From 7ee24cf2cf00275fde706deb1c1b203cf25471c7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 8 Oct 2025 09:37:35 +0200 Subject: [PATCH] drop staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch from older kernels breaks the build --- queue-5.10/series | 1 - ...x-handling-on-copy_from_user-failure.patch | 97 ------------------- ...is-fifo-flush-rx-fifo-on-read-errors.patch | 8 +- queue-5.15/series | 1 - ...x-handling-on-copy_from_user-failure.patch | 97 ------------------- ...is-fifo-flush-rx-fifo-on-read-errors.patch | 8 +- queue-5.4/series | 1 - ...x-handling-on-copy_from_user-failure.patch | 97 ------------------- ...is-fifo-flush-rx-fifo-on-read-errors.patch | 8 +- 9 files changed, 12 insertions(+), 306 deletions(-) delete mode 100644 queue-5.10/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch delete mode 100644 queue-5.15/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch delete mode 100644 queue-5.4/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch diff --git a/queue-5.10/series b/queue-5.10/series index 6252ba56ae..a0b9d67481 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -12,6 +12,5 @@ perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch hid-fix-i2c-read-buffer-overflow-in-raw_event-for-mcp2221.patch serial-stm32-allow-selecting-console-when-the-driver-is-module.patch staging-axis-fifo-fix-maximum-tx-packet-length-check.patch -staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch staging-axis-fifo-flush-rx-fifo-on-read-errors.patch driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch diff --git a/queue-5.10/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch b/queue-5.10/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch deleted file mode 100644 index 875eaa2fa5..0000000000 --- a/queue-5.10/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait -Date: Fri, 12 Sep 2025 13:13:21 +0300 -Subject: staging: axis-fifo: fix TX handling on copy_from_user() failure - -From: Ovidiu Panait - -commit 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 upstream. - -If copy_from_user() fails, write() currently returns -EFAULT, but any -partially written data leaves the TX FIFO in an inconsistent state. -Subsequent write() calls then fail with "transmit length mismatch" -errors. - -Once partial data is written to the hardware FIFO, it cannot be removed -without a TX reset. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove -hardware resets for user errors") removed a full FIFO reset for this case, -which fixed a potential RX data loss, but introduced this TX issue. - -Fix this by introducing a bounce buffer: copy the full packet from -userspace first, and write to the hardware FIFO only if the copy -was successful. - -Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") -Cc: stable@vger.kernel.org -Signed-off-by: Ovidiu Panait -Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com -Signed-off-by: Greg Kroah-Hartman ---- - drivers/staging/axis-fifo/axis-fifo.c | 36 +++++++++------------------------- - 1 file changed, 10 insertions(+), 26 deletions(-) - ---- a/drivers/staging/axis-fifo/axis-fifo.c -+++ b/drivers/staging/axis-fifo/axis-fifo.c -@@ -43,7 +43,6 @@ - #define DRIVER_NAME "axis_fifo" - - #define READ_BUF_SIZE 128U /* read buffer length in words */ --#define WRITE_BUF_SIZE 128U /* write buffer length in words */ - - /* ---------------------------- - * IP register offsets -@@ -474,11 +473,8 @@ static ssize_t axis_fifo_write(struct fi - { - struct axis_fifo *fifo = (struct axis_fifo *)f->private_data; - unsigned int words_to_write; -- unsigned int copied; -- unsigned int copy; -- unsigned int i; -+ u32 *txbuf; - int ret; -- u32 tmp_buf[WRITE_BUF_SIZE]; - - if (len % sizeof(u32)) { - dev_err(fifo->dt_device, -@@ -545,32 +541,20 @@ static ssize_t axis_fifo_write(struct fi - } - } - -- /* write data from an intermediate buffer into the fifo IP, refilling -- * the buffer with userspace data as needed -- */ -- copied = 0; -- while (words_to_write > 0) { -- copy = min(words_to_write, WRITE_BUF_SIZE); -- -- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32), -- copy * sizeof(u32))) { -- ret = -EFAULT; -- goto end_unlock; -- } -- -- for (i = 0; i < copy; i++) -- iowrite32(tmp_buf[i], fifo->base_addr + -- XLLF_TDFD_OFFSET); -- -- copied += copy; -- words_to_write -= copy; -+ txbuf = vmemdup_user(buf, len); -+ if (IS_ERR(txbuf)) { -+ ret = PTR_ERR(txbuf); -+ goto end_unlock; - } - -- ret = copied * sizeof(u32); -+ for (int i = 0; i < words_to_write; ++i) -+ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET); - - /* write packet size to fifo */ -- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET); -+ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET); - -+ ret = len; -+ kvfree(txbuf); - end_unlock: - mutex_unlock(&fifo->write_lock); - diff --git a/queue-5.10/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch b/queue-5.10/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch index 8a4b85d9f8..ba8e8cc1a4 100644 --- a/queue-5.10/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch +++ b/queue-5.10/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch @@ -25,7 +25,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/staging/axis-fifo/axis-fifo.c +++ b/drivers/staging/axis-fifo/axis-fifo.c -@@ -399,6 +399,7 @@ static ssize_t axis_fifo_read(struct fil +@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil } bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET); @@ -33,7 +33,7 @@ Signed-off-by: Greg Kroah-Hartman if (!bytes_available) { dev_err(fifo->dt_device, "received a packet of length 0\n"); ret = -EIO; -@@ -409,7 +410,7 @@ static ssize_t axis_fifo_read(struct fil +@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fil dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n", bytes_available, len); ret = -EINVAL; @@ -42,7 +42,7 @@ Signed-off-by: Greg Kroah-Hartman } if (bytes_available % sizeof(u32)) { -@@ -418,11 +419,9 @@ static ssize_t axis_fifo_read(struct fil +@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil */ dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n"); ret = -EIO; @@ -55,7 +55,7 @@ Signed-off-by: Greg Kroah-Hartman /* read data into an intermediate buffer, copying the contents * to userspace when the buffer is full */ -@@ -434,18 +433,23 @@ static ssize_t axis_fifo_read(struct fil +@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil tmp_buf[i] = ioread32(fifo->base_addr + XLLF_RDFD_OFFSET); } diff --git a/queue-5.15/series b/queue-5.15/series index d48bd00de5..db12b4a00b 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -15,6 +15,5 @@ perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch hid-fix-i2c-read-buffer-overflow-in-raw_event-for-mcp2221.patch serial-stm32-allow-selecting-console-when-the-driver-is-module.patch staging-axis-fifo-fix-maximum-tx-packet-length-check.patch -staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch staging-axis-fifo-flush-rx-fifo-on-read-errors.patch driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch diff --git a/queue-5.15/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch b/queue-5.15/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch deleted file mode 100644 index 875eaa2fa5..0000000000 --- a/queue-5.15/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait -Date: Fri, 12 Sep 2025 13:13:21 +0300 -Subject: staging: axis-fifo: fix TX handling on copy_from_user() failure - -From: Ovidiu Panait - -commit 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 upstream. - -If copy_from_user() fails, write() currently returns -EFAULT, but any -partially written data leaves the TX FIFO in an inconsistent state. -Subsequent write() calls then fail with "transmit length mismatch" -errors. - -Once partial data is written to the hardware FIFO, it cannot be removed -without a TX reset. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove -hardware resets for user errors") removed a full FIFO reset for this case, -which fixed a potential RX data loss, but introduced this TX issue. - -Fix this by introducing a bounce buffer: copy the full packet from -userspace first, and write to the hardware FIFO only if the copy -was successful. - -Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") -Cc: stable@vger.kernel.org -Signed-off-by: Ovidiu Panait -Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com -Signed-off-by: Greg Kroah-Hartman ---- - drivers/staging/axis-fifo/axis-fifo.c | 36 +++++++++------------------------- - 1 file changed, 10 insertions(+), 26 deletions(-) - ---- a/drivers/staging/axis-fifo/axis-fifo.c -+++ b/drivers/staging/axis-fifo/axis-fifo.c -@@ -43,7 +43,6 @@ - #define DRIVER_NAME "axis_fifo" - - #define READ_BUF_SIZE 128U /* read buffer length in words */ --#define WRITE_BUF_SIZE 128U /* write