From 9354ed6ced0292ed49aa94c8677e18697166d217 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 9 Jan 2022 14:09:13 +0100 Subject: [PATCH] 5.15-stable patches added patches: drm-amdgpu-disable-runpm-if-we-are-the-primary-adapter.patch fbdev-fbmem-add-a-helper-to-determine-if-an-aperture-is-used-by-a-fw-fb.patch gpio-gpio-aspeed-sgpio-fix-wrong-hwirq-base-in-irq-handler.patch i2c-mpc-avoid-out-of-bounds-memory-access.patch net-ticp-fix-a-kernel-infoleak-in-__tipc_sendmsg.patch phonet-refcount-leak-in-pep_sock_accep.patch power-bq25890-enable-continuous-conversion-for-adc-at-charging.patch power-reset-ltc2952-fix-use-of-floating-point-literals.patch power-supply-core-break-capacity-loop.patch reset-renesas-fix-runtime-pm-usage.patch revert-i2c-core-support-bus-regulator-controlling-in-adapter.patch rndis_host-support-hytera-digital-radios.patch xfs-map-unwritten-blocks-in-xfs_ioc_-alloc-free-sp-just-like-fallocate.patch --- ...-runpm-if-we-are-the-primary-adapter.patch | 118 ++++++++++++ ...ne-if-an-aperture-is-used-by-a-fw-fb.patch | 88 +++++++++ ...-fix-wrong-hwirq-base-in-irq-handler.patch | 31 +++ ...pc-avoid-out-of-bounds-memory-access.patch | 104 ++++++++++ ...-a-kernel-infoleak-in-__tipc_sendmsg.patch | 99 ++++++++++ ...onet-refcount-leak-in-pep_sock_accep.patch | 31 +++ ...nuous-conversion-for-adc-at-charging.patch | 38 ++++ ...2-fix-use-of-floating-point-literals.patch | 58 ++++++ ...ower-supply-core-break-capacity-loop.patch | 37 ++++ .../reset-renesas-fix-runtime-pm-usage.patch | 40 ++++ ...bus-regulator-controlling-in-adapter.patch | 177 ++++++++++++++++++ ...s_host-support-hytera-digital-radios.patch | 51 +++++ queue-5.15/series | 13 ++ ...c_-alloc-free-sp-just-like-fallocate.patch | 35 ++++ 14 files changed, 920 insertions(+) create mode 100644 queue-5.15/drm-amdgpu-disable-runpm-if-we-are-the-primary-adapter.patch create mode 100644 queue-5.15/fbdev-fbmem-add-a-helper-to-determine-if-an-aperture-is-used-by-a-fw-fb.patch create mode 100644 queue-5.15/gpio-gpio-aspeed-sgpio-fix-wrong-hwirq-base-in-irq-handler.patch create mode 100644 queue-5.15/i2c-mpc-avoid-out-of-bounds-memory-access.patch create mode 100644 queue-5.15/net-ticp-fix-a-kernel-infoleak-in-__tipc_sendmsg.patch create mode 100644 queue-5.15/phonet-refcount-leak-in-pep_sock_accep.patch create mode 100644 queue-5.15/power-bq25890-enable-continuous-conversion-for-adc-at-charging.patch create mode 100644 queue-5.15/power-reset-ltc2952-fix-use-of-floating-point-literals.patch create mode 100644 queue-5.15/power-supply-core-break-capacity-loop.patch create mode 100644 queue-5.15/reset-renesas-fix-runtime-pm-usage.patch create mode 100644 queue-5.15/revert-i2c-core-support-bus-regulator-controlling-in-adapter.patch create mode 100644 queue-5.15/rndis_host-support-hytera-digital-radios.patch create mode 100644 queue-5.15/xfs-map-unwritten-blocks-in-xfs_ioc_-alloc-free-sp-just-like-fallocate.patch diff --git a/queue-5.15/drm-amdgpu-disable-runpm-if-we-are-the-primary-adapter.patch b/queue-5.15/drm-amdgpu-disable-runpm-if-we-are-the-primary-adapter.patch new file mode 100644 index 00000000000..56d2ec2038f --- /dev/null +++ b/queue-5.15/drm-amdgpu-disable-runpm-if-we-are-the-primary-adapter.patch @@ -0,0 +1,118 @@ +From b95dc06af3e683d6b7ddbbae178b2b2a21ee8b2b Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 22 Dec 2021 22:57:16 -0500 +Subject: drm/amdgpu: disable runpm if we are the primary adapter + +From: Alex Deucher + +commit b95dc06af3e683d6b7ddbbae178b2b2a21ee8b2b upstream. + +If we are the primary adapter (i.e., the one used by the firwmare +framebuffer), disable runtime pm. This fixes a regression caused +by commit 55285e21f045 which results in the displays waking up +shortly after they go to sleep due to the device coming out of +runtime suspend and sending a hotplug uevent. + +v2: squash in reworked fix from Evan + +Fixes: 55285e21f045 ("fbdev/efifb: Release PCI device's runtime PM ref during FB destroy") +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=215203 +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1840 +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 28 ++++++++++++++++++++++++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 6 ++++++ + 3 files changed, 35 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1069,6 +1069,7 @@ struct amdgpu_device { + bool runpm; + bool in_runpm; + bool has_pr3; ++ bool is_fw_fb; + + bool pm_sysfs_en; + bool ucode_sysfs_en; +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + + #include "amdgpu.h" + #include "amdgpu_irq.h" +@@ -1246,6 +1247,26 @@ MODULE_DEVICE_TABLE(pci, pciidlist); + + static const struct drm_driver amdgpu_kms_driver; + ++static bool