]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 26 Jan 2024 23:32:24 +0000 (15:32 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 26 Jan 2024 23:32:24 +0000 (15:32 -0800)
added patches:
arm64-dts-qcom-sdm845-fix-usb-dp-dm-hs-phy-interrupts.patch
arm64-dts-qcom-sdm845-fix-usb-ss-wakeup.patch
mmc-core-use-mrq.sbc-in-close-ended-ffu.patch
nouveau-vmm-don-t-set-addr-on-the-fail-path-to-avoid-warning.patch
ubifs-ubifs_symlink-fix-memleak-of-inode-i_link-in-error-path.patch

queue-5.4/arm64-dts-qcom-sdm845-fix-usb-dp-dm-hs-phy-interrupts.patch [new file with mode: 0644]
queue-5.4/arm64-dts-qcom-sdm845-fix-usb-ss-wakeup.patch [new file with mode: 0644]
queue-5.4/mmc-core-use-mrq.sbc-in-close-ended-ffu.patch [new file with mode: 0644]
queue-5.4/nouveau-vmm-don-t-set-addr-on-the-fail-path-to-avoid-warning.patch [new file with mode: 0644]
queue-5.4/series
queue-5.4/ubifs-ubifs_symlink-fix-memleak-of-inode-i_link-in-error-path.patch [new file with mode: 0644]

diff --git a/queue-5.4/arm64-dts-qcom-sdm845-fix-usb-dp-dm-hs-phy-interrupts.patch b/queue-5.4/arm64-dts-qcom-sdm845-fix-usb-dp-dm-hs-phy-interrupts.patch
new file mode 100644 (file)
index 0000000..019e033
--- /dev/null
@@ -0,0 +1,63 @@
+From 204f9ed4bad6293933179517624143b8f412347c Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 13 Dec 2023 18:34:00 +0100
+Subject: arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 204f9ed4bad6293933179517624143b8f412347c upstream.
+
+The USB DP/DM HS PHY interrupts need to be provided by the PDC interrupt
+controller in order to be able to wake the system up from low-power
+states and to be able to detect disconnect events, which requires
+triggering on falling edges.
+
+A recent commit updated the trigger type but failed to change the
+interrupt provider as required. This leads to the current Linux driver
+failing to probe instead of printing an error during suspend and USB
+wakeup not working as intended.
+
+Fixes: 84ad9ac8d9ca ("arm64: dts: qcom: sdm845: fix USB wakeup interrupt types")
+Fixes: ca4db2b538a1 ("arm64: dts: qcom: sdm845: Add USB-related nodes")
+Cc: stable@vger.kernel.org      # 4.20
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231213173403.29544-3-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi |   16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2501,10 +2501,10 @@
+                                         <&gcc GCC_USB30_PRIM_MASTER_CLK>;
+                       assigned-clock-rates = <19200000>, <150000000>;
+-                      interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+-                                   <GIC_SPI 486 IRQ_TYPE_LEVEL_HIGH>,
+-                                   <GIC_SPI 488 IRQ_TYPE_EDGE_BOTH>,
+-                                   <GIC_SPI 489 IRQ_TYPE_EDGE_BOTH>;
++                      interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
++                                            <&intc GIC_SPI 486 IRQ_TYPE_LEVEL_HIGH>,
++                                            <&pdc_intc 8 IRQ_TYPE_EDGE_BOTH>,
++                                            <&pdc_intc 9 IRQ_TYPE_EDGE_BOTH>;
+                       interrupt-names = "hs_phy_irq", "ss_phy_irq",
+                                         "dm_hs_phy_irq", "dp_hs_phy_irq";
+@@ -2545,10 +2545,10 @@
+                                         <&gcc GCC_USB30_SEC_MASTER_CLK>;
+                       assigned-clock-rates = <19200000>, <150000000>;
+-                      interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
+-                                   <GIC_SPI 487 IRQ_TYPE_LEVEL_HIGH>,
+-                                   <GIC_SPI 490 IRQ_TYPE_EDGE_BOTH>,
+-                                   <GIC_SPI 491 IRQ_TYPE_EDGE_BOTH>;
++                      interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
++                                            <&intc GIC_SPI 487 IRQ_TYPE_LEVEL_HIGH>,
++                                            <&pdc_intc 10 IRQ_TYPE_EDGE_BOTH>,
++                                            <&pdc_intc 11 IRQ_TYPE_EDGE_BOTH>;
+                       interrupt-names = "hs_phy_irq", "ss_phy_irq",
+                                         "dm_hs_phy_irq", "dp_hs_phy_irq";
diff --git a/queue-5.4/arm64-dts-qcom-sdm845-fix-usb-ss-wakeup.patch b/queue-5.4/arm64-dts-qcom-sdm845-fix-usb-ss-wakeup.patch
new file mode 100644 (file)
index 0000000..0076a6b
--- /dev/null
@@ -0,0 +1,44 @@
+From 971f5d8b0618d09db75184ddd8cca0767514db5d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 13 Dec 2023 18:34:01 +0100
+Subject: arm64: dts: qcom: sdm845: fix USB SS wakeup
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 971f5d8b0618d09db75184ddd8cca0767514db5d upstream.