buffer length in words */ - - /* ---------------------------- - * IP register offsets -@@ -474,11 +473,8 @@ static ssize_t axis_fifo_write(struct fi - { - struct axis_fifo *fifo = (struct axis_fifo *)f->private_data; - unsigned int words_to_write; -- unsigned int copied; -- unsigned int copy; -- unsigned int i; -+ u32 *txbuf; - int ret; -- u32 tmp_buf[WRITE_BUF_SIZE]; - - if (len % sizeof(u32)) { - dev_err(fifo->dt_device, -@@ -545,32 +541,20 @@ static ssize_t axis_fifo_write(struct fi - } - } - -- /* write data from an intermediate buffer into the fifo IP, refilling -- * the buffer with userspace data as needed -- */ -- copied = 0; -- while (words_to_write > 0) { -- copy = min(words_to_write, WRITE_BUF_SIZE); -- -- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32), -- copy * sizeof(u32))) { -- ret = -EFAULT; -- goto end_unlock; -- } -- -- for (i = 0; i < copy; i++) -- iowrite32(tmp_buf[i], fifo->base_addr + -- XLLF_TDFD_OFFSET); -- -- copied += copy; -- words_to_write -= copy; -+ txbuf = vmemdup_user(buf, len); -+ if (IS_ERR(txbuf)) { -+ ret = PTR_ERR(txbuf); -+ goto end_unlock; - } - -- ret = copied * sizeof(u32); -+ for (int i = 0; i < words_to_write; ++i) -+ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET); - - /* write packet size to fifo */ -- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET); -+ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET); - -+ ret = len; -+ kvfree(txbuf); - end_unlock: - mutex_unlock(&fifo->write_lock); - diff --git a/queue-5.15/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch b/queue-5.15/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch index 8a4b85d9f8..ba8e8cc1a4 100644 --- a/queue-5.15/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch +++ b/queue-5.15/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch @@ -25,7 +25,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/staging/axis-fifo/axis-fifo.c +++ b/drivers/staging/axis-fifo/axis-fifo.c -@@ -399,6 +399,7 @@ static ssize_t axis_fifo_read(struct fil +@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil } bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET); @@ -33,7 +33,7 @@ Signed-off-by: Greg Kroah-Hartman if (!bytes_available) { dev_err(fifo->dt_device, "received a packet of length 0\n"); ret = -EIO; -@@ -409,7 +410,7 @@ static ssize_t axis_fifo_read(struct fil +@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fil dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n", bytes_available, len); ret = -EINVAL; @@ -42,7 +42,7 @@ Signed-off-by: Greg Kroah-Hartman } if (bytes_available % sizeof(u32)) { -@@ -418,11 +419,9 @@ static ssize_t axis_fifo_read(struct fil +@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil */ dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n"); ret = -EIO; @@ -55,7 +55,7 @@ Signed-off-by: Greg Kroah-Hartman /* read data into an intermediate buffer, copying the contents * to userspace when the buffer is full */ -@@ -434,18 +433,23 @@ static ssize_t axis_fifo_read(struct fil +@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil tmp_buf[i] = ioread32(fifo->base_addr + XLLF_RDFD_OFFSET); } diff --git a/queue-5.4/series b/queue-5.4/series index 6f7e550131..111eeb6f72 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -14,6 +14,5 @@ dm-integrity-limit-max_tag_size-to-255.patch perf-subcmd-avoid-crash-in-exclude_cmds-when-exclude.patch serial-stm32-allow-selecting-console-when-the-driver-is-module.patch staging-axis-fifo-fix-maximum-tx-packet-length-check.patch -staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch staging-axis-fifo-flush-rx-fifo-on-read-errors.patch driver-core-pm-set-power.no_callbacks-along-with-power.no_pm.patch diff --git a/queue-5.4/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch b/queue-5.4/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch deleted file mode 100644 index 4fcc9d9ac7..0000000000 --- a/queue-5.4/staging-axis-fifo-fix-tx-handling-on-copy_from_user-failure.