/asoc-intel-avs-rt5682-explicitly-define-codec-format.patch b/queue-6.2/asoc-intel-avs-rt5682-explicitly-define-codec-format.patch new file mode 100644 index 00000000000..4e1f612c6b2 --- /dev/null +++ b/queue-6.2/asoc-intel-avs-rt5682-explicitly-define-codec-format.patch @@ -0,0 +1,67 @@ +From 805ffc94bc04a3b8a406306b33cb902e1dddc04f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 14:48:52 +0100 +Subject: ASoC: Intel: avs: rt5682: Explicitly define codec format +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit d24dbc865c2bd5946bef62bb862a65df092dfc79 ] + +rt5682 is headset codec configured in 48000/2/S24_LE format regardless +of front end format, so force it to be so. + +Reviewed-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-4-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/boards/rt5682.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/sound/soc/intel/avs/boards/rt5682.c b/sound/soc/intel/avs/boards/rt5682.c +index 473e9fe5d0bf7..b2c2ba93dcb56 100644 +--- a/sound/soc/intel/avs/boards/rt5682.c ++++ b/sound/soc/intel/avs/boards/rt5682.c +@@ -169,6 +169,27 @@ static const struct snd_soc_ops avs_rt5682_ops = { + .hw_params = avs_rt5682_hw_params, + }; + ++static int ++avs_rt5682_be_fixup(struct snd_soc_pcm_runtime *runtime, struct snd_pcm_hw_params *params) ++{ ++ struct snd_interval *rate, *channels; ++ struct snd_mask *fmt; ++ ++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE); ++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS); ++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); ++ ++ /* The ADSP will convert the FE rate to 48k, stereo */ ++ rate->min = rate->max = 48000; ++ channels->min = channels->max = 2; ++ ++ /* set SSPN to 24 bit */ ++ snd_mask_none(fmt); ++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE); ++ ++ return 0; ++} ++ + static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port, + struct snd_soc_dai_link **dai_link) + { +@@ -201,6 +222,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in + dl->id = 0; + dl->init = avs_rt5682_codec_init; + dl->exit = avs_rt5682_codec_exit; ++ dl->be_hw_params_fixup = avs_rt5682_be_fixup; + dl->ops = &avs_rt5682_ops; + dl->nonatomic = 1; + dl->no_pcm = 1; +-- +2.39.2 + diff --git a/queue-6.2/asoc-intel-avs-ssm4567-remove-nau8825-bits.patch b/queue-6.2/asoc-intel-avs-ssm4567-remove-nau8825-bits.patch new file mode 100644 index 00000000000..967ba230949 --- /dev/null +++ b/queue-6.2/asoc-intel-avs-ssm4567-remove-nau8825-bits.patch @@ -0,0 +1,80 @@ +From 3d13d6bed45ea5dd9adaa44bc30b95317889eb6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 14:48:53 +0100 +Subject: ASoC: Intel: avs: ssm4567: Remove nau8825 bits +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cezary Rojewski + +[ Upstream commit 933de2d127281731166cf2880fa1e23c5a0f7faa ] + +Some of the nau8825 clock control got into the ssm4567, remove it. + +Signed-off-by: Cezary Rojewski +Signed-off-by: Amadeusz Sławiński +Link: https://lore.kernel.org/r/20230303134854.2277146-5-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/boards/ssm4567.c | 31 ---------------------------- + 1 file changed, 31 deletions(-) + +diff --git a/sound/soc/intel/avs/boards/ssm4567.c b/sound/soc/intel/avs/boards/ssm4567.c +index c5db696127624..2b7f5ad92aca7 100644 +--- a/sound/soc/intel/avs/boards/ssm4567.c ++++ b/sound/soc/intel/avs/boards/ssm4567.c +@@ -15,7 +15,6 @@ + #include + #include "../../../codecs/nau8825.h" + +-#define SKL_NUVOTON_CODEC_DAI "nau8825-hifi" + #define SKL_SSM_CODEC_DAI "ssm4567-hifi" + + static struct snd_soc_codec_conf card_codec_conf[] = { +@@ -34,41 +33,11 @@ static const struct snd_kcontrol_new card_controls[] = { + SOC_DAPM_PIN_SWITCH("Right Speaker"), + }; + +-static int +-platform_clock_control(struct snd_soc_dapm_widget *w, struct snd_kcontrol *control, int event) +-{ +- struct snd_soc_dapm_context *dapm = w->dapm; +- struct snd_soc_card *card = dapm->card; +- struct snd_soc_dai *codec_dai; +- int ret; +- +- codec_dai = snd_soc_card_get_codec_dai(card, SKL_NUVOTON_CODEC_DAI); +- if (!codec_dai) { +- dev_err(card->dev, "Codec dai not found\n"); +- return -EINVAL; +- } +- +- if (SND_SOC_DAPM_EVENT_ON(event)) { +- ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_MCLK, 24000000, +- SND_SOC_CLOCK_IN); +- if (ret < 0) +- dev_err(card->dev, "set sysclk err = %d\n", ret); +- } else { +- ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_INTERNAL, 0, SND_SOC_CLOCK_IN); +- if (ret < 0) +- dev_err(card->dev, "set sysclk err = %d\n", ret); +- } +- +- return ret; +-} +- + static const struct snd_soc_dapm_widget card_widgets[] = { + SND_SOC_DAPM_SPK("Left Speaker", NULL), + SND_SOC_DAPM_SPK("Right Speaker", NULL), + SND_SOC_DAPM_SPK("DP1", NULL), + SND_SOC_DAPM_SPK("DP2", NULL), +- SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0, platform_clock_control, +- SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), + }; + + static const struct snd_soc_dapm_route card_base_routes[] = { +-- +2.39.2 + diff --git a/queue-6.2/asoc-sof-intel-hda-ctrl-re-add-sleep-after-entering-.patch b/queue-6.2/asoc-sof-intel-hda-ctrl-re-add-sleep-after-entering-.patch new file mode 100644 index 00000000000..ff080d48fe9 --- /dev/null +++ b/queue-6.2/asoc-sof-intel-hda-ctrl-re-add-sleep-after-entering-.patch @@ -0,0 +1,55 @@ +From c00693a56213ed307f6de1f8a6da5bc62ca38218 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:54:12 +0200 +Subject: ASoC: SOF: Intel: hda-ctrl: re-add sleep after entering and exiting + reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit 8bac40b8ed17ab1be9133e9620f65fae80262b7e ] + +This reverts commit a09d82ce0a867 ("ASoC: SOF: Intel: hda-ctrl: remove +useless sleep") + +It was a mistake to remove those delays, in light of comments in the +HDaudio spec captured in snd_hdac_bus_reset_link() that the codec +needs time for its initialization and PLL lock. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Péter Ujfalusi +Reviewed-by: Rander Wang +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307095412.3416-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-ctrl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/sof/intel/hda-ctrl.c b/sound/soc/sof/intel/hda-ctrl.c +index 3aea36c077c9d..f3bdeba284122 100644 +--- a/sound/soc/sof/intel/hda-ctrl.c ++++ b/sound/soc/sof/intel/hda-ctrl.c +@@ -196,12 +196,15 @@ int hda_dsp_ctrl_init_chip(struct snd_sof_dev *sdev) + goto err; + } + ++ usleep_range(500, 1000); ++ + /* exit HDA controller reset */ + ret = hda_dsp_ctrl_link_reset(sdev, false); + if (ret < 0) { + dev_err(sdev->dev, "error: failed to exit HDA controller reset\n"); + goto err; + } ++ usleep_range(1000, 1200); + + hda_codec_detect_mask(sdev); + +-- +2.39.2 + diff --git a/queue-6.2/asoc-sof-intel-hda-dsp-harden-d0i3-programming-seque.patch b/queue-6.2/asoc-sof-intel-hda-dsp-harden-d0i3-programming-seque.patch new file mode 100644 index 00000000000..7da82fa41d7 --- /dev/null +++ b/queue-6.2/asoc-sof-intel-hda-dsp-harden-d0i3-programming-seque.patch @@ -0,0 +1,61 @@ +From d0604453e3aa7de3bb17fa8705b8ebd0aa45d8d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:54:52 +0200 +Subject: ASoC: SOF: Intel: hda-dsp: harden D0i3 programming sequence +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rander Wang + +[ Upstream commit 52a55779ed14792a150421339664193d6eb8e036 ] + +Add delay between set and wait command according to hardware programming +sequence. Also add debug log to detect error. + +Signed-off-by: Rander Wang +Reviewed-by: Péter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Reviewed-by: Ranjani Sridharan +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307095453.3719-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dsp.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c +index b4eacae8564c8..6b2094f74c9c0 100644 +--- a/sound/soc/sof/intel/hda-dsp.c ++++ b/sound/soc/sof/intel/hda-dsp.c +@@ -399,6 +399,12 @@ static int hda_dsp_update_d0i3c_register(struct snd_sof_dev *sdev, u8 value) + snd_sof_dsp_update8(sdev, HDA_DSP_HDA_BAR, chip->d0i3_offset, + SOF_HDA_VS_D0I3C_I3, value); + ++ /* ++ * The value written to the D0I3C::I3 bit may not be taken into account immediately. ++ * A delay is recommended before checking if D0I3C::CIP is cleared ++ */ ++ usleep_range(30, 40); ++ + /* Wait for cmd in progress to be cleared before exiting the function */ + ret = hda_dsp_wait_d0i3c_done(sdev); + if (ret < 0) { +@@ -407,6 +413,12 @@ static int hda_dsp_update_d0i3c_register(struct snd_sof_dev *sdev, u8 value) + } + + reg = snd_sof_dsp_read8(sdev, HDA_DSP_HDA_BAR, chip->d0i3_offset); ++ /* Confirm d0i3 state changed with paranoia check */ ++ if ((reg ^ value) & SOF_HDA_VS_D0I3C_I3) { ++ dev_err(sdev->dev, "failed to update D0I3C!\n"); ++ return -EIO; ++ } ++ + trace_sof_intel_D0I3C_updated(sdev, reg); + + return 0; +-- +2.39.2 + diff --git a/queue-6.2/asoc-sof-intel-pci-tng-revert-invalid-bar-size-setti.patch b/queue-6.2/asoc-sof-intel-pci-tng-revert-invalid-bar-size-setti.patch new file mode 100644 index 00000000000..30d747e5d1c --- /dev/null +++ b/queue-6.2/asoc-sof-intel-pci-tng-revert-invalid-bar-size-setti.patch @@ -0,0 +1,60 @@ +From 1e61114842fd535f51bbdd7fe35d52d4f7f0336a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:53:41 +0200 +Subject: ASoC: SOF: Intel: pci-tng: revert invalid bar size setting +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit ca09e2a351fbc7836ba9418304ff0c3e72addfe0 ] + +The logic for the ioremap is to find the resource index 3 (IRAM) and +infer the BAR address by subtracting the IRAM offset. The BAR size +defined in hardware specifications is 2MB. + +The commit 5947b2726beb6 ("ASoC: SOF: Intel: Check the bar size before +remapping") tried to find the BAR size by querying the resource length +instead of a pre-canned value, but by requesting the size for index 3 +it only gets the size of the IRAM. That's obviously wrong and prevents +the probe from proceeding. + +This commit attempted to fix an issue in a fuzzing/simulated +environment but created another on actual devices, so the best course +of action is to revert that change. + +Reported-by: Ferry Toth +Tested-by: Ferry Toth (Intel Edison-Arduino) +Link: https://github.com/thesofproject/linux/issues/3901 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Reviewed-by: Ranjani Sridharan +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307095341.3222-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/pci-tng.