amdgpu_is_fw_framebuffer(resource_size_t base, ++ resource_size_t size) ++{ ++ bool found = false; ++#if IS_REACHABLE(CONFIG_FB) ++ struct apertures_struct *a; ++ ++ a = alloc_apertures(1); ++ if (!a) ++ return false; ++ ++ a->ranges[0].base = base; ++ a->ranges[0].size = size; ++ ++ found = is_firmware_framebuffer(a); ++ kfree(a); ++#endif ++ return found; ++} ++ + static int amdgpu_pci_probe(struct pci_dev *pdev, + const struct pci_device_id *ent) + { +@@ -1254,6 +1275,8 @@ static int amdgpu_pci_probe(struct pci_d + unsigned long flags = ent->driver_data; + int ret, retry = 0; + bool supports_atomic = false; ++ bool is_fw_fb; ++ resource_size_t base, size; + + if (amdgpu_virtual_display || + amdgpu_device_asic_has_dc_support(flags & AMD_ASIC_MASK)) +@@ -1310,6 +1333,10 @@ static int amdgpu_pci_probe(struct pci_d + } + #endif + ++ base = pci_resource_start(pdev, 0); ++ size = pci_resource_len(pdev, 0); ++ is_fw_fb = amdgpu_is_fw_framebuffer(base, size); ++ + /* Get rid of things like offb */ + ret = drm_aperture_remove_conflicting_pci_framebuffers(pdev, &amdgpu_kms_driver); + if (ret) +@@ -1322,6 +1349,7 @@ static int amdgpu_pci_probe(struct pci_d + adev->dev = &pdev->dev; + adev->pdev = pdev; + ddev = adev_to_drm(adev); ++ adev->is_fw_fb = is_fw_fb; + + if (!supports_atomic) + ddev->driver_features &= ~DRIVER_ATOMIC; +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -206,6 +206,12 @@ int amdgpu_driver_load_kms(struct amdgpu + adev->runpm = true; + break; + } ++ /* XXX: disable runtime pm if we are the primary adapter ++ * to avoid displays being re-enabled after DPMS. ++ * This needs to be sorted out and fixed properly. ++ */ ++ if (adev->is_fw_fb) ++ adev->runpm = false; + if (adev->runpm) + dev_info(adev->dev, "Using BACO for runtime pm\n"); + } diff --git a/queue-5.15/fbdev-fbmem-add-a-helper-to-determine-if-an-aperture-is-used-by-a-fw-fb.patch b/queue-5.15/fbdev-fbmem-add-a-helper-to-determine-if-an-aperture-is-used-by-a-fw-fb.patch new file mode 100644 index 00000000000..1c9607abad8 --- /dev/null +++ b/queue-5.15/fbdev-fbmem-add-a-helper-to-determine-if-an-aperture-is-used-by-a-fw-fb.patch @@ -0,0 +1,88 @@ +From 9a45ac2320d0a6ae01880a30d4b86025fce4061b Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 22 Dec 2021 22:41:18 -0500 +Subject: fbdev: fbmem: add a helper to determine if an aperture is used by a fw fb + +From: Alex Deucher + +commit 9a45ac2320d0a6ae01880a30d4b86025fce4061b upstream. + +Add a function for drivers to check if the a firmware initialized +fb is corresponds to their aperture. This allows drivers to check if the +device corresponds to what the firmware set up as the display device. + +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=215203 +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1840 +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbmem.c | 47 +++++++++++++++++++++++++++++++++++++++ + include/linux/fb.h | 1 + 2 files changed, 48 insertions(+) + +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1760,6 +1760,53 @@ int remove_conflicting_framebuffers(stru + EXPORT_SYMBOL(remove_conflicting_framebuffers); + + /** ++ * is_firmware_framebuffer - detect if firmware-configured framebuffer matches ++ * @a: memory range, users of which are to be checked ++ * ++ * This function checks framebuffer devices (initialized by firmware/bootloader) ++ * which use memory range described by @a. If @a matchesm the function returns ++ * true, otherwise false. ++ */ ++bool is_firmware_framebuffer(struct apertures_struct *a) ++{ ++ bool do_free = false; ++ bool found = false; ++ int i; ++ ++ if (!a) { ++ a = alloc_apertures(1); ++ if (!a) ++ return false; ++ ++ a->ranges[0].base = 0; ++ a->ranges[0].size = ~0; ++ do_free = true; ++ } ++ ++ mutex_lock(®istration_lock); ++ /* check all firmware fbs and kick off if the base addr overlaps */ ++ for_each_registered_fb(i) { ++ struct apertures_struct *gen_aper; ++ ++ if (!(registered_fb[i]->flags & FBINFO_MISC_FIRMWARE)) ++ continue; ++ ++ gen_aper = registered_fb[i]->apertures; ++ if (fb_do_apertures_overlap(gen_aper, a)) { ++ found = true; ++ break; ++ } ++ } ++ mutex_unlock(®istration_lock); ++ ++ if (do_free) ++ kfree(a); ++ ++ return found; ++} ++EXPORT_SYMBOL(is_firmware_framebuffer); ++ ++/** + * remove_conflicting_pci_framebuffers - remove firmware-configured framebuffers for PCI devices + * @pdev: PCI device + * @name: requesting driver name +--- a/include/linux/fb.h ++++ b/include/linux/fb.h +@@ -610,6 +610,7 @@ extern int remove_conflicting_pci_frameb + const char *name); + extern int remove_conflicting_framebuffers(struct apertures_struct *a, + const char *name, bool primary); ++extern bool is_firmware_framebuffer(struct apertures_struct *a); + extern int fb_prepare_logo(struct fb_info *fb_info, int rotate); + extern int fb_show_logo(struct fb_info *fb_info, int rotate); + extern char* fb_get_buffer_offset(struct fb_info *info, struct fb_pixmap *buf, u32 size); diff --git a/queue-5.15/gpio-gpio-aspeed-sgpio-fix-wrong-hwirq-base-in-irq-handler.patch b/queue-5.15/gpio-gpio-aspeed-sgpio-fix-wrong-hwirq-base-in-irq-handler.patch new file mode 100644 index 00000000000..04ec364cf30 --- /dev/null +++ b/queue-5.15/gpio-gpio-aspeed-sgpio-fix-wrong-hwirq-base-in-irq-handler.patch @@ -0,0 +1,31 @@ +From e5a7431f5a2d6dcff7d516ee9d178a3254b17b87 Mon Sep 17 00:00:00 2001 +From: Steven Lee +Date: Tue, 14 Dec 2021 12:02:38 +0800 +Subject: gpio: gpio-aspeed-sgpio: Fix wrong hwirq base in irq handler + +From: Steven Lee + +commit e5a7431f5a2d6dcff7d516ee9d178a3254b17b87 upstream. + +Each aspeed sgpio bank has 64 gpio pins(32 input pins and 32 output pins). +The hwirq base for each sgpio bank should be multiples of 64 rather than +multiples of 32. + +Signed-off-by: Steven Lee +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-aspeed-sgpio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpio/gpio-aspeed-sgpio.c ++++ b/drivers/gpio/gpio-aspeed-sgpio.c +@@ -395,7 +395,7 @@ static void aspeed_sgpio_irq_handler(str + reg = ioread32(bank_reg(data, bank, reg_irq_status)); + + for_each_set_bit(p, ®, 32) +- generic_handle_domain_irq(gc->irq.domain, i * 32 + p * 2); ++ generic_handle_domain_irq(gc->irq.domain, (i * 32 + p) * 2); + } + + chained_irq_exit(ic, desc); diff --git a/queue-5.15/i2c-mpc-avoid-out-of-bounds-memory-access.patch b/queue-5.15/i2c-mpc-avoid-out-of-bounds-memory-access.patch new file mode 100644 index 00000000000..fa93c8f6cbf --- /dev/null +++ b/queue-5.15/i2c-mpc-avoid-out-of-bounds-memory-access.patch @@ -0,0 +1,104 @@ +From 72a4a87da8f7bcf868b338615a814b6542f277f3 Mon Sep 17 00:00:00 2001 +From: Chris Packham +Date: Wed, 5 Jan 2022 14:53:04 +1300 +Subject: i2c: mpc: Avoid out of bounds memory access + +From: Chris Packham + +commit 72a4a87da8f7bcf868b338615a814b6542f277f3 upstream. + +When performing an I2C transfer where the last message was a write KASAN +would complain: + + BUG: KASAN: slab-out-of-bounds in mpc_i2c_do_action+0x154/0x630 + Read of size 2 at addr c814e310 by task swapper/2/0 + + CPU: 2 PID: 0 Comm: swapper/2 Tainted: G B 5.16.0-rc8 #1 + Call Trace: + [e5ee9d50] [c08418e8] dump_stack_lvl+0x4c/0x6c (unreliable) + [e5ee9d70] [c02f8a14] print_address_description.constprop.13+0x64/0x3b0 + [e5ee9da0] [c02f9030] kasan_report+0x1f0/0x204 + [e5ee9de0] [c0c76ee4] mpc_i2c_do_action+0x154/0x630 + [e5ee9e30] [c0c782c4] mpc_i2c_isr+0x164/0x240 + [e5ee9e60] [c00f3a04] __handle_irq_event_percpu+0xf4/0x3b0 + [e5ee9ec0] [c00f3d40] handle_irq_event_percpu+0x80/0x110 + [e5ee9f40] [c00f3e48] handle_irq_event+0x78/0xd0 + [e5ee9f60] [c00fcfec] handle_fasteoi_irq+0x19c/0x370 + [e5ee9fa0] [c00f1d84] generic_handle_irq+0x54/0x80 + [e5ee9fc0] [c0006b54] __do_irq+0x64/0x200 + [e5ee9ff0] [c0007958] __do_IRQ+0xe8/0x1c0 + [c812dd50] [e3eaab20] 0xe3eaab20 + [c812dd90] [c0007a4c] do_IRQ+0x1c/0x30 + [c812dda0] [c0000c04] ExternalInput+0x144/0x160 + --- interrupt: 500 at arch_cpu_idle+0x34/0x60 + NIP: c000b684 LR: c000b684 CTR: c0019688 + REGS: c812ddb0 TRAP: 0500 Tainted: G B (5.16.0-rc8) + MSR: 00029002 CR: 22000488 XER: 20000000 + + GPR00: c10ef7fc c812de90 c80ff200 c2394718 00000001 00000001 c10e3f90 00000003 + GPR08: 00000000 c0019688 c2394718 fc7d625b 22000484 00000000 21e17000 c208228c + GPR16: e3e99284 00000000 ffffffff c2390000 c001bac0 c2082288 c812df60 c001ba60 + GPR24: c23949c0 00000018 00080000 00000004 c80ff200 00000002 c2348ee4 c2394718 + NIP [c000b684] arch_cpu_idle+0x34/0x60 + LR [c000b684] arch_cpu_idle+0x34/0x60 + --- interrupt: 500 + [c812de90] [c10e3f90] rcu_eqs_enter.isra.60+0xc0/0x110 (unreliable) + [c812deb0] [c10ef7fc] default_idle_call+0xbc/0x230 + [c812dee0] [c00af0e8] do_idle+0x1c8/0x200 + [c812df10] [c00af3c0] cpu_startup_entry+0x20/0x30 + [c812df20] [c001e010] start_secondary+0x5d0/0xba0 + [c812dff0] [c00028a0] __secondary_start+0x90/0xdc + +This happened because we would overrun the i2c->msgs array on the final +interrupt for the I2C STOP. This didn't happen if the last message was a +read because there is no interrupt in that case. Ensure that we only +access the current message if we are not processing a I2C STOP +condition. + +Fixes: 1538d82f4647 ("i2c: mpc: Interrupt driven transfer") +Reported-by: Maxime Bizon +Signed-off-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-mpc.