From 97d847da559525089e879491bbce03919b11f5ff Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 13 Jan 2025 09:02:58 -0500 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...ip-add-hevc-power-domain-clock-to-rk.patch | 76 ++++++ ...ip-add-power-domain-cells-to-power-d.patch | 254 ++++++++++++++++++ ...-update_bdev-parameter-to-set_capaci.patch | 159 +++++++++++ ...am-zram_drv.c-do-not-keep-dangling-z.patch | 66 +++++ ...use-after-free-in-adv7533_attach_dsi.patch | 80 ++++++ ...11-remove-redundant-null-check-befor.patch | 49 ++++ ...11-unregister-cec-i2c-device-after-c.patch | 86 ++++++ ...11-use-dev_err_probe-in-probe-functi.patch | 93 +++++++ ...7533-switch-to-devm-mipi-dsi-helpers.patch | 98 +++++++ ...pi-dsi-create-devm-device-attachment.patch | 89 ++++++ ...-dsi-create-devm-device-registration.patch | 103 +++++++ ...acity_revalidate_and_notify-update-t.patch | 42 +++ ...acity_revalidate_and_notify-update-t.patch | 53 ++++ ...eturn-value-of-ocfs2_local_free_info.patch | 66 +++++ ...se-after-free-due-to-dangling-pointe.patch | 73 +++++ ...s-add-support-for-3-address-cell-bus.patch | 189 +++++++++++++ ...ddress-translation-when-address-size.patch | 129 +++++++++ ...rve-the-flags-portion-on-1-1-dma-ran.patch | 50 ++++ ...-address-remove-duplicated-functions.patch | 72 +++++ ...-number-of-bus-flag-cells-rather-tha.patch | 85 ++++++ ...ddress-use-is_enabled-for-config_pci.patch | 129 +++++++++ ...address-and-of_get_pci_address-imple.patch | 193 +++++++++++++ ...-add-bus-address-range-parsing-tests.patch | 96 +++++++ ...-on-functionality-for-newer-synopsis.patch | 135 ++++++++++ ...usb-toggle-the-phy-power-during-init.patch | 43 +++ ..._min-max-avoid-using-current-nsproxy.patch | 63 +++++ ...-the-bdev-size-in-sd_revalidate_disk.patch | 60 +++++ queue-5.10/series | 29 ++ ...alized-zram-not-releasing-backing-de.patch | 65 +++++ .../zram-use-set_capacity_and_notify.patch | 55 ++++ 30 files changed, 2780 insertions(+) create mode 100644 queue-5.10/arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch create mode 100644 queue-5.10/arm64-dts-rockchip-add-power-domain-cells-to-power-d.patch create mode 100644 queue-5.10/block-remove-the-update_bdev-parameter-to-set_capaci.patch create mode 100644 queue-5.10/drivers-block-zram-zram_drv.c-do-not-keep-dangling-z.patch create mode 100644 queue-5.10/drm-adv7511-fix-use-after-free-in-adv7533_attach_dsi.patch create mode 100644 queue-5.10/drm-bridge-adv7511-remove-redundant-null-check-befor.patch create mode 100644 queue-5.10/drm-bridge-adv7511-unregister-cec-i2c-device-after-c.patch create mode 100644 queue-5.10/drm-bridge-adv7511-use-dev_err_probe-in-probe-functi.patch create mode 100644 queue-5.10/drm-bridge-adv7533-switch-to-devm-mipi-dsi-helpers.patch create mode 100644 queue-5.10/drm-mipi-dsi-create-devm-device-attachment.patch create mode 100644 queue-5.10/drm-mipi-dsi-create-devm-device-registration.patch create mode 100644 queue-5.10/loop-let-set_capacity_revalidate_and_notify-update-t.patch create mode 100644 queue-5.10/nvme-let-set_capacity_revalidate_and_notify-update-t.patch create mode 100644 queue-5.10/ocfs2-correct-return-value-of-ocfs2_local_free_info.patch create mode 100644 queue-5.10/ocfs2-fix-slab-use-after-free-due-to-dangling-pointe.patch create mode 100644 queue-5.10/of-address-add-support-for-3-address-cell-bus.patch create mode 100644 queue-5.10/of-address-fix-address-translation-when-address-size.patch create mode 100644 queue-5.10/of-address-preserve-the-flags-portion-on-1-1-dma-ran.patch create mode 100644 queue-5.10/of-address-remove-duplicated-functions.patch create mode 100644 queue-5.10/of-address-store-number-of-bus-flag-cells-rather-tha.patch create mode 100644 queue-5.10/of-address-use-is_enabled-for-config_pci.patch create mode 100644 queue-5.10/of-merge-of_get_address-and-of_get_pci_address-imple.patch create mode 100644 queue-5.10/of-unittest-add-bus-address-range-parsing-tests.patch create mode 100644 queue-5.10/phy-usb-add-wake-on-functionality-for-newer-synopsis.patch create mode 100644 queue-5.10/phy-usb-toggle-the-phy-power-during-init.patch create mode 100644 queue-5.10/sctp-sysctl-rto_min-max-avoid-using-current-nsproxy.patch create mode 100644 queue-5.10/sd-update-the-bdev-size-in-sd_revalidate_disk.patch create mode 100644 queue-5.10/zram-fix-uninitialized-zram-not-releasing-backing-de.patch create mode 100644 queue-5.10/zram-use-set_capacity_and_notify.patch diff --git a/queue-5.10/arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch b/queue-5.10/arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch new file mode 100644 index 00000000000..22d01ff3627 --- /dev/null +++ b/queue-5.10/arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch @@ -0,0 +1,76 @@ +From 6dbe1a432ecd652ccb2165bce1e9b82c39ebb74a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Dec 2024 22:43:39 +0000 +Subject: arm64: dts: rockchip: add hevc power domain clock to rk3328 + +From: Peter Geis + +[ Upstream commit 3699f2c43ea9984e00d70463f8c29baaf260ea97 ] + +There is a race condition at startup between disabling power domains not +used and disabling clocks not used on the rk3328. When the clocks are +disabled first, the hevc power domain fails to shut off leading to a +splat of failures. Add the hevc core clock to the rk3328 power domain +node to prevent this condition. + +rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 3-.... } +1087 jiffies s: 89 root: 0x8/. +rcu: blocking rcu_node structures (internal RCU debug): +Sending NMI from CPU 0 to CPUs 3: +NMI backtrace for cpu 3 +CPU: 3 UID: 0 PID: 86 Comm: kworker/3:3 Not tainted 6.12.0-rc5+ #53 +Hardware name: Firefly ROC-RK3328-CC (DT) +Workqueue: pm genpd_power_off_work_fn +pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : regmap_unlock_spinlock+0x18/0x30 +lr : regmap_read+0x60/0x88 +sp : ffff800081123c00 +x29: ffff800081123c00 x28: ffff2fa4c62cad80 x27: 0000000000000000 +x26: ffffd74e6e660eb8 x25: ffff2fa4c62cae00 x24: 0000000000000040 +x23: ffffd74e6d2f3ab8 x22: 0000000000000001 x21: ffff800081123c74 +x20: 0000000000000000 x19: ffff2fa4c0412000 x18: 0000000000000000 +x17: 77202c31203d2065 x16: 6c6469203a72656c x15: 6c6f72746e6f632d +x14: 7265776f703a6e6f x13: 2063766568206e69 x12: 616d6f64202c3431 +x11: 347830206f742030 x10: 3430303034783020 x9 : ffffd74e6c7369e0 +x8 : 3030316666206e69 x7 : 205d383738353733 x6 : 332e31202020205b +x5 : ffffd74e6c73fc88 x4 : ffffd74e6c73fcd4 x3 : ffffd74e6c740b40 +x2 : ffff800080015484 x1 : 0000000000000000 x0 : ffff2fa4c0412000 +Call trace: +regmap_unlock_spinlock+0x18/0x30 +rockchip_pmu_set_idle_request+0xac/0x2c0 +rockchip_pd_power+0x144/0x5f8 +rockchip_pd_power_off+0x1c/0x30 +_genpd_power_off+0x9c/0x180 +genpd_power_off.part.0.isra.0+0x130/0x2a8 +genpd_power_off_work_fn+0x6c/0x98 +process_one_work+0x170/0x3f0 +worker_thread+0x290/0x4a8 +kthread+0xec/0xf8 +ret_from_fork+0x10/0x20 +rockchip-pm-domain ff100000.syscon:power-controller: failed to get ack on domain 'hevc', val=0x88220 + +Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs") +Signed-off-by: Peter Geis +Reviewed-by: Dragan Simic +Link: https://lore.kernel.org/r/20241214224339.24674-1-pgwipeout@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 5a706b8ffc72..28c861ac20f7 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -320,6 +320,7 @@ + + power-domain@RK3328_PD_HEVC { + reg = ; ++ clocks = <&cru SCLK_VENC_CORE>; + #power-domain-cells = <0>; + }; + power-domain@RK3328_PD_VIDEO { +-- +2.39.5 + diff --git a/queue-5.10/arm64-dts-rockchip-add-power-domain-cells-to-power-d.patch b/queue-5.10/arm64-dts-rockchip-add-power-domain-cells-to-power-d.patch new file mode 100644 index 00000000000..5cee99a333b --- /dev/null +++ b/queue-5.10/arm64-dts-rockchip-add-power-domain-cells-to-power-d.patch @@ -0,0 +1,254 @@ +From fdab29a4106ff733510140e1734422e20284dc79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Apr 2021 13:29:45 +0200 +Subject: arm64: dts: rockchip: add #power-domain-cells to power domain nodes + +From: Johan Jonker + +[ Upstream commit 837188d49823230f47afdbbec7556740e89a8557 ] + +Add #power-domain-cells to power domain nodes, because they +are required by power-domain.yaml + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/20210417112952.8516-9-jbx6244@gmail.com +Signed-off-by: Heiko Stuebner +Stable-dep-of: 3699f2c43ea9 ("arm64: dts: rockchip: add hevc power domain clock to rk3328") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/px30.dtsi | 8 ++++++++ + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 3 +++ + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 20 ++++++++++++++++++++ + 3 files changed, 31 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/px30.dtsi b/arch/arm64/boot/dts/rockchip/px30.dtsi +index f241e7c318bc..91e4d92d2ab2 100644 +--- a/arch/arm64/boot/dts/rockchip/px30.dtsi ++++ b/arch/arm64/boot/dts/rockchip/px30.dtsi +@@ -250,12 +250,14 @@ + <&cru HCLK_OTG>, + <&cru SCLK_OTG_ADP>; + pm_qos = <&qos_usb_host>, <&qos_usb_otg>; ++ #power-domain-cells = <0>; + }; + power-domain@PX30_PD_SDCARD { + reg = ; + clocks = <&cru HCLK_SDMMC>, + <&cru SCLK_SDMMC>; + pm_qos = <&qos_sdmmc>; ++ #power-domain-cells = <0>; + }; + power-domain@PX30_PD_GMAC { + reg = ; +@@ -264,6 +266,7 @@ + <&cru SCLK_MAC_REF>, + <&cru SCLK_GMAC_RX_TX>; + pm_qos = <&qos_gmac>; ++ #power-domain-cells = <0>; + }; + power-domain@PX30_PD_MMC_NAND { + reg = ; +@@ -277,6 +280,7 @@ + <&cru SCLK_SFC>; + pm_qos = <&qos_emmc>, <&qos_nand>, + <&qos_sdio>, <&qos_sfc>; ++ #power-domain-cells = <0>; + }; + power-domain@PX30_PD_VPU { + reg = ; +@@ -284,6 +288,7 @@ + <&cru HCLK_VPU>, + <&cru SCLK_CORE_VPU>; + pm_qos = <&qos_vpu>, <&qos_vpu_r128>; ++ #power-domain-cells = <0>; + }; + power-domain@PX30_PD_VO { + reg = ; +@@ -300,6 +305,7 @@ + <&cru SCLK_VOPB_PWM>; + pm_qos = <&qos_rga_rd>, <&qos_rga_wr>, + <&qos_vop_m0>, <&qos_vop_m1>; ++ #power-domain-cells = <0>; + }; + power-domain@PX30_PD_VI { + reg = ; +@@ -311,11 +317,13 @@ + pm_qos = <&qos_isp_128>, <&qos_isp_rd>, + <&qos_isp_wr>, <&qos_isp_m1>, + <&qos_vip>; ++ #power-domain-cells = <0>; + }; + power-domain@PX30_PD_GPU { + reg = ; + clocks = <&cru SCLK_GPU>; + pm_qos = <&qos_gpu>; ++ #power-domain-cells = <0>; + }; + }; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 9e1701f42184..5a706b8ffc72 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -320,13 +320,16 @@ + + power-domain@RK3328_PD_HEVC { + reg = ; ++ #power-domain-cells = <0>; + }; + power-domain@RK3328_PD_VIDEO { + reg = ; ++ #power-domain-cells = <0>; + }; + power-domain@RK3328_PD_VPU { + reg = ; + clocks = <&cru ACLK_VPU>, <&cru HCLK_VPU>; ++ #power-domain-cells = <0>; + }; + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index e2515218ff73..bf71f390f8a6 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1005,6 +1005,7 @@ + clocks = <&cru ACLK_IEP>, + <&cru HCLK_IEP>; + pm_qos = <&qos_iep>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_RGA { + reg = ; +@@ -1012,12 +1013,14 @@ + <&cru HCLK_RGA>; + pm_qos = <&qos_rga_r>, + <&qos_rga_w>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_VCODEC { + reg = ; + clocks = <&cru ACLK_VCODEC>, + <&cru HCLK_VCODEC>; + pm_qos = <&qos_video_m0>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_VDU { + reg = ; +@@ -1027,6 +1030,7 @@ + <&cru SCLK_VDU_CORE>; + pm_qos = <&qos_video_m1_r>, + <&qos_video_m1_w>; ++ #power-domain-cells = <0>; + }; + + /* These power domains are grouped by VD_GPU */ +@@ -1034,53 +1038,63 @@ + reg = ; + clocks = <&cru ACLK_GPU>; + pm_qos = <&qos_gpu>; ++ #power-domain-cells = <0>; + }; + + /* These power domains are grouped by VD_LOGIC */ + power-domain@RK3399_PD_EDP { + reg = ; + clocks = <&cru PCLK_EDP_CTRL>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_EMMC { + reg = ; + clocks = <&cru ACLK_EMMC>; + pm_qos = <&qos_emmc>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_GMAC { + reg = ; + clocks = <&cru ACLK_GMAC>, + <&cru PCLK_GMAC>; + pm_qos = <&qos_gmac>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_SD { + reg = ; + clocks = <&cru HCLK_SDMMC>, + <&cru SCLK_SDMMC>; + pm_qos = <&qos_sd>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_SDIOAUDIO { + reg = ; + clocks = <&cru HCLK_SDIO>; + pm_qos = <&qos_sdioaudio>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_TCPD0 { + reg = ; + clocks = <&cru SCLK_UPHY0_TCPDCORE>, + <&cru SCLK_UPHY0_TCPDPHY_REF>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_TCPD1 { + reg = ; + clocks = <&cru SCLK_UPHY1_TCPDCORE>, + <&cru SCLK_UPHY1_TCPDPHY_REF>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_USB3 { + reg = ; + clocks = <&cru ACLK_USB3>; + pm_qos = <&qos_usb_otg0>, + <&qos_usb_otg1>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_VIO { + reg = ; ++ #power-domain-cells = <1>; + #address-cells = <1>; + #size-cells = <0>; + +@@ -1090,6 +1104,7 @@ + <&cru HCLK_HDCP>, + <&cru PCLK_HDCP>; + pm_qos = <&qos_hdcp>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_ISP0 { + reg = ; +@@ -1097,6 +1112,7 @@ + <&cru HCLK_ISP0>; + pm_qos = <&qos_isp0_m0>, + <&qos_isp0_m1>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_ISP1 { + reg = ; +@@ -1104,9 +1120,11 @@ + <&cru HCLK_ISP1>; + pm_qos = <&qos_isp1_m0>, + <&qos_isp1_m1>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_VO { + reg = ; ++ #power-domain-cells = <1>; + #address-cells = <1>; + #size-cells = <0>; + +@@ -1116,12 +1134,14 @@ + <&cru HCLK_VOP0>; + pm_qos = <&qos_vop_big_r>, + <&qos_vop_big_w>; ++ #power-domain-cells = <0>; + }; + power-domain@RK3399_PD_VOPL { + reg = ; + clocks = <&cru ACLK_VOP1>, + <&cru HCLK_VOP1>; + pm_qos = <&qos_vop_little>; ++ #power-domain-cells = <0>; + }; + }; + }; +-- +2.39.5 + diff --git a/queue-5.10/block-remove-the-update_bdev-parameter-to-set_capaci.patch b/queue-5.10/block-remove-the-update_bdev-parameter-to-set_capaci.patch new file mode 100644 index 00000000000..fdd502a5b83 --- /dev/null +++ b/queue-5.10/block-remove-the-update_bdev-parameter-to-set_capaci.patch @@ -0,0 +1,159 @@ +From 5a9e9f8be62bf799aab85852ef31468566421e35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 15:56:56 +0100 +Subject: block: remove the update_bdev parameter to + set_capacity_revalidate_and_notify + +From: Christoph Hellwig + +[ Upstream commit 449f4ec9892ebc2f37a7eae6d97db2cf7c65e09a ] + +The update_bdev argument is always set to true, so remove it. Also +rename the function to the slighly less verbose set_capacity_and_notify, +as propagating the disk size to the block device isn't really +revalidation. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Reviewed-by: Petr Vorel +Signed-off-by: Jens Axboe +Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device") +Signed-off-by: Sasha Levin +--- + block/genhd.c | 13 +++++-------- + drivers/block/loop.c | 2 +- + drivers/block/virtio_blk.c | 2 +- + drivers/block/xen-blkfront.c | 2 +- + drivers/nvme/host/core.c | 2 +- + drivers/scsi/sd.c | 5 ++--- + include/linux/genhd.h | 3 +-- + 7 files changed, 12 insertions(+), 17 deletions(-) + +diff --git a/block/genhd.c b/block/genhd.c +index 796baf761202..768a49460bf1 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -46,17 +46,15 @@ static void disk_del_events(struct gendisk *disk); + static void disk_release_events(struct gendisk *disk); + + /* +- * Set disk capacity and notify if the size is not currently +- * zero and will not be set to zero ++ * Set disk capacity and notify if the size is not currently zero and will not ++ * be set to zero. Returns true if a uevent was sent, otherwise false. + */ +-bool set_capacity_revalidate_and_notify(struct gendisk *disk, sector_t size, +- bool update_bdev) ++bool set_capacity_and_notify(struct gendisk *disk, sector_t size) + { + sector_t capacity = get_capacity(disk); + + set_capacity(disk, size); +- if (update_bdev) +- revalidate_disk_size(disk, true); ++ revalidate_disk_size(disk, true); + + if (capacity != size && capacity != 0 && size != 0) { + char *envp[] = { "RESIZE=1", NULL }; +@@ -67,8 +65,7 @@ bool set_capacity_revalidate_and_notify(struct gendisk *disk, sector_t size, + + return false; + } +- +-EXPORT_SYMBOL_GPL(set_capacity_revalidate_and_notify); ++EXPORT_SYMBOL_GPL(set_capacity_and_notify); + + /* + * Format the device name of the indicated disk into the supplied buffer and +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 198f7ce3234b..b30f4d525bc8 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -238,7 +238,7 @@ static void __loop_update_dio(struct loop_device *lo, bool dio) + */ + static void loop_set_size(struct loop_device *lo, loff_t size) + { +- if (!set_capacity_revalidate_and_notify(lo->lo_disk, size, true)) ++ if (!set_capacity_and_notify(lo->lo_disk, size)) + kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE); + } + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 28ea9b511fd0..c87c6a4eb3b3 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -470,7 +470,7 @@ static void virtblk_update_capacity(struct virtio_blk *vblk, bool resize) + cap_str_10, + cap_str_2); + +- set_capacity_revalidate_and_notify(vblk->disk, capacity, true); ++ set_capacity_and_notify(vblk->disk, capacity); + } + + static void virtblk_config_changed_work(struct work_struct *work) +diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c +index d68a8ca2161f..19ddbf977d28 100644 +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -2443,7 +2443,7 @@ static void blkfront_connect(struct blkfront_info *info) + return; + printk(KERN_INFO "Setting capacity to %Lu\n", + sectors); +- set_capacity_revalidate_and_notify(info->gd, sectors, true); ++ set_capacity_and_notify(info->gd, sectors); + + return; + case BLKIF_STATE_SUSPENDED: +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index c8e64a1e2fc0..c739ac1761ba 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2132,7 +2132,7 @@ static void nvme_update_disk_info(struct gendisk *disk, + capacity = 0; + } + +- set_capacity_revalidate_and_notify(disk, capacity, true); ++ set_capacity_and_notify(disk, capacity); + + nvme_config_discard(disk, ns); + nvme_config_write_zeroes(disk->queue, ns->ctrl); +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 355d38cab862..da6df9809b0c 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -3292,8 +3292,7 @@ static int sd_revalidate_disk(struct gendisk *disk) + + sdkp->first_scan = 0; + +- set_capacity_revalidate_and_notify(disk, +- logical_to_sectors(sdp, sdkp->capacity), true); ++ set_capacity_and_notify(disk, logical_to_sectors(sdp, sdkp->capacity)); + sd_config_write_same(sdkp); + kfree(buffer); + +@@ -3303,7 +3302,7 @@ static int sd_revalidate_disk(struct gendisk *disk) + * capacity to 0. + */ + if (sd_zbc_revalidate_zones(sdkp)) +- set_capacity_revalidate_and_notify(disk, 0, true); ++ set_capacity_and_notify(disk, 0); + + out: + return 0; +diff --git a/include/linux/genhd.h b/include/linux/genhd.h +index 03da3f603d30..4b22bfd9336e 100644 +--- a/include/linux/genhd.h ++++ b/include/linux/genhd.h +@@ -315,8 +315,7 @@ static inline int get_disk_ro(struct gendisk *disk) + extern void disk_block_events(struct gendisk *disk); + extern void disk_unblock_events(struct gendisk *disk); + extern void disk_flush_events(struct gendisk *disk, unsigned int mask); +-bool set_capacity_revalidate_and_notify(struct gendisk *disk, sector_t size, +- bool update_bdev); ++bool set_capacity_and_notify(struct gendisk *disk, sector_t size); + + /* drivers/char/random.c */ + extern void add_disk_randomness(struct gendisk *disk) __latent_entropy; +-- +2.39.5 + diff --git a/queue-5.10/drivers-block-zram-zram_drv.c-do-not-keep-dangling-z.patch b/queue-5.10/drivers-block-zram-zram_drv.c-do-not-keep-dangling-z.patch new file mode 100644 index 00000000000..5f821fc13e0 --- /dev/null +++ b/queue-5.10/drivers-block-zram-zram_drv.c-do-not-keep-dangling-z.patch @@ -0,0 +1,66 @@ +From 08db8a0c5b9907a453d3fbffab435d7727daa8d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 12:51:00 +0900 +Subject: drivers/block/zram/zram_drv.c: do not keep dangling zcomp pointer + after zram reset + +From: Sergey Senozhatsky + +[ Upstream commit 6d2453c3dbc5f70eafc1c866289a90a1fc57ce18 ] + +We do all reset operations under write lock, so we don't need to save +->disksize and ->comp to stack variables. Another thing is that ->comp is +freed during zram reset, but comp pointer is not NULL-ed, so zram keeps +the freed pointer value. + +Link: https://lkml.kernel.org/r/20220824035100.971816-1-senozhatsky@chromium.org +Signed-off-by: Sergey Senozhatsky +Cc: Minchan Kim +Cc: Nitin Gupta +Signed-off-by: Andrew Morton +Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device") +Signed-off-by: Sasha Levin +--- + drivers/block/zram/zram_drv.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index 8f38e5a1a63f..8e13586be8c9 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -1690,9 +1690,6 @@ static int zram_rw_page(struct block_device *bdev, sector_t sector, + + static void zram_reset_device(struct zram *zram) + { +- struct zcomp *comp; +- u64 disksize; +- + down_write(&zram->init_lock); + + zram->limit_pages = 0; +@@ -1702,18 +1699,16 @@ static void zram_reset_device(struct zram *zram) + return; + } + +- comp = zram->comp; +- disksize = zram->disksize; +- zram->disksize = 0; +- + set_capacity_and_notify(zram->disk, 0); + part_stat_set_all(&zram->disk->part0, 0); + + up_write(&zram->init_lock); + /* I/O operation under all of CPU are done so let's free */ +- zram_meta_free(zram, disksize); ++ zram_meta_free(zram, zram->disksize); ++ zram->disksize = 0; + memset(&zram->stats, 0, sizeof(zram->stats)); +- zcomp_destroy(comp); ++ zcomp_destroy(zram->comp); ++ zram->comp = NULL; + reset_bdev(zram); + } + +-- +2.39.5 + diff --git a/queue-5.10/drm-adv7511-fix-use-after-free-in-adv7533_attach_dsi.patch b/queue-5.10/drm-adv7511-fix-use-after-free-in-adv7533_attach_dsi.patch new file mode 100644 index 00000000000..5c60c8f27e8 --- /dev/null +++ b/queue-5.10/drm-adv7511-fix-use-after-free-in-adv7533_attach_dsi.patch @@ -0,0 +1,80 @@ +From 9c4845f9a6ca844378905e7999dbb3978c0fb7b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 19:20:29 +0000 +Subject: drm: adv7511: Fix use-after-free in adv7533_attach_dsi() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Biju Das + +[ Upstream commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 ] + +The host_node pointer was assigned and freed in adv7533_parse_dt(), and +later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue +by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put() +in error path of probe() and also in the remove(). + +Fixes: 1e4d58cd7f88 ("drm/bridge: adv7533: Create a MIPI DSI device") +Cc: stable@vger.kernel.org +Reviewed-by: Laurent Pinchart +Signed-off-by: Biju Das +Link: https://patchwork.freedesktop.org/patch/msgid/20241119192040.152657-2-biju.das.jz@bp.renesas.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 ++++++++-- + drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 -- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 9255bce51753..46782f72564b 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1220,8 +1220,10 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + return ret; + + ret = adv7511_init_regulators(adv7511); +- if (ret) +- return dev_err_probe(dev, ret, "failed to init regulators\n"); ++ if (ret) { ++ dev_err_probe(dev, ret, "failed to init regulators\n"); ++ goto err_of_node_put; ++ } + + /* + * The power down GPIO is optional. If present, toggle it from active to +@@ -1329,6 +1331,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + i2c_unregister_device(adv7511->i2c_edid); + uninit_regulators: + adv7511_uninit_regulators(adv7511); ++err_of_node_put: ++ of_node_put(adv7511->host_node); + + return ret; + } +@@ -1337,6 +1341,8 @@ static int adv7511_remove(struct i2c_client *i2c) + { + struct adv7511 *adv7511 = i2c_get_clientdata(i2c); + ++ of_node_put(adv7511->host_node); ++ + adv7511_uninit_regulators(adv7511); + + drm_bridge_remove(&adv7511->bridge); +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c +index f8d5fa6652af..ee33e7a033ef 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c +@@ -184,8 +184,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) + if (!adv->host_node) + return -ENODEV; + +- of_node_put(adv->host_node); +- + adv->use_timing_gen = !of_property_read_bool(np, + "adi,disable-timing-generator"); + +-- +2.39.5 + diff --git a/queue-5.10/drm-bridge-adv7511-remove-redundant-null-check-befor.patch b/queue-5.10/drm-bridge-adv7511-remove-redundant-null-check-befor.patch new file mode 100644 index 00000000000..6b3c0362a66 --- /dev/null +++ b/queue-5.10/drm-bridge-adv7511-remove-redundant-null-check-befor.patch @@ -0,0 +1,49 @@ +From 328065832950870c2a46b5c471ce3df8f8be780a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 09:18:29 +0000 +Subject: drm: bridge: adv7511: Remove redundant null check before + clk_disable_unprepare + +From: Xu Wang + +[ Upstream commit 3fc5a284213d5fca1c0807ea8725355d39808930 ] + +Because clk_disable_unprepare() already checked NULL clock parameter, +so the additional check is unnecessary, just remove them. + +Signed-off-by: Xu Wang +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index e50c741cbfe7..60400efe1dd3 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1324,8 +1324,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + err_unregister_cec: + cec_unregister_adapter(adv7511->cec_adap); + i2c_unregister_device(adv7511->i2c_cec); +- if (adv7511->cec_clk) +- clk_disable_unprepare(adv7511->cec_clk); ++ clk_disable_unprepare(adv7511->cec_clk); + err_i2c_unregister_packet: + i2c_unregister_device(adv7511->i2c_packet); + err_i2c_unregister_edid: +@@ -1343,8 +1342,7 @@ static int adv7511_remove(struct i2c_client *i2c) + if (adv7511->type == ADV7533 || adv7511->type == ADV7535) + adv7533_detach_dsi(adv7511); + i2c_unregister_device(adv7511->i2c_cec); +- if (adv7511->cec_clk) +- clk_disable_unprepare(adv7511->cec_clk); ++ clk_disable_unprepare(adv7511->cec_clk); + + adv7511_uninit_regulators(adv7511); + +-- +2.39.5 + diff --git a/queue-5.10/drm-bridge-adv7511-unregister-cec-i2c-device-after-c.patch b/queue-5.10/drm-bridge-adv7511-unregister-cec-i2c-device-after-c.patch new file mode 100644 index 00000000000..d0b9add2751 --- /dev/null +++ b/queue-5.10/drm-bridge-adv7511-unregister-cec-i2c-device-after-c.patch @@ -0,0 +1,86 @@ +From ef19577ed3d00246dfa5a60e529ecfc489ae5b11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jun 2022 16:48:54 +0200 +Subject: drm: bridge: adv7511: unregister cec i2c device after cec adapter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alvin Šipraga + +[ Upstream commit 40cdb02cb9f965732eb543d47f15bef8d10f0f5f ] + +cec_unregister_adapter() assumes that the underlying adapter ops are +callable. For example, if the CEC adapter currently has a valid physical +address, then the unregistration procedure will invalidate the physical +address by setting it to f.f.f.f. Whence the following kernel oops +observed after removing the adv7511 module: + + Unable to handle kernel execution of user memory at virtual address 0000000000000000 + Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP + Call trace: + 0x0 + adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511] + cec_adap_unconfigure+0x44/0x90 [cec] + __cec_s_phys_addr.part.0+0x68/0x230 [cec] + __cec_s_phys_addr+0x40/0x50 [cec] + cec_unregister_adapter+0xb4/0x118 [cec] + adv7511_remove+0x60/0x90 [adv7511] + i2c_device_remove+0x34/0xe0 + device_release_driver_internal+0x114/0x1f0 + driver_detach+0x54/0xe0 + bus_remove_driver+0x60/0xd8 + driver_unregister+0x34/0x60 + i2c_del_driver+0x2c/0x68 + adv7511_exit+0x1c/0x67c [adv7511] + __arm64_sys_delete_module+0x154/0x288 + invoke_syscall+0x48/0x100 + el0_svc_common.constprop.0+0x48/0xe8 + do_el0_svc+0x28/0x88 + el0_svc+0x1c/0x50 + el0t_64_sync_handler+0xa8/0xb0 + el0t_64_sync+0x15c/0x160 + Code: bad PC value + ---[ end trace 0000000000000000 ]--- + +Protect against this scenario by unregistering i2c_cec after +unregistering the CEC adapter. Duly disable the CEC clock afterwards +too. + +Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support") +Signed-off-by: Alvin Šipraga +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220612144854.2223873-3-alvin@pqrs.dk +Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 42d93f314699..9e8f45fa5c5e 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1339,9 +1339,6 @@ static int adv7511_remove(struct i2c_client *i2c) + { + struct adv7511 *adv7511 = i2c_get_clientdata(i2c); + +- i2c_unregister_device(adv7511->i2c_cec); +- clk_disable_unprepare(adv7511->cec_clk); +- + adv7511_uninit_regulators(adv7511); + + drm_bridge_remove(&adv7511->bridge); +@@ -1349,6 +1346,8 @@ static int adv7511_remove(struct i2c_client *i2c) + adv7511_audio_exit(adv7511); + + cec_unregister_adapter(adv7511->cec_adap); ++ i2c_unregister_device(adv7511->i2c_cec); ++ clk_disable_unprepare(adv7511->cec_clk); + + i2c_unregister_device(adv7511->i2c_packet); + i2c_unregister_device(adv7511->i2c_edid); +-- +2.39.5 + diff --git a/queue-5.10/drm-bridge-adv7511-use-dev_err_probe-in-probe-functi.patch b/queue-5.10/drm-bridge-adv7511-use-dev_err_probe-in-probe-functi.patch new file mode 100644 index 00000000000..3d85fd6c0ff --- /dev/null +++ b/queue-5.10/drm-bridge-adv7511-use-dev_err_probe-in-probe-functi.patch @@ -0,0 +1,93 @@ +From 3209aaab55597c082cba3b9057d854c9416fef97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 14:52:46 +0200 +Subject: drm: bridge: adv7511: use dev_err_probe in probe function + +From: Ahmad Fatoum + +[ Upstream commit 2a865248399a13bb2b2bcc50297069a7521de258 ] + +adv7511 probe may need to be attempted multiple times before no +-EPROBE_DEFER is returned. Currently, every such probe results in +an error message: + +[ 4.534229] adv7511 1-003d: failed to find dsi host +[ 4.580288] adv7511 1-003d: failed to find dsi host + +This is misleading, as there is no error and probe deferral is normal +behavior. Fix this by using dev_err_probe that will suppress +-EPROBE_DEFER errors. While at it, we touch all dev_err in the probe +path. This makes the code more concise and included the error code +everywhere to aid user in debugging. + +Reviewed-by: Laurent Pinchart +Signed-off-by: Ahmad Fatoum +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20221026125246.3188260-1-a.fatoum@pengutronix.de +Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 6 ++---- + drivers/gpu/drm/bridge/adv7511/adv7533.c | 20 ++++++++------------ + 2 files changed, 10 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 9e8f45fa5c5e..9255bce51753 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1220,10 +1220,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + return ret; + + ret = adv7511_init_regulators(adv7511); +- if (ret) { +- dev_err(dev, "failed to init regulators\n"); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, "failed to init regulators\n"); + + /* + * The power down GPIO is optional. If present, toggle it from active to +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c +index ec624b9d5077..f8d5fa6652af 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c +@@ -146,16 +146,14 @@ int adv7533_attach_dsi(struct adv7511 *adv) + }; + + host = of_find_mipi_dsi_host_by_node(adv->host_node); +- if (!host) { +- dev_err(dev, "failed to find dsi host\n"); +- return -EPROBE_DEFER; +- } ++ if (!host) ++ return dev_err_probe(dev, -EPROBE_DEFER, ++ "failed to find dsi host\n"); + + dsi = devm_mipi_dsi_device_register_full(dev, host, &info); +- if (IS_ERR(dsi)) { +- dev_err(dev, "failed to create dsi device\n"); +- return PTR_ERR(dsi); +- } ++ if (IS_ERR(dsi)) ++ return dev_err_probe(dev, PTR_ERR(dsi), ++ "failed to create dsi device\n"); + + adv->dsi = dsi; + +@@ -165,10 +163,8 @@ int adv7533_attach_dsi(struct adv7511 *adv) + MIPI_DSI_MODE_EOT_PACKET | MIPI_DSI_MODE_VIDEO_HSE; + + ret = devm_mipi_dsi_attach(dev, dsi); +- if (ret < 0) { +- dev_err(dev, "failed to attach dsi to host\n"); +- return ret; +- } ++ if (ret < 0) ++ return dev_err_probe(dev, ret, "failed to attach dsi to host\n"); + + return 0; + } +-- +2.39.5 + diff --git a/queue-5.10/drm-bridge-adv7533-switch-to-devm-mipi-dsi-helpers.patch b/queue-5.10/drm-bridge-adv7533-switch-to-devm-mipi-dsi-helpers.patch new file mode 100644 index 00000000000..bb181c04b91 --- /dev/null +++ b/queue-5.10/drm-bridge-adv7533-switch-to-devm-mipi-dsi-helpers.patch @@ -0,0 +1,98 @@ +From b92d9e67028223a1ee902943e7d5c607cf83509c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Oct 2021 17:15:16 +0200 +Subject: drm/bridge: adv7533: Switch to devm MIPI-DSI helpers + +From: Maxime Ripard + +[ Upstream commit ee9418808bcce77e2c31dbbfc58621ea99a05597 ] + +Let's switch to the new devm MIPI-DSI function to register and attach +our secondary device. This also avoids leaking the device when we detach +the bridge. + +Acked-by: Sam Ravnborg +Tested-by: John Stultz +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20211025151536.1048186-2-maxime@cerno.tech +Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 - + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 2 -- + drivers/gpu/drm/bridge/adv7511/adv7533.c | 20 ++++---------------- + 3 files changed, 4 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511.h b/drivers/gpu/drm/bridge/adv7511/adv7511.h +index e95abeb64b93..dcb792adc62c 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511.h ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511.h +@@ -399,7 +399,6 @@ enum drm_mode_status adv7533_mode_valid(struct adv7511 *adv, + int adv7533_patch_registers(struct adv7511 *adv); + int adv7533_patch_cec_registers(struct adv7511 *adv); + int adv7533_attach_dsi(struct adv7511 *adv); +-void adv7533_detach_dsi(struct adv7511 *adv); + int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv); + + #ifdef CONFIG_DRM_I2C_ADV7511_AUDIO +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 60400efe1dd3..42d93f314699 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1339,8 +1339,6 @@ static int adv7511_remove(struct i2c_client *i2c) + { + struct adv7511 *adv7511 = i2c_get_clientdata(i2c); + +- if (adv7511->type == ADV7533 || adv7511->type == ADV7535) +- adv7533_detach_dsi(adv7511); + i2c_unregister_device(adv7511->i2c_cec); + clk_disable_unprepare(adv7511->cec_clk); + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c +index 2cade7ae0c0d..ec624b9d5077 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7533.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c +@@ -151,11 +151,10 @@ int adv7533_attach_dsi(struct adv7511 *adv) + return -EPROBE_DEFER; + } + +- dsi = mipi_dsi_device_register_full(host, &info); ++ dsi = devm_mipi_dsi_device_register_full(dev, host, &info); + if (IS_ERR(dsi)) { + dev_err(dev, "failed to create dsi device\n"); +- ret = PTR_ERR(dsi); +- goto err_dsi_device; ++ return PTR_ERR(dsi); + } + + adv->dsi = dsi; +@@ -165,24 +164,13 @@ int adv7533_attach_dsi(struct adv7511 *adv) + dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_SYNC_PULSE | + MIPI_DSI_MODE_EOT_PACKET | MIPI_DSI_MODE_VIDEO_HSE; + +- ret = mipi_dsi_attach(dsi); ++ ret = devm_mipi_dsi_attach(dev, dsi); + if (ret < 0) { + dev_err(dev, "failed to attach dsi to host\n"); +- goto err_dsi_attach; ++ return ret; + } + + return 0; +- +-err_dsi_attach: +- mipi_dsi_device_unregister(dsi); +-err_dsi_device: +- return ret; +-} +- +-void adv7533_detach_dsi(struct adv7511 *adv) +-{ +- mipi_dsi_detach(adv->dsi); +- mipi_dsi_device_unregister(adv->dsi); + } + + int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) +-- +2.39.5 + diff --git a/queue-5.10/drm-mipi-dsi-create-devm-device-attachment.patch b/queue-5.10/drm-mipi-dsi-create-devm-device-attachment.patch new file mode 100644 index 00000000000..4e71c32f541 --- /dev/null +++ b/queue-5.10/drm-mipi-dsi-create-devm-device-attachment.patch @@ -0,0 +1,89 @@ +From be7bb753304b3f853db18f823d97ba4dbf671dcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Sep 2021 12:11:58 +0200 +Subject: drm/mipi-dsi: Create devm device attachment + +From: Maxime Ripard + +[ Upstream commit db6568498b35a4d5d5a99420df27ed25fae31406 ] + +MIPI-DSI devices need to call mipi_dsi_attach() when their probe is done +to attach against their host. + +However, at removal or when an error occurs, that attachment needs to be +undone through a call to mipi_dsi_detach(). + +Let's create a device-managed variant of the attachment function that +will automatically detach the device at unbind. + +Reviewed-by: Andrzej Hajda +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210910101218.1632297-5-maxime@cerno.tech +Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_mipi_dsi.c | 35 ++++++++++++++++++++++++++++++++++ + include/drm/drm_mipi_dsi.h | 1 + + 2 files changed, 36 insertions(+) + +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index e53a5b14b47b..468a3a7cb6a5 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -405,6 +405,41 @@ int mipi_dsi_detach(struct mipi_dsi_device *dsi) + } + EXPORT_SYMBOL(mipi_dsi_detach); + ++static void devm_mipi_dsi_detach(void *arg) ++{ ++ struct mipi_dsi_device *dsi = arg; ++ ++ mipi_dsi_detach(dsi); ++} ++ ++/** ++ * devm_mipi_dsi_attach - Attach a MIPI-DSI device to its DSI Host ++ * @dev: device to tie the MIPI-DSI device attachment lifetime to ++ * @dsi: DSI peripheral ++ * ++ * This is the managed version of mipi_dsi_attach() which automatically ++ * calls mipi_dsi_detach() when @dev is unbound. ++ * ++ * Returns: ++ * 0 on success, a negative error code on failure. ++ */ ++int devm_mipi_dsi_attach(struct device *dev, ++ struct mipi_dsi_device *dsi) ++{ ++ int ret; ++ ++ ret = mipi_dsi_attach(dsi); ++ if (ret) ++ return ret; ++ ++ ret = devm_add_action_or_reset(dev, devm_mipi_dsi_detach, dsi); ++ if (ret) ++ return ret; ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(devm_mipi_dsi_attach); ++ + static ssize_t