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/sound/soc/sof/intel/pci-tng.c b/sound/soc/sof/intel/pci-tng.c +index 5b2b409752c58..8c22a00266c06 100644 +--- a/sound/soc/sof/intel/pci-tng.c ++++ b/sound/soc/sof/intel/pci-tng.c +@@ -75,11 +75,7 @@ static int tangier_pci_probe(struct snd_sof_dev *sdev) + + /* LPE base */ + base = pci_resource_start(pci, desc->resindex_lpe_base) - IRAM_OFFSET; +- size = pci_resource_len(pci, desc->resindex_lpe_base); +- if (size < PCI_BAR_SIZE) { +- dev_err(sdev->dev, "error: I/O region is too small.\n"); +- return -ENODEV; +- } ++ size = PCI_BAR_SIZE; + + dev_dbg(sdev->dev, "LPE PHY base at 0x%x size 0x%x", base, size); + sdev->bar[DSP_BAR] = devm_ioremap(sdev->dev, base, size); +-- +2.39.2 + diff --git a/queue-6.2/asoc-sof-ipc3-check-for-upper-size-limit-for-the-rec.patch b/queue-6.2/asoc-sof-ipc3-check-for-upper-size-limit-for-the-rec.patch new file mode 100644 index 00000000000..ebe9637543d --- /dev/null +++ b/queue-6.2/asoc-sof-ipc3-check-for-upper-size-limit-for-the-rec.patch @@ -0,0 +1,45 @@ +From 606a7a34d4279e7fa657e52671b69c00b590e6ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 13:49:17 +0200 +Subject: ASoC: SOF: ipc3: Check for upper size limit for the received message + +From: Peter Ujfalusi + +[ Upstream commit 989a3e4479177d0f4afab8be1960731bc0ffbbd0 ] + +The sof_ipc3_rx_msg() checks for minimum size of a new rx message but it is +missing the check for upper limit. +Corrupted or compromised firmware might be able to take advantage of this +to cause out of bounds reads outside of the message area. + +Reported-by: Curtis Malainey +Signed-off-by: Peter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Curtis Malainey +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307114917.5124-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc3.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sof/ipc3.c b/sound/soc/sof/ipc3.c +index 1fef4dcc09368..fde8af5a1f485 100644 +--- a/sound/soc/sof/ipc3.c ++++ b/sound/soc/sof/ipc3.c +@@ -970,8 +970,9 @@ static void sof_ipc3_rx_msg(struct snd_sof_dev *sdev) + return; + } + +- if (hdr.size < sizeof(hdr)) { +- dev_err(sdev->dev, "The received message size is invalid\n"); ++ if (hdr.size < sizeof(hdr) || hdr.size > SOF_IPC_MSG_MAX_SIZE) { ++ dev_err(sdev->dev, "The received message size is invalid: %u\n", ++ hdr.size); + return; + } + +-- +2.39.2 + diff --git a/queue-6.2/asoc-sof-ipc4-topology-fix-incorrect-sample-rate-pri.patch b/queue-6.2/asoc-sof-ipc4-topology-fix-incorrect-sample-rate-pri.patch new file mode 100644 index 00000000000..132f311cdbd --- /dev/null +++ b/queue-6.2/asoc-sof-ipc4-topology-fix-incorrect-sample-rate-pri.patch @@ -0,0 +1,39 @@ +From fe2fb26c253f0dda78360d5ce47bcd1ea52e098d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 13:07:51 +0200 +Subject: ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit + +From: Seppo Ingalsuo + +[ Upstream commit 9e269e3aa9006440de639597079ee7140ef5b5f3 ] + +This patch fixes the sample rate print unit from KHz to Hz. +E.g. 48000KHz becomes 48000Hz. + +Signed-off-by: Seppo Ingalsuo +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307110751.2053-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-topology.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index 59f4d42f9011e..65da1cf790d9c 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -155,7 +155,7 @@ static void sof_ipc4_dbg_audio_format(struct device *dev, + for (i = 0; i < num_format; i++, ptr = (u8 *)ptr + object_size) { + fmt = ptr; + dev_dbg(dev, +- " #%d: %uKHz, %ubit (ch_map %#x ch_cfg %u interleaving_style %u fmt_cfg %#x)\n", ++ " #%d: %uHz, %ubit (ch_map %#x ch_cfg %u interleaving_style %u fmt_cfg %#x)\n", + i, fmt->sampling_frequency, fmt->bit_depth, fmt->ch_map, + fmt->ch_cfg, fmt->interleaving_style, fmt->fmt_cfg); + } +-- +2.39.2 + diff --git a/queue-6.2/asoc-sof-ipc4-update-gain-ipc-msg-definition-to-alig.patch b/queue-6.2/asoc-sof-ipc4-update-gain-ipc-msg-definition-to-alig.patch new file mode 100644 index 00000000000..6f52962a643 --- /dev/null +++ b/queue-6.2/asoc-sof-ipc4-update-gain-ipc-msg-definition-to-alig.patch @@ -0,0 +1,103 @@ +From 5f321135d28e807ba23620a4edc93e7ce5447d62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 13:06:56 +0200 +Subject: ASoC: SOF: IPC4: update gain ipc msg definition to align with fw +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rander Wang + +[ Upstream commit e45cd86c3a78bfb9875a5eb8ab5dab459b59bbe2 ] + +Recent firmware changes modified the curve duration from 32 to 64 bits, +which breaks volume ramps. A simple solution would be to change the +definition, but unfortunately the ASoC topology framework only supports +up to 32 bit tokens. + +This patch suggests breaking the 64 bit value in low and high parts, with +only the low-part extracted from topology and high-part only zeroes. Since +the curve duration is represented in hundred of nanoseconds, we can still +represent a 400s ramp, which is just fine. The defacto ABI change has no +effect on existing users since the IPC4 firmware has not been released just +yet. + +Link: https://github.com/thesofproject/linux/issues/4026 + +Signed-off-by: Rander Wang +Reviewed-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Péter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20230307110656.1816-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc4-control.c | 3 ++- + sound/soc/sof/ipc4-topology.c | 4 ++-- + sound/soc/sof/ipc4-topology.h | 6 ++++-- + 3 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c +index 0d5a578c34962..7442ec1c5a4d4 100644 +--- a/sound/soc/sof/ipc4-control.c ++++ b/sound/soc/sof/ipc4-control.c +@@ -84,7 +84,8 @@ sof_ipc4_set_volume_data(struct snd_sof_dev *sdev, struct snd_sof_widget *swidge + } + + /* set curve type and duration from topology */ +- data.curve_duration = gain->data.curve_duration; ++ data.curve_duration_l = gain->data.curve_duration_l; ++ data.curve_duration_h = gain->data.curve_duration_h; + data.curve_type = gain->data.curve_type; + + msg->data_ptr = &data; +diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c +index 65da1cf790d9c..6da6137fa2cbc 100644 +--- a/sound/soc/sof/ipc4-topology.c ++++ b/sound/soc/sof/ipc4-topology.c +@@ -107,7 +107,7 @@ static const struct sof_topology_token gain_tokens[] = { + get_token_u32, offsetof(struct sof_ipc4_gain_data, curve_type)}, + {SOF_TKN_GAIN_RAMP_DURATION, + SND_SOC_TPLG_TUPLE_TYPE_WORD, get_token_u32, +- offsetof(struct sof_ipc4_gain_data, curve_duration)}, ++ offsetof(struct sof_ipc4_gain_data, curve_duration_l)}, + {SOF_TKN_GAIN_VAL, SND_SOC_TPLG_TUPLE_TYPE_WORD, + get_token_u32, offsetof(struct sof_ipc4_gain_data, init_val)}, + }; +@@ -670,7 +670,7 @@ static int sof_ipc4_widget_setup_comp_pga(struct snd_sof_widget *swidget) + + dev_dbg(scomp->dev, + "pga widget %s: ramp type: %d, ramp duration %d, initial gain value: %#x, cpc %d\n", +- swidget->widget->name, gain->data.curve_type, gain->data.curve_duration, ++ swidget->widget->name, gain->data.curve_type, gain->data.curve_duration_l, + gain->data.init_val, gain->base_config.cpc); + + ret = sof_ipc4_widget_setup_msg(swidget, &gain->msg); +diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h +index 2363a7cc0b57d..cf9d278524572 100644 +--- a/sound/soc/sof/ipc4-topology.h ++++ b/sound/soc/sof/ipc4-topology.h +@@ -217,14 +217,16 @@ struct sof_ipc4_control_data { + * @init_val: Initial value + * @curve_type: Curve type + * @reserved: reserved for future use +- * @curve_duration: Curve duration ++ * @curve_duration_l: Curve duration low part ++ * @curve_duration_h: Curve duration high part + */ + struct sof_ipc4_gain_data { + uint32_t channels; + uint32_t init_val; + uint32_t curve_type; + uint32_t reserved; +- uint32_t curve_duration; ++ uint32_t curve_duration_l; ++ uint32_t curve_duration_h; + } __aligned(8); + + /** +-- +2.39.2 + diff --git a/queue-6.2/cifs-fix-missing-unload_nls-in-smb2_reconnect.patch b/queue-6.2/cifs-fix-missing-unload_nls-in-smb2_reconnect.patch new file mode 100644 index 00000000000..1d9b9f42da3 --- /dev/null +++ b/queue-6.2/cifs-fix-missing-unload_nls-in-smb2_reconnect.patch @@ -0,0 +1,54 @@ +From 00c823efb4eba37bf739ef817726142cbdc0f8e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 16:05:19 -0300 +Subject: cifs: fix missing unload_nls() in smb2_reconnect() + +From: Paulo Alcantara + +[ Upstream commit c24bb1a87dc3f2d77d410eaac2c6a295961bf50e ] + +Make sure to unload_nls() @nls_codepage if we no longer need it. + +Fixes: bc962159e8e3 ("cifs: avoid race conditions with parallel reconnects") +Signed-off-by: Paulo Alcantara (SUSE) +Cc: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index f0b1ae0835d71..b37379b62cc77 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -144,7 +144,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + struct TCP_Server_Info *server) + { + int rc = 0; +- struct nls_table *nls_codepage; ++ struct nls_table *nls_codepage = NULL; + struct cifs_ses *ses; + + /* +@@ -216,8 +216,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + tcon->ses->chans_need_reconnect, + tcon->need_reconnect); + +- nls_codepage = load_nls_default(); +- + mutex_lock(&ses->session_mutex); + /* + * Recheck after acquire mutex. If another thread is negotiating +@@ -237,6 +235,8 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + } + spin_unlock(&server->srv_lock); + ++ nls_codepage = load_nls_default(); ++ + /* + * need to prevent multiple threads trying to simultaneously + * reconnect the same SMB session +-- +2.39.2 + diff --git a/queue-6.2/drm-amd-display-fix-hdcp-failing-to-enable-after-sus.patch b/queue-6.2/drm-amd-display-fix-hdcp-failing-to-enable-after-sus.patch new file mode 100644 index 00000000000..549c52fba96 --- /dev/null +++ b/queue-6.2/drm-amd-display-fix-hdcp-failing-to-enable-after-sus.patch @@ -0,0 +1,48 @@ +From e98e1877962ac924efdd7e305d07ae32fe98b098 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 16:08:21 -0500 +Subject: drm/amd/display: Fix HDCP failing to enable after suspend + +From: Bhawanpreet Lakha + +[ Upstream commit 728cefa53a36ba378ed4a7f31a0c08289687d824 ] + +[Why] +On resume some displays are not ready for HDCP, so they will fail if we +start the hdcp authentintication too soon. + +Add a delay so that the displays can be ready before we start. + +NOTE: Previoulsy this delay was set to 3 seconds but it was causing +issues with compliance, 2 seconds should enough for compliance and the +s3 resume case. + +[How] +Change the Delay to 2 seconds. + +Reviewed-by: Aurabindo Pillai +Acked-by: Qingqing Zhuo +Signed-off-by: Bhawanpreet Lakha +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +index a7fd98f57f94c..dc62375a8e2c4 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +@@ -495,7 +495,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config) + link->dp.mst_enabled = config->mst_enabled; + link->dp.usb4_enabled = config->usb4_enabled; + display->adjust.disable = MOD_HDCP_DISPLAY_DISABLE_AUTHENTICATION; +- link->adjust.auth_delay = 0; ++ link->adjust.auth_delay = 2; + link->adjust.hdcp1.disable = 0; + conn_state = aconnector->base.state; + +-- +2.39.2 + diff --git a/queue-6.2/drm-amdgpu-vcn-custom-video-info-caps-for-sriov.patch b/queue-6.2/drm-amdgpu-vcn-custom-video-info-caps-for-sriov.patch new file mode 100644 index 00000000000..1fff1898b1f --- /dev/null +++ b/queue-6.2/drm-amdgpu-vcn-custom-video-info-caps-for-sriov.patch @@ -0,0 +1,191 @@ +From 09b46fb0ad74b0a493cbfcda8e7eaeb99f5835fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 18:48:41 +0800 +Subject: drm/amdgpu/vcn: custom video info caps for sriov + +From: Jane Jian + +[ Upstream commit d71e38df3b730a17ab6b25cabb2ccfe8a7f04385 ] + +for sriov, we added a new flag to indicate av1 support, +this will override the original caps info. + +Signed-off-by: Jane Jian +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 4 + + drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 3 +- + drivers/gpu/drm/amd/amdgpu/soc21.c | 103 ++++++++++++++++++-- + 3 files changed, 99 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +index 2b9d806e23afb..10a0a510910b6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +@@ -123,6 +123,8 @@ enum AMDGIM_FEATURE_FLAG { + AMDGIM_FEATURE_PP_ONE_VF = (1 << 4), + /* Indirect Reg Access enabled */ + AMDGIM_FEATURE_INDIRECT_REG_ACCESS = (1 << 5), ++ /* AV1 Support MODE*/ ++ AMDGIM_FEATURE_AV1_SUPPORT = (1 << 6), + }; + + enum AMDGIM_REG_ACCESS_FLAG { +@@ -321,6 +323,8 @@ static inline bool is_virtual_machine(void) + ((!amdgpu_in_reset(adev)) && adev->virt.tdr_debug) + #define amdgpu_sriov_is_normal(adev) \ + ((!amdgpu_in_reset(adev)) && (!adev->virt.tdr_debug)) ++#define amdgpu_sriov_is_av1_support(adev) \ ++ ((adev)->virt.gim_feature & AMDGIM_FEATURE_AV1_SUPPORT) + bool amdgpu_virt_mmio_blocked(struct amdgpu_device *adev); + void amdgpu_virt_init_setting(struct amdgpu_device *adev); + void amdgpu_virt_kiq_reg_write_reg_wait(struct amdgpu_device *adev, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h +index 6c97148ca0ed3..24d42d24e6a01 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h +@@ -93,7 +93,8 @@ union amd_sriov_msg_feature_flags { + uint32_t mm_bw_management : 1; + uint32_t pp_one_vf_mode : 1; + uint32_t reg_indirect_acc : 1; +- uint32_t reserved : 26; ++ uint32_t av1_support : 1; ++ uint32_t reserved : 25; + } flags; + uint32_t all; + }; +diff --git a/drivers/gpu/drm/amd/amdgpu/soc21.c b/drivers/gpu/drm/amd/amdgpu/soc21.c +index 3d938b52178e3..9eedc1a1494c0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc21.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c +@@ -101,6 +101,59 @@ static const struct amdgpu_video_codecs vcn_4_0_0_video_codecs_decode_vcn1 = + .codec_array = vcn_4_0_0_video_codecs_decode_array_vcn1, + }; + ++/* SRIOV SOC21, not const since data is controlled by host */ ++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_encode_array_vcn0[] = { ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)}, ++}; ++ ++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_encode_array_vcn1[] = { ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)}, ++}; ++ ++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_encode_vcn0 = { ++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn0), ++ .codec_array = sriov_vcn_4_0_0_video_codecs_encode_array_vcn0, ++}; ++ ++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_encode_vcn1 = { ++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn1), ++ .codec_array = sriov_vcn_4_0_0_video_codecs_encode_array_vcn1, ++}; ++ ++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_decode_array_vcn0[] = { ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)}, ++}; ++ ++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_decode_array_vcn1[] = { ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)}, ++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)}, ++}; ++ ++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_decode_vcn0 = { ++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn0), ++ .codec_array = sriov_vcn_4_0_0_video_codecs_decode_array_vcn0, ++}; ++ ++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_decode_vcn1 = { ++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn1), ++ .codec_array = sriov_vcn_4_0_0_video_codecs_decode_array_vcn1, ++}; ++ + static int soc21_query_video_codecs(struct amdgpu_device *adev, bool encode, + const struct amdgpu_video_codecs **codecs) + { +@@ -111,16 +164,31 @@ static int soc21_query_video_codecs(struct amdgpu_device *adev, bool encode, + case IP_VERSION(4, 0, 0): + case IP_VERSION(4, 0, 2): + case IP_VERSION(4, 0, 4): +- if (adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) { +- if (encode) +- *codecs = &vcn_4_0_0_video_codecs_encode_vcn1; +- else +- *codecs = &vcn_4_0_0_video_codecs_decode_vcn1; ++ if (amdgpu_sriov_vf(adev)) { ++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) || ++ !amdgpu_sriov_is_av1_support(adev)) { ++ if (encode) ++ *codecs = &sriov_vcn_4_0_0_video_codecs_encode_vcn1; ++ else ++ *codecs = &sriov_vcn_4_0_0_video_codecs_decode_vcn1; ++ } else { ++ if (encode) ++ *codecs = &sriov_vcn_4_0_0_video_codecs_encode_vcn0; ++ else ++ *codecs = &sriov_vcn_4_0_0_video_codecs_decode_vcn0; ++ } + } else { +- if (encode) +- *codecs = &vcn_4_0_0_video_codecs_encode_vcn0; +- else +- *codecs = &vcn_4_0_0_video_codecs_decode_vcn0; ++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)) { ++ if (encode) ++ *codecs = &vcn_4_0_0_video_codecs_encode_vcn1; ++ else ++ *codecs = &vcn_4_0_0_video_codecs_decode_vcn1; ++ } else { ++ if (encode) ++ *codecs = &vcn_4_0_0_video_codecs_encode_vcn0; ++ else ++ *codecs = &vcn_4_0_0_video_codecs_decode_vcn0; ++ } + } + return 0; + default: +@@ -729,8 +797,23 @@ static int soc21_common_late_init(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + +- if (amdgpu_sriov_vf(adev)) ++ if (amdgpu_sriov_vf(adev)) { + xgpu_nv_mailbox_get_irq(adev); ++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) || ++ !amdgpu_sriov_is_av1_support(adev)) { ++ amdgpu_virt_update_sriov_video_codec(adev, ++ sriov_vcn_4_0_0_video_codecs_encode_array_vcn1, ++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn1), ++ sriov_vcn_4_0_0_video_codecs_decode_array_vcn1, ++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn1)); ++ } else { ++ amdgpu_virt_update_sriov_video_codec(adev, ++ sriov_vcn_4_0_0_video_codecs_encode_array_vcn0, ++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn0), ++ sriov_vcn_4_0_0_video_codecs_decode_array_vcn0, ++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn0)); ++ } ++ } + + return 0; + } +-- +2.39.2 + diff --git a/queue-6.2/drm-amdkfd-fix-a-potential-double-free-in-pqm_create.patch b/queue-6.2/drm-amdkfd-fix-a-potential-double-free-in-pqm_create.patch new file mode 100644 index 00000000000..29041a80157 --- /dev/null +++ b/queue-6.2/drm-amdkfd-fix-a-potential-double-free-in-pqm_create.patch @@ -0,0 +1,39 @@ +From 79bf9860fa6c3c3a55179ce4931cda26298a6d98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 16:19:02 -0800 +Subject: drm/amdkfd: fix a potential double free in pqm_create_queue + +From: Chia-I Wu + +[ Upstream commit b2ca5c5d416b4e72d1e9d0293fc720e2d525fd42 ] + +Set *q to NULL on errors, otherwise pqm_create_queue would free it +again. + +Signed-off-by: Chia-I Wu +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +index 5137476ec18e6..4236539d9f932 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +@@ -218,8 +218,8 @@ static int init_user_queue(struct process_queue_manager *pqm, + return 0; + + cleanup: +- if (dev->shared_resources.enable_mes) +- uninit_queue(*q); ++ uninit_queue(*q); ++ *q = NULL; + return retval; + } + +-- +2.39.2 + diff --git a/queue-6.2/drm-amdkfd-fix-bo-offset-for-multi-vma-page-migratio.patch b/queue-6.2/drm-amdkfd-fix-bo-offset-for-multi-vma-page-migratio.patch new file mode 100644 index 00000000000..a1617bb3269 --- /dev/null +++ b/queue-6.2/drm-amdkfd-fix-bo-offset-for-multi-vma-page-migratio.patch @@ -0,0 +1,109 @@ +From 0993c8b8025394c19d5f59565adc7b270f75a353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 10:21:06 -0600 +Subject: drm/amdkfd: Fix BO offset for multi-VMA page migration + +From: Xiaogang Chen + +[ Upstream commit b4ee9606378bb9520c94d8b96f0305c3696f5c29 ] + +svm_migrate_ram_to_vram migrates a prange from sys ram to vram. The prange may +cross multiple vma. Need remember current dst vram offset in the TTM resource for +each migration. + +v2: squash in warning fix (Alex) + +Signed-off-by: Xiaogang Chen +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +index 10048ce16aea4..5c319007b4701 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c +@@ -289,7 +289,7 @@ static unsigned long svm_migrate_unsuccessful_pages(struct migrate_vma *migrate) + static int + svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + struct migrate_vma *migrate, struct dma_fence **mfence, +- dma_addr_t *scratch) ++ dma_addr_t *scratch, uint64_t ttm_res_offset) + { + uint64_t npages = migrate->npages; + struct device *dev = adev->dev; +@@ -299,8 +299,8 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + uint64_t i, j; + int r; + +- pr_debug("svms 0x%p [0x%lx 0x%lx]\n", prange->svms, prange->start, +- prange->last); ++ pr_debug("svms 0x%p [0x%lx 0x%lx 0x%llx]\n", prange->svms, prange->start, ++ prange->last, ttm_res_offset); + + src = scratch; + dst = (uint64_t *)(scratch + npages); +@@ -311,7 +311,7 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + goto out; + } + +- amdgpu_res_first(prange->ttm_res, prange->offset << PAGE_SHIFT, ++ amdgpu_res_first(prange->ttm_res, ttm_res_offset, + npages << PAGE_SHIFT, &cursor); + for (i = j = 0; i < npages; i++) { + struct page *spage; +@@ -398,7 +398,7 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + static long + svm_migrate_vma_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + struct vm_area_struct *vma, uint64_t start, +- uint64_t end, uint32_t trigger) ++ uint64_t end, uint32_t trigger, uint64_t ttm_res_offset) + { + struct kfd_process *p = container_of(prange->svms, struct kfd_process, svms); + uint64_t npages = (end - start) >> PAGE_SHIFT; +@@ -451,7 +451,7 @@ svm_migrate_vma_to_vram(struct