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -492,7 +492,7 @@ static void mpc_i2c_finish(struct mpc_i2 + + static void mpc_i2c_do_action(struct mpc_i2c *i2c) + { +- struct i2c_msg *msg = &i2c->msgs[i2c->curr_msg]; ++ struct i2c_msg *msg = NULL; + int dir = 0; + int recv_len = 0; + u8 byte; +@@ -501,10 +501,13 @@ static void mpc_i2c_do_action(struct mpc + + i2c->cntl_bits &= ~(CCR_RSTA | CCR_MTX | CCR_TXAK); + +- if (msg->flags & I2C_M_RD) +- dir = 1; +- if (msg->flags & I2C_M_RECV_LEN) +- recv_len = 1; ++ if (i2c->action != MPC_I2C_ACTION_STOP) { ++ msg = &i2c->msgs[i2c->curr_msg]; ++ if (msg->flags & I2C_M_RD) ++ dir = 1; ++ if (msg->flags & I2C_M_RECV_LEN) ++ recv_len = 1; ++ } + + switch (i2c->action) { + case MPC_I2C_ACTION_RESTART: +@@ -581,7 +584,7 @@ static void mpc_i2c_do_action(struct mpc + break; + } + +- if (msg->len == i2c->byte_posn) { ++ if (msg && msg->len == i2c->byte_posn) { + i2c->curr_msg++; + i2c->byte_posn = 0; + diff --git a/queue-5.15/net-ticp-fix-a-kernel-infoleak-in-__tipc_sendmsg.patch b/queue-5.15/net-ticp-fix-a-kernel-infoleak-in-__tipc_sendmsg.patch new file mode 100644 index 00000000000..6bb42837971 --- /dev/null +++ b/queue-5.15/net-ticp-fix-a-kernel-infoleak-in-__tipc_sendmsg.patch @@ -0,0 +1,99 @@ +From d6d86830705f173fca6087a3e67ceaf68db80523 Mon Sep 17 00:00:00 2001 +From: Haimin Zhang +Date: Fri, 31 Dec 2021 10:35:23 +0800 +Subject: net ticp:fix a kernel-infoleak in __tipc_sendmsg() + +From: Haimin Zhang + +commit d6d86830705f173fca6087a3e67ceaf68db80523 upstream. + +struct tipc_socket_addr.ref has a 4-byte hole,and __tipc_getname() currently +copying it to user space,causing kernel-infoleak. + +BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] +BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33 +BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33 + instrument_copy_to_user include/linux/instrumented.h:121 [inline] + instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33 + _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33 + copy_to_user include/linux/uaccess.h:209 [inline] + copy_to_user include/linux/uaccess.h:209 [inline] net/socket.c:287 + move_addr_to_user+0x3f6/0x600 net/socket.c:287 net/socket.c:287 + __sys_getpeername+0x470/0x6b0 net/socket.c:1987 net/socket.c:1987 + __do_sys_getpeername net/socket.c:1997 [inline] + __se_sys_getpeername net/socket.c:1994 [inline] + __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994 + __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994 + __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82 + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Uninit was stored to memory at: + tipc_getname+0x575/0x5e0 net/tipc/socket.c:757 net/tipc/socket.c:757 + __sys_getpeername+0x3b3/0x6b0 net/socket.c:1984 net/socket.c:1984 + __do_sys_getpeername net/socket.c:1997 [inline] + __se_sys_getpeername net/socket.c:1994 [inline] + __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994 + __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994 + __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82 + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Uninit was stored to memory at: + msg_set_word net/tipc/msg.h:212 [inline] + msg_set_destport net/tipc/msg.h:619 [inline] + msg_set_word net/tipc/msg.h:212 [inline] net/tipc/socket.c:1486 + msg_set_destport net/tipc/msg.h:619 [inline] net/tipc/socket.c:1486 + __tipc_sendmsg+0x44fa/0x5890 net/tipc/socket.c:1486 net/tipc/socket.c:1486 + tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg net/socket.c:724 [inline] + sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:2409 + sock_sendmsg net/socket.c:724 [inline] net/socket.c:2409 + ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2409 net/socket.c:2409 + ___sys_sendmsg net/socket.c:2463 [inline] + ___sys_sendmsg net/socket.c:2463 [inline] net/socket.c:2492 + __sys_sendmsg+0x704/0x840 net/socket.c:2492 net/socket.c:2492 + __do_sys_sendmsg net/socket.c:2501 [inline] + __se_sys_sendmsg net/socket.c:2499 [inline] + __do_sys_sendmsg net/socket.c:2501 [inline] net/socket.c:2499 + __se_sys_sendmsg net/socket.c:2499 [inline] net/socket.c:2499 + __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2499 net/socket.c:2499 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82 + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Local variable skaddr created at: + __tipc_sendmsg+0x2d0/0x5890 net/tipc/socket.c:1419 net/tipc/socket.c:1419 + tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402 + +Bytes 4-7 of 16 are uninitialized +Memory access of size 16 starts at ffff888113753e00 +Data copied to user address 0000000020000280 + +Reported-by: syzbot+cdbd40e0c3ca02cae3b7@syzkaller.appspotmail.com +Signed-off-by: Haimin Zhang +Acked-by: Jon Maloy +Link: https://lore.kernel.org/r/1640918123-14547-1-git-send-email-tcs.kernel@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/socket.