mipi_dsi_device_transfer(struct mipi_dsi_device *dsi, + struct mipi_dsi_msg *msg) + { +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index af8ed48749eb..75995f3f2099 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -230,6 +230,7 @@ devm_mipi_dsi_device_register_full(struct device *dev, struct mipi_dsi_host *hos + struct mipi_dsi_device *of_find_mipi_dsi_device_by_node(struct device_node *np); + int mipi_dsi_attach(struct mipi_dsi_device *dsi); + int mipi_dsi_detach(struct mipi_dsi_device *dsi); ++int devm_mipi_dsi_attach(struct device *dev, struct mipi_dsi_device *dsi); + int mipi_dsi_shutdown_peripheral(struct mipi_dsi_device *dsi); + int mipi_dsi_turn_on_peripheral(struct mipi_dsi_device *dsi); + int mipi_dsi_set_maximum_return_packet_size(struct mipi_dsi_device *dsi, +-- +2.39.5 + diff --git a/queue-5.10/drm-mipi-dsi-create-devm-device-registration.patch b/queue-5.10/drm-mipi-dsi-create-devm-device-registration.patch new file mode 100644 index 00000000000..b523d282e13 --- /dev/null +++ b/queue-5.10/drm-mipi-dsi-create-devm-device-registration.patch @@ -0,0 +1,103 @@ +From 84b277c887cf8b27a00523fd940f54d853cdec7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Sep 2021 12:11:57 +0200 +Subject: drm/mipi-dsi: Create devm device registration + +From: Maxime Ripard + +[ Upstream commit a1419fb4a73e47f0eab2985dff594ed52397471b ] + +Devices that take their data through the MIPI-DSI bus but are controlled +through a secondary bus like I2C have to register a secondary device on +the MIPI-DSI bus through the mipi_dsi_device_register_full() function. + +At removal or when an error occurs, that device needs to be removed +through a call to mipi_dsi_device_unregister(). + +Let's create a device-managed variant of the registration function that +will automatically unregister the device at unbind. + +Reviewed-by: Andrzej Hajda +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210910101218.1632297-4-maxime@cerno.tech +Stable-dep-of: 81adbd3ff21c ("drm: adv7511: Fix use-after-free in adv7533_attach_dsi()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_mipi_dsi.c | 46 ++++++++++++++++++++++++++++++++++ + include/drm/drm_mipi_dsi.h | 3 +++ + 2 files changed, 49 insertions(+) + +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index 107a98484f50..e53a5b14b47b 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -246,6 +246,52 @@ void mipi_dsi_device_unregister(struct mipi_dsi_device *dsi) + } + EXPORT_SYMBOL(mipi_dsi_device_unregister); + ++static void devm_mipi_dsi_device_unregister(void *arg) ++{ ++ struct mipi_dsi_device *dsi = arg; ++ ++ mipi_dsi_device_unregister(dsi); ++} ++ ++/** ++ * devm_mipi_dsi_device_register_full - create a managed MIPI DSI device ++ * @dev: device to tie the MIPI-DSI device lifetime to ++ * @host: DSI host to which this device is connected ++ * @info: pointer to template containing DSI device information ++ * ++ * Create a MIPI DSI device by using the device information provided by ++ * mipi_dsi_device_info template ++ * ++ * This is the managed version of mipi_dsi_device_register_full() which ++ * automatically calls mipi_dsi_device_unregister() when @dev is ++ * unbound. ++ * ++ * Returns: ++ * A pointer to the newly created MIPI DSI device, or, a pointer encoded ++ * with an error ++ */ ++struct mipi_dsi_device * ++devm_mipi_dsi_device_register_full(struct device *dev, ++ struct mipi_dsi_host *host, ++ const struct mipi_dsi_device_info *info) ++{ ++ struct mipi_dsi_device *dsi; ++ int ret; ++ ++ dsi = mipi_dsi_device_register_full(host, info); ++ if (IS_ERR(dsi)) ++ return dsi; ++ ++ ret = devm_add_action_or_reset(dev, ++ devm_mipi_dsi_device_unregister, ++ dsi); ++ if (ret) ++ return ERR_PTR(ret); ++ ++ return dsi; ++} ++EXPORT_SYMBOL_GPL(devm_mipi_dsi_device_register_full); ++ + static DEFINE_MUTEX(host_lock); + static LIST_HEAD(host_list); + +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index 0dbed65c0ca5..af8ed48749eb 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -224,6 +224,9 @@ struct mipi_dsi_device * + mipi_dsi_device_register_full(struct mipi_dsi_host *host, + const struct mipi_dsi_device_info *info); + void mipi_dsi_device_unregister(struct mipi_dsi_device *dsi); ++struct mipi_dsi_device * ++devm_mipi_dsi_device_register_full(struct device *dev, struct mipi_dsi_host *host, ++ const struct mipi_dsi_device_info *info); + struct mipi_dsi_device *of_find_mipi_dsi_device_by_node(struct device_node *np); + int mipi_dsi_attach(struct mipi_dsi_device *dsi); + int mipi_dsi_detach(struct mipi_dsi_device *dsi); +-- +2.39.5 + diff --git a/queue-5.10/loop-let-set_capacity_revalidate_and_notify-update-t.patch b/queue-5.10/loop-let-set_capacity_revalidate_and_notify-update-t.patch new file mode 100644 index 00000000000..c5d1acbccd0 --- /dev/null +++ b/queue-5.10/loop-let-set_capacity_revalidate_and_notify-update-t.patch @@ -0,0 +1,42 @@ +From 68e6f55c9201471439c85e81c5d3e51b85683eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 15:56:53 +0100 +Subject: loop: let set_capacity_revalidate_and_notify update the bdev size + +From: Christoph Hellwig + +[ Upstream commit 3b4f85d02a4bd85cbea999a064235a47694bbb7b ] + +There is no good reason to call revalidate_disk_size separately. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device") +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 7444cc2a6c86..198f7ce3234b 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -238,12 +238,8 @@ static void __loop_update_dio(struct loop_device *lo, bool dio) + */ + static void loop_set_size(struct loop_device *lo, loff_t size) + { +- struct block_device *bdev = lo->lo_device; +- +- bd_set_nr_sectors(bdev, size); +- +- if (!set_capacity_revalidate_and_notify(lo->lo_disk, size, false)) +- kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); ++ if (!set_capacity_revalidate_and_notify(lo->lo_disk, size, true)) ++ kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE); + } + + static inline int +-- +2.39.5 + diff --git a/queue-5.10/nvme-let-set_capacity_revalidate_and_notify-update-t.patch b/queue-5.10/nvme-let-set_capacity_revalidate_and_notify-update-t.patch new file mode 100644 index 00000000000..8e08c21142c --- /dev/null +++ b/queue-5.10/nvme-let-set_capacity_revalidate_and_notify-update-t.patch @@ -0,0 +1,53 @@ +From 96fcae6735c1655f1c7a9588fa38609d3b8f8706 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 15:56:54 +0100 +Subject: nvme: let set_capacity_revalidate_and_notify update the bdev size + +From: Christoph Hellwig + +[ Upstream commit 5dd55749b79cdf471ca0966ad91541daebac3e2f ] + +There is no good reason to call revalidate_disk_size separately. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Jens Axboe +Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index bee55902fe6c..c8e64a1e2fc0 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2132,7 +2132,7 @@ static void nvme_update_disk_info(struct gendisk *disk, + capacity = 0; + } + +- set_capacity_revalidate_and_notify(disk, capacity, false); ++ set_capacity_revalidate_and_notify(disk, capacity, true); + + nvme_config_discard(disk, ns); + nvme_config_write_zeroes(disk->queue, ns->ctrl); +@@ -2213,7 +2213,6 @@ static int nvme_update_ns_info(struct nvme_ns *ns, struct nvme_id_ns *id) + blk_stack_limits(&ns->head->disk->queue->limits, + &ns->queue->limits, 0); + blk_queue_update_readahead(ns->head->disk->queue); +- nvme_update_bdev_size(ns->head->disk); + blk_mq_unfreeze_queue(ns->head->disk->queue); + } + #endif +@@ -4095,8 +4094,6 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids) + */ + if (ret > 0 && (ret & NVME_SC_DNR)) + nvme_ns_remove(ns); +- else +- revalidate_disk_size(ns->disk, true); + } + + static void nvme_validate_or_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) +-- +2.39.5 + diff --git a/queue-5.10/ocfs2-correct-return-value-of-ocfs2_local_free_info.patch b/queue-5.10/ocfs2-correct-return-value-of-ocfs2_local_free_info.patch new file mode 100644 index 00000000000..776e8f07eef --- /dev/null +++ b/queue-5.10/ocfs2-correct-return-value-of-ocfs2_local_free_info.patch @@ -0,0 +1,66 @@ +From e6fdf60a146d02ac17c09324b7a2a53b8dd82016 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 21:20:32 +0800 +Subject: ocfs2: correct return value of ocfs2_local_free_info() + +From: Joseph Qi + +[ Upstream commit d32840ad4a111c6abd651fbf6b5996e6123913da ] + +Now in ocfs2_local_free_info(), it returns 0 even if it actually fails. +Though it doesn't cause any real problem since the only caller +dquot_disable() ignores the return value, we'd better return correct as it +is. + +Link: https://lkml.kernel.org/r/20230528132033.217664-1-joseph.qi@linux.alibaba.com +Signed-off-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Joseph Qi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Signed-off-by: Andrew Morton +Stable-dep-of: 5f3fd772d152 ("ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv") +Signed-off-by: Sasha Levin +--- + fs/ocfs2/quota_local.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c +index 7a1c8da9e44b..fbab536741e2 100644 +--- a/fs/ocfs2/quota_local.c ++++ b/fs/ocfs2/quota_local.c +@@ -815,7 +815,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) + struct ocfs2_quota_chunk *chunk; + struct ocfs2_local_disk_chunk *dchunk; + int mark_clean = 1, len; +- int status; ++ int status = 0; + + iput(oinfo->dqi_gqinode); + ocfs2_simple_drop_lockres(OCFS2_SB(sb), &oinfo->dqi_gqlock); +@@ -857,17 +857,14 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) + oinfo->dqi_libh, + olq_update_info, + info); +- if (status < 0) { ++ if (status < 0) + mlog_errno(status); +- goto out; +- } +- + out: + ocfs2_inode_unlock(sb_dqopt(sb)->files[type], 1); + brelse(oinfo->dqi_libh); + brelse(oinfo->dqi_lqi_bh); + kfree(oinfo); +- return 0; ++ return status; + } + + static void olq_set_dquot(struct buffer_head *bh, void *private) +-- +2.39.5 + diff --git a/queue-5.10/ocfs2-fix-slab-use-after-free-due-to-dangling-pointe.patch b/queue-5.10/ocfs2-fix-slab-use-after-free-due-to-dangling-pointe.patch new file mode 100644 index 00000000000..d70f5ed215b --- /dev/null +++ b/queue-5.10/ocfs2-fix-slab-use-after-free-due-to-dangling-pointe.patch @@ -0,0 +1,73 @@ +From f1755a0e8fb7dc81f0b45ad804e8ce03229da454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Dec 2024 21:39:25 -0500 +Subject: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv + +From: Dennis Lam + +[ Upstream commit 5f3fd772d152229d94602bca243fbb658068a597 ] + +When mounting ocfs2 and then remounting it as read-only, a +slab-use-after-free occurs after the user uses a syscall to +quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the +dangling pointer. + +During the remounting process, the pointer dqi_priv is freed but is never +set as null leaving it to be accessed. Additionally, the read-only option +for remounting sets the DQUOT_SUSPENDED flag instead of setting the +DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the +next quota, the function ocfs2_get_next_id is called and only checks the +quota usage flags and not the quota suspended flags. + +To fix this, I set dqi_priv to null when it is freed after remounting with +read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id. + +[akpm@linux-foundation.org: coding-style cleanups] +Link: https://lkml.kernel.org/r/20241218023924.22821-2-dennis.lamerice@gmail.com +Fixes: 8f9e8f5fcc05 ("ocfs2: Fix Q_GETNEXTQUOTA for filesystem without quotas") +Signed-off-by: Dennis Lam +Reported-by: syzbot+d173bf8a5a7faeede34c@syzkaller.appspotmail.com +Tested-by: syzbot+d173bf8a5a7faeede34c@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/6731d26f.050a0220.1fb99c.014b.GAE@google.com/T/ +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/quota_global.c | 2 +- + fs/ocfs2/quota_local.