From 6c433e20851d07ccf6b4fb67bc585d3e716dba37 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 24 Aug 2025 07:21:06 +0200 Subject: [PATCH] 6.12-stable patches added patches: compiler-remove-__addressable_asm-_str-again.patch drm-i915-icl-tc-cache-the-max-lane-count-value.patch drm-i915-icl-tc-convert-aux-powered-warn-to-a-debug-message.patch iio-light-as73211-ensure-buffer-holes-are-zeroed.patch iio-light-use-aligned_s64-instead-of-open-coding-alignment.patch iio-temperature-maxim_thermocouple-use-dma-safe-buffer-for-spi_read.patch tracing-limit-access-to-parser-buffer-when-trace_get_user-failed.patch tracing-remove-unneeded-goto-out-logic.patch --- ...-remove-__addressable_asm-_str-again.patch | 73 +++++++ ...cl-tc-cache-the-max-lane-count-value.patch | 194 ++++++++++++++++++ ...-aux-powered-warn-to-a-debug-message.patch | 45 ++++ ...73211-ensure-buffer-holes-are-zeroed.patch | 38 ++++ ...s64-instead-of-open-coding-alignment.patch | 158 ++++++++++++++ ...ple-use-dma-safe-buffer-for-spi_read.patch | 95 +++++++++ queue-6.12/series | 8 + ...er-buffer-when-trace_get_user-failed.patch | 142 +++++++++++++ ...acing-remove-unneeded-goto-out-logic.patch | 152 ++++++++++++++ 9 files changed, 905 insertions(+) create mode 100644 queue-6.12/compiler-remove-__addressable_asm-_str-again.patch create mode 100644 queue-6.12/drm-i915-icl-tc-cache-the-max-lane-count-value.patch create mode 100644 queue-6.12/drm-i915-icl-tc-convert-aux-powered-warn-to-a-debug-message.patch create mode 100644 queue-6.12/iio-light-as73211-ensure-buffer-holes-are-zeroed.patch create mode 100644 queue-6.12/iio-light-use-aligned_s64-instead-of-open-coding-alignment.patch create mode 100644 queue-6.12/iio-temperature-maxim_thermocouple-use-dma-safe-buffer-for-spi_read.patch create mode 100644 queue-6.12/tracing-limit-access-to-parser-buffer-when-trace_get_user-failed.patch create mode 100644 queue-6.12/tracing-remove-unneeded-goto-out-logic.patch diff --git a/queue-6.12/compiler-remove-__addressable_asm-_str-again.patch b/queue-6.12/compiler-remove-__addressable_asm-_str-again.patch new file mode 100644 index 0000000000..307304fc51 --- /dev/null +++ b/queue-6.12/compiler-remove-__addressable_asm-_str-again.patch @@ -0,0 +1,73 @@ +From stable+bounces-172666-greg=kroah.com@vger.kernel.org Sun Aug 24 01:47:38 2025 +From: Sasha Levin +Date: Sat, 23 Aug 2025 19:47:31 -0400 +Subject: compiler: remove __ADDRESSABLE_ASM{_STR,}() again +To: stable@vger.kernel.org +Cc: Jan Beulich , Josh Poimboeuf , Juergen Gross , Sasha Levin +Message-ID: <20250823234731.2467994-1-sashal@kernel.org> + +From: Jan Beulich + +[ Upstream commit 8ea815399c3fcce1889bd951fec25b5b9a3979c1 ] + +__ADDRESSABLE_ASM_STR() is where the necessary stringification happens. +As long as "sym" doesn't contain any odd characters, no quoting is +required for its use with .quad / .long. In fact the quotation gets in +the way with gas 2.25; it's only from 2.26 onwards that quoted symbols +are half-way properly supported. + +However, assembly being different from C anyway, drop +__ADDRESSABLE_ASM_STR() and its helper macro altogether. A simple +.global directive will suffice to get the symbol "declared", i.e. into +the symbol table. While there also stop open-coding STATIC_CALL_TRAMP() +and STATIC_CALL_KEY(). + +Fixes: 0ef8047b737d ("x86/static-call: provide a way to do very early static-call updates") +Signed-off-by: Jan Beulich +Acked-by: Josh Poimboeuf +Cc: stable@vger.kernel.org +Signed-off-by: Juergen Gross +Message-ID: <609d2c74-de13-4fae-ab1a-1ec44afb948d@suse.com> +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/xen/hypercall.h | 5 +++-- + include/linux/compiler.h | 8 -------- + 2 files changed, 3 insertions(+), 10 deletions(-) + +--- a/arch/x86/include/asm/xen/hypercall.h ++++ b/arch/x86/include/asm/xen/hypercall.h +@@ -94,12 +94,13 @@ DECLARE_STATIC_CALL(xen_hypercall, xen_h + #ifdef MODULE + #define __ADDRESSABLE_xen_hypercall + #else +-#define __ADDRESSABLE_xen_hypercall __ADDRESSABLE_ASM_STR(__SCK__xen_hypercall) ++#define __ADDRESSABLE_xen_hypercall \ ++ __stringify(.global STATIC_CALL_KEY(xen_hypercall);) + #endif + + #define __HYPERCALL \ + __ADDRESSABLE_xen_hypercall \ +- "call __SCT__xen_hypercall" ++ __stringify(call STATIC_CALL_TRAMP(xen_hypercall)) + + #define __HYPERCALL_ENTRY(x) "a" (x) + +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -223,14 +223,6 @@ static inline void *offset_to_ptr(const + #define __ADDRESSABLE(sym) \ + ___ADDRESSABLE(sym, __section(".discard.addressable")) + +-#define __ADDRESSABLE_ASM(sym) \ +- .pushsection .discard.addressable,"aw"; \ +- .align ARCH_SEL(8,4); \ +- ARCH_SEL(.quad, .long) __stringify(sym); \ +- .popsection; +- +-#define __ADDRESSABLE_ASM_STR(sym) __stringify(__ADDRESSABLE_ASM(sym)) +- + /* &a[0] degrades to a pointer: a different type from an array */ + #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) + diff --git a/queue-6.12/drm-i915-icl-tc-cache-the-max-lane-count-value.patch b/queue-6.12/drm-i915-icl-tc-cache-the-max-lane-count-value.patch new file mode 100644 index 0000000000..1052e41d8c --- /dev/null +++ b/queue-6.12/drm-i915-icl-tc-cache-the-max-lane-count-value.patch @@ -0,0 +1,194 @@ +From stable+bounces-172657-greg=kroah.com@vger.kernel.org Sat Aug 23 18:56:28 2025 +From: Sasha Levin +Date: Sat, 23 Aug 2025 12:56:18 -0400 +Subject: drm/i915/icl+/tc: Cache the max lane count value +To: stable@vger.kernel.org +Cc: Imre Deak , Charlton Lin , Khaled Almahallawy , Mika Kahola , Tvrtko Ursulin , Sasha Levin +Message-ID: <20250823165618.2341421-1-sashal@kernel.org> + +From: Imre Deak + +[ Upstream commit 5fd35236546abe780eaadb7561e09953719d4fc3 ] + +The PHY's pin assignment value in the TCSS_DDI_STATUS register - as set +by the HW/FW based on the connected DP-alt sink's TypeC/PD pin +assignment negotiation - gets cleared by the HW/FW on LNL+ as soon as +the sink gets disconnected, even if the PHY ownership got acquired +already by the driver (and hence the PHY itself is still connected and +used by the display). This is similar to how the PHY Ready flag gets +cleared on LNL+ in the same register. + +To be able to query the max lane count value on LNL+ - which is based on +the above pin assignment - at all times even after the sink gets +disconnected, the max lane count must be determined and cached during +the PHY's HW readout and connect sequences. Do that here, leaving the +actual use of the cached value to a follow-up change. + +v2: Don't read out the pin configuration if the PHY is disconnected. + +Cc: stable@vger.kernel.org # v6.8+ +Reported-by: Charlton Lin +Tested-by: Khaled Almahallawy +Reviewed-by: Mika Kahola +Signed-off-by: Imre Deak +Link: https://lore.kernel.org/r/20250811080152.906216-3-imre.deak@intel.com +(cherry picked from commit 3e32438fc406761f81b1928d210b3d2a5e7501a0) +Signed-off-by: Tvrtko Ursulin +[ adapted APIs from intel_display to drm_i915_private structures ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_tc.c | 55 +++++++++++++++++++++++++++----- + 1 file changed, 47 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_tc.c ++++ b/drivers/gpu/drm/i915/display/intel_tc.c +@@ -63,6 +63,7 @@ struct intel_tc_port { + enum tc_port_mode init_mode; + enum phy_fia phy_fia; + u8 phy_fia_idx; ++ u8 max_lane_count; + }; + + static enum intel_display_power_domain +@@ -366,12 +367,12 @@ static int intel_tc_port_get_max_lane_co + } + } + +-int intel_tc_port_max_lane_count(struct intel_digital_port *dig_port) ++static int get_max_lane_count(struct intel_tc_port *tc) + { ++ struct intel_digital_port *dig_port = tc->dig_port; + struct drm_i915_private *i915 = to_i915(dig_port->base.base.dev); +- struct intel_tc_port *tc = to_tc_port(dig_port); + +- if (!intel_encoder_is_tc(&dig_port->base) || tc->mode != TC_PORT_DP_ALT) ++ if (tc->mode != TC_PORT_DP_ALT) + return 4; + + assert_tc_cold_blocked(tc); +@@ -385,6 +386,21 @@ int intel_tc_port_max_lane_count(struct + return intel_tc_port_get_max_lane_count(dig_port); + } + ++static void