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -1461,6 +1461,8 @@ static int __tipc_sendmsg(struct socket + msg_set_syn(hdr, 1); + } + ++ memset(&skaddr, 0, sizeof(skaddr)); ++ + /* Determine destination */ + if (atype == TIPC_SERVICE_RANGE) { + return tipc_sendmcast(sock, ua, m, dlen, timeout); diff --git a/queue-5.15/phonet-refcount-leak-in-pep_sock_accep.patch b/queue-5.15/phonet-refcount-leak-in-pep_sock_accep.patch new file mode 100644 index 00000000000..0abc89f9a22 --- /dev/null +++ b/queue-5.15/phonet-refcount-leak-in-pep_sock_accep.patch @@ -0,0 +1,31 @@ +From bcd0f93353326954817a4f9fa55ec57fb38acbb0 Mon Sep 17 00:00:00 2001 +From: Hangyu Hua +Date: Thu, 9 Dec 2021 16:28:39 +0800 +Subject: phonet: refcount leak in pep_sock_accep + +From: Hangyu Hua + +commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 upstream. + +sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not +invoked in subsequent failure branches(pep_accept_conn() != 0). + +Signed-off-by: Hangyu Hua +Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Aayush Agarwal +Signed-off-by: Greg Kroah-Hartman +--- + net/phonet/pep.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/phonet/pep.c ++++ b/net/phonet/pep.c +@@ -868,6 +868,7 @@ static struct sock *pep_sock_accept(stru + + err = pep_accept_conn(newsk, skb); + if (err) { ++ __sock_put(sk); + sock_put(newsk); + newsk = NULL; + goto drop; diff --git a/queue-5.15/power-bq25890-enable-continuous-conversion-for-adc-at-charging.patch b/queue-5.15/power-bq25890-enable-continuous-conversion-for-adc-at-charging.patch new file mode 100644 index 00000000000..e0baffa92fe --- /dev/null +++ b/queue-5.15/power-bq25890-enable-continuous-conversion-for-adc-at-charging.patch @@ -0,0 +1,38 @@ +From 80211be1b9dec04cc2805d3d81e2091ecac289a1 Mon Sep 17 00:00:00 2001 +From: Yauhen Kharuzhy +Date: Sun, 7 Nov 2021 23:20:01 +0300 +Subject: power: bq25890: Enable continuous conversion for ADC at charging + +From: Yauhen Kharuzhy + +commit 80211be1b9dec04cc2805d3d81e2091ecac289a1 upstream. + +Instead of one shot run of ADC at beginning of charging, run continuous +conversion to ensure that all charging-related values are monitored +properly (input voltage, input current, themperature etc.). + +Signed-off-by: Yauhen Kharuzhy +Reviewed-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/bq25890_charger.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/power/supply/bq25890_charger.c ++++ b/drivers/power/supply/bq25890_charger.c +@@ -581,12 +581,12 @@ static irqreturn_t __bq25890_handle_irq( + + if (!new_state.online && bq->state.online) { /* power removed */ + /* disable ADC */ +- ret = bq25890_field_write(bq, F_CONV_START, 0); ++ ret = bq25890_field_write(bq, F_CONV_RATE, 0); + if (ret < 0) + goto error; + } else if (new_state.online && !bq->state.online) { /* power inserted */ + /* enable ADC, to have control of charge current/voltage */ +- ret = bq25890_field_write(bq, F_CONV_START, 1); ++ ret = bq25890_field_write(bq, F_CONV_RATE, 1); + if (ret < 0) + goto error; + } diff --git a/queue-5.15/power-reset-ltc2952-fix-use-of-floating-point-literals.patch b/queue-5.15/power-reset-ltc2952-fix-use-of-floating-point-literals.patch new file mode 100644 index 00000000000..5437072fcf2 --- /dev/null +++ b/queue-5.15/power-reset-ltc2952-fix-use-of-floating-point-literals.patch @@ -0,0 +1,58 @@ +From 644106cdb89844be2496b21175b7c0c2e0fab381 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Fri, 5 Nov 2021 08:20:50 -0700 +Subject: power: reset: ltc2952: Fix use of floating point literals + +From: Nathan Chancellor + +commit 644106cdb89844be2496b21175b7c0c2e0fab381 upstream. + +A new commit in LLVM causes an error on the use of 'long double' when +'-mno-x87' is used, which the kernel does through an alias, +'-mno-80387' (see the LLVM commit below for more details around why it +does this). + +drivers/power/reset/ltc2952-poweroff.c:162:28: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it + data->wde_interval = 300L * 1E6L; + ^ +drivers/power/reset/ltc2952-poweroff.c:162:21: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it + data->wde_interval = 300L * 1E6L; + ^ +drivers/power/reset/ltc2952-poweroff.c:163:41: error: expression requires 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not support it + data->trigger_delay = ktime_set(2, 500L*1E6L); + ^ +3 errors generated. + +This happens due to the use of a 'long double' literal. The 'E6' part of +'1E6L' causes the literal to be a 'double' then the 'L' suffix promotes +it to 'long double'. + +There is no visible reason for floating point values in this driver, as +the values are only assigned to integer types. Use NSEC_PER_MSEC, which +is the same integer value as '1E6L', to avoid changing functionality but +fix the error. + +Fixes: 6647156c00cc ("power: reset: add LTC2952 poweroff driver") +Link: https://github.com/ClangBuiltLinux/linux/issues/1497 +Link: https://github.com/llvm/llvm-project/commit/a8083d42b1c346e21623a1d36d1f0cadd7801d83 +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/reset/ltc2952-poweroff.