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c +index eda83487c9ec..1ce3780e8b49 100644 +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -881,7 +881,7 @@ static int ocfs2_get_next_id(struct super_block *sb, struct kqid *qid) + int status = 0; + + trace_ocfs2_get_next_id(from_kqid(&init_user_ns, *qid), type); +- if (!sb_has_quota_loaded(sb, type)) { ++ if (!sb_has_quota_active(sb, type)) { + status = -ESRCH; + goto out; + } +diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c +index fbab536741e2..77d5aa90338f 100644 +--- a/fs/ocfs2/quota_local.c ++++ b/fs/ocfs2/quota_local.c +@@ -864,6 +864,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) + brelse(oinfo->dqi_libh); + brelse(oinfo->dqi_lqi_bh); + kfree(oinfo); ++ info->dqi_priv = NULL; + return status; + } + +-- +2.39.5 + diff --git a/queue-5.10/of-address-add-support-for-3-address-cell-bus.patch b/queue-5.10/of-address-add-support-for-3-address-cell-bus.patch new file mode 100644 index 00000000000..6941c6f52fc --- /dev/null +++ b/queue-5.10/of-address-add-support-for-3-address-cell-bus.patch @@ -0,0 +1,189 @@ +From 700240b95c9636d364dbc31d7ceb5adeedadc860 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 15:15:58 -0500 +Subject: of/address: Add support for 3 address cell bus + +From: Rob Herring + +[ Upstream commit 3d5089c4263d3594dc055e0f9c5cb990505cdd64 ] + +There's a few custom bus bindings (e.g. fsl,qoriq-mc) which use a +3 cell format with custom flags in the high cell. We can match these +buses as a fallback if we didn't match on PCI bus which is the only +standard bus binding with 3 address cells. + +Link: https://lore.kernel.org/r/20230328-dt-address-helpers-v1-3-e2456c3e77ab@kernel.org +Signed-off-by: Rob Herring +Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping") +Signed-off-by: Sasha Levin +--- + drivers/of/address.c | 22 ++++++++ + drivers/of/unittest-data/tests-address.dtsi | 9 +++- + drivers/of/unittest.c | 58 ++++++++++++++++++++- + 3 files changed, 87 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 068a134f6df7..2aebce8f4a76 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -97,11 +97,17 @@ static int of_bus_default_translate(__be32 *addr, u64 offset, int na) + return 0; + } + ++static unsigned int of_bus_default_flags_get_flags(const __be32 *addr) ++{ ++ return of_read_number(addr, 1); ++} ++ + static unsigned int of_bus_default_get_flags(const __be32 *addr) + { + return IORESOURCE_MEM; + } + ++ + #ifdef CONFIG_PCI + static unsigned int of_bus_pci_get_flags(const __be32 *addr) + { +@@ -328,6 +334,11 @@ static unsigned int of_bus_isa_get_flags(const __be32 *addr) + return flags; + } + ++static int of_bus_default_flags_match(struct device_node *np) ++{ ++ return of_bus_n_addr_cells(np) == 3; ++} ++ + /* + * Array of bus specific translators + */ +@@ -357,6 +368,17 @@ static struct of_bus of_busses[] = { + .has_flags = true, + .get_flags = of_bus_isa_get_flags, + }, ++ /* Default with flags cell */ ++ { ++ .name = "default-flags", ++ .addresses = "reg", ++ .match = of_bus_default_flags_match, ++ .count_cells = of_bus_default_count_cells, ++ .map = of_bus_default_map, ++ .translate = of_bus_default_translate, ++ .has_flags = true, ++ .get_flags = of_bus_default_flags_get_flags, ++ }, + /* Default */ + { + .name = "default", +diff --git a/drivers/of/unittest-data/tests-address.dtsi b/drivers/of/unittest-data/tests-address.dtsi +index 6604a52bf6cb..bc0029cbf8ea 100644 +--- a/drivers/of/unittest-data/tests-address.dtsi ++++ b/drivers/of/unittest-data/tests-address.dtsi +@@ -14,7 +14,7 @@ + #size-cells = <1>; + /* ranges here is to make sure we don't use it for + * dma-ranges translation */ +- ranges = <0x70000000 0x70000000 0x40000000>, ++ ranges = <0x70000000 0x70000000 0x50000000>, + <0x00000000 0xd0000000 0x20000000>; + dma-ranges = <0x0 0x20000000 0x40000000>; + +@@ -43,6 +43,13 @@ + <0x42000000 0x0 0xc0000000 0x20000000 0x0 0x10000000>; + }; + ++ bus@a0000000 { ++ #address-cells = <3>; ++ #size-cells = <2>; ++ ranges = <0xf00baa 0x0 0x0 0xa0000000 0x0 0x100000>, ++ <0xf00bee 0x1 0x0 0xb0000000 0x0 0x200000>; ++ }; ++ + }; + }; + }; +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index cb199ace8681..1659d4dceded 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -1044,7 +1044,7 @@ static void __init of_unittest_bus_ranges(void) + "for_each_of_range wrong flags on node %pOF flags=%x (expected %x)\n", + np, range.flags, IORESOURCE_MEM); + if (!i) { +- unittest(range.size == 0x40000000, ++ unittest(range.size == 0x50000000, + "for_each_of_range wrong size on node %pOF size=%llx\n", + np, range.size); + unittest(range.cpu_addr == 0x70000000, +@@ -1070,6 +1070,61 @@ static void __init of_unittest_bus_ranges(void) + of_node_put(np); + } + ++static void __init of_unittest_bus_3cell_ranges(void) ++{ ++ struct device_node *np; ++ struct of_range range; ++ struct of_range_parser parser; ++ int i = 0; ++ ++ np = of_find_node_by_path("/testcase-data/address-tests/bus@a0000000"); ++ if (!np) { ++ pr_err("missing testcase data\n"); ++ return; ++ } ++ ++ if (of_range_parser_init(&parser, np)) { ++ pr_err("missing ranges property\n"); ++ return; ++ } ++ ++ /* ++ * Get the "ranges" from the device tree ++ */ ++ for_each_of_range(&parser, &range) { ++ if (!i) { ++ unittest(range.flags == 0xf00baa, ++ "for_each_of_range wrong flags on node %pOF flags=%x\n", ++ np, range.flags); ++ unittest(range.size == 0x100000, ++ "for_each_of_range wrong size on node %pOF size=%llx\n", ++ np, range.size); ++ unittest(range.cpu_addr == 0xa0000000, ++ "for_each_of_range wrong CPU addr (%llx) on node %pOF", ++ range.cpu_addr, np); ++ unittest(range.bus_addr == 0x0, ++ "for_each_of_range wrong bus addr (%llx) on node %pOF", ++ range.pci_addr, np); ++ } else { ++ unittest(range.flags == 0xf00bee, ++ "for_each_of_range wrong flags on node %pOF flags=%x\n", ++ np, range.flags); ++ unittest(range.size == 0x200000, ++ "for_each_of_range wrong size on node %pOF size=%llx\n", ++ np, range.size); ++ unittest(range.cpu_addr == 0xb0000000, ++ "for_each_of_range wrong CPU addr (%llx) on node %pOF", ++ range.cpu_addr, np); ++ unittest(range.bus_addr == 0x100000000, ++ "for_each_of_range wrong bus addr (%llx) on node %pOF", ++ range.pci_addr, np); ++ } ++ i++; ++ } ++ ++ of_node_put(np); ++} ++ + static void __init of_unittest_parse_interrupts(void) + { + struct device_node *np; +@@ -3371,6 +3426,7 @@ static int __init of_unittest(void) + of_unittest_parse_dma_ranges(); + of_unittest_pci_dma_ranges(); + of_unittest_bus_ranges(); ++ of_unittest_bus_3cell_ranges(); + of_unittest_match_node(); + of_unittest_platform_populate(); + of_unittest_overlay(); +-- +2.39.5 + diff --git a/queue-5.10/of-address-fix-address-translation-when-address-size.patch b/queue-5.10/of-address-fix-address-translation-when-address-size.patch new file mode 100644 index 00000000000..15788f64c53 --- /dev/null +++ b/queue-5.10/of-address-fix-address-translation-when-address-size.patch @@ -0,0 +1,129 @@ +From d3faf872f43180dfb978054e0c48e19a47708f8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Oct 2023 13:02:16 +0200 +Subject: of: address: Fix address translation when address-size is greater + than 2 + +From: Herve Codina + +[ Upstream commit 42604f8eb7ba04b589375049cc76282dad4677d2 ] + +With the recent addition of of_pci_prop_ranges() in commit 407d1a51921e +("PCI: Create device tree node for bridge"), the ranges property can +have a 3 cells child address, a 3 cells parent address and a 2 cells +child size. + +A range item property for a PCI device is filled as follow: + 0 0 + <-- Child --> <-- Parent (PCI definition) --> <- BAR size (64bit) --> + +This allow to translate BAR addresses from the DT. For instance: +pci@0,0 { + #address-cells = <0x03>; + #size-cells = <0x02>; + device_type = "pci"; + compatible = "pci11ab,100", "pciclass,060400", "pciclass,0604"; + ranges = <0x82000000 0x00 0xe8000000 + 0x82000000 0x00 0xe8000000 + 0x00 0x4400000>; + ... + dev@0,0 { + #address-cells = <0x03>; + #size-cells = <0x02>; + compatible = "pci1055,9660", "pciclass,020000", "pciclass,0200"; + /* Translations for BAR0 to BAR5 */ + ranges = <0x00 0x00 0x00 0x82010000 0x00 0xe8000000 0x00 0x2000000 + 0x01 0x00 0x00 0x82010000 0x00 0xea000000 0x00 0x1000000 + 0x02 0x00 0x00 0x82010000 0x00 0xeb000000 0x00 0x800000 + 0x03 0x00 0x00 0x82010000 0x00 0xeb800000 0x00 0x800000 + 0x04 0x00 0x00 0x82010000 0x00 0xec000000 0x00 0x20000 + 0x05 0x00 0x00 0x82010000 0x00 0xec020000 0x00 0x2000>; + ... + pci-ep-bus@0 { + #address-cells = <0x01>; + #size-cells = <0x01>; + compatible = "simple-bus"; + /* Translate 0xe2000000 to BAR0 and 0xe0000000 to BAR1 */ + ranges = <0xe2000000 0x00 0x00 0x00 0x2000000 + 0xe0000000 0x01 0x00 0x00 0x1000000>; + ... + }; + }; +}; + +During the translation process, the "default-flags" map() function is +used to select the matching item in the ranges table and determine the +address offset from this matching item. +This map() function simply calls of_read_number() and when address-size +is greater than 2, the map() function skips the extra high address part +(ie part over 64bit). This lead to a wrong matching item and a wrong +offset computation. +Also during the translation itself, the extra high part related to the +parent address is not present in the translated address. + +Fix the "default-flags" map() and translate() in order to take into +account the child extra high address part in map() and the parent extra +high address part in translate() and so having a correct address +translation for ranges patterns such as the one given in the example +above. + +Signed-off-by: Herve Codina +Link: https://lore.kernel.org/r/20231017110221.189299-2-herve.codina@bootlin.com +Signed-off-by: Rob Herring +Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping") +Signed-off-by: Sasha Levin +--- + drivers/of/address.c | 30 ++++++++++++++++++++++++++++-- + 1 file changed, 28 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 2aebce8f4a76..f1c4f987ef95 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -107,6 +107,32 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr) + return IORESOURCE_MEM; + } + ++static u64 of_bus_default_flags_map(__be32 *addr, const __be32 *range, int na, ++ int ns, int pna) ++{ ++ u64 cp, s, da; ++ ++ /* Check that flags match */ ++ if (*addr != *range) ++ return OF_BAD_ADDR; ++ ++ /* Read address values, skipping high cell */ ++ cp = of_read_number(range + 1, na - 1); ++ s = of_read_number(range + na + pna, ns); ++ da = of_read_number(addr + 1, na - 1); ++ ++ pr_debug("default flags map, cp=%llx, s=%llx, da=%llx\n", cp, s, da); ++ ++ if (da < cp || da >= (cp + s)) ++ return OF_BAD_ADDR; ++ return da - cp; ++} ++ ++static int of_bus_default_flags_translate(__be32 *addr, u64 offset, int na) ++{ ++ /* Keep "flags" part (high cell) in translated address */ ++ return of_bus_default_translate(addr + 1, offset, na - 1); ++} + + #ifdef CONFIG_PCI + static unsigned int of_bus_pci_get_flags(const __be32 *addr) +@@ -374,8 +400,8 @@ static struct of_bus of_busses[] = { + .addresses = "reg", + .match = of_bus_default_flags_match, + .count_cells = of_bus_default_count_cells, +- .map = of_bus_default_map, +- .translate = of_bus_default_translate, ++ .map = of_bus_default_flags_map, ++ .translate = of_bus_default_flags_translate, + .has_flags = true, + .get_flags = of_bus_default_flags_get_flags, + }, +-- +2.39.5 + diff --git a/queue-5.10/of-address-preserve-the-flags-portion-on-1-1-dma-ran.patch b/queue-5.10/of-address-preserve-the-flags-portion-on-1-1-dma-ran.patch new file mode 100644 index 00000000000..bf5c2fbb2aa --- /dev/null +++ b/queue-5.10/of-address-preserve-the-flags-portion-on-1-1-dma-ran.patch @@ -0,0 +1,50 @@ +From 390a61201e9816ab7f3b6191a6d9efe5f1158166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Nov 2024 11:05:37 +0100 +Subject: of: address: Preserve the flags portion on 1:1 dma-ranges mapping + +From: Andrea della Porta + +[ Upstream commit 7f05e20b989ac33c9c0f8c2028ec0a566493548f ] + +A missing or empty dma-ranges in a DT node implies a 1:1 mapping for dma +translations. In this specific case, the current behaviour is to zero out +the entire specifier so that the translation could be carried on as an +offset from zero. This includes address specifier that has flags (e.g. +PCI ranges). + +Once the flags portion has been zeroed, the translation chain is broken +since the mapping functions will check the upcoming address specifier +against mismatching flags, always failing the 1:1 mapping and its entire +purpose of always succeeding. + +Set to zero only the address portion while passing the flags through. + +Fixes: dbbdee94734b ("of/address: Merge all of the bus translation code") +Cc: stable@vger.kernel.org +Signed-off-by: Andrea della Porta +Tested-by: Herve Codina +Link: https://lore.kernel.org/r/e51ae57874e58a9b349c35e2e877425ebc075d7a.1732441813.git.andrea.porta@suse.com +Signed-off-by: Rob Herring (Arm) +Signed-off-by: Sasha Levin +--- + drivers/of/address.