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 Mon Sep 17 00:00:00 2001 -From: Ovidiu Panait -Date: Fri, 12 Sep 2025 13:13:21 +0300 -Subject: staging: axis-fifo: fix TX handling on copy_from_user() failure - -From: Ovidiu Panait - -commit 6d07bee10e4bdd043ec7152cbbb9deb27033c9e2 upstream. - -If copy_from_user() fails, write() currently returns -EFAULT, but any -partially written data leaves the TX FIFO in an inconsistent state. -Subsequent write() calls then fail with "transmit length mismatch" -errors. - -Once partial data is written to the hardware FIFO, it cannot be removed -without a TX reset. Commit c6e8d85fafa7 ("staging: axis-fifo: Remove -hardware resets for user errors") removed a full FIFO reset for this case, -which fixed a potential RX data loss, but introduced this TX issue. - -Fix this by introducing a bounce buffer: copy the full packet from -userspace first, and write to the hardware FIFO only if the copy -was successful. - -Fixes: c6e8d85fafa7 ("staging: axis-fifo: Remove hardware resets for user errors") -Cc: stable@vger.kernel.org -Signed-off-by: Ovidiu Panait -Link: https://lore.kernel.org/r/20250912101322.1282507-1-ovidiu.panait.oss@gmail.com -Signed-off-by: Greg Kroah-Hartman ---- - drivers/staging/axis-fifo/axis-fifo.c | 36 +++++++++------------------------- - 1 file changed, 10 insertions(+), 26 deletions(-) - ---- a/drivers/staging/axis-fifo/axis-fifo.c -+++ b/drivers/staging/axis-fifo/axis-fifo.c -@@ -43,7 +43,6 @@ - #define DRIVER_NAME "axis_fifo" - - #define READ_BUF_SIZE 128U /* read buffer length in words */ --#define WRITE_BUF_SIZE 128U /* write buffer length in words */ - - /* ---------------------------- - * IP register offsets -@@ -474,11 +473,8 @@ static ssize_t axis_fifo_write(struct fi - { - struct axis_fifo *fifo = (struct axis_fifo *)f->private_data; - unsigned int words_to_write; -- unsigned int copied; -- unsigned int copy; -- unsigned int i; -+ u32 *txbuf; - int ret; -- u32 tmp_buf[WRITE_BUF_SIZE]; - - if (len % sizeof(u32)) { - dev_err(fifo->dt_device, -@@ -544,32 +540,20 @@ static ssize_t axis_fifo_write(struct fi - } - } - -- /* write data from an intermediate buffer into the fifo IP, refilling -- * the buffer with userspace data as needed -- */ -- copied = 0; -- while (words_to_write > 0) { -- copy = min(words_to_write, WRITE_BUF_SIZE); -- -- if (copy_from_user(tmp_buf, buf + copied * sizeof(u32), -- copy * sizeof(u32))) { -- ret = -EFAULT; -- goto end_unlock; -- } -- -- for (i = 0; i < copy; i++) -- iowrite32(tmp_buf[i], fifo->base_addr + -- XLLF_TDFD_OFFSET); -- -- copied += copy; -- words_to_write -= copy; -+ txbuf = vmemdup_user(buf, len); -+ if (IS_ERR(txbuf)) { -+ ret = PTR_ERR(txbuf); -+ goto end_unlock; - } - -- ret = copied * sizeof(u32); -+ for (int i = 0; i < words_to_write; ++i) -+ iowrite32(txbuf[i], fifo->base_addr + XLLF_TDFD_OFFSET); - - /* write packet size to fifo */ -- iowrite32(ret, fifo->base_addr + XLLF_TLR_OFFSET); -+ iowrite32(len, fifo->base_addr + XLLF_TLR_OFFSET); - -+ ret = len; -+ kvfree(txbuf); - end_unlock: - mutex_unlock(&fifo->write_lock); - diff --git a/queue-5.4/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch b/queue-5.4/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch index 8a4b85d9f8..ba8e8cc1a4 100644 --- a/queue-5.4/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch +++ b/queue-5.4/staging-axis-fifo-flush-rx-fifo-on-read-errors.patch @@ -25,7 +25,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/drivers/staging/axis-fifo/axis-fifo.c +++ b/drivers/staging/axis-fifo/axis-fifo.c -@@ -399,6 +399,7 @@ static ssize_t axis_fifo_read(struct fil +@@ -400,6 +400,7 @@ static ssize_t axis_fifo_read(struct fil } bytes_available = ioread32(fifo->base_addr + XLLF_RLR_OFFSET); @@ -33,7 +33,7 @@ Signed-off-by: Greg Kroah-Hartman if (!bytes_available) { dev_err(fifo->dt_device, "received a packet of length 0\n"); ret = -EIO; -@@ -409,7 +410,7 @@ static ssize_t axis_fifo_read(struct fil +@@ -410,7 +411,7 @@ static ssize_t axis_fifo_read(struct fil dev_err(fifo->dt_device, "user read buffer too small (available bytes=%zu user buffer bytes=%zu)\n", bytes_available, len); ret = -EINVAL; @@ -42,7 +42,7 @@ Signed-off-by: Greg Kroah-Hartman } if (bytes_available % sizeof(u32)) { -@@ -418,11 +419,9 @@ static ssize_t axis_fifo_read(struct fil +@@ -419,11 +420,9 @@ static ssize_t axis_fifo_read(struct fil */ dev_err(fifo->dt_device, "received a packet that isn't word-aligned\n"); ret = -EIO; @@ -55,7 +55,7 @@ Signed-off-by: Greg Kroah-Hartman /* read data into an intermediate buffer, copying the contents * to userspace when the buffer is full */ -@@ -434,18 +433,23 @@ static ssize_t axis_fifo_read(struct fil +@@ -435,18 +434,23 @@ static ssize_t axis_fifo_read(struct fil tmp_buf[i] = ioread32(fifo->base_addr + XLLF_RDFD_OFFSET); } -- 2.47.3