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/power/reset/ltc2952-poweroff.c ++++ b/drivers/power/reset/ltc2952-poweroff.c +@@ -161,8 +161,8 @@ static void ltc2952_poweroff_kill(void) + + static void ltc2952_poweroff_default(struct ltc2952_poweroff *data) + { +- data->wde_interval = 300L * 1E6L; +- data->trigger_delay = ktime_set(2, 500L*1E6L); ++ data->wde_interval = 300L * NSEC_PER_MSEC; ++ data->trigger_delay = ktime_set(2, 500L * NSEC_PER_MSEC); + + hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + data->timer_trigger.function = ltc2952_poweroff_timer_trigger; diff --git a/queue-5.15/power-supply-core-break-capacity-loop.patch b/queue-5.15/power-supply-core-break-capacity-loop.patch new file mode 100644 index 00000000000..303f8d146ee --- /dev/null +++ b/queue-5.15/power-supply-core-break-capacity-loop.patch @@ -0,0 +1,37 @@ +From 51c7b6a0398f54b9120795796a4cff4fc9634f7d Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Mon, 15 Nov 2021 00:12:07 +0100 +Subject: power: supply: core: Break capacity loop + +From: Linus Walleij + +commit 51c7b6a0398f54b9120795796a4cff4fc9634f7d upstream. + +We should not go on looking for more capacity tables after +we realize we have looked at the last one in +power_supply_find_ocv2cap_table(). + +Fixes: 3afb50d7125b ("power: supply: core: Add some helpers to use the battery OCV capacity table") +Cc: Chunyan Zhang +Cc: Baolin Wang +Signed-off-by: Linus Walleij +Reviewed-by: Baolin Wang +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/power_supply_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -853,6 +853,10 @@ power_supply_find_ocv2cap_table(struct p + return NULL; + + for (i = 0; i < POWER_SUPPLY_OCV_TEMP_MAX; i++) { ++ /* Out of capacity tables */ ++ if (!info->ocv_table[i]) ++ break; ++ + temp_diff = abs(info->ocv_temp[i] - temp); + + if (temp_diff < best_temp_diff) { diff --git a/queue-5.15/reset-renesas-fix-runtime-pm-usage.patch b/queue-5.15/reset-renesas-fix-runtime-pm-usage.patch new file mode 100644 index 00000000000..abb3cb7165c --- /dev/null +++ b/queue-5.15/reset-renesas-fix-runtime-pm-usage.patch @@ -0,0 +1,40 @@ +From 92c959bae2e54ba1e2540ba5f813f7752bd76be1 Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Wed, 15 Dec 2021 11:14:23 +0100 +Subject: reset: renesas: Fix Runtime PM usage + +From: Heiner Kallweit + +commit 92c959bae2e54ba1e2540ba5f813f7752bd76be1 upstream. + +If pm_runtime_resume_and_get() fails then it returns w/o the RPM usage +counter being incremented. In this case call pm_runtime_put() in +remove() will result in a usage counter imbalance. Therefore check the +return code of pm_runtime_resume_and_get() and bail out in case of error. + +Fixes: bee08559701f ("reset: renesas: Add RZ/G2L usbphy control driver") +Signed-off-by: Heiner Kallweit +Reviewed-by: Biju Das +Link: https://lore.kernel.org/r/ec24e13f-0530-b091-7a08-864577b9b3be@gmail.com +Signed-off-by: Philipp Zabel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/reset/reset-rzg2l-usbphy-ctrl.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/reset/reset-rzg2l-usbphy-ctrl.c ++++ b/drivers/reset/reset-rzg2l-usbphy-ctrl.c +@@ -137,7 +137,12 @@ static int rzg2l_usbphy_ctrl_probe(struc + dev_set_drvdata(dev, priv); + + pm_runtime_enable(&pdev->dev); +- pm_runtime_resume_and_get(&pdev->dev); ++ error = pm_runtime_resume_and_get(&pdev->dev); ++ if (error < 0) { ++ pm_runtime_disable(&pdev->dev); ++ reset_control_assert(priv->rstc); ++ return dev_err_probe(&pdev->dev, error, "pm_runtime_resume_and_get failed"); ++ } + + /* put pll and phy into reset state */ + spin_lock_irqsave(&priv->lock, flags); diff --git a/queue-5.15/revert-i2c-core-support-bus-regulator-controlling-in-adapter.patch b/queue-5.15/revert-i2c-core-support-bus-regulator-controlling-in-adapter.patch new file mode 100644 index 00000000000..766bc8c0280 --- /dev/null +++ b/queue-5.15/revert-i2c-core-support-bus-regulator-controlling-in-adapter.patch @@ -0,0 +1,177 @@ +From a19f75de73c220b4496d2aefb7a605dd032f7c01 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Thu, 6 Jan 2022 13:24:52 +0100 +Subject: Revert "i2c: core: support bus regulator controlling in adapter" + +From: Wolfram Sang + +commit a19f75de73c220b4496d2aefb7a605dd032f7c01 upstream. + +This largely reverts commit 5a7b95fb993ec399c8a685552aa6a8fc995c40bd. It +breaks suspend with AMD GPUs, and we couldn't incrementally fix it. So, +let's remove the code and go back to the drawing board. We keep the +header extension to not break drivers already populating the regulator. +We expect to re-add the code handling it soon. + +Fixes: 5a7b95fb993e ("i2c: core: support bus regulator controlling in adapter") +Reported-by: "Tareque Md.Hanif" +Link: https://lore.kernel.org/r/1295184560.182511.1639075777725@mail.yahoo.com +Reported-by: Konstantin Kharlamov +Link: https://lore.kernel.org/r/7143a7147978f4104171072d9f5225d2ce355ec1.camel@yandex.ru +BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1850 +Tested-by: "Tareque Md.Hanif" +Tested-by: Konstantin Kharlamov +Signed-off-by: Wolfram Sang +Cc: # 5.14+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/i2c-core-base.c | 95 -------------------------------------------- + 1 file changed, 95 deletions(-) + +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -466,14 +466,12 @@ static int i2c_smbus_host_notify_to_irq( + static int i2c_device_probe(struct device *dev) + { + struct i2c_client *client = i2c_verify_client(dev); +- struct i2c_adapter *adap; + struct i2c_driver *driver; + int status; + + if (!client) + return 0; + +- adap = client->adapter; + client->irq = client->init_irq; + + if (!client->irq) { +@@ -539,14 +537,6 @@ static int i2c_device_probe(struct devic + + dev_dbg(dev, "probe\n"); + +- if (adap->bus_regulator) { +- status = regulator_enable(adap->bus_regulator); +- if (status < 0) { +- dev_err(&adap->dev, "Failed to enable bus regulator\n"); +- goto err_clear_wakeup_irq; +- } +- } +- + status = of_clk_set_defaults(dev->of_node, false); + if (status < 0) + goto err_clear_wakeup_irq; +@@ -604,10 +594,8 @@ put_sync_adapter: + static void i2c_device_remove(struct device *dev) + { + struct i2c_client *client = to_i2c_client(dev); +- struct i2c_adapter *adap; + struct i2c_driver *driver; + +- adap = client->adapter; + driver = to_i2c_driver(dev->driver); + if (driver->remove) { + int status; +@@ -622,8 +610,6 @@ static void i2c_device_remove(struct dev + devres_release_group(&client->dev, client->devres_group_id); + + dev_pm_domain_detach(&client->dev, true); +- if (!pm_runtime_status_suspended(&client->dev) && adap->bus_regulator) +- regulator_disable(adap->bus_regulator); + + dev_pm_clear_wake_irq(&client->dev); + device_init_wakeup(&client->dev, false); +@@ -633,86 +619,6 @@ static void i2c_device_remove(struct dev + pm_runtime_put(&client->adapter->dev); + } + +-#ifdef CONFIG_PM_SLEEP +-static int i2c_resume_early(struct device *dev) +-{ +- struct i2c_client *client = i2c_verify_client(dev); +- int err; +- +- if (!client) +- return 0; +- +- if (pm_runtime_status_suspended(&client->dev) && +- client->adapter->bus_regulator) { +- err = regulator_enable(client->adapter->bus_regulator); +- if (err) +- return err; +- } +- +- return pm_generic_resume_early(&client->dev); +-} +- +-static int i2c_suspend_late(struct device *dev) +-{ +- struct i2c_client *client = i2c_verify_client(dev); +- int err; +- +- if (!client) +- return 0; +- +- err = pm_generic_suspend_late(&client->dev); +- if (err) +- return err; +- +- if (!pm_runtime_status_suspended(&client->dev) && +- client->adapter->bus_regulator) +- return regulator_disable(client->adapter->bus_regulator); +- +- return 0; +-} +-#endif +- +-#ifdef CONFIG_PM +-static int i2c_runtime_resume(struct device *dev) +-{ +- struct i2c_client *client = i2c_verify_client(dev); +- int err; +- +- if (!client) +- return 0; +- +- if (client->adapter->bus_regulator) { +- err = regulator_enable(client->adapter->bus_regulator); +- if (err) +- return err; +- } +- +- return pm_generic_runtime_resume(&client->dev); +-} +- +-static int i2c_runtime_suspend(struct device *dev) +-{ +- struct i2c_client *client = i2c_verify_client(dev); +- int err; +- +- if (!client) +- return 0; +- +- err = pm_generic_runtime_suspend(&client->dev); +- if (err) +- return err; +- +- if (client->adapter->bus_regulator) +- return regulator_disable(client->adapter->bus_regulator); +- return 0; +-} +-#endif +- +-static const struct dev_pm_ops i2c_device_pm = { +- SET_LATE_SYSTEM_SLEEP_PM_OPS(i2c_suspend_late, i2c_resume_early) +- SET_RUNTIME_PM_OPS(i2c_runtime_suspend, i2c_runtime_resume, NULL) +-}; +- + static void i2c_device_shutdown(struct device *dev) + { + struct i2c_client *client = i2c_verify_client(dev); +@@ -772,7 +678,6 @@ struct bus_type i2c_bus_type = { + .probe = i2c_device_probe, + .remove = i2c_device_remove, + .shutdown = i2c_device_shutdown, +- .pm = &i2c_device_pm, + }; + EXPORT_SYMBOL_GPL(i2c_bus_type); + diff --git a/queue-5.15/rndis_host-support-hytera-digital-radios.patch