amdgpu_device *adev, struct svm_range *prange, + else + pr_debug("0x%lx pages migrated\n", cpages); + +- r = svm_migrate_copy_to_vram(adev, prange, &migrate, &mfence, scratch); ++ r = svm_migrate_copy_to_vram(adev, prange, &migrate, &mfence, scratch, ttm_res_offset); + migrate_vma_pages(&migrate); + + pr_debug("successful/cpages/npages 0x%lx/0x%lx/0x%lx\n", +@@ -499,6 +499,7 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + unsigned long addr, start, end; + struct vm_area_struct *vma; + struct amdgpu_device *adev; ++ uint64_t ttm_res_offset; + unsigned long cpages = 0; + long r = 0; + +@@ -519,6 +520,7 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + + start = prange->start << PAGE_SHIFT; + end = (prange->last + 1) << PAGE_SHIFT; ++ ttm_res_offset = prange->offset << PAGE_SHIFT; + + for (addr = start; addr < end;) { + unsigned long next; +@@ -528,13 +530,14 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc, + break; + + next = min(vma->vm_end, end); +- r = svm_migrate_vma_to_vram(adev, prange, vma, addr, next, trigger); ++ r = svm_migrate_vma_to_vram(adev, prange, vma, addr, next, trigger, ttm_res_offset); + if (r < 0) { + pr_debug("failed %ld to migrate\n", r); + break; + } else { + cpages += r; + } ++ ttm_res_offset += next - addr; + addr = next; + } + +-- +2.39.2 + diff --git a/queue-6.2/drm-amdkfd-fix-potential-kgd_mem-uafs.patch b/queue-6.2/drm-amdkfd-fix-potential-kgd_mem-uafs.patch new file mode 100644 index 00000000000..94654bc8d05 --- /dev/null +++ b/queue-6.2/drm-amdkfd-fix-potential-kgd_mem-uafs.patch @@ -0,0 +1,98 @@ +From a22bb3b87b6c0bdc68489a8b0fcde65f0449e650 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 13:37:24 -0800 +Subject: drm/amdkfd: fix potential kgd_mem UAFs + +From: Chia-I Wu + +[ Upstream commit 9da050b0d9e04439d225a2ec3044af70cdfb3933 ] + +kgd_mem pointers returned by kfd_process_device_translate_handle are +only guaranteed to be valid while p->mutex is held. As soon as the mutex +is unlocked, another thread can free the BO. + +Signed-off-by: Chia-I Wu +Signed-off-by: Felix Kuehling +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +index f79b8e964140e..e191d38f3da62 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -1298,14 +1298,14 @@ static int kfd_ioctl_map_memory_to_gpu(struct file *filep, + args->n_success = i+1; + } + +- mutex_unlock(&p->mutex); +- + err = amdgpu_amdkfd_gpuvm_sync_memory(dev->adev, (struct kgd_mem *) mem, true); + if (err) { + pr_debug("Sync memory failed, wait interrupted by user signal\n"); + goto sync_memory_failed; + } + ++ mutex_unlock(&p->mutex); ++ + /* Flush TLBs after waiting for the page table updates to complete */ + for (i = 0; i < args->n_devices; i++) { + peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]); +@@ -1321,9 +1321,9 @@ static int kfd_ioctl_map_memory_to_gpu(struct file *filep, + bind_process_to_device_failed: + get_mem_obj_from_handle_failed: + map_memory_to_gpu_failed: ++sync_memory_failed: + mutex_unlock(&p->mutex); + copy_from_user_failed: +-sync_memory_failed: + kfree(devices_arr); + + return err; +@@ -1337,6 +1337,7 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep, + void *mem; + long err = 0; + uint32_t *devices_arr = NULL, i; ++ bool flush_tlb; + + if (!args->n_devices) { + pr_debug("Device IDs array empty\n"); +@@ -1389,16 +1390,19 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep, + } + args->n_success = i+1; + } +- mutex_unlock(&p->mutex); + +- if (kfd_flush_tlb_after_unmap(pdd->dev)) { ++ flush_tlb = kfd_flush_tlb_after_unmap(pdd->dev); ++ if (flush_tlb) { + err = amdgpu_amdkfd_gpuvm_sync_memory(pdd->dev->adev, + (struct kgd_mem *) mem, true); + if (err) { + pr_debug("Sync memory failed, wait interrupted by user signal\n"); + goto sync_memory_failed; + } ++ } ++ mutex_unlock(&p->mutex); + ++ if (flush_tlb) { + /* Flush TLBs after waiting for the page table updates to complete */ + for (i = 0; i < args->n_devices; i++) { + peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]); +@@ -1414,9 +1418,9 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep, + bind_process_to_device_failed: + get_mem_obj_from_handle_failed: + unmap_memory_from_gpu_failed: ++sync_memory_failed: + mutex_unlock(&p->mutex); + copy_from_user_failed: +-sync_memory_failed: + kfree(devices_arr); + return err; + } +-- +2.39.2 + diff --git a/queue-6.2/drm-amdkfd-fixed-kfd_process-cleanup-on-module-exit.patch b/queue-6.2/drm-amdkfd-fixed-kfd_process-cleanup-on-module-exit.patch new file mode 100644 index 00000000000..710460f1169 --- /dev/null +++ b/queue-6.2/drm-amdkfd-fixed-kfd_process-cleanup-on-module-exit.patch @@ -0,0 +1,150 @@ +From 81e2ee644325118a3526cb75c61beb3c1ce48ff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 14:11:24 -0500 +Subject: drm/amdkfd: Fixed kfd_process cleanup on module exit. + +From: David Belanger + +[ Upstream commit 20bc9f76b6a2455c6b54b91ae7634f147f64987f ] + +Handle case when module is unloaded (kfd_exit) before a process space +(mm_struct) is released. + +v2: Fixed potential race conditions by removing all kfd_process from +the process table first, then working on releasing the resources. + +v3: Fixed loop element access / synchronization. Fixed extra empty lines. + +Signed-off-by: David Belanger +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_module.c | 1 + + drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 1 + + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 67 +++++++++++++++++++++--- + 3 files changed, 62 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +index 09b966dc37681..aee2212e52f69 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +@@ -77,6 +77,7 @@ static int kfd_init(void) + + static void kfd_exit(void) + { ++ kfd_cleanup_processes(); + kfd_debugfs_fini(); + kfd_process_destroy_wq(); + kfd_procfs_shutdown(); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +index 552c3ac85a132..7dc55919993c0 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +@@ -926,6 +926,7 @@ bool kfd_dev_is_large_bar(struct kfd_dev *dev); + + int kfd_process_create_wq(void); + void kfd_process_destroy_wq(void); ++void kfd_cleanup_processes(void); + struct kfd_process *kfd_create_process(struct file *filep); + struct kfd_process *kfd_get_process(const struct task_struct *task); + struct kfd_process *kfd_lookup_process_by_pasid(u32 pasid); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index 51b1683ac5c1e..4d9f2d1c49b1d 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -1167,6 +1167,17 @@ static void kfd_process_free_notifier(struct mmu_notifier *mn) + kfd_unref_process(container_of(mn, struct kfd_process, mmu_notifier)); + } + ++static void kfd_process_notifier_release_internal(struct kfd_process *p) ++{ ++ cancel_delayed_work_sync(&p->eviction_work); ++ cancel_delayed_work_sync(&p->restore_work); ++ ++ /* Indicate to other users that MM is no longer valid */ ++ p->mm = NULL; ++ ++ mmu_notifier_put(&p->mmu_notifier); ++} ++ + static void kfd_process_notifier_release(struct mmu_notifier *mn, + struct mm_struct *mm) + { +@@ -1181,17 +1192,22 @@ static void kfd_process_notifier_release(struct mmu_notifier *mn, + return; + + mutex_lock(&kfd_processes_mutex); ++ /* ++ * Do early return if table is empty. ++ * ++ * This could potentially happen if this function is called concurrently ++ * by mmu_notifier and by kfd_cleanup_pocesses. ++ * ++ */ ++ if (hash_empty(kfd_processes_table)) { ++ mutex_unlock(&kfd_processes_mutex); ++ return; ++ } + hash_del_rcu(&p->kfd_processes); + mutex_unlock(&kfd_processes_mutex); + synchronize_srcu(&kfd_processes_srcu); + +- cancel_delayed_work_sync(&p->eviction_work); +- cancel_delayed_work_sync(&p->restore_work); +- +- /* Indicate to other users that MM is no longer valid */ +- p->mm = NULL; +- +- mmu_notifier_put(&p->mmu_notifier); ++ kfd_process_notifier_release_internal(p); + } + + static const struct mmu_notifier_ops kfd_process_mmu_notifier_ops = { +@@ -1200,6 +1216,43 @@ static const struct mmu_notifier_ops kfd_process_mmu_notifier_ops = { + .free_notifier = kfd_process_free_notifier, + }; + ++/* ++ * This code handles the case when driver is being unloaded before all ++ * mm_struct are released. We need to safely free the kfd_process and ++ * avoid race conditions with mmu_notifier that might try to free them. ++ * ++ */ ++void kfd_cleanup_processes(void) ++{ ++ struct kfd_process *p; ++ struct hlist_node *p_temp; ++ unsigned int temp; ++ HLIST_HEAD(cleanup_list); ++ ++ /* ++ * Move all remaining kfd_process from the process table to a ++ * temp list for processing. Once done, callback from mmu_notifier ++ * release will not see the kfd_process in the table and do early return, ++ * avoiding double free issues. ++ */ ++ mutex_lock(&kfd_processes_mutex); ++ hash_for_each_safe(kfd_processes_table, temp, p_temp, p, kfd_processes) { ++ hash_del_rcu(&p->kfd_processes); ++ synchronize_srcu(&kfd_processes_srcu); ++ hlist_add_head(&p->kfd_processes, &cleanup_list); ++ } ++ mutex_unlock(&kfd_processes_mutex); ++ ++ hlist_for_each_entry_safe(p, p_temp, &cleanup_list, kfd_processes) ++ kfd_process_notifier_release_internal(p); ++ ++ /* ++ * Ensures that all outstanding free_notifier get called, triggering ++ * the release of the kfd_process struct. ++ */ ++ mmu_notifier_synchronize(); ++} ++ + static int kfd_process_init_cwsr_apu(struct kfd_process *p, struct file *filep) + { + unsigned long offset; +-- +2.39.2 + diff --git a/queue-6.2/fbdev-au1200fb-fix-potential-divide-by-zero.patch b/queue-6.2/fbdev-au1200fb-fix-potential-divide-by-zero.patch new file mode 100644 index 00000000000..09fc19eb40c --- /dev/null +++ b/queue-6.2/fbdev-au1200fb-fix-potential-divide-by-zero.patch @@ -0,0 +1,39 @@ +From e90bf977ac4685331e7a815c2d05446324434312 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 09:22:54 +0000 +Subject: fbdev: au1200fb: Fix potential divide by zero + +From: Wei Chen + +[ Upstream commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb ] + +var->pixclock can be assigned to zero by user. Without +proper check, divide by zero would occur when invoking +macro PICOS2KHZ in au1200fb_fb_check_var. + +Error out if var->pixclock is zero. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/au1200fb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c +index 81c3154544287..b6b22fa4a8a01 100644 +--- a/drivers/video/fbdev/au1200fb.c ++++ b/drivers/video/fbdev/au1200fb.c +@@ -1040,6 +1040,9 @@ static int au1200fb_fb_check_var(struct fb_var_screeninfo *var, + u32 pixclock; + int screen_size, plane; + ++ if (!var->pixclock) ++ return -EINVAL; ++ + plane = fbdev->plane; + + /* Make sure that the mode respect all LCD controller and +-- +2.39.2 + diff --git a/queue-6.2/fbdev-intelfb-fix-potential-divide-by-zero.patch b/queue-6.2/fbdev-intelfb-fix-potential-divide-by-zero.patch new file mode 100644 index 00000000000..808cdde621b --- /dev/null +++ b/queue-6.2/fbdev-intelfb-fix-potential-divide-by-zero.patch @@ -0,0 +1,39 @@ +From 01d815b18f0135054f4ac7f2ef7bedc850315672 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 08:33:47 +0000 +Subject: fbdev: intelfb: Fix potential divide by zero + +From: Wei Chen + +[ Upstream commit d823685486a3446d061fed7c7d2f80af984f119a ] + +Variable var->pixclock is controlled by user and can be assigned +to zero. Without proper check, divide by zero would occur in +intelfbhw_validate_mode and intelfbhw_mode_to_hw. + +Error out if var->pixclock is zero. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/intelfb/intelfbdrv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c +index 0a9e5067b2010..a81095b2b1ea5 100644 +--- a/drivers/video/fbdev/intelfb/intelfbdrv.c ++++ b/drivers/video/fbdev/intelfb/intelfbdrv.c +@@ -1222,6 +1222,9 @@ static int intelfb_check_var(struct fb_var_screeninfo *var, + + dinfo = GET_DINFO(info); + ++ if (!var->pixclock) ++ return -EINVAL; ++ + /* update the pitch */ + if (intelfbhw_validate_mode(dinfo, var) != 0) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-6.2/fbdev-lxfb-fix-potential-divide-by-zero.patch b/queue-6.2/fbdev-lxfb-fix-potential-divide-by-zero.patch new file mode 100644 index 00000000000..c04c3a36dfa --- /dev/null +++ b/queue-6.2/fbdev-lxfb-fix-potential-divide-by-zero.patch @@ -0,0 +1,38 @@ +From 253616073bf3e7c755079797aff37d6d0d336677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 09:05:18 +0000 +Subject: fbdev: lxfb: Fix potential divide by zero + +From: Wei Chen + +[ Upstream commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 ] + +var->pixclock can be assigned to zero by user. Without proper +check, divide by zero would occur in lx_set_clock. + +Error out if var->pixclock is zero. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/geode/lxfb_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/geode/lxfb_core.c b/drivers/video/fbdev/geode/lxfb_core.c +index 8130e9eee2b4b..556d8b1a9e06a 100644 +--- a/drivers/video/fbdev/geode/lxfb_core.c ++++ b/drivers/video/fbdev/geode/lxfb_core.c +@@ -235,6 +235,9 @@ static void get_modedb(struct fb_videomode **modedb, unsigned int *size) + + static int lxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + { ++ if (!var->pixclock) ++ return -EINVAL; ++ + if (var->xres > 1920 || var->yres > 1440) + return -EINVAL; + +-- +2.39.2 + diff --git a/queue-6.2/fbdev-nvidia-fix-potential-divide-by-zero.patch b/queue-6.2/fbdev-nvidia-fix-potential-divide-by-zero.patch new file mode 100644 index 00000000000..842f3f5e8bb --- /dev/null +++ b/queue-6.2/fbdev-nvidia-fix-potential-divide-by-zero.patch @@ -0,0 +1,40 @@ +From 4cd6c6b80b658ea7287f5d1f07dfc3c42d632139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 07:18:31 +0000 +Subject: fbdev: nvidia: Fix potential divide by zero + +From: Wei Chen + +[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ] + +variable var->pixclock can be set by user. In case it +equals to zero, divide by zero would occur in nvidiafb_set_par. + +Similar crashes have happened in other fbdev drivers. There +is no check and modification on var->pixclock along the call +chain to nvidia_check_var and nvidiafb_set_par. We believe it +could also be triggered in driver nvidia from user site. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/nvidia/nvidia.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c +index e60a276b4855d..ea4ba3dfb96bb 100644 +--- a/drivers/video/fbdev/nvidia/nvidia.c ++++ b/drivers/video/fbdev/nvidia/nvidia.c +@@ -764,6 +764,8 @@ static int nvidiafb_check_var(struct fb_var_screeninfo *var, + int pitch, err = 0; + + NVTRACE_ENTER(); ++ if (!var->pixclock) ++ return -EINVAL; + + var->transp.offset = 0; + var->transp.length = 0; +-- +2.39.2 + diff --git a/queue-6.2/fbdev-tgafb-fix-potential-divide-by-zero.patch b/queue-6.2/fbdev-tgafb-fix-potential-divide-by-zero.patch new file mode 100644 index 00000000000..e4364931810 --- /dev/null +++ b/queue-6.2/fbdev-tgafb-fix-potential-divide-by-zero.patch @@ -0,0 +1,44 @@ +From 14f89f6ea348b4102bb324191cfcb96d3b380541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 13:08:56 +0000 +Subject: fbdev: tgafb: Fix potential divide by zero + +From: Wei Chen + +[ Upstream commit f90bd245de82c095187d8c2cabb8b488a39eaecc ] + +fb_set_var would by called when user invokes ioctl with cmd +FBIOPUT_VSCREENINFO. User-provided data would finally reach +tgafb_check_var. In case var->pixclock is assigned to zero, +divide by zero would occur when checking whether reciprocal +of var->pixclock is too high. + +Similar crashes have happened in other fbdev drivers. There +is no check and modification on var->pixclock along the call +chain to tgafb_check_var. We believe it could also be triggered +in driver tgafb from user site. + +Signed-off-by: Wei Chen +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/tgafb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/video/fbdev/tgafb.c b/drivers/video/fbdev/tgafb.c +index 14d37c49633c6..b44004880f0d1 100644 +--- a/drivers/video/fbdev/tgafb.c ++++ b/drivers/video/fbdev/tgafb.c +@@ -173,6 +173,9 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) + { + struct tga_par *par = (struct tga_par *)info->par; + ++ if (!var->pixclock) ++ return -EINVAL; ++ + if (par->tga_type == TGA_TYPE_8PLANE) { + if (var->bits_per_pixel != 8) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-6.2/lib-zstd-backport-fix-for-in-place-decompression.patch b/queue-6.2/lib-zstd-backport-fix-for-in-place-decompression.patch new file mode 100644 index 00000000000..19d1f7c7af4 --- /dev/null +++ b/queue-6.2/lib-zstd-backport-fix-for-in-place-decompression.patch @@ -0,0 +1,118 @@ +From b81fbe7a1756180ed1548f0c75439a194832c5ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 15:19:17 -0800 +Subject: lib: zstd: Backport fix for in-place decompression + +From: Nick Terrell + +[ Upstream commit 038505c41f0aad26ef101f4f7f6e111531c3914f ] + +Backport the relevant part of upstream commit 5b266196 [0]. + +This fixes in-place decompression for x86-64 kernel decompression. It +uses a bound of 131072 + (uncompressed_size >> 8), which can be violated +after upstream commit 6a7ede3d [1], as zstd can use part of the output +buffer as temporary storage, and without this patch needs a bound of +~262144. + +The fix is for zstd to detect that the input and output buffers overlap, +so that zstd knows it can't use the overlapping portion of the output +buffer as tempoary storage. If the margin is not large enough, this will +ensure that zstd will fail the decompression, rather than overwriting +part of the input data, and causing corruption. + +This fix has been landed upstream and is in release v1.5.4. That commit +also adds unit and fuzz tests to verify that the margin we use is +respected, and correct. That means that the fix is well tested upstream. + +I have not been able to reproduce the potential bug in x86-64 kernel +decompression locally, nor have I recieved reports of failures to +decompress the kernel. It is possible that compression saves enough +space to make it very hard for the issue to appear. + +I've boot tested the zstd compressed kernel on x86-64 and i386 with this +patch, which uses in-place decompression, and sanity tested zstd compression +in btrfs / squashfs to make sure that we don't see any issues, but other +uses of zstd shouldn't be affected, because they don't use in-place +decompression. + +Thanks to Vasily Gorbik for debugging a related issue +on s390, which was triggered by the same commit, but was a bug in how +__decompress() was called [2]. And to Sasha Levin +for the CC alerting me of the issue. + +[0] https://github.com/facebook/zstd/commit/5b266196a41e6a15e21bd4f0eeab43b938db1d90 +[1] https://github.com/facebook/zstd/commit/6a7ede3dfccbf3e0a5928b4224a039c260dcff72 +[2] https://lore.kernel.org/r/patch-1.thread-41c676.git-41c676c2d153.your-ad-here.call-01675030179-ext-9637@work.hours + +CC: Vasily Gorbik +CC: Heiko Carstens +CC: Sasha Levin +CC: Yann Collet +Signed-off-by: Nick Terrell +Signed-off-by: Sasha Levin +--- + lib/zstd/decompress/zstd_decompress.c | 25 ++++++++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +diff --git a/lib/zstd/decompress/zstd_decompress.c b/lib/zstd/decompress/zstd_decompress.c +index b9b935a9f5c0d..6b3177c947114 100644 +--- a/lib/zstd/decompress/zstd_decompress.c ++++ b/lib/zstd/decompress/zstd_decompress.c +@@ -798,7 +798,7 @@ static size_t ZSTD_copyRawBlock(void* dst, size_t dstCapacity, + if (srcSize == 0) return 0; + RETURN_ERROR(dstBuffer_null, ""); + } +- ZSTD_memcpy(dst, src, srcSize); ++ ZSTD_memmove(dst, src, srcSize); + return srcSize; + } + +@@ -858,6 +858,7 @@ static size_t ZSTD_decompressFrame(ZSTD_DCtx* dctx, + + /* Loop on each block */ + while (1) { ++ BYTE* oBlockEnd = oend; + size_t decodedSize; + blockProperties_t blockProperties; + size_t const cBlockSize = ZSTD_getcBlockSize(ip, remainingSrcSize, &blockProperties); +@@ -867,16 +868,34 @@ static size_t ZSTD_decompressFrame(ZSTD_DCtx* dctx, + remainingSrcSize -= ZSTD_blockHeaderSize; + RETURN_ERROR_IF(cBlockSize > remainingSrcSize, srcSize_wrong, ""); + ++ if (ip >= op && ip < oBlockEnd) { ++ /* We are decompressing in-place. Limit the output pointer so that we ++ * don't overwrite the block that we are currently reading. This will ++ * fail decompression if the input & output pointers aren't spaced ++ * far enough apart. ++ * ++ * This is important to set, even when the pointers are far enough ++ * apart, because ZSTD_decompressBlock_internal() can decide to store ++ * literals in the output buffer, after the block it is decompressing. ++ * Since we don't want anything to overwrite our input, we have to tell ++ * ZSTD_decompressBlock_internal to never write past ip. ++ * ++ * See ZSTD_allocateLiteralsBuffer() for reference. ++ */ ++ oBlockEnd = op + (ip - op); ++ } ++ + switch(blockProperties.blockType) + { + case bt_compressed: +- decodedSize = ZSTD_decompressBlock_internal(dctx, op, (size_t)(oend-op), ip, cBlockSize, /* frame */ 1, not_streaming); ++ decodedSize = ZSTD_decompressBlock_internal(dctx, op, (size_t)(oBlockEnd-op), ip, cBlockSize, /* frame */ 1, not_streaming); + break; + case bt_raw : ++ /* Use oend instead of oBlockEnd because this function is safe to overlap. It uses memmove. */ + decodedSize = ZSTD_copyRawBlock(op, (size_t)(oend-op), ip, cBlockSize); + break; + case bt_rle : +- decodedSize = ZSTD_setRleBlock(op, (size_t)(oend-op), *ip, blockProperties.origSize); ++ decodedSize = ZSTD_setRleBlock(op, (size_t)(oBlockEnd-op), *ip, blockProperties.origSize); + break; + case bt_reserved : + default: +-- +2.39.2 + diff --git a/queue-6.2/md-avoid-signed-overflow-in-slot_store.patch b/queue-6.2/md-avoid-signed-overflow-in-slot_store.patch new file mode 100644 index 00000000000..4c16e648ac3 --- /dev/null +++ b/queue-6.2/md-avoid-signed-overflow-in-slot_store.patch @@ -0,0 +1,44 @@ +From 65e554143561e67964380f542a723dda82717dce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 09:36:25 +1100 +Subject: md: avoid signed overflow in slot_store() + +From: NeilBrown + +[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ] + +slot_store() uses kstrtouint() to get a slot number, but stores the +result in an "int" variable (by casting a pointer). +This can result in a negative slot number if the unsigned int value is +very large. + +A negative number means that the slot is empty, but setting a negative +slot number this way will not remove the device from the array. I don't +think this is a serious problem, but it could cause confusion and it is +best to fix it. + +Reported-by: Dan Carpenter +Signed-off-by: NeilBrown +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 272cc5d14906f..beab84f0c585c 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -3131,6 +3131,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len) + err = kstrtouint(buf, 10, (unsigned int *)&slot); + if (err < 0) + return err; ++ if (slot < 0) ++ /* overflow */ ++ return -ENOSPC; + } + if (rdev->mddev->pers && slot == -1) { + /* Setting 'slot' on an active array requires also +-- +2.39.2 + diff --git a/queue-6.2/net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch b/queue-6.2/net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch new file mode 100644 index 00000000000..dcc919b8f54 --- /dev/null +++ b/queue-6.2/net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch @@ -0,0 +1,40 @@ +From 67b49e9c3dd7377a6140c73423a18c2e3bad603b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 14:32:29 +0100 +Subject: net: hsr: Don't log netdev_err message on unknown prp dst node + +From: Kristian Overskeid + +[ Upstream commit 28e8cabe80f3e6e3c98121576eda898eeb20f1b1 ] + +If no frames has been exchanged with a node for HSR_NODE_FORGET_TIME, the +node will be deleted from the node_db list. If a frame is sent to the node +after it is deleted, a netdev_err message for each slave interface is +produced. This should not happen with dan nodes because of supervision +frames, but can happen often with san nodes, which clutters the kernel +log. Since the hsr protocol does not support sans, this is only relevant +for the prp protocol. + +Signed-off-by: Kristian Overskeid +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_framereg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c +index 00db74d96583d..865eda39d6014 100644 +--- a/net/hsr/hsr_framereg.c ++++ b/net/hsr/hsr_framereg.c +@@ -415,7 +415,7 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb, + node_dst = find_node_by_addr_A(&port->hsr->node_db, + eth_hdr(skb)->h_dest); + if (!node_dst) { +- if (net_ratelimit()) ++ if (net_ratelimit() && port->hsr->prot_version != PRP_V1) + netdev_err(skb->dev, "%s: Unknown node\n", __func__); + return; + } +-- +2.39.2 + diff --git a/queue-6.2/net-mlx5e-lower-maximum-allowed-mtu-in-xsk-to-match-.patch b/queue-6.2/net-mlx5e-lower-maximum-allowed-mtu-in-xsk-to-match-.patch new file mode 100644 index 00000000000..69cc38cab72 --- /dev/null +++ b/queue-6.2/net-mlx5e-lower-maximum-allowed-mtu-in-xsk-to-match-.patch @@ -0,0 +1,72 @@ +From 795b98df42e299374dee3caea0cf06159a85c48c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 10:09:01 +0200 +Subject: net/mlx5e: Lower maximum allowed MTU in XSK to match XDP + prerequisites + +From: Adham Faris + +[ Upstream commit 78dee7befd56987283c13877b834c0aa97ad51b9 ] + +XSK redirecting XDP programs require linearity, hence applies +restrictions on the MTU. For PAGE_SIZE=4K, MTU shouldn't exceed 3498. + +Features that contradict with XDP such HW-LRO and HW-GRO are enforced +by the driver in advance, during XSK params validation, except for MTU, +which was not enforced before this patch. + +This has been spotted during test scenario described below: +Attaching xdpsock program (PAGE_SIZE=4K), with MTU < 3498, detaching +XDP program, changing the MTU to arbitrary value in the range +[3499, 3754], attaching XDP program again, which ended up with failure +since MTU is > 3498. + +This commit lowers the XSK MTU limitation to be aligned with XDP MTU +limitation, since XSK socket is meaningless without XDP program. + +Signed-off-by: Adham Faris +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 47d4b54d15634..1f4233b2842f7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4117,13 +4117,17 @@ static bool mlx5e_xsk_validate_mtu(struct net_device *netdev, + struct xsk_buff_pool *xsk_pool = + mlx5e_xsk_get_pool(&chs->params, chs->params.xsk, ix); + struct mlx5e_xsk_param xsk; ++ int max_xdp_mtu; + + if (!xsk_pool) + continue; + + mlx5e_build_xsk_param(xsk_pool, &xsk); ++ max_xdp_mtu = mlx5e_xdp_max_mtu(new_params, &xsk); + +- if (!mlx5e_validate_xsk_param(new_params, &xsk, mdev)) { ++ /* Validate XSK params and XDP MTU in advance */ ++ if (!mlx5e_validate_xsk_param(new_params, &xsk, mdev) || ++ new_params->sw_mtu > max_xdp_mtu) { + u32 hr = mlx5e_get_linear_rq_headroom(new_params, &xsk); + int max_mtu_frame, max_mtu_page, max_mtu; + +@@ -4133,9 +4137,9 @@ static bool mlx5e_xsk_validate_mtu(struct net_device *netdev, + */ + max_mtu_frame = MLX5E_HW2SW_MTU(new_params, xsk.chunk_size - hr); + max_mtu_page = MLX5E_HW2SW_MTU(new_params, SKB_MAX_HEAD(0)); +- max_mtu = min(max_mtu_frame, max_mtu_page); ++ max_mtu = min3(max_mtu_frame, max_mtu_page, max_xdp_mtu); + +- netdev_err(netdev, "MTU %d is too big for an XSK running on channel %u. Try MTU <= %d\n", ++ netdev_err(netdev, "MTU %d is too big for an XSK running on channel %u or its redirection XDP program. Try MTU <= %d\n", + new_params->sw_mtu, ix, max_mtu); + return false; + } +-- +2.39.2 + diff --git a/queue-6.2/nvme-pci-add-nvme_quirk_bogus_nid-for-lexar-nm620.patch b/queue-6.2/nvme-pci-add-nvme_quirk_bogus_nid-for-lexar-nm620.patch new file mode 100644 index 00000000000..80b1b35877e --- /dev/null +++ b/queue-6.2/nvme-pci-add-nvme_quirk_bogus_nid-for-lexar-nm620.patch @@ -0,0 +1,35 @@ +From 3228525fd283c6e7db353daba164cdabb094f2b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 11:11:50 +0100 +Subject: nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 + +From: Philipp Geulen + +[ Upstream commit b65d44fa0fe072c91bf41cd8756baa2b4c77eff2 ] + +Added a quirk to fix Lexar NM620 1TB SSD reporting duplicate NGUIDs. + +Signed-off-by: Philipp Geulen +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index c51ebbee8103e..ea3f0806783a3 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3491,6 +3491,8 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1d97, 0x2263), /* Lexar NM610 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, ++ { PCI_DEVICE(0x1d97, 0x1d97), /* Lexar NM620 */ ++ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061), +-- +2.39.2 + diff --git a/queue-6.2/nvme-pci-fixing-memory-leak-in-probe-teardown-path.patch b/queue-6.2/nvme-pci-fixing-memory-leak-in-probe-teardown-path.patch new file mode 100644 index 00000000000..5ce7db0fda9 --- /dev/null +++ b/queue-6.2/nvme-pci-fixing-memory-leak-in-probe-teardown-path.patch @@ -0,0 +1,34 @@ +From 860bef73f1b1ac8f1e4fc9b878215fe33a1799ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 18:05:08 -0300 +Subject: nvme-pci: fixing memory leak in probe teardown path + +From: Irvin Cote + +[ Upstream commit a61d265533b7fe0026a02a49916aa564ffe38e4c ] + +In case the nvme_probe teardown path is triggered the ctrl ref count does +not reach 0 thus creating a memory leak upon failure of nvme_probe. + +Signed-off-by: Irvin Cote +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 29c902b9aecbd..c51ebbee8103e 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3126,6 +3126,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + nvme_dev_unmap(dev); + out_uninit_ctrl: + nvme_uninit_ctrl(&dev->ctrl); ++ nvme_put_ctrl(&dev->ctrl); + return result; + } + +-- +2.39.2 + diff --git a/queue-6.2/sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch b/queue-6.2/sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch new file mode 100644 index 00000000000..4f1efe2eeb0 --- /dev/null +++ b/queue-6.2/sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch @@ -0,0 +1,82 @@ +From 05265566a1f5a98e1f6029dd723d1616ee5121ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 19:32:38 -0700 +Subject: sched_getaffinity: don't assume 'cpumask_size()' is fully initialized + +From: Linus Torvalds + +[ Upstream commit 6015b1aca1a233379625385feb01dd014aca60b5 ] + +The getaffinity() system call uses 'cpumask_size()' to decide how big +the CPU mask is - so far so good. It is indeed the allocation size of a +cpumask. + +But the code also assumes that the whole allocation is initialized +without actually doing so itself. That's wrong, because we might have +fixed-size allocations (making copying and clearing more efficient), but +not all of it is then necessarily used if 'nr_cpu_ids' is smaller. + +Having checked other users of 'cpumask_size()', they all seem to be ok, +either using it purely for the allocation size, or explicitly zeroing +the cpumask before using the size in bytes to copy it. + +See for example the ublk_ctrl_get_queue_affinity() function that uses +the proper 'zalloc_cpumask_var()' to make sure that the whole mask is +cleared, whether the storage is on the stack or if it was an external +allocation. + +Fix this by just zeroing the allocation before using it. Do the same +for the compat version of sched_getaffinity(), which had the same logic. + +Also, for consistency, make sched_getaffinity() use 'cpumask_bits()' to +access the bits. For a cpumask_var_t, it ends up being a pointer to the +same data either way, but it's just a good idea to treat it like you +would a 'cpumask_t'. The compat case already did that. + +Reported-by: Ryan Roberts +Link: https://lore.kernel.org/lkml/7d026744-6bd6-6827-0471-b5e8eae0be3f@arm.com/ +Cc: Yury Norov +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/compat.c | 2 +- + kernel/sched/core.