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 2bbbc4f5e196..d995033fb661 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -475,7 +475,8 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus, + } + if (ranges == NULL || rlen == 0) { + offset = of_read_number(addr, na); +- memset(addr, 0, pna * 4); ++ /* set address to zero, pass flags through */ ++ memset(addr + pbus->flag_cells, 0, (pna - pbus->flag_cells) * 4); + pr_debug("empty ranges; 1:1 translation\n"); + goto finish; + } +-- +2.39.5 + diff --git a/queue-5.10/of-address-remove-duplicated-functions.patch b/queue-5.10/of-address-remove-duplicated-functions.patch new file mode 100644 index 00000000000..66045b2337a --- /dev/null +++ b/queue-5.10/of-address-remove-duplicated-functions.patch @@ -0,0 +1,72 @@ +From 81e795c7ebfcf01f32c0f7bf1dfd8e23ba390ae9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Oct 2023 13:02:17 +0200 +Subject: of: address: Remove duplicated functions + +From: Herve Codina + +[ Upstream commit 3eb030c60835668997d5763b1a0c7938faf169f6 ] + +The recently added of_bus_default_flags_translate() performs the exact +same operation as of_bus_pci_translate() and of_bus_isa_translate(). + +Avoid duplicated code replacing both of_bus_pci_translate() and +of_bus_isa_translate() with of_bus_default_flags_translate(). + +Signed-off-by: Herve Codina +Link: https://lore.kernel.org/r/20231017110221.189299-3-herve.codina@bootlin.com +Signed-off-by: Rob Herring +Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping") +Signed-off-by: Sasha Levin +--- + drivers/of/address.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index f1c4f987ef95..6b03adec12a7 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -222,10 +222,6 @@ static u64 of_bus_pci_map(__be32 *addr, const __be32 *range, int na, int ns, + return da - cp; + } + +-static int of_bus_pci_translate(__be32 *addr, u64 offset, int na) +-{ +- return of_bus_default_translate(addr + 1, offset, na - 1); +-} + #endif /* CONFIG_PCI */ + + int of_pci_address_to_resource(struct device_node *dev, int bar, +@@ -343,11 +339,6 @@ static u64 of_bus_isa_map(__be32 *addr, const __be32 *range, int na, int ns, + return da - cp; + } + +-static int of_bus_isa_translate(__be32 *addr, u64 offset, int na) +-{ +- return of_bus_default_translate(addr + 1, offset, na - 1); +-} +- + static unsigned int of_bus_isa_get_flags(const __be32 *addr) + { + unsigned int flags = 0; +@@ -378,7 +369,7 @@ static struct of_bus of_busses[] = { + .match = of_bus_pci_match, + .count_cells = of_bus_pci_count_cells, + .map = of_bus_pci_map, +- .translate = of_bus_pci_translate, ++ .translate = of_bus_default_flags_translate, + .has_flags = true, + .get_flags = of_bus_pci_get_flags, + }, +@@ -390,7 +381,7 @@ static struct of_bus of_busses[] = { + .match = of_bus_isa_match, + .count_cells = of_bus_isa_count_cells, + .map = of_bus_isa_map, +- .translate = of_bus_isa_translate, ++ .translate = of_bus_default_flags_translate, + .has_flags = true, + .get_flags = of_bus_isa_get_flags, + }, +-- +2.39.5 + diff --git a/queue-5.10/of-address-store-number-of-bus-flag-cells-rather-tha.patch b/queue-5.10/of-address-store-number-of-bus-flag-cells-rather-tha.patch new file mode 100644 index 00000000000..fa49b024c61 --- /dev/null +++ b/queue-5.10/of-address-store-number-of-bus-flag-cells-rather-tha.patch @@ -0,0 +1,85 @@ +From 6d2a462f7524d46f03edd94dcc037d6ba436b576 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Oct 2023 08:53:58 -0500 +Subject: of: address: Store number of bus flag cells rather than bool + +From: Rob Herring + +[ Upstream commit 88696db08b7efa3b6bb722014ea7429e78f6be32 ] + +It is more useful to know how many flags cells a bus has rather than +whether a bus has flags or not as ultimately the number of cells is the +information used. Replace 'has_flags' boolean with 'flag_cells' count. + +Acked-by: Herve Codina +Link: https://lore.kernel.org/r/20231026135358.3564307-2-robh@kernel.org +Signed-off-by: Rob Herring +Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping") +Signed-off-by: Sasha Levin +--- + drivers/of/address.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 6b03adec12a7..2bbbc4f5e196 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -50,7 +50,7 @@ struct of_bus { + u64 (*map)(__be32 *addr, const __be32 *range, + int na, int ns, int pna); + int (*translate)(__be32 *addr, u64 offset, int na); +- bool has_flags; ++ int flag_cells; + unsigned int (*get_flags)(const __be32 *addr); + }; + +@@ -370,7 +370,7 @@ static struct of_bus of_busses[] = { + .count_cells = of_bus_pci_count_cells, + .map = of_bus_pci_map, + .translate = of_bus_default_flags_translate, +- .has_flags = true, ++ .flag_cells = 1, + .get_flags = of_bus_pci_get_flags, + }, + #endif /* CONFIG_PCI */ +@@ -382,7 +382,7 @@ static struct of_bus of_busses[] = { + .count_cells = of_bus_isa_count_cells, + .map = of_bus_isa_map, + .translate = of_bus_default_flags_translate, +- .has_flags = true, ++ .flag_cells = 1, + .get_flags = of_bus_isa_get_flags, + }, + /* Default with flags cell */ +@@ -393,7 +393,7 @@ static struct of_bus of_busses[] = { + .count_cells = of_bus_default_count_cells, + .map = of_bus_default_flags_map, + .translate = of_bus_default_flags_translate, +- .has_flags = true, ++ .flag_cells = 1, + .get_flags = of_bus_default_flags_get_flags, + }, + /* Default */ +@@ -760,7 +760,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser, + int na = parser->na; + int ns = parser->ns; + int np = parser->pna + na + ns; +- int busflag_na = 0; ++ int busflag_na = parser->bus->flag_cells; + + if (!range) + return NULL; +@@ -770,10 +770,6 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser, + + range->flags = parser->bus->get_flags(parser->range); + +- /* A extra cell for resource flags */ +- if (parser->bus->has_flags) +- busflag_na = 1; +- + range->bus_addr = of_read_number(parser->range + busflag_na, na - busflag_na); + + if (parser->dma) +-- +2.39.5 + diff --git a/queue-5.10/of-address-use-is_enabled-for-config_pci.patch b/queue-5.10/of-address-use-is_enabled-for-config_pci.patch new file mode 100644 index 00000000000..cfafb83acef --- /dev/null +++ b/queue-5.10/of-address-use-is_enabled-for-config_pci.patch @@ -0,0 +1,129 @@ +From fae3d11e5b37adf684317c00baa2549606b90419 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 14:45:46 -0500 +Subject: of: address: Use IS_ENABLED() for !CONFIG_PCI + +From: Rob Herring + +[ Upstream commit c3c0dc75774b488770f33598109161040d291367 ] + +Convert address.c to use IS_ENABLED() instead of ifdefs for the +public PCI functions. This simplifies the ifdefs in of_address.h. + +Cc: Frank Rowand +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20210527194547.1287934-4-robh@kernel.org +Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping") +Signed-off-by: Sasha Levin +--- + drivers/of/address.c | 8 +++++++- + include/linux/of_address.h | 39 ++++++++++++++++++-------------------- + 2 files changed, 25 insertions(+), 22 deletions(-) + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 0455271a26ac..068a134f6df7 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -194,6 +194,7 @@ static int of_bus_pci_translate(__be32 *addr, u64 offset, int na) + { + return of_bus_default_translate(addr + 1, offset, na - 1); + } ++#endif /* CONFIG_PCI */ + + int of_pci_address_to_resource(struct device_node *dev, int bar, + struct resource *r) +@@ -202,6 +203,9 @@ int of_pci_address_to_resource(struct device_node *dev, int bar, + u64 size; + unsigned int flags; + ++ if (!IS_ENABLED(CONFIG_PCI)) ++ return -ENOSYS; ++ + addrp = of_get_pci_address(dev, bar, &size, &flags); + if (addrp == NULL) + return -EINVAL; +@@ -232,6 +236,9 @@ int of_pci_range_to_resource(struct of_pci_range *range, + res->parent = res->child = res->sibling = NULL; + res->name = np->full_name; + ++ if (!IS_ENABLED(CONFIG_PCI)) ++ return -ENOSYS; ++ + if (res->flags & IORESOURCE_IO) { + unsigned long port; + err = pci_register_io_range(&np->fwnode, range->cpu_addr, +@@ -262,7 +269,6 @@ int of_pci_range_to_resource(struct of_pci_range *range, + return err; + } + EXPORT_SYMBOL(of_pci_range_to_resource); +-#endif /* CONFIG_PCI */ + + /* + * ISA bus specific translator +diff --git a/include/linux/of_address.h b/include/linux/of_address.h +index b72807faf037..45598dbec269 100644 +--- a/include/linux/of_address.h ++++ b/include/linux/of_address.h +@@ -61,6 +61,11 @@ extern int of_pci_dma_range_parser_init(struct of_pci_range_parser *parser, + extern struct of_pci_range *of_pci_range_parser_one( + struct of_pci_range_parser *parser, + struct of_pci_range *range); ++extern int of_pci_address_to_resource(struct device_node *dev, int bar, ++ struct resource *r); ++extern int of_pci_range_to_resource(struct of_pci_range *range, ++ struct device_node *np, ++ struct resource *res); + extern bool of_dma_is_coherent(struct device_node *np); + #else /* CONFIG_OF_ADDRESS */ + static inline void __iomem *of_io_request_and_map(struct device_node *device, +@@ -100,6 +105,19 @@ static inline struct of_pci_range *of_pci_range_parser_one( + return NULL; + } + ++static inline int of_pci_address_to_resource(struct device_node *dev, int bar, ++ struct resource *r) ++{ ++ return -ENOSYS; ++} ++ ++static inline int of_pci_range_to_resource(struct of_pci_range *range, ++ struct device_node *np, ++ struct resource *res) ++{ ++ return -ENOSYS; ++} ++ + static inline bool of_dma_is_coherent(struct device_node *np) + { + return false; +@@ -124,27 +142,6 @@ static inline void __iomem *of_iomap(struct device_node *device, int index) + #endif + #define of_range_parser_init of_pci_range_parser_init + +-#if defined(CONFIG_OF_ADDRESS) && defined(CONFIG_PCI) +-extern int of_pci_address_to_resource(struct device_node *dev, int bar, +- struct resource *r); +-extern int of_pci_range_to_resource(struct of_pci_range *range, +- struct device_node *np, +- struct resource *res); +-#else /* CONFIG_OF_ADDRESS && CONFIG_PCI */ +-static inline int of_pci_address_to_resource(struct device_node *dev, int bar, +- struct resource *r) +-{ +- return -ENOSYS; +-} +- +-static inline int of_pci_range_to_resource(struct of_pci_range *range, +- struct device_node *np, +- struct resource *res) +-{ +- return -ENOSYS; +-} +-#endif /* CONFIG_OF_ADDRESS && CONFIG_PCI */ +- + static inline const __be32 *of_get_address(struct device_node *dev, int index, + u64 *size, unsigned int *flags) + { +-- +2.39.5 + diff --git a/queue-5.10/of-merge-of_get_address-and-of_get_pci_address-imple.patch b/queue-5.10/of-merge-of_get_address-and-of_get_pci_address-imple.patch new file mode 100644 index 00000000000..297b02d7f62 --- /dev/null +++ b/queue-5.10/of-merge-of_get_address-and-of_get_pci_address-imple.patch @@ -0,0 +1,193 @@ +From 83a68f7ded70bd823ff3b463647c3610d6b55722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 14:45:45 -0500 +Subject: of: Merge of_get_address() and of_get_pci_address() implementations + +From: Rob Herring + +[ Upstream commit 050a2c62dfc7d9ef457405f6ab4b715e9a2e32d7 ] + +of_get_address() and of_get_pci_address() are the same implementation +except of_get_pci_address() takes the PCI BAR number rather than an +index. Modify the of_get_address() implementation to work on either +index or BAR and provide wrapper functions for the existing functions. + +Cc: Frank Rowand +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20210527194547.1287934-3-robh@kernel.org +Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping") +Signed-off-by: Sasha Levin +--- + drivers/of/address.c | 62 ++++++++------------------------------ + include/linux/of_address.h | 27 ++++++++++------- + 2 files changed, 29 insertions(+), 60 deletions(-) + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index 7e2bfbb22430..0455271a26ac 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -195,50 +195,6 @@ static int of_bus_pci_translate(__be32 *addr, u64 offset, int na) + return of_bus_default_translate(addr + 1, offset, na - 1); + } + +-const __be32 *of_get_pci_address(struct device_node *dev, int bar_no, u64 *size, +- unsigned int *flags) +-{ +- const __be32 *prop; +- unsigned int psize; +- struct device_node *parent; +- struct of_bus *bus; +- int onesize, i, na, ns; +- +- /* Get parent & match bus type */ +- parent = of_get_parent(dev); +- if (parent == NULL) +- return NULL; +- bus = of_match_bus(parent); +- if (strcmp(bus->name, "pci")) { +- of_node_put(parent); +- return NULL; +- } +- bus->count_cells(dev, &na, &ns); +- of_node_put(parent); +- if (!OF_CHECK_ADDR_COUNT(na)) +- return NULL; +- +- /* Get "reg" or "assigned-addresses" property */ +- prop = of_get_property(dev, bus->addresses, &psize); +- if (prop == NULL) +- return NULL; +- psize /= 4; +- +- onesize = na + ns; +- for (i = 0; psize >= onesize; psize -= onesize, prop += onesize, i++) { +- u32 val = be32_to_cpu(prop[0]); +- if ((val & 0xff) == ((bar_no * 4) + PCI_BASE_ADDRESS_0)) { +- if (size) +- *size = of_read_number(prop + na, ns); +- if (flags) +- *flags = bus->get_flags(prop); +- return prop; +- } +- } +- return