+
+The USB SS PHY interrupts need to be provided by the PDC interrupt
+controller in order to be able to wake the system up from low-power
+states.
+
+Fixes: ca4db2b538a1 ("arm64: dts: qcom: sdm845: Add USB-related nodes")
+Cc: stable@vger.kernel.org     # 4.20
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231213173403.29544-4-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2502,7 +2502,7 @@
+                       assigned-clock-rates = <19200000>, <150000000>;
+                       interrupts-extended = <&intc GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>,
+-                                            <&intc GIC_SPI 486 IRQ_TYPE_LEVEL_HIGH>,
++                                            <&pdc_intc 6 IRQ_TYPE_LEVEL_HIGH>,
+                                             <&pdc_intc 8 IRQ_TYPE_EDGE_BOTH>,
+                                             <&pdc_intc 9 IRQ_TYPE_EDGE_BOTH>;
+                       interrupt-names = "hs_phy_irq", "ss_phy_irq",
+@@ -2546,7 +2546,7 @@
+                       assigned-clock-rates = <19200000>, <150000000>;
+                       interrupts-extended = <&intc GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>,
+-                                            <&intc GIC_SPI 487 IRQ_TYPE_LEVEL_HIGH>,
++                                            <&pdc_intc 7 IRQ_TYPE_LEVEL_HIGH>,
+                                             <&pdc_intc 10 IRQ_TYPE_EDGE_BOTH>,
+                                             <&pdc_intc 11 IRQ_TYPE_EDGE_BOTH>;
+                       interrupt-names = "hs_phy_irq", "ss_phy_irq",
diff --git a/queue-5.4/mmc-core-use-mrq.sbc-in-close-ended-ffu.patch b/queue-5.4/mmc-core-use-mrq.sbc-in-close-ended-ffu.patch
new file mode 100644 (file)
index 0000000..2f3dbdd
--- /dev/null
@@ -0,0 +1,145 @@
+From 4d0c8d0aef6355660b6775d57ccd5d4ea2e15802 Mon Sep 17 00:00:00 2001
+From: Avri Altman <avri.altman@wdc.com>
+Date: Wed, 29 Nov 2023 11:25:35 +0200
+Subject: mmc: core: Use mrq.sbc in close-ended ffu
+
+From: Avri Altman <avri.altman@wdc.com>
+
+commit 4d0c8d0aef6355660b6775d57ccd5d4ea2e15802 upstream.
+
+Field Firmware Update (ffu) may use close-ended or open ended sequence.
+Each such sequence is comprised of a write commands enclosed between 2
+switch commands - to and from ffu mode. So for the close-ended case, it
+will be: cmd6->cmd23-cmd25-cmd6.
+
+Some host controllers however, get confused when multi-block rw is sent
+without sbc, and may generate auto-cmd12 which breaks the ffu sequence.
+I encountered  this issue while testing fwupd (github.com/fwupd/fwupd)
+on HP Chromebook x2, a qualcomm based QC-7c, code name - strongbad.
+
+Instead of a quirk, or hooking the request function of the msm ops,
+it would be better to fix the ioctl handling and make it use mrq.sbc
+instead of issuing SET_BLOCK_COUNT separately.