b/queue-5.15/rndis_host-support-hytera-digital-radios.patch new file mode 100644 index 00000000000..561574b347e --- /dev/null +++ b/queue-5.15/rndis_host-support-hytera-digital-radios.patch @@ -0,0 +1,51 @@ +From 29262e1f773b4b6a43711120be564c57fca07cfb Mon Sep 17 00:00:00 2001 +From: Thomas Toye +Date: Sat, 1 Jan 2022 18:22:07 +0100 +Subject: rndis_host: support Hytera digital radios + +From: Thomas Toye + +commit 29262e1f773b4b6a43711120be564c57fca07cfb upstream. + +Hytera makes a range of digital (DMR) radios. These radios can be +programmed to a allow a computer to control them over Ethernet over USB, +either using NCM or RNDIS. + +This commit adds support for RNDIS for Hytera radios. I tested with a +Hytera PD785 and a Hytera MD785G. When these radios are programmed to +set up a Radio to PC Network using RNDIS, an USB interface will be added +with class 2 (Communications), subclass 2 (Abstract Modem Control) and +an interface protocol of 255 ("vendor specific" - lsusb even hints "MSFT +RNDIS?"). + +This patch is similar to the solution of this StackOverflow user, but +that only works for the Hytera MD785: +https://stackoverflow.com/a/53550858 + +To use the "Radio to PC Network" functionality of Hytera DMR radios, the +radios need to be programmed correctly in CPS (Hytera's Customer +Programming Software). "Forward to PC" should be checked in "Network" +(under "General Setting" in "Conventional") and the "USB Network +Communication Protocol" should be set to RNDIS. + +Signed-off-by: Thomas Toye +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/rndis_host.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -609,6 +609,11 @@ static const struct usb_device_id produc + USB_CLASS_COMM, 2 /* ACM */, 0x0ff), + .driver_info = (unsigned long) &rndis_poll_status_info, + }, { ++ /* Hytera Communications DMR radios' "Radio to PC Network" */ ++ USB_VENDOR_AND_INTERFACE_INFO(0x238b, ++ USB_CLASS_COMM, 2 /* ACM */, 0x0ff), ++ .driver_info = (unsigned long)&rndis_info, ++}, { + /* RNDIS is MSFT's un-official variant of CDC ACM */ + USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff), + .driver_info = (unsigned long) &rndis_info, diff --git a/queue-5.15/series b/queue-5.15/series index cd789cdd978..302ba9a257e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -35,3 +35,16 @@ kvm-x86-check-for-rmaps-allocation.patch cgroup-use-open-time-credentials-for-process-migraton-perm-checks.patch cgroup-allocate-cgroup_file_ctx-for-kernfs_open_file-priv.patch cgroup-use-open-time-cgroup-namespace-for-process-migration-perm-checks.patch +revert-i2c-core-support-bus-regulator-controlling-in-adapter.patch +i2c-mpc-avoid-out-of-bounds-memory-access.patch +xfs-map-unwritten-blocks-in-xfs_ioc_-alloc-free-sp-just-like-fallocate.patch +power-supply-core-break-capacity-loop.patch +power-reset-ltc2952-fix-use-of-floating-point-literals.patch +reset-renesas-fix-runtime-pm-usage.patch +rndis_host-support-hytera-digital-radios.patch +gpio-gpio-aspeed-sgpio-fix-wrong-hwirq-base-in-irq-handler.patch +net-ticp-fix-a-kernel-infoleak-in-__tipc_sendmsg.patch +phonet-refcount-leak-in-pep_sock_accep.patch +fbdev-fbmem-add-a-helper-to-determine-if-an-aperture-is-used-by-a-fw-fb.patch +drm-amdgpu-disable-runpm-if-we-are-the-primary-adapter.patch +power-bq25890-enable-continuous-conversion-for-adc-at-charging.patch diff --git a/queue-5.15/xfs-map-unwritten-blocks-in-xfs_ioc_-alloc-free-sp-just-like-fallocate.patch b/queue-5.15/xfs-map-unwritten-blocks-in-xfs_ioc_-alloc-free-sp-just-like-fallocate.patch new file mode 100644 index 00000000000..36837366181 --- /dev/null +++ b/queue-5.15/xfs-map-unwritten-blocks-in-xfs_ioc_-alloc-free-sp-just-like-fallocate.patch @@ -0,0 +1,35 @@ +From 983d8e60f50806f90534cc5373d0ce867e5aaf79 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Wed, 22 Dec 2021 14:19:18 -0800 +Subject: xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate + +From: Darrick J. Wong + +commit 983d8e60f50806f90534cc5373d0ce867e5aaf79 upstream. + +The old ALLOCSP/FREESP ioctls in XFS can be used to preallocate space at +the end of files, just like fallocate and RESVSP. Make the behavior +consistent with the other ioctls. + +Reported-by: Kirill Tkhai +Signed-off-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Dave Chinner +Reviewed-by: Eric Sandeen +Signed-off-by: Greg Kroah-Hartman +--- + fs/xfs/xfs_ioctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/xfs/xfs_ioctl.c ++++ b/fs/xfs/xfs_ioctl.c +@@ -687,7 +687,8 @@ xfs_ioc_space( + + if (bf->l_start > XFS_ISIZE(ip)) { + error = xfs_alloc_file_space(ip, XFS_ISIZE(ip), +- bf->l_start - XFS_ISIZE(ip), 0); ++ bf->l_start - XFS_ISIZE(ip), ++ XFS_BMAPI_PREALLOC); + if (error) + goto out_unlock; + } -- 2.47.3