NULL; +-} +-EXPORT_SYMBOL(of_get_pci_address); +- + int of_pci_address_to_resource(struct device_node *dev, int bar, + struct resource *r) + { +@@ -671,8 +627,8 @@ u64 of_translate_dma_address(struct device_node *dev, const __be32 *in_addr) + } + EXPORT_SYMBOL(of_translate_dma_address); + +-const __be32 *of_get_address(struct device_node *dev, int index, u64 *size, +- unsigned int *flags) ++const __be32 *__of_get_address(struct device_node *dev, int index, int bar_no, ++ u64 *size, unsigned int *flags) + { + const __be32 *prop; + unsigned int psize; +@@ -685,6 +641,10 @@ const __be32 *of_get_address(struct device_node *dev, int index, u64 *size, + if (parent == NULL) + return NULL; + bus = of_match_bus(parent); ++ if (strcmp(bus->name, "pci") && (bar_no >= 0)) { ++ of_node_put(parent); ++ return NULL; ++ } + bus->count_cells(dev, &na, &ns); + of_node_put(parent); + if (!OF_CHECK_ADDR_COUNT(na)) +@@ -697,17 +657,21 @@ const __be32 *of_get_address(struct device_node *dev, int index, u64 *size, + psize /= 4; + + onesize = na + ns; +- for (i = 0; psize >= onesize; psize -= onesize, prop += onesize, i++) +- if (i == index) { ++ for (i = 0; psize >= onesize; psize -= onesize, prop += onesize, i++) { ++ u32 val = be32_to_cpu(prop[0]); ++ /* PCI bus matches on BAR number instead of index */ ++ if (((bar_no >= 0) && ((val & 0xff) == ((bar_no * 4) + PCI_BASE_ADDRESS_0))) || ++ ((index >= 0) && (i == index))) { + if (size) + *size = of_read_number(prop + na, ns); + if (flags) + *flags = bus->get_flags(prop); + return prop; + } ++ } + return NULL; + } +-EXPORT_SYMBOL(of_get_address); ++EXPORT_SYMBOL(__of_get_address); + + static int parser_init(struct of_pci_range_parser *parser, + struct device_node *node, const char *name) +diff --git a/include/linux/of_address.h b/include/linux/of_address.h +index 88bc943405cd..b72807faf037 100644 +--- a/include/linux/of_address.h ++++ b/include/linux/of_address.h +@@ -51,8 +51,8 @@ void __iomem *of_io_request_and_map(struct device_node *device, + * the address space flags too. The PCI version uses a BAR number + * instead of an absolute index + */ +-extern const __be32 *of_get_address(struct device_node *dev, int index, +- u64 *size, unsigned int *flags); ++extern const __be32 *__of_get_address(struct device_node *dev, int index, int bar_no, ++ u64 *size, unsigned int *flags); + + extern int of_pci_range_parser_init(struct of_pci_range_parser *parser, + struct device_node *node); +@@ -75,8 +75,8 @@ static inline u64 of_translate_address(struct device_node *np, + return OF_BAD_ADDR; + } + +-static inline const __be32 *of_get_address(struct device_node *dev, int index, +- u64 *size, unsigned int *flags) ++static inline const __be32 *__of_get_address(struct device_node *dev, int index, int bar_no, ++ u64 *size, unsigned int *flags) + { + return NULL; + } +@@ -125,8 +125,6 @@ static inline void __iomem *of_iomap(struct device_node *device, int index) + #define of_range_parser_init of_pci_range_parser_init + + #if defined(CONFIG_OF_ADDRESS) && defined(CONFIG_PCI) +-extern const __be32 *of_get_pci_address(struct device_node *dev, int bar_no, +- u64 *size, unsigned int *flags); + extern int of_pci_address_to_resource(struct device_node *dev, int bar, + struct resource *r); + extern int of_pci_range_to_resource(struct of_pci_range *range, +@@ -139,11 +137,6 @@ static inline int of_pci_address_to_resource(struct device_node *dev, int bar, + return -ENOSYS; + } + +-static inline const __be32 *of_get_pci_address(struct device_node *dev, +- int bar_no, u64 *size, unsigned int *flags) +-{ +- return NULL; +-} + static inline int of_pci_range_to_resource(struct of_pci_range *range, + struct device_node *np, + struct resource *res) +@@ -152,4 +145,16 @@ static inline int of_pci_range_to_resource(struct of_pci_range *range, + } + #endif /* CONFIG_OF_ADDRESS && CONFIG_PCI */ + ++static inline const __be32 *of_get_address(struct device_node *dev, int index, ++ u64 *size, unsigned int *flags) ++{ ++ return __of_get_address(dev, index, -1, size, flags); ++} ++ ++static inline const __be32 *of_get_pci_address(struct device_node *dev, int bar_no, ++ u64 *size, unsigned int *flags) ++{ ++ return __of_get_address(dev, -1, bar_no, size, flags); ++} ++ + #endif /* __OF_ADDRESS_H */ +-- +2.39.5 + diff --git a/queue-5.10/of-unittest-add-bus-address-range-parsing-tests.patch b/queue-5.10/of-unittest-add-bus-address-range-parsing-tests.patch new file mode 100644 index 00000000000..f818b07fa0f --- /dev/null +++ b/queue-5.10/of-unittest-add-bus-address-range-parsing-tests.patch @@ -0,0 +1,96 @@ +From 29f2f3ced2ef45609c453f87d322c18589ce7c33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 15:15:56 -0500 +Subject: of: unittest: Add bus address range parsing tests + +From: Rob Herring + +[ Upstream commit 6d32dadb11a6480be62c6ada901bbdcbda1775c9 ] + +While there are tests for "dma-ranges" helpers, "ranges" is missing any +tests. It's the same underlying code, but for completeness add a test +for "ranges" parsing iterators. This is in preparation to add some +additional "ranges" helpers. + +Link: https://lore.kernel.org/r/20230328-dt-address-helpers-v1-1-e2456c3e77ab@kernel.org +Signed-off-by: Rob Herring +Stable-dep-of: 7f05e20b989a ("of: address: Preserve the flags portion on 1:1 dma-ranges mapping") +Signed-off-by: Sasha Levin +--- + drivers/of/unittest.c | 53 +++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 53 insertions(+) + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index a334c68db339..cb199ace8681 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -1018,6 +1018,58 @@ static void __init of_unittest_pci_dma_ranges(void) + of_node_put(np); + } + ++static void __init of_unittest_bus_ranges(void) ++{ ++ struct device_node *np; ++ struct of_range range; ++ struct of_range_parser parser; ++ int i = 0; ++ ++ np = of_find_node_by_path("/testcase-data/address-tests"); ++ if (!np) { ++ pr_err("missing testcase data\n"); ++ return; ++ } ++ ++ if (of_range_parser_init(&parser, np)) { ++ pr_err("missing ranges property\n"); ++ return; ++ } ++ ++ /* ++ * Get the "ranges" from the device tree ++ */ ++ for_each_of_range(&parser, &range) { ++ unittest(range.flags == IORESOURCE_MEM, ++ "for_each_of_range wrong flags on node %pOF flags=%x (expected %x)\n", ++ np, range.flags, IORESOURCE_MEM); ++ if (!i) { ++ unittest(range.size == 0x40000000, ++ "for_each_of_range wrong size on node %pOF size=%llx\n", ++ np, range.size); ++ unittest(range.cpu_addr == 0x70000000, ++ "for_each_of_range wrong CPU addr (%llx) on node %pOF", ++ range.cpu_addr, np); ++ unittest(range.bus_addr == 0x70000000, ++ "for_each_of_range wrong bus addr (%llx) on node %pOF", ++ range.pci_addr, np); ++ } else { ++ unittest(range.size == 0x20000000, ++ "for_each_of_range wrong size on node %pOF size=%llx\n", ++ np, range.size); ++ unittest(range.cpu_addr == 0xd0000000, ++ "for_each_of_range wrong CPU addr (%llx) on node %pOF", ++ range.cpu_addr, np); ++ unittest(range.bus_addr == 0x00000000, ++ "for_each_of_range wrong bus addr (%llx) on node %pOF", ++ range.pci_addr, np); ++ } ++ i++; ++ } ++ ++ of_node_put(np); ++} ++ + static void __init of_unittest_parse_interrupts(void) + { + struct device_node *np; +@@ -3318,6 +3370,7 @@ static int __init of_unittest(void) + of_unittest_dma_get_max_cpu_address(); + of_unittest_parse_dma_ranges(); + of_unittest_pci_dma_ranges(); ++ of_unittest_bus_ranges(); + of_unittest_match_node(); + of_unittest_platform_populate(); + of_unittest_overlay(); +-- +2.39.5 + diff --git a/queue-5.10/phy-usb-add-wake-on-functionality-for-newer-synopsis.patch b/queue-5.10/phy-usb-add-wake-on-functionality-for-newer-synopsis.patch new file mode 100644 index 00000000000..d5dd6f34283 --- /dev/null +++ b/queue-5.10/phy-usb-add-wake-on-functionality-for-newer-synopsis.patch @@ -0,0 +1,135 @@ +From 5603ae0380bbf09228ca3361710dcb04d178cbfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Feb 2022 19:24:21 -0800 +Subject: phy: usb: Add "wake on" functionality for newer Synopsis XHCI + controllers + +From: Al Cooper + +[ Upstream commit ae532b2b7aa5a3dad036aef4e0b177607172d276 ] + +Add "wake on" support for the newer Synopsis based XHCI only controller. +This works on the 72165 and 72164 and newer chips and does not work +on 7216 based systems. Also switch the USB sysclk to a slower clock +on suspend to save additional power in S2. The clock switch will only +save power on the 72165b0 and newer chips and is a nop on older chips. + +Signed-off-by: Al Cooper +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220215032422.5179-1-f.fainelli@gmail.com +Signed-off-by: Vinod Koul +Stable-dep-of: 0a92ea87bdd6 ("phy: usb: Toggle the PHY power during init") +Signed-off-by: Sasha Levin +--- + .../phy/broadcom/phy-brcm-usb-init-synopsys.c | 46 +++++++++++++++---- + 1 file changed, 38 insertions(+), 8 deletions(-) + +diff --git a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +index e63457e145c7..d2524b70ea16 100644 +--- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c ++++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +@@ -47,6 +47,8 @@ + #define USB_CTRL_USB_PM_SOFT_RESET_MASK 0x40000000 + #define USB_CTRL_USB_PM_BDC_SOFT_RESETB_MASK 0x00800000 + #define USB_CTRL_USB_PM_XHC_SOFT_RESETB_MASK 0x00400000 ++#define USB_CTRL_USB_PM_XHC_PME_EN_MASK 0x00000010 ++#define USB_CTRL_USB_PM_XHC_S2_CLK_SWITCH_EN_MASK 0x00000008 + #define USB_CTRL_USB_PM_STATUS 0x08 + #define USB_CTRL_USB_DEVICE_CTL1 0x10 + #define USB_CTRL_USB_DEVICE_CTL1_PORT_MODE_MASK 0x00000003 +@@ -190,10 +192,6 @@ static void usb_init_common(struct brcm_usb_init_params *params) + + pr_debug("%s\n", __func__); + +- USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN); +- /* 1 millisecond - for USB clocks to settle down */ +- usleep_range(1000, 2000); +- + if (USB_CTRL_MASK(USB_DEVICE_CTL1, PORT_MODE)) { + reg = brcm_usb_readl(USB_CTRL_REG(ctrl, USB_DEVICE_CTL1)); + reg &= ~USB_CTRL_MASK(USB_DEVICE_CTL1, PORT_MODE); +@@ -222,6 +220,17 @@ static void usb_wake_enable_7211b0(struct brcm_usb_init_params *params, + USB_CTRL_UNSET(ctrl, CTLR_CSHCR, ctl_pme_en); + } + ++static void usb_wake_enable_7216(struct brcm_usb_init_params *params, ++ bool enable) ++{ ++ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; ++ ++ if (enable) ++ USB_CTRL_SET(ctrl, USB_PM, XHC_PME_EN); ++ else ++ USB_CTRL_UNSET(ctrl, USB_PM, XHC_PME_EN); ++} ++ + static void usb_init_common_7211b0(struct brcm_usb_init_params *params) + { + void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; +@@ -295,6 +304,20 @@ static void usb_init_common_7211b0(struct brcm_usb_init_params *params) + usb2_eye_fix_7211b0(params); + } + ++static void usb_init_common_7216(struct brcm_usb_init_params *params) ++{ ++ void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; ++ ++ USB_CTRL_UNSET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN); ++ USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN); ++ ++ /* 1 millisecond - for USB clocks to settle down */ ++ usleep_range(1000, 2000); ++ ++ usb_wake_enable_7216(params, false); ++ usb_init_common(params); ++} ++ + static void usb_init_xhci(struct brcm_usb_init_params *params) + { + pr_debug("%s\n", __func__); +@@ -302,14 +325,20 @@ static void usb_init_xhci(struct brcm_usb_init_params *params) + xhci_soft_reset(params, 0); + } + +-static void usb_uninit_common(struct brcm_usb_init_params *params) ++static void usb_uninit_common_7216(struct brcm_usb_init_params *params) + { + void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; + + pr_debug("%s\n", __func__); + +- USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN); ++ if (!params->wake_enabled) { ++ USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN); + ++ /* Switch to using slower clock during suspend to save power */ ++ USB_CTRL_SET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN); ++ } else { ++ usb_wake_enable_7216(params, true); ++ } + } + + static void usb_uninit_common_7211b0(struct brcm_usb_init_params *params) +@@ -371,9 +400,9 @@ static void usb_set_dual_select(struct brcm_usb_init_params *params, int mode) + + static const struct brcm_usb_init_ops bcm7216_ops = { + .init_ipp = usb_init_ipp, +- .init_common = usb_init_common, ++ .init_common = usb_init_common_7216, + .init_xhci = usb_init_xhci, +- .uninit_common = usb_uninit_common, ++ .uninit_common = usb_uninit_common_7216, + .uninit_xhci = usb_uninit_xhci, + .get_dual_select = usb_get_dual_select, + .set_dual_select = usb_set_dual_select, +@@ -396,6 +425,7 @@ void brcm_usb_dvr_init_7216(struct brcm_usb_init_params *params) + + params->family_name = "7216"; + params->ops = &bcm7216_ops; ++ params->suspend_with_clocks = true; + } + + void brcm_usb_dvr_init_7211b0(struct brcm_usb_init_params *params) +-- +2.39.5 + diff --git a/queue-5.10/phy-usb-toggle-the-phy-power-during-init.patch b/queue-5.10/phy-usb-toggle-the-phy-power-during-init.patch new file mode 100644 index 00000000000..db54af3837f --- /dev/null +++ b/queue-5.10/phy-usb-toggle-the-phy-power-during-init.patch @@ -0,0 +1,43 @@ +From cc2bf570b2deb1852288fd18cd739d97d495e579 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2024 14:35:40 -0700 +Subject: phy: usb: Toggle the PHY power during init + +From: Justin Chen + +[ Upstream commit 0a92ea87bdd6f77ca4e17fe19649882cf5209edd ] + +When bringing up the PHY, it might be in a bad state if left powered. +One case is we lose the PLL lock if the PLL is gated while the PHY +is powered. Toggle the PHY power so we can start from a known state. + +Fixes: 4e5b9c9a73b3 ("phy: usb: Add support for new Synopsys USB controller on the 7216") +Signed-off-by: Justin Chen +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20241024213540.1059412-1-justin.chen@broadcom.