+
+Signed-off-by: Avri Altman <avri.altman@wdc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20231129092535.3278-1-avri.altman@wdc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/block.c |   46 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 43 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -345,6 +345,10 @@ struct mmc_blk_ioc_data {
+       struct mmc_ioc_cmd ic;
+       unsigned char *buf;
+       u64 buf_bytes;
++      unsigned int flags;
++#define MMC_BLK_IOC_DROP      BIT(0)  /* drop this mrq */
++#define MMC_BLK_IOC_SBC       BIT(1)  /* use mrq.sbc */
++
+       struct mmc_rpmb_data *rpmb;
+ };
+@@ -490,7 +494,7 @@ static int card_busy_detect(struct mmc_c
+ }
+ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
+-                             struct mmc_blk_ioc_data *idata)
++                             struct mmc_blk_ioc_data **idatas, int i)
+ {
+       struct mmc_command cmd = {}, sbc = {};
+       struct mmc_data data = {};
+@@ -498,10 +502,18 @@ static int __mmc_blk_ioctl_cmd(struct mm
+       struct scatterlist sg;
+       int err;
+       unsigned int target_part;
++      struct mmc_blk_ioc_data *idata = idatas[i];
++      struct mmc_blk_ioc_data *prev_idata = NULL;
+       if (!card || !md || !idata)
+               return -EINVAL;
++      if (idata->flags & MMC_BLK_IOC_DROP)
++              return 0;
++
++      if (idata->flags & MMC_BLK_IOC_SBC)
++              prev_idata = idatas[i - 1];
++
+       /*
+        * The RPMB accesses comes in from the character device, so we
+        * need to target these explicitly. Else we just target the
+@@ -568,7 +580,7 @@ static int __mmc_blk_ioctl_cmd(struct mm
+                       return err;
+       }
+-      if (idata->rpmb) {
++      if (idata->rpmb || prev_idata) {
+               sbc.opcode = MMC_SET_BLOCK_COUNT;
+               /*
+                * We don't do any blockcount validation because the max size
+@@ -576,6 +588,8 @@ static int __mmc_blk_ioctl_cmd(struct mm
+                * 'Reliable Write' bit here.
+                */
+               sbc.arg = data.blocks | (idata->ic.write_flag & BIT(31));
++              if (prev_idata)
++                      sbc.arg = prev_idata->ic.arg;
+               sbc.flags = MMC_RSP_R1 | MMC_CMD_AC;
+               mrq.sbc = &sbc;
+       }
+@@ -594,6 +608,15 @@ static int __mmc_blk_ioctl_cmd(struct mm
+       mmc_wait_for_req(card->host, &mrq);
+       memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
++      if (prev_idata) {
++              memcpy(&prev_idata->ic.response, sbc.resp, sizeof(sbc.resp));
++              if (sbc.error) {
++                      dev_err(mmc_dev(card->host), "%s: sbc error %d\n",
++                                                      __func__, sbc.error);
++                      return sbc.error;
++              }
++      }
++
+       if (cmd.error) {
+               dev_err(mmc_dev(card->host), "%s: cmd error %d\n",
+                                               __func__, cmd.error);
+@@ -1035,6 +1058,20 @@ static inline void mmc_blk_reset_success
+       md->reset_done &= ~type;
+ }
++static void mmc_blk_check_sbc(struct mmc_queue_req *mq_rq)
++{
++      struct mmc_blk_ioc_data **idata = mq_rq->drv_op_data;
++      int i;
++
++      for (i = 1; i < mq_rq->ioc_count; i++) {
++              if (idata[i - 1]->ic.opcode == MMC_SET_BLOCK_COUNT &&
++                  mmc_op_multi(idata[i]->ic.opcode)) {
++                      idata[i - 1]->flags |= MMC_BLK_IOC_DROP;
++                      idata[i]->flags |= MMC_BLK_IOC_SBC;
++              }
++      }
++}
++
+ /*
+  * The non-block commands come back from the block layer after it queued it and
+  * processed it with all other requests and then they get issued in this
+@@ -1062,11 +1099,14 @@ static void mmc_blk_issue_drv_op(struct
+                       if (ret)
+                               break;
+               }
++
++              mmc_blk_check_sbc(mq_rq);
++
+               fallthrough;
+       case MMC_DRV_OP_IOCTL_RPMB:
+               idata = mq_rq->drv_op_data;
+               for (i = 0, ret = 0; i < mq_rq->ioc_count; i++) {
+-                      ret = __mmc_blk_ioctl_cmd(card, md, idata[i]);
++                      ret = __mmc_blk_ioctl_cmd(card, md, idata, i);
+                       if (ret)
+                               break;
+               }
diff --git a/queue-5.4/nouveau-vmm-don-t-set-addr-on-the-fail-path-to-avoid-warning.patch b/queue-5.4/nouveau-vmm-don-t-set-addr-on-the-fail-path-to-avoid-warning.patch
new file mode 100644 (file)
index 0000000..71211f7
--- /dev/null
@@ -0,0 +1,80 @@
+From cacea81390fd8c8c85404e5eb2adeb83d87a912e Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 18 Jan 2024 06:19:57 +1000
+Subject: nouveau/vmm: don't set addr on the fail path to avoid warning
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit cacea81390fd8c8c85404e5eb2adeb83d87a912e upstream.