read_pin_configuration(struct intel_tc_port *tc) ++{ ++ tc->max_lane_count = get_max_lane_count(tc); ++} ++ ++int intel_tc_port_max_lane_count(struct intel_digital_port *dig_port) ++{ ++ struct intel_tc_port *tc = to_tc_port(dig_port); ++ ++ if (!intel_encoder_is_tc(&dig_port->base)) ++ return 4; ++ ++ return get_max_lane_count(tc); ++} ++ + void intel_tc_port_set_fia_lane_count(struct intel_digital_port *dig_port, + int required_lanes) + { +@@ -597,9 +613,12 @@ static void icl_tc_phy_get_hw_state(stru + tc_cold_wref = __tc_cold_block(tc, &domain); + + tc->mode = tc_phy_get_current_mode(tc); +- if (tc->mode != TC_PORT_DISCONNECTED) ++ if (tc->mode != TC_PORT_DISCONNECTED) { + tc->lock_wakeref = tc_cold_block(tc); + ++ read_pin_configuration(tc); ++ } ++ + __tc_cold_unblock(tc, domain, tc_cold_wref); + } + +@@ -657,8 +676,11 @@ static bool icl_tc_phy_connect(struct in + + tc->lock_wakeref = tc_cold_block(tc); + +- if (tc->mode == TC_PORT_TBT_ALT) ++ if (tc->mode == TC_PORT_TBT_ALT) { ++ read_pin_configuration(tc); ++ + return true; ++ } + + if ((!tc_phy_is_ready(tc) || + !icl_tc_phy_take_ownership(tc, true)) && +@@ -669,6 +691,7 @@ static bool icl_tc_phy_connect(struct in + goto out_unblock_tc_cold; + } + ++ read_pin_configuration(tc); + + if (!tc_phy_verify_legacy_or_dp_alt_mode(tc, required_lanes)) + goto out_release_phy; +@@ -859,9 +882,12 @@ static void adlp_tc_phy_get_hw_state(str + port_wakeref = intel_display_power_get(i915, port_power_domain); + + tc->mode = tc_phy_get_current_mode(tc); +- if (tc->mode != TC_PORT_DISCONNECTED) ++ if (tc->mode != TC_PORT_DISCONNECTED) { + tc->lock_wakeref = tc_cold_block(tc); + ++ read_pin_configuration(tc); ++ } ++ + intel_display_power_put(i915, port_power_domain, port_wakeref); + } + +@@ -874,6 +900,9 @@ static bool adlp_tc_phy_connect(struct i + + if (tc->mode == TC_PORT_TBT_ALT) { + tc->lock_wakeref = tc_cold_block(tc); ++ ++ read_pin_configuration(tc); ++ + return true; + } + +@@ -895,6 +924,8 @@ static bool adlp_tc_phy_connect(struct i + + tc->lock_wakeref = tc_cold_block(tc); + ++ read_pin_configuration(tc); ++ + if (!tc_phy_verify_legacy_or_dp_alt_mode(tc, required_lanes)) + goto out_unblock_tc_cold; + +@@ -1094,9 +1125,12 @@ static void xelpdp_tc_phy_get_hw_state(s + tc_cold_wref = __tc_cold_block(tc, &domain); + + tc->mode = tc_phy_get_current_mode(tc); +- if (tc->mode != TC_PORT_DISCONNECTED) ++ if (tc->mode != TC_PORT_DISCONNECTED) { + tc->lock_wakeref = tc_cold_block(tc); + ++ read_pin_configuration(tc); ++ } ++ + drm_WARN_ON(&i915->drm, + (tc->mode == TC_PORT_DP_ALT || tc->mode == TC_PORT_LEGACY) && + !xelpdp_tc_phy_tcss_power_is_enabled(tc)); +@@ -1108,14 +1142,19 @@ static bool xelpdp_tc_phy_connect(struct + { + tc->lock_wakeref = tc_cold_block(tc); + +- if (tc->mode == TC_PORT_TBT_ALT) ++ if (tc->mode == TC_PORT_TBT_ALT) { ++ read_pin_configuration(tc); ++ + return true; ++ } + + if (!xelpdp_tc_phy_enable_tcss_power(tc, true)) + goto out_unblock_tccold; + + xelpdp_tc_phy_take_ownership(tc, true); + ++ read_pin_configuration(tc); ++ + if (!tc_phy_verify_legacy_or_dp_alt_mode(tc, required_lanes)) + goto out_release_phy; + diff --git a/queue-6.12/drm-i915-icl-tc-convert-aux-powered-warn-to-a-debug-message.patch b/queue-6.12/drm-i915-icl-tc-convert-aux-powered-warn-to-a-debug-message.patch new file mode 100644 index 0000000000..3914ab0aed --- /dev/null +++ b/queue-6.12/drm-i915-icl-tc-convert-aux-powered-warn-to-a-debug-message.patch @@ -0,0 +1,45 @@ +From stable+bounces-172670-greg=kroah.com@vger.kernel.org Sun Aug 24 02:32:24 2025 +From: Sasha Levin +Date: Sat, 23 Aug 2025 20:32:15 -0400 +Subject: drm/i915/icl+/tc: Convert AUX powered WARN to a debug message +To: stable@vger.kernel.org +Cc: Imre Deak , Charlton Lin , Khaled Almahallawy , Mika Kahola , Tvrtko Ursulin , Sasha Levin +Message-ID: <20250824003215.2541102-1-sashal@kernel.org> + +From: Imre Deak + +[ Upstream commit d7fa5754e83cd36c4327eb2d806064e598a72ff6 ] + +The BIOS can leave the AUX power well enabled on an output, even