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/compat.c b/kernel/compat.c +index 55551989d9da5..fb50f29d9b361 100644 +--- a/kernel/compat.c ++++ b/kernel/compat.c +@@ -152,7 +152,7 @@ COMPAT_SYSCALL_DEFINE3(sched_getaffinity, compat_pid_t, pid, unsigned int, len, + if (len & (sizeof(compat_ulong_t)-1)) + return -EINVAL; + +- if (!alloc_cpumask_var(&mask, GFP_KERNEL)) ++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) + return -ENOMEM; + + ret = sched_getaffinity(pid, mask); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 9a0698353d60f..57d84b534cdea 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8404,14 +8404,14 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len, + if (len & (sizeof(unsigned long)-1)) + return -EINVAL; + +- if (!alloc_cpumask_var(&mask, GFP_KERNEL)) ++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) + return -ENOMEM; + + ret = sched_getaffinity(pid, mask); + if (ret == 0) { + unsigned int retlen = min(len, cpumask_size()); + +- if (copy_to_user(user_mask_ptr, mask, retlen)) ++ if (copy_to_user(user_mask_ptr, cpumask_bits(mask), retlen)) + ret = -EFAULT; + else + ret = retlen; +-- +2.39.2 + diff --git a/queue-6.2/series b/queue-6.2/series index 17cefee76b0..5433b49c110 100644 --- a/queue-6.2/series +++ b/queue-6.2/series @@ -11,3 +11,49 @@ btrfs-rename-btrfs_fs_no_overcommit-to-btrfs_fs_acti.patch btrfs-zoned-count-fresh-bg-region-as-zone-unusable.patch btrfs-zoned-drop-space_info-active_total_bytes.patch fsverity-don-t-drop-pagecache-at-end-of-fs_ioc_enabl.patch +cifs-fix-missing-unload_nls-in-smb2_reconnect.patch +xfrm-zero-padding-when-dumping-algos-and-encap.patch +asoc-codecs-tx-macro-fix-for-kasan-slab-out-of-bound.patch +asoc-intel-avs-max98357a-explicitly-define-codec-for.patch +asoc-intel-avs-da7219-explicitly-define-codec-format.patch +asoc-intel-avs-rt5682-explicitly-define-codec-format.patch +asoc-intel-avs-ssm4567-remove-nau8825-bits.patch +asoc-intel-avs-nau8825-adjust-clock-control.patch +lib-zstd-backport-fix-for-in-place-decompression.patch +zstd-fix-definition-of-assert.patch +acpi-video-add-backlight-native-dmi-quirk-for-dell-v.patch +acpi-x86-introduce-an-acpi_quirk_skip_gpio_event_han.patch +acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch +acpi-x86-add-skip-i2c-clients-quirk-for-lenovo-yoga-.patch +asoc-sof-ipc3-check-for-upper-size-limit-for-the-rec.patch +asoc-sof-ipc4-topology-fix-incorrect-sample-rate-pri.patch +asoc-sof-intel-pci-tng-revert-invalid-bar-size-setti.patch +asoc-sof-intel-hda-dsp-harden-d0i3-programming-seque.patch +asoc-sof-intel-hda-ctrl-re-add-sleep-after-entering-.patch +asoc-sof-ipc4-update-gain-ipc-msg-definition-to-alig.patch +asoc-hdmi-codec-only-startup-shutdown-on-supported-s.patch +wifi-mac80211-check-basic-rates-validity.patch +md-avoid-signed-overflow-in-slot_store.patch +x86-pvh-obtain-vga-console-info-in-dom0.patch +drm-amdkfd-fix-bo-offset-for-multi-vma-page-migratio.patch +drm-amdkfd-fix-a-potential-double-free-in-pqm_create.patch +drm-amdgpu-vcn-custom-video-info-caps-for-sriov.patch +drm-amdkfd-fix-potential-kgd_mem-uafs.patch +drm-amd-display-fix-hdcp-failing-to-enable-after-sus.patch +net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch +alsa-asihpi-check-pao-in-control_message.patch +alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch +fbdev-tgafb-fix-potential-divide-by-zero.patch +acpi-tools-pfrut-check-if-the-input-of-level-and-typ.patch +sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch +nvme-pci-fixing-memory-leak-in-probe-teardown-path.patch +nvme-pci-add-nvme_quirk_bogus_nid-for-lexar-nm620.patch +drm-amdkfd-fixed-kfd_process-cleanup-on-module-exit.patch +net-mlx5e-lower-maximum-allowed-mtu-in-xsk-to-match-.patch +fbdev-nvidia-fix-potential-divide-by-zero.patch +fbdev-intelfb-fix-potential-divide-by-zero.patch +fbdev-lxfb-fix-potential-divide-by-zero.patch +fbdev-au1200fb-fix-potential-divide-by-zero.patch +tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch +tools-power-turbostat-fix-decoding-of-hwp_status.patch +tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch diff --git a/queue-6.2/tools-power-turbostat-fix-decoding-of-hwp_status.patch b/queue-6.2/tools-power-turbostat-fix-decoding-of-hwp_status.patch new file mode 100644 index 00000000000..027fe2bc4a6 --- /dev/null +++ b/queue-6.2/tools-power-turbostat-fix-decoding-of-hwp_status.patch @@ -0,0 +1,37 @@ +From ffec8467cac86b07e98dd3033f160b3bf38bdb39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 15:17:50 +0200 +Subject: tools/power turbostat: fix decoding of HWP_STATUS + +From: Antti Laakso + +[ Upstream commit 92c25393586ac799b9b7d9e50434f3c44a7622c4 ] + +The "excursion to minimum" information is in bit2 +in HWP_STATUS MSR. Fix the bitmask used for +decoding the register. + +Signed-off-by: Antti Laakso +Reviewed-by: Artem Bityutskiy +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index c24054e3ef7ad..c61c6c704fbe6 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -4426,7 +4426,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p) + + fprintf(outf, "cpu%d: MSR_HWP_STATUS: 0x%08llx " + "(%sGuaranteed_Perf_Change, %sExcursion_Min)\n", +- cpu, msr, ((msr) & 0x1) ? "" : "No-", ((msr) & 0x2) ? "" : "No-"); ++ cpu, msr, ((msr) & 0x1) ? "" : "No-", ((msr) & 0x4) ? "" : "No-"); + + return 0; + } +-- +2.39.2 + diff --git a/queue-6.2/tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch b/queue-6.2/tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch new file mode 100644 index 00000000000..64c478608f4 --- /dev/null +++ b/queue-6.2/tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch @@ -0,0 +1,58 @@ +From 2411dbe122076b7d0cddf6dc13383916523f5acd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 10:18:16 -0500 +Subject: tools/power turbostat: Fix /dev/cpu_dma_latency warnings + +From: Prarit Bhargava + +[ Upstream commit 40aafc7d58d3544f152a863a0e9863014b6d5d8c ] + +When running as non-root the following error is seen in turbostat: + +turbostat: fopen /dev/cpu_dma_latency +: Permission denied + +turbostat and the man page have information on how to avoid other +permission errors, so these can be fixed the same way. + +Provide better /dev/cpu_dma_latency warnings that provide instructions on +how to avoid the error, and update the man page. + +Signed-off-by: Prarit Bhargava +Cc: linux-pm@vger.kernel.org +Signed-off-by: Len Brown +Signed-off-by: Sasha Levin +--- + tools/power/x86/turbostat/turbostat.8 | 2 ++ + tools/power/x86/turbostat/turbostat.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8 +index c7b26a3603afe..3e1a4c4be001a 100644 +--- a/tools/power/x86/turbostat/turbostat.8 ++++ b/tools/power/x86/turbostat/turbostat.8 +@@ -344,6 +344,8 @@ Alternatively, non-root users can be enabled to run turbostat this way: + + # chmod +r /dev/cpu/*/msr + ++# chmod +r /dev/cpu_dma_latency ++ + .B "turbostat " + reads hardware counters, but doesn't write them. + So it will not interfere with the OS or other programs, including +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index aba460410dbd1..c24054e3ef7ad 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -5482,7 +5482,7 @@ void print_dev_latency(void) + + retval = read(fd, (void *)&value, sizeof(int)); + if (retval != sizeof(int)) { +- warn("read %s\n", path); ++ warn("read failed %s\n", path); + close(fd); + return; + } +-- +2.39.2 + diff --git a/queue-6.2/tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch b/queue-6.2/tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch new file mode 100644 index 00000000000..775e9147d2a --- /dev/null +++ b/queue-6.2/tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch @@ -0,0 +1,53 @@ +From 75dd00aee887948106f947e0d5b27b6a3017548f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 10:58:18 +0300 +Subject: tracing: Fix wrong return in kprobe_event_gen_test.c + +From: Anton Gusev + +[ Upstream commit bc4f359b3b607daac0290d0038561237a86b38cb ] + +Overwriting the error code with the deletion result may cause the +function to return 0 despite encountering an error. Commit b111545d26c0 +("tracing: Remove the useless value assignment in +test_create_synth_event()") solves a similar issue by +returning the original error code, so this patch does the same. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://lore.kernel.org/linux-trace-kernel/20230131075818.5322-1-aagusev@ispras.ru + +Signed-off-by: Anton Gusev +Reviewed-by: Steven Rostedt (Google) +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/kprobe_event_gen_test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/kprobe_event_gen_test.c b/kernel/trace/kprobe_event_gen_test.c +index c736487fc0e48..e0c420eb0b2b4 100644 +--- a/kernel/trace/kprobe_event_gen_test.c ++++ b/kernel/trace/kprobe_event_gen_test.c +@@ -146,7 +146,7 @@ static int __init test_gen_kprobe_cmd(void) + if (trace_event_file_is_valid(gen_kprobe_test)) + gen_kprobe_test = NULL; + /* We got an error after creating the event, delete it */ +- ret = kprobe_event_delete("gen_kprobe_test"); ++ kprobe_event_delete("gen_kprobe_test"); + goto out; + } + +@@ -211,7 +211,7 @@ static int __init test_gen_kretprobe_cmd(void) + if (trace_event_file_is_valid(gen_kretprobe_test)) + gen_kretprobe_test = NULL; + /* We got an error after creating the event, delete it */ +- ret = kprobe_event_delete("gen_kretprobe_test"); ++ kprobe_event_delete("gen_kretprobe_test"); + goto out; + } + +-- +2.39.2 + diff --git a/queue-6.2/wifi-mac80211-check-basic-rates-validity.patch b/queue-6.2/wifi-mac80211-check-basic-rates-validity.patch new file mode 100644 index 00000000000..34cd7062d15 --- /dev/null +++ b/queue-6.2/wifi-mac80211-check-basic-rates-validity.patch @@ -0,0 +1,64 @@ +From 6617d6f3f817c6e761c40abbb73ba63ad8a8c16b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 10:52:19 +0100 +Subject: wifi: mac80211: check basic rates validity + +From: Johannes Berg + +[ Upstream commit ce04abc3fcc62cd5640af981ebfd7c4dc3bded28 ] + +When userspace sets basic rates, it might send us some rates +list that's empty or consists of invalid values only. We're +currently ignoring invalid values and then may end up with a +rates bitmap that's empty, which later results in a warning. + +Reject the call if there were no valid rates. + +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index d611e15301839..e24d2d5b04ad0 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2576,6 +2576,17 @@ static