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +index d2524b70ea16..fa54da35719f 100644 +--- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c ++++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c +@@ -309,6 +309,12 @@ static void usb_init_common_7216(struct brcm_usb_init_params *params) + void __iomem *ctrl = params->regs[BRCM_REGS_CTRL]; + + USB_CTRL_UNSET(ctrl, USB_PM, XHC_S2_CLK_SWITCH_EN); ++ ++ /* ++ * The PHY might be in a bad state if it is already powered ++ * up. Toggle the power just in case. ++ */ ++ USB_CTRL_SET(ctrl, USB_PM, USB_PWRDN); + USB_CTRL_UNSET(ctrl, USB_PM, USB_PWRDN); + + /* 1 millisecond - for USB clocks to settle down */ +-- +2.39.5 + diff --git a/queue-5.10/sctp-sysctl-rto_min-max-avoid-using-current-nsproxy.patch b/queue-5.10/sctp-sysctl-rto_min-max-avoid-using-current-nsproxy.patch new file mode 100644 index 00000000000..a716d2f0da3 --- /dev/null +++ b/queue-5.10/sctp-sysctl-rto_min-max-avoid-using-current-nsproxy.patch @@ -0,0 +1,63 @@ +From c22d413bad9a7b906c475b929133687c2ff17d51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jan 2025 16:34:33 +0100 +Subject: sctp: sysctl: rto_min/max: avoid using current->nsproxy + +From: Matthieu Baerts (NGI0) + +[ Upstream commit 9fc17b76fc70763780aa78b38fcf4742384044a5 ] + +As mentioned in a previous commit of this series, using the 'net' +structure via 'current' is not recommended for different reasons: + +- Inconsistency: getting info from the reader's/writer's netns vs only + from the opener's netns. + +- current->nsproxy can be NULL in some cases, resulting in an 'Oops' + (null-ptr-deref), e.g. when the current task is exiting, as spotted by + syzbot [1] using acct(2). + +The 'net' structure can be obtained from the table->data using +container_of(). + +Note that table->data could also be used directly, as this is the only +member needed from the 'net' structure, but that would increase the size +of this fix, to use '*data' everywhere 'net->sctp.rto_min/max' is used. + +Fixes: 4f3fdf3bc59c ("sctp: add check rto_min and rto_max in sysctl") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/67769ecb.050a0220.3a8527.003f.GAE@google.com [1] +Suggested-by: Al Viro +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250108-net-sysctl-current-nsproxy-v1-5-5df34b2083e8@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sctp/sysctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c +index 8be80096fbb6..82b736843c9d 100644 +--- a/net/sctp/sysctl.c ++++ b/net/sctp/sysctl.c +@@ -396,7 +396,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write, + static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *ppos) + { +- struct net *net = current->nsproxy->net_ns; ++ struct net *net = container_of(ctl->data, struct net, sctp.rto_min); + unsigned int min = *(unsigned int *) ctl->extra1; + unsigned int max = *(unsigned int *) ctl->extra2; + struct ctl_table tbl; +@@ -424,7 +424,7 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write, + static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write, + void *buffer, size_t *lenp, loff_t *ppos) + { +- struct net *net = current->nsproxy->net_ns; ++ struct net *net = container_of(ctl->data, struct net, sctp.rto_max); + unsigned int min = *(unsigned int *) ctl->extra1; + unsigned int max = *(unsigned int *) ctl->extra2; + struct ctl_table tbl; +-- +2.39.5 + diff --git a/queue-5.10/sd-update-the-bdev-size-in-sd_revalidate_disk.patch b/queue-5.10/sd-update-the-bdev-size-in-sd_revalidate_disk.patch new file mode 100644 index 00000000000..5412469c93e --- /dev/null +++ b/queue-5.10/sd-update-the-bdev-size-in-sd_revalidate_disk.patch @@ -0,0 +1,60 @@ +From 04f23ab1b09fc8d72a96882f1f1ac80958b58d5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 15:56:55 +0100 +Subject: sd: update the bdev size in sd_revalidate_disk + +From: Christoph Hellwig + +[ Upstream commit b200e38c493b2a5acff4f86d40a3e45d546c664c ] + +This avoids the extra call to revalidate_disk_size in sd_rescan and +is otherwise a no-op because the size did not change, or we are in +the probe path. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Acked-by: Martin K. Petersen +Signed-off-by: Jens Axboe +Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device") +Signed-off-by: Sasha Levin +--- + drivers/scsi/sd.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 2f2ca2878876..355d38cab862 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1767,10 +1767,8 @@ static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr) + static void sd_rescan(struct device *dev) + { + struct scsi_disk *sdkp = dev_get_drvdata(dev); +- int ret; + +- ret = sd_revalidate_disk(sdkp->disk); +- revalidate_disk_size(sdkp->disk, ret == 0); ++ sd_revalidate_disk(sdkp->disk); + } + + static int sd_ioctl(struct block_device *bdev, fmode_t mode, +@@ -3295,7 +3293,7 @@ static int sd_revalidate_disk(struct gendisk *disk) + sdkp->first_scan = 0; + + set_capacity_revalidate_and_notify(disk, +- logical_to_sectors(sdp, sdkp->capacity), false); ++ logical_to_sectors(sdp, sdkp->capacity), true); + sd_config_write_same(sdkp); + kfree(buffer); + +@@ -3305,7 +3303,7 @@ static int sd_revalidate_disk(struct gendisk *disk) + * capacity to 0. + */ + if (sd_zbc_revalidate_zones(sdkp)) +- set_capacity_revalidate_and_notify(disk, 0, false); ++ set_capacity_revalidate_and_notify(disk, 0, true); + + out: + return 0; +-- +2.39.5 + diff --git a/queue-5.10/series b/queue-5.10/series index 1a6d4c1713a..0c5a804db1b 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -49,3 +49,32 @@ iio-gyro-fxas21002c-fix-missing-data-update-in-trigger-handler.patch iio-adc-ti-ads124s08-use-gpiod_set_value_cansleep.patch iio-adc-at91-call-input_free_device-on-allocated-iio_dev.patch iio-inkern-call-iio_device_put-only-on-mapped-devices.patch +arm64-dts-rockchip-add-power-domain-cells-to-power-d.patch +arm64-dts-rockchip-add-hevc-power-domain-clock-to-rk.patch +loop-let-set_capacity_revalidate_and_notify-update-t.patch +nvme-let-set_capacity_revalidate_and_notify-update-t.patch +sd-update-the-bdev-size-in-sd_revalidate_disk.patch +block-remove-the-update_bdev-parameter-to-set_capaci.patch +zram-use-set_capacity_and_notify.patch +drivers-block-zram-zram_drv.c-do-not-keep-dangling-z.patch +zram-fix-uninitialized-zram-not-releasing-backing-de.patch +of-merge-of_get_address-and-of_get_pci_address-imple.patch +of-address-use-is_enabled-for-config_pci.patch +of-unittest-add-bus-address-range-parsing-tests.patch +of-address-add-support-for-3-address-cell-bus.patch +of-address-fix-address-translation-when-address-size.patch +of-address-remove-duplicated-functions.patch +of-address-store-number-of-bus-flag-cells-rather-tha.patch +of-address-preserve-the-flags-portion-on-1-1-dma-ran.patch +phy-usb-add-wake-on-functionality-for-newer-synopsis.patch +phy-usb-toggle-the-phy-power-during-init.patch +ocfs2-correct-return-value-of-ocfs2_local_free_info.patch +ocfs2-fix-slab-use-after-free-due-to-dangling-pointe.patch +drm-bridge-adv7511-remove-redundant-null-check-befor.patch +drm-mipi-dsi-create-devm-device-registration.patch +drm-mipi-dsi-create-devm-device-attachment.patch +drm-bridge-adv7533-switch-to-devm-mipi-dsi-helpers.patch +drm-bridge-adv7511-unregister-cec-i2c-device-after-c.patch +drm-bridge-adv7511-use-dev_err_probe-in-probe-functi.patch +drm-adv7511-fix-use-after-free-in-adv7533_attach_dsi.patch +sctp-sysctl-rto_min-max-avoid-using-current-nsproxy.patch diff --git a/queue-5.10/zram-fix-uninitialized-zram-not-releasing-backing-de.patch b/queue-5.10/zram-fix-uninitialized-zram-not-releasing-backing-de.patch new file mode 100644 index 00000000000..c81db4290cb --- /dev/null +++ b/queue-5.10/zram-fix-uninitialized-zram-not-releasing-backing-de.patch @@ -0,0 +1,65 @@ +From 592137471373262c25f7e8773160c6e022b55c0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Dec 2024 00:57:16 +0800 +Subject: zram: fix uninitialized ZRAM not releasing backing device + +From: Kairui Song + +[ Upstream commit 74363ec674cb172d8856de25776c8f3103f05e2f ] + +Setting backing device is done before ZRAM initialization. If we set the +backing device, then remove the ZRAM module without initializing the +device, the backing device reference will be leaked and the device will be +hold forever. + +Fix this by always reset the ZRAM fully on rmmod or reset store. + +Link: https://lkml.kernel.org/r/20241209165717.94215-3-ryncsn@gmail.com +Fixes: 013bf95a83ec ("zram: add interface to specif backing device") +Signed-off-by: Kairui Song +Reported-by: Desheng Wu +Suggested-by: Sergey Senozhatsky +Reviewed-by: Sergey Senozhatsky +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/block/zram/zram_drv.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index 8e13586be8c9..05a46fbe0ea9 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -1146,12 +1146,16 @@ static void zram_meta_free(struct zram *zram, u64 disksize) + size_t num_pages = disksize >> PAGE_SHIFT; + size_t index; + ++ if (!zram->table) ++ return; ++ + /* Free all pages that are still in this zram device */ + for (index = 0; index < num_pages; index++) + zram_free_page(zram, index); + + zs_destroy_pool(zram->mem_pool); + vfree(zram->table); ++ zram->table = NULL; + } + + static bool zram_meta_alloc(struct zram *zram, u64 disksize) +@@ -1694,11 +1698,6 @@ static void zram_reset_device(struct zram *zram) + + zram->limit_pages = 0; + +- if (!init_done(zram)) { +- up_write(&zram->init_lock); +- return; +- } +- + set_capacity_and_notify(zram->disk, 0); + part_stat_set_all(&zram->disk->part0, 0); + +-- +2.39.5 + diff --git a/queue-5.10/zram-use-set_capacity_and_notify.patch b/queue-5.10/zram-use-set_capacity_and_notify.patch new file mode 100644 index 00000000000..166194e9a63 --- /dev/null +++ b/queue-5.10/zram-use-set_capacity_and_notify.patch @@ -0,0 +1,55 @@ +From 6e7bbd86b21ac8e554be9809d3db48dbe050ce4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 15:57:09 +0100 +Subject: zram: use set_capacity_and_notify + +From: Christoph Hellwig + +[ Upstream commit 6e017a3931d7722260e3656a6fc9b02de5fb3c5d ] + +Use set_capacity_and_notify to set the size of both the disk and block +device. This also gets the uevent notifications for the resize for free. + +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Stable-dep-of: 74363ec674cb ("zram: fix uninitialized ZRAM not releasing backing device") +Signed-off-by: Sasha Levin +--- + drivers/block/zram/zram_drv.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index 16db4fae5145..8f38e5a1a63f 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -1706,7 +1706,7 @@ static void zram_reset_device(struct zram *zram) + disksize = zram->disksize; + zram->disksize = 0; + +- set_capacity(zram->disk, 0); ++ set_capacity_and_notify(zram->disk, 0); + part_stat_set_all(&zram->disk->part0, 0); + + up_write(&zram->init_lock); +@@ -1752,9 +1752,7 @@ static ssize_t disksize_store(struct device *dev, + + zram->comp = comp; + zram->disksize = disksize; +- set_capacity(zram->disk, zram->disksize >> SECTOR_SHIFT); +- +- revalidate_disk_size(zram->disk, true); ++ set_capacity_and_notify(zram->disk, zram->disksize >> SECTOR_SHIFT); + up_write(&zram->init_lock); + + return len; +@@ -1801,7 +1799,6 @@ static ssize_t reset_store(struct device *dev, + /* Make sure all the pending I/O are finished */ + fsync_bdev(bdev); + zram_reset_device(zram); +- revalidate_disk_size(zram->disk, true); + bdput(bdev); + + mutex_lock(&bdev->bd_mutex); +-- +2.39.5 + -- 2.47.2