if this +isn't required (on platforms where the AUX power is only needed for an +AUX access). This was observed at least on PTL. To avoid the WARN which +would be triggered by this during the HW readout, convert the WARN to a +debug message. + +Cc: stable@vger.kernel.org # v6.8+ +Reported-by: Charlton Lin +Tested-by: Khaled Almahallawy +Reviewed-by: Mika Kahola +Signed-off-by: Imre Deak +Link: https://lore.kernel.org/r/20250811080152.906216-6-imre.deak@intel.com +(cherry picked from commit 6cb52cba474b2bec1a3018d3dbf75292059a29a1) +Signed-off-by: Tvrtko Ursulin +[ display->drm API => i915->drm ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_tc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_tc.c ++++ b/drivers/gpu/drm/i915/display/intel_tc.c +@@ -1416,7 +1416,8 @@ static void intel_tc_port_reset_mode(str + + aux_domain = intel_aux_power_domain(dig_port); + aux_powered = intel_display_power_is_enabled(i915, aux_domain); +- drm_WARN_ON(&i915->drm, aux_powered); ++ drm_dbg_kms(&i915->drm, "Port %s: AUX powered %d\n", ++ tc->port_name, aux_powered); + } + + tc_phy_disconnect(tc); diff --git a/queue-6.12/iio-light-as73211-ensure-buffer-holes-are-zeroed.patch b/queue-6.12/iio-light-as73211-ensure-buffer-holes-are-zeroed.patch new file mode 100644 index 0000000000..0184b174ef --- /dev/null +++ b/queue-6.12/iio-light-as73211-ensure-buffer-holes-are-zeroed.patch @@ -0,0 +1,38 @@ +From stable+bounces-172682-greg=kroah.com@vger.kernel.org Sun Aug 24 03:29:42 2025 +From: Sasha Levin +Date: Sat, 23 Aug 2025 21:29:32 -0400 +Subject: iio: light: as73211: Ensure buffer holes are zeroed +To: stable@vger.kernel.org +Cc: Jonathan Cameron , Matti Vaittinen , Andy Shevchenko , Stable@vger.kernel.org, Sasha Levin +Message-ID: <20250824012932.2578686-2-sashal@kernel.org> + +From: Jonathan Cameron + +[ Upstream commit 433b99e922943efdfd62b9a8e3ad1604838181f2 ] + +Given that the buffer is copied to a kfifo that ultimately user space +can read, ensure we zero it. + +Fixes: 403e5586b52e ("iio: light: as73211: New driver") +Reviewed-by: Matti Vaittinen +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20250802164436.515988-2-jic23@kernel.org +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/as73211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/as73211.c ++++ b/drivers/iio/light/as73211.c +@@ -643,7 +643,7 @@ static irqreturn_t as73211_trigger_handl + struct { + __le16 chan[4]; + aligned_s64 ts; +- } scan; ++ } scan = { }; + int data_result, ret; + + mutex_lock(&data->mutex); diff --git a/queue-6.12/iio-light-use-aligned_s64-instead-of-open-coding-alignment.patch b/queue-6.12/iio-light-use-aligned_s64-instead-of-open-coding-alignment.patch new file mode 100644 index 0000000000..b02cb57e66 --- /dev/null +++ b/queue-6.12/iio-light-use-aligned_s64-instead-of-open-coding-alignment.patch @@ -0,0 +1,158 @@ +From stable+bounces-172681-greg=kroah.com@vger.kernel.org Sun Aug 24 03:29:41 2025 +From: Sasha Levin +Date: Sat, 23 Aug 2025 21:29:31 -0400 +Subject: iio: light: Use aligned_s64 instead of open coding alignment. +To: stable@vger.kernel.org +Cc: Jonathan Cameron , Matti Vaittinen , Andy Shevchenko , Sasha Levin +Message-ID: <20250824012932.2578686-1-sashal@kernel.org> + +From: Jonathan Cameron + +[ Upstream commit a801016da0bbb955acf1a551584790e3816bb4db ] + +Use this new type to both slightly simplify the code and avoid +confusing static analysis tools. Mostly this series is about consistency +to avoid this code pattern getting copied into more drivers. + +Acked-By: Matti Vaittinen #For bu27034, rpr0521 +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20241215182912.481706-9-jic23@kernel.org +Signed-off-by: Jonathan Cameron +Stable-dep-of: 433b99e92294 ("iio: light: as73211: Ensure buffer holes are zeroed") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/adjd_s311.c | 2 +- + drivers/iio/light/as73211.c | 2 +- + drivers/iio/light/bh1745.c | 2 +- + drivers/iio/light/isl29125.c | 2 +- + drivers/iio/light/ltr501.c | 2 +- + drivers/iio/light/max44000.c | 2 +- + drivers/iio/light/rohm-bu27034.c | 2 +- + drivers/iio/light/rpr0521.c | 2 +- + drivers/iio/light/st_uvis25.h | 2 +- + drivers/iio/light/tcs3414.c | 2 +- + drivers/iio/light/tcs3472.c | 2 +- + 11 files changed, 11 insertions(+), 11 deletions(-) + +--- a/drivers/iio/light/adjd_s311.c ++++ b/drivers/iio/light/adjd_s311.c +@@ -56,7 +56,7 @@ struct adjd_s311_data { + struct i2c_client *client; + struct { + s16 chans[4]; +- s64 ts __aligned(8); ++ aligned_s64 ts; + } scan; + }; + +--- a/drivers/iio/light/as73211.c ++++ b/drivers/iio/light/as73211.c +@@ -642,7 +642,7 @@ static irqreturn_t as73211_trigger_handl + struct as73211_data *data = iio_priv(indio_dev); + struct { + __le16 chan[4]; +- s64 ts __aligned(8); ++ aligned_s64 ts; + } scan; + int data_result, ret; + +--- a/drivers/iio/light/bh1745.c ++++ b/drivers/iio/light/bh1745.c +@@ -743,7 +743,7 @@ static irqreturn_t bh1745_trigger_handle + struct bh1745_data *data = iio_priv(indio_dev); + struct { + u16 chans[4]; +- s64 timestamp __aligned(8); ++ aligned_s64 timestamp; + } scan; + u16 value; + int ret; +--- a/drivers/iio/light/isl29125.c ++++ b/drivers/iio/light/isl29125.c +@@ -54,7 +54,7 @@ struct isl29125_data { + /* Ensure timestamp is naturally aligned */ + struct { + u16 chans[3]; +- s64 timestamp __aligned(8); ++ aligned_s64 timestamp; + } scan; + }; + +--- a/drivers/iio/light/ltr501.c ++++ b/drivers/iio/light/ltr501.c +@@ -1285,7 +1285,7 @@ static irqreturn_t ltr501_trigger_handle + struct ltr501_data *data = iio_priv(indio_dev); + struct { + u16 channels[3]; +- s64 ts __aligned(8); ++ aligned_s64 ts; + } scan; + __le16 als_buf[2]; + u8 mask = 0; +--- a/drivers/iio/light/max44000.c ++++ b/drivers/iio/light/max44000.c +@@ -78,7 +78,7 @@ struct max44000_data { + /* Ensure naturally aligned timestamp */ + struct { + u16 channels[2]; +- s64 ts __aligned(8); ++ aligned_s64 ts; + } scan; + }; + +--- a/drivers/iio/light/rohm-bu27034.c ++++ b/drivers/iio/light/rohm-bu27034.c +@@ -205,7 +205,7 @@ struct bu27034_data { + struct { + u32 mlux; + __le16 channels[BU27034_NUM_HW_DATA_CHANS]; +- s64 ts __aligned(8); ++ aligned_s64 ts; + } scan; + }; + +--- a/drivers/iio/light/rpr0521.c ++++ b/drivers/iio/light/rpr0521.c +@@ -203,7 +203,7 @@ struct rpr0521_data { + struct { + __le16 channels[3]; + u8 garbage; +- s64 ts __aligned(8); ++ aligned_s64 ts; + } scan; + }; + +--- a/drivers/iio/light/st_uvis25.h ++++ b/drivers/iio/light/st_uvis25.h +@@ -30,7 +30,7 @@ struct st_uvis25_hw { + /* Ensure timestamp is naturally aligned */ + struct { + u8 chan; +- s64 ts __aligned(8); ++ aligned_s64 ts; + } scan; + }; + +--- a/drivers/iio/light/tcs3414.c ++++ b/drivers/iio/light/tcs3414.c +@@ -56,7 +56,7 @@ struct tcs3414_data { + /* Ensure timestamp is naturally aligned */ + struct { + u16 chans[4]; +- s64 timestamp __aligned(8); ++ aligned_s64 timestamp; + } scan; + }; + +--- a/drivers/iio/light/tcs3472.c ++++ b/drivers/iio/light/tcs3472.c +@@ -67,7 +67,7 @@ struct tcs3472_data { + /* Ensure timestamp is naturally aligned */ + struct { + u16 chans[4]; +- s64 timestamp __aligned(8); ++ aligned_s64 timestamp; + } scan; + }; + diff --git a/queue-6.12/iio-temperature-maxim_thermocouple-use-dma-safe-buffer-for-spi_read.patch b/queue-6.12/iio-temperature-maxim_thermocouple-use-dma-safe-buffer-for-spi_read.patch new file mode 100644 index 0000000000..23f50fef4a --- /dev/null +++ b/queue-6.12/iio-temperature-maxim_thermocouple-use-dma-safe-buffer-for-spi_read.patch @@ -0,0 +1,95 @@ +From stable+bounces-172680-greg=kroah.com@vger.kernel.org Sun Aug 24 03:20:15 2025 +From: Sasha Levin +Date: Sat, 23 Aug 2025 21:20:08 -0400 +Subject: iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() +To: stable@vger.kernel.org +Cc: "David Lechner" , "Nuno Sá" , Stable@vger.kernel.org, "Jonathan Cameron" , "Sasha Levin" +Message-ID: <20250824012008.2575688-1-sashal@kernel.org> + +From: David Lechner + +[ Upstream commit ae5bc07ec9f73a41734270ef3f800c5c8a7e0ad3 ] + +Replace using