int ieee80211_change_bss(struct wiphy *wiphy, + if (!sband) + return -EINVAL; + ++ if (params->basic_rates) { ++ if (!ieee80211_parse_bitrates(link->conf->chandef.width, ++ wiphy->bands[sband->band], ++ params->basic_rates, ++ params->basic_rates_len, ++ &link->conf->basic_rates)) ++ return -EINVAL; ++ changed |= BSS_CHANGED_BASIC_RATES; ++ ieee80211_check_rate_mask(link); ++ } ++ + if (params->use_cts_prot >= 0) { + link->conf->use_cts_prot = params->use_cts_prot; + changed |= BSS_CHANGED_ERP_CTS_PROT; +@@ -2597,16 +2608,6 @@ static int ieee80211_change_bss(struct wiphy *wiphy, + changed |= BSS_CHANGED_ERP_SLOT; + } + +- if (params->basic_rates) { +- ieee80211_parse_bitrates(link->conf->chandef.width, +- wiphy->bands[sband->band], +- params->basic_rates, +- params->basic_rates_len, +- &link->conf->basic_rates); +- changed |= BSS_CHANGED_BASIC_RATES; +- ieee80211_check_rate_mask(link); +- } +- + if (params->ap_isolate >= 0) { + if (params->ap_isolate) + sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS; +-- +2.39.2 + diff --git a/queue-6.2/x86-pvh-obtain-vga-console-info-in-dom0.patch b/queue-6.2/x86-pvh-obtain-vga-console-info-in-dom0.patch new file mode 100644 index 00000000000..08724465518 --- /dev/null +++ b/queue-6.2/x86-pvh-obtain-vga-console-info-in-dom0.patch @@ -0,0 +1,139 @@ +From ec6ca50686804013fdf01e589551951e952aba98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 15:45:48 +0100 +Subject: x86/PVH: obtain VGA console info in Dom0 + +From: Jan Beulich + +[ Upstream commit 934ef33ee75c3846f605f18b65048acd147e3918 ] + +A new platform-op was added to Xen to allow obtaining the same VGA +console information PV Dom0 is handed. Invoke the new function and have +the output data processed by xen_init_vga(). + +Signed-off-by: Jan Beulich +Reviewed-by: Juergen Gross + +Link: https://lore.kernel.org/r/8f315e92-7bda-c124-71cc-478ab9c5e610@suse.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/Makefile | 2 +- + arch/x86/xen/enlighten_pv.c | 3 ++- + arch/x86/xen/enlighten_pvh.c | 13 +++++++++++++ + arch/x86/xen/vga.c | 5 ++--- + arch/x86/xen/xen-ops.h | 7 ++++--- + include/xen/interface/platform.h | 3 +++ + 6 files changed, 25 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile +index 3c5b52fbe4a7f..a9ec8c9f5c5dd 100644 +--- a/arch/x86/xen/Makefile ++++ b/arch/x86/xen/Makefile +@@ -45,6 +45,6 @@ obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o + + obj-$(CONFIG_XEN_DEBUG_FS) += debugfs.o + +-obj-$(CONFIG_XEN_PV_DOM0) += vga.o ++obj-$(CONFIG_XEN_DOM0) += vga.o + + obj-$(CONFIG_XEN_EFI) += efi.o +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 5b13796628770..68f5f5d209dfa 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -1389,7 +1389,8 @@ asmlinkage __visible void __init xen_start_kernel(struct start_info *si) + + x86_platform.set_legacy_features = + xen_dom0_set_legacy_features; +- xen_init_vga(info, xen_start_info->console.dom0.info_size); ++ xen_init_vga(info, xen_start_info->console.dom0.info_size, ++ &boot_params.screen_info); + xen_start_info->console.domU.mfn = 0; + xen_start_info->console.domU.evtchn = 0; + +diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c +index bcae606bbc5cf..1da44aca896c6 100644 +--- a/arch/x86/xen/enlighten_pvh.c ++++ b/arch/x86/xen/enlighten_pvh.c +@@ -43,6 +43,19 @@ void __init xen_pvh_init(struct boot_params *boot_params) + x86_init.oem.banner = xen_banner; + + xen_efi_init(boot_params); ++ ++ if (xen_initial_domain()) { ++ struct xen_platform_op op = { ++ .cmd = XENPF_get_dom0_console, ++ }; ++ long ret = HYPERVISOR_platform_op(&op); ++ ++ if (ret > 0) ++ xen_init_vga(&op.u.dom0_console, ++ min(ret * sizeof(char), ++ sizeof(op.u.dom0_console)), ++ &boot_params->screen_info); ++ } + } + + void __init mem_map_via_hcall(struct boot_params *boot_params_p) +diff --git a/arch/x86/xen/vga.c b/arch/x86/xen/vga.c +index 14ea32e734d59..d97adab8420f4 100644 +--- a/arch/x86/xen/vga.c ++++ b/arch/x86/xen/vga.c +@@ -9,10 +9,9 @@ + + #include "xen-ops.h" + +-void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size) ++void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size, ++ struct screen_info *screen_info) + { +- struct screen_info *screen_info = &boot_params.screen_info; +- + /* This is drawn from a dump from vgacon:startup in + * standard Linux. */ + screen_info->orig_video_mode = 3; +diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h +index 9a8bb972193d8..a10903785a338 100644 +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -108,11 +108,12 @@ static inline void xen_uninit_lock_cpu(int cpu) + + struct dom0_vga_console_info; + +-#ifdef CONFIG_XEN_PV_DOM0 +-void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size); ++#ifdef CONFIG_XEN_DOM0 ++void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size, ++ struct screen_info *); + #else + static inline void __init xen_init_vga(const struct dom0_vga_console_info *info, +- size_t size) ++ size_t size, struct screen_info *si) + { + } + #endif +diff --git a/include/xen/interface/platform.h b/include/xen/interface/platform.h +index 655d92e803e14..79a443c65ea93 100644 +--- a/include/xen/interface/platform.h ++++ b/include/xen/interface/platform.h +@@ -483,6 +483,8 @@ struct xenpf_symdata { + }; + DEFINE_GUEST_HANDLE_STRUCT(xenpf_symdata); + ++#define XENPF_get_dom0_console 64 ++ + struct xen_platform_op { + uint32_t cmd; + uint32_t interface_version; /* XENPF_INTERFACE_VERSION */ +@@ -506,6 +508,7 @@ struct xen_platform_op { + struct xenpf_mem_hotadd mem_add; + struct xenpf_core_parking core_parking; + struct xenpf_symdata symdata; ++ struct dom0_vga_console_info dom0_console; + uint8_t pad[128]; + } u; + }; +-- +2.39.2 + diff --git a/queue-6.2/xfrm-zero-padding-when-dumping-algos-and-encap.patch b/queue-6.2/xfrm-zero-padding-when-dumping-algos-and-encap.patch new file mode 100644 index 00000000000..8c4cf6f0f28 --- /dev/null +++ b/queue-6.2/xfrm-zero-padding-when-dumping-algos-and-encap.patch @@ -0,0 +1,111 @@ +From 127254d2d550ce033db377cd10412e32088512cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 09:09:52 +0800 +Subject: xfrm: Zero padding when dumping algos and encap + +From: Herbert Xu + +[ Upstream commit 8222d5910dae08213b6d9d4bc9a7f8502855e624 ] + +When copying data to user-space we should ensure that only valid +data is copied over. Padding in structures may be filled with +random (possibly sensitve) data and should never be given directly +to user-space. + +This patch fixes the copying of xfrm algorithms and the encap +template in xfrm_user so that padding is zeroed. + +Reported-by: syzbot+fa5414772d5c445dac3c@syzkaller.appspotmail.com +Reported-by: Hyunwoo Kim +Signed-off-by: Herbert Xu +Reviewed-by: Sabrina Dubroca +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_user.c | 45 ++++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 41 insertions(+), 4 deletions(-) + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index cf5172d4ce68c..103af2b3e986f 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1012,7 +1012,9 @@ static int copy_to_user_aead(struct xfrm_algo_aead *aead, struct sk_buff *skb) + return -EMSGSIZE; + + ap = nla_data(nla); +- memcpy(ap, aead, sizeof(*aead)); ++ strscpy_pad(ap->alg_name, aead->alg_name, sizeof(ap->alg_name)); ++ ap->alg_key_len = aead->alg_key_len; ++ ap->alg_icv_len = aead->alg_icv_len; + + if (redact_secret && aead->alg_key_len) + memset(ap->alg_key, 0, (aead->alg_key_len + 7) / 8); +@@ -1032,7 +1034,8 @@ static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb) + return -EMSGSIZE; + + ap = nla_data(nla); +- memcpy(ap, ealg, sizeof(*ealg)); ++ strscpy_pad(ap->alg_name, ealg->alg_name, sizeof(ap->alg_name)); ++ ap->alg_key_len = ealg->alg_key_len; + + if (redact_secret && ealg->alg_key_len) + memset(ap->alg_key, 0, (ealg->alg_key_len + 7) / 8); +@@ -1043,6 +1046,40 @@ static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb) + return 0; + } + ++static int copy_to_user_calg(struct xfrm_algo *calg, struct sk_buff *skb) ++{ ++ struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_COMP, sizeof(*calg)); ++ struct xfrm_algo *ap; ++ ++ if (!nla) ++ return -EMSGSIZE; ++ ++ ap = nla_data(nla); ++ strscpy_pad(ap->alg_name, calg->alg_name, sizeof(ap->alg_name)); ++ ap->alg_key_len = 0; ++ ++ return 0; ++} ++ ++static int copy_to_user_encap(struct xfrm_encap_tmpl *ep, struct sk_buff *skb) ++{ ++ struct nlattr *nla = nla_reserve(skb, XFRMA_ENCAP, sizeof(*ep)); ++ struct xfrm_encap_tmpl *uep; ++ ++ if (!nla) ++ return -EMSGSIZE; ++ ++ uep = nla_data(nla); ++ memset(uep, 0, sizeof(*uep)); ++ ++ uep->encap_type = ep->encap_type; ++ uep->encap_sport = ep->encap_sport; ++ uep->encap_dport = ep->encap_dport; ++ uep->encap_oa = ep->encap_oa; ++ ++ return 0; ++} ++ + static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m) + { + int ret = 0; +@@ -1098,12 +1135,12 @@ static int copy_to_user_state_extra(struct xfrm_state *x, + goto out; + } + if (x->calg) { +- ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg); ++ ret = copy_to_user_calg(x->calg, skb); + if (ret) + goto out; + } + if (x->encap) { +- ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap); ++ ret = copy_to_user_encap(x->encap, skb); + if (ret) + goto out; + } +-- +2.39.2 + diff --git a/queue-6.2/zstd-fix-definition-of-assert.patch b/queue-6.2/zstd-fix-definition-of-assert.patch new file mode 100644 index 00000000000..525b7d7c920 --- /dev/null +++ b/queue-6.2/zstd-fix-definition-of-assert.patch @@ -0,0 +1,39 @@ +From 22f90de804e6385e6cbcc64b2c3d50ab937ca876 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Jan 2023 14:14:36 +0100 +Subject: zstd: Fix definition of assert() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Neuschäfer + +[ Upstream commit 6906598f1ce93761716d780b6e3f171e13f0f4ce ] + +assert(x) should emit a warning if x is false. WARN_ON(x) emits a +warning if x is true. Thus, assert(x) should be defined as WARN_ON(!x) +rather than WARN_ON(x). + +Signed-off-by: Jonathan Neuschäfer +Signed-off-by: Nick Terrell +Signed-off-by: Sasha Levin +--- + lib/zstd/common/zstd_deps.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/zstd/common/zstd_deps.h b/lib/zstd/common/zstd_deps.h +index 7a5bf44839c9c..f06df065dec01 100644 +--- a/lib/zstd/common/zstd_deps.h ++++ b/lib/zstd/common/zstd_deps.h +@@ -84,7 +84,7 @@ static uint64_t ZSTD_div64(uint64_t dividend, uint32_t divisor) { + + #include + +-#define assert(x) WARN_ON((x)) ++#define assert(x) WARN_ON(!(x)) + + #endif /* ZSTD_DEPS_ASSERT */ + #endif /* ZSTD_DEPS_NEED_ASSERT */ +-- +2.39.2 + -- 2.47.3