stack-allocated buffers with a DMA-safe buffer for use +with spi_read(). This allows the driver to be safely used with +DMA-enabled SPI controllers. + +The buffer array is also converted to a struct with a union to make the +usage of the memory in the buffer more clear and ensure proper alignment. + +Fixes: 1f25ca11d84a ("iio: temperature: add support for Maxim thermocouple chips") +Signed-off-by: David Lechner +Reviewed-by: Nuno Sá +Link: https://patch.msgid.link/20250721-iio-use-more-iio_declare_buffer_with_ts-3-v2-1-0c68d41ccf6c@baylibre.com +Cc: +Signed-off-by: Jonathan Cameron +[ iio_push_to_buffers_with_ts() => iio_push_to_buffers_with_timestamp() ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/temperature/maxim_thermocouple.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +--- a/drivers/iio/temperature/maxim_thermocouple.c ++++ b/drivers/iio/temperature/maxim_thermocouple.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -122,8 +123,15 @@ struct maxim_thermocouple_data { + struct spi_device *spi; + const struct maxim_thermocouple_chip *chip; + char tc_type; +- +- u8 buffer[16] __aligned(IIO_DMA_MINALIGN); ++ /* Buffer for reading up to 2 hardware channels. */ ++ struct { ++ union { ++ __be16 raw16; ++ __be32 raw32; ++ __be16 raw[2]; ++ }; ++ aligned_s64 timestamp; ++ } buffer __aligned(IIO_DMA_MINALIGN); + }; + + static int maxim_thermocouple_read(struct maxim_thermocouple_data *data, +@@ -131,18 +139,16 @@ static int maxim_thermocouple_read(struc + { + unsigned int storage_bytes = data->chip->read_size; + unsigned int shift = chan->scan_type.shift + (chan->address * 8); +- __be16 buf16; +- __be32 buf32; + int ret; + + switch (storage_bytes) { + case 2: +- ret = spi_read(data->spi, (void *)&buf16, storage_bytes); +- *val = be16_to_cpu(buf16); ++ ret = spi_read(data->spi, &data->buffer.raw16, storage_bytes); ++ *val = be16_to_cpu(data->buffer.raw16); + break; + case 4: +- ret = spi_read(data->spi, (void *)&buf32, storage_bytes); +- *val = be32_to_cpu(buf32); ++ ret = spi_read(data->spi, &data->buffer.raw32, storage_bytes); ++ *val = be32_to_cpu(data->buffer.raw32); + break; + default: + ret = -EINVAL; +@@ -167,9 +173,9 @@ static irqreturn_t maxim_thermocouple_tr + struct maxim_thermocouple_data *data = iio_priv(indio_dev); + int ret; + +- ret = spi_read(data->spi, data->buffer, data->chip->read_size); ++ ret = spi_read(data->spi, data->buffer.raw, data->chip->read_size); + if (!ret) { +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer, + iio_get_time_ns(indio_dev)); + } + diff --git a/queue-6.12/series b/queue-6.12/series index 4889aaf8d1..47cfbe5302 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -233,3 +233,11 @@ usb-xhci-fix-slot_id-resource-race-conflict.patch usb-dwc3-ignore-late-xfernotready-event-to-prevent-halt-timeout.patch usb-dwc3-remove-warn_on-for-device-endpoint-command-timeouts.patch usb-dwc3-pci-add-support-for-the-intel-wildcat-lake.patch +iio-light-use-aligned_s64-instead-of-open-coding-alignment.patch +iio-light-as73211-ensure-buffer-holes-are-zeroed.patch +iio-temperature-maxim_thermocouple-use-dma-safe-buffer-for-spi_read.patch +tracing-remove-unneeded-goto-out-logic.patch +tracing-limit-access-to-parser-buffer-when-trace_get_user-failed.patch +drm-i915-icl-tc-convert-aux-powered-warn-to-a-debug-message.patch +compiler-remove-__addressable_asm-_str-again.patch +drm-i915-icl-tc-cache-the-max-lane-count-value.patch diff --git a/queue-6.12/tracing-limit-access-to-parser-buffer-when-trace_get_user-failed.patch b/queue-6.12/tracing-limit-access-to-parser-buffer-when-trace_get_user-failed.patch new file mode 100644 index 0000000000..a585c10a79 --- /dev/null +++ b/queue-6.12/tracing-limit-access-to-parser-buffer-when-trace_get_user-failed.patch @@ -0,0 +1,142 @@ +From stable+bounces-172678-greg=kroah.com@vger.kernel.org Sun Aug 24 03:19:03 2025 +From: Sasha Levin +Date: Sat, 23 Aug 2025 21:18:55 -0400 +Subject: tracing: Limit access to parser->buffer when trace_get_user failed +To: stable@vger.kernel.org +Cc: Pu Lehui , "Steven Rostedt (Google)" , Sasha Levin +Message-ID: <20250824011855.2574804-2-sashal@kernel.org> + +From: Pu Lehui + +[ Upstream commit 6a909ea83f226803ea0e718f6e88613df9234d58 ] + +When the length of the string written to set_ftrace_filter exceeds +FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: + +BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 +Read of size 1 at addr ffff0000d00bd5ba by task ash/165 + +CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty +Hardware name: linux,dummy-virt (DT) +Call trace: + show_stack+0x34/0x50 (C) + dump_stack_lvl+0xa0/0x158 + print_address_description.constprop.0+0x88/0x398 + print_report+0xb0/0x280 + kasan_report+0xa4/0xf0 + __asan_report_load1_noabort+0x20/0x30 + strsep+0x18c/0x1b0 + ftrace_process_regex.isra.0+0x100/0x2d8 + ftrace_regex_release+0x484/0x618 + __fput+0x364/0xa58 + ____fput+0x28/0x40 + task_work_run+0x154/0x278 + do_notify_resume+0x1f0/0x220 + el0_svc+0xec/0xf0 + el0t_64_sync_handler+0xa0/0xe8 + el0t_64_sync+0x1ac/0x1b0 + +The reason is that trace_get_user will fail when processing a string +longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. +Then an OOB access will be triggered in ftrace_regex_release-> +ftrace_process_regex->strsep->strpbrk. We can solve this problem by +limiting access to parser->buffer when trace_get_user failed. + +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/20250813040232.1344527-1-pulehui@huaweicloud.com +Fixes: 8c9af478c06b ("ftrace: Handle commands when closing set_ftrace_filter file") +Signed-off-by: Pu Lehui +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace.c | 18 ++++++++++++------ + kernel/trace/trace.h | 8 +++++++- + 2 files changed, 19 insertions(+), 7 deletions(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1754,7 +1754,7 @@ int trace_get_user(struct trace_parser * + + ret = get_user(ch, ubuf++); + if (ret) +- return ret; ++ goto fail; + + read++; + cnt--; +@@ -1768,7 +1768,7 @@ int trace_get_user(struct trace_parser * + while (cnt && isspace(ch)) { + ret = get_user(ch, ubuf++); + if (ret) +- return ret; ++ goto fail; + read++; + cnt--; + } +@@ -1786,12 +1786,14 @@ int trace_get_user(struct trace_parser * + while (cnt && !isspace(ch) && ch) { + if (parser->idx < parser->size - 1) + parser->buffer[parser->idx++] = ch; +- else +- return -EINVAL; ++ else { ++ ret = -EINVAL; ++ goto fail; ++ } + + ret = get_user(ch, ubuf++); + if (ret) +- return ret; ++ goto fail; + read++; + cnt--; + } +@@ -1806,11 +1808,15 @@ int trace_get_user(struct trace_parser * + /* Make sure the parsed string always terminates with '\0'. */ + parser->buffer[parser->idx] = 0; + } else { +- return -EINVAL; ++ ret = -EINVAL; ++ goto fail; + } + + *ppos += read; + return read; ++fail: ++ trace_parser_fail(parser); ++ return ret; + } + + /* TODO add a seq_buf_to_buffer() */ +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -1230,6 +1230,7 @@ bool ftrace_event_is_function(struct tra + */ + struct trace_parser { + bool cont; ++ bool fail; + char *buffer; + unsigned idx; + unsigned size; +@@ -1237,7 +1238,7 @@ struct trace_parser { + + static inline bool trace_parser_loaded(struct trace_parser *parser) + { +- return (parser->idx != 0); ++ return !parser->fail && parser->idx != 0; + } + + static inline bool trace_parser_cont(struct trace_parser *parser) +@@ -1251,6 +1252,11 @@ static inline void trace_parser_clear(st + parser->idx = 0; + } + ++static inline void trace_parser_fail(struct trace_parser *parser) ++{ ++ parser->fail = true; ++} ++ + extern int trace_parser_get_init(struct trace_parser *parser, int size); + extern void trace_parser_put(struct trace_parser *parser); + extern int trace_get_user(struct trace_parser *parser, const char __user *ubuf, diff --git a/queue-6.12/tracing-remove-unneeded-goto-out-logic.patch b/queue-6.12/tracing-remove-unneeded-goto-out-logic.patch new file mode 100644 index 0000000000..4f55747908 --- /dev/null +++ b/queue-6.12/tracing-remove-unneeded-goto-out-logic.patch @@ -0,0 +1,152 @@ +From stable+bounces-172677-greg=kroah.com@vger.kernel.org Sun Aug 24 03:19:02 2025 +From: Sasha Levin +Date: Sat, 23 Aug 2025 21:18:54 -0400 +Subject: tracing: Remove unneeded goto out logic +To: stable@vger.kernel.org +Cc: Steven Rostedt , Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Sasha Levin +Message-ID: <20250824011855.2574804-1-sashal@kernel.org> + +From: Steven Rostedt + +[ Upstream commit c89504a703fb779052213add0e8ed642f4a4f1c8 ] + +Several places in the trace.c file there's a goto out where the out is +simply a return. There's no reason to jump to the out label if it's not +doing any more logic but simply returning from the function. + +Replace the goto outs with a return and remove the out labels. + +Cc: Masami Hiramatsu +Cc: Mark Rutland +Cc: Mathieu Desnoyers +Cc: Andrew Morton +Link: https://lore.kernel.org/20250801203857.538726745@kernel.org +Signed-off-by: Steven Rostedt (Google) +Stable-dep-of: 6a909ea83f22 ("tracing: Limit access to parser->buffer when trace_get_user failed") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/trace/trace.c | 38 +++++++++++++++----------------------- + 1 file changed, 15 insertions(+), 23 deletions(-) + +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1754,7 +1754,7 @@ int trace_get_user(struct trace_parser * + + ret = get_user(ch, ubuf++); + if (ret) +- goto out; ++ return ret; + + read++; + cnt--; +@@ -1768,7 +1768,7 @@ int trace_get_user(struct trace_parser * + while (cnt && isspace(ch)) { + ret = get_user(ch, ubuf++); + if (ret) +- goto out; ++ return ret; + read++; + cnt--; + } +@@ -1778,8 +1778,7 @@ int trace_get_user(struct trace_parser * + /* only spaces were written */ + if (isspace(ch) || !ch) { + *ppos += read; +- ret = read; +- goto out; ++ return read; + } + } + +@@ -1787,13 +1786,12 @@ int trace_get_user(struct trace_parser * + while (cnt && !isspace(ch) && ch) { + if (parser->idx < parser->size - 1) + parser->buffer[parser->idx++] = ch; +- else { +- ret = -EINVAL; +- goto out; +- } ++ else ++ return -EINVAL; ++ + ret = get_user(ch, ubuf++); + if (ret) +- goto out; ++ return ret; + read++; + cnt--; + } +@@ -1808,15 +1806,11 @@ int trace_get_user(struct trace_parser * + /* Make sure the parsed string always terminates with '\0'. */ + parser->buffer[parser->idx] = 0; + } else { +- ret = -EINVAL; +- goto out; ++ return -EINVAL; + } + + *ppos += read; +- ret = read; +- +-out: +- return ret; ++ return read; + } + + /* TODO add a seq_buf_to_buffer() */ +@@ -2318,10 +2312,10 @@ int __init register_tracer(struct tracer + mutex_unlock(&trace_types_lock); + + if (ret || !default_bootup_tracer) +- goto out_unlock; ++ return ret; + + if (strncmp(default_bootup_tracer, type->name, MAX_TRACER_SIZE)) +- goto out_unlock; ++ return 0; + + printk(KERN_INFO "Starting tracer '%s'\n", type->name); + /* Do we want this tracer to start on bootup? */ +@@ -2333,8 +2327,7 @@ int __init register_tracer(struct tracer + /* disable other selftests, since this will break it. */ + disable_tracing_selftest("running a tracer"); + +- out_unlock: +- return ret; ++ return 0; + } + + static void tracing_reset_cpu(struct array_buffer *buf, int cpu) +@@ -8563,12 +8556,12 @@ ftrace_trace_snapshot_callback(struct tr + out_reg: + ret = tracing_arm_snapshot(tr); + if (ret < 0) +- goto out; ++ return ret; + + ret = register_ftrace_function_probe(glob, tr, ops, count); + if (ret < 0) + tracing_disarm_snapshot(tr); +- out: ++ + return ret < 0 ? ret : 0; + } + +@@ -10469,7 +10462,7 @@ __init static int tracer_alloc_buffers(v + BUILD_BUG_ON(TRACE_ITER_LAST_BIT > TRACE_FLAGS_MAX_SIZE); + + if (!alloc_cpumask_var(&tracing_buffer_mask, GFP_KERNEL)) +- goto out; ++ return -ENOMEM; + + if (!alloc_cpumask_var(&global_trace.tracing_cpumask, GFP_KERNEL)) + goto out_free_buffer_mask; +@@ -10582,7 +10575,6 @@ out_free_cpumask: + free_cpumask_var(global_trace.tracing_cpumask); + out_free_buffer_mask: + free_cpumask_var(tracing_buffer_mask); +-out: + return ret; + } + -- 2.47.3