+
+nvif_vmm_put gets called if addr is set, but if the allocation
+fails we don't need to call put, otherwise we get a warning like
+
+[523232.435671] ------------[ cut here ]------------
+[523232.435674] WARNING: CPU: 8 PID: 1505697 at drivers/gpu/drm/nouveau/nvif/vmm.c:68 nvif_vmm_put+0x72/0x80 [nouveau]
+[523232.435795] Modules linked in: uinput rfcomm snd_seq_dummy snd_hrtimer nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr bnep sunrpc binfmt_misc intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common isst_if_common iwlmvm nfit libnvdimm vfat fat x86_pkg_temp_thermal intel_powerclamp mac80211 snd_soc_avs snd_soc_hda_codec coretemp snd_hda_ext_core snd_soc_core snd_hda_codec_realtek kvm_intel snd_hda_codec_hdmi snd_compress snd_hda_codec_generic ac97_bus snd_pcm_dmaengine snd_hda_intel libarc4 snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec kvm iwlwifi snd_hda_core btusb snd_hwdep btrtl snd_seq btintel irqbypass btbcm rapl snd_seq_device eeepc_wmi btmtk intel_cstate iTCO_wdt cfg80211 snd_pcm asus_wmi bluetooth intel_pmc_bxt iTCO_vendor_support snd_timer ledtrig_audio pktcdvd snd mei_me
+[523232.435828]  sparse_keymap intel_uncore i2c_i801 platform_profile wmi_bmof mei pcspkr ioatdma soundcore i2c_smbus rfkill idma64 dca joydev acpi_tad loop zram nouveau drm_ttm_helper ttm video drm_exec drm_gpuvm gpu_sched crct10dif_pclmul i2c_algo_bit nvme crc32_pclmul crc32c_intel drm_display_helper polyval_clmulni nvme_core polyval_generic e1000e mxm_wmi cec ghash_clmulni_intel r8169 sha512_ssse3 nvme_common wmi pinctrl_sunrisepoint uas usb_storage ip6_tables ip_tables fuse
+[523232.435849] CPU: 8 PID: 1505697 Comm: gnome-shell Tainted: G        W          6.6.0-rc7-nvk-uapi+ #12
+[523232.435851] Hardware name: System manufacturer System Product Name/ROG STRIX X299-E GAMING II, BIOS 1301 09/24/2021
+[523232.435852] RIP: 0010:nvif_vmm_put+0x72/0x80 [nouveau]
+[523232.435934] Code: 00 00 48 89 e2 be 02 00 00 00 48 c7 04 24 00 00 00 00 48 89 44 24 08 e8 fc bf ff ff 85
+c0 75 0a 48 c7 43 08 00 00 00 00 eb b3 <0f> 0b eb f2 e8 f5 c9 b2 e6 0f 1f 44 00 00 90 90 90 90 90 90 90 90
+[523232.435936] RSP: 0018:ffffc900077ffbd8 EFLAGS: 00010282
+[523232.435937] RAX: 00000000fffffffe RBX: ffffc900077ffc00 RCX: 0000000000000010
+[523232.435938] RDX: 0000000000000010 RSI: ffffc900077ffb38 RDI: ffffc900077ffbd8
+[523232.435940] RBP: ffff888e1c4f2140 R08: 0000000000000000 R09: 0000000000000000
+[523232.435940] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888503811800
+[523232.435941] R13: ffffc900077ffca0 R14: ffff888e1c4f2140 R15: ffff88810317e1e0
+[523232.435942] FS:  00007f933a769640(0000) GS:ffff88905fa00000(0000) knlGS:0000000000000000
+[523232.435943] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[523232.435944] CR2: 00007f930bef7000 CR3: 00000005d0322001 CR4: 00000000003706e0
+[523232.435945] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[523232.435946] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[523232.435964] Call Trace:
+[523232.435965]  <TASK>
+[523232.435966]  ? nvif_vmm_put+0x72/0x80 [nouveau]
+[523232.436051]  ? __warn+0x81/0x130
+[523232.436055]  ? nvif_vmm_put+0x72/0x80 [nouveau]
+[523232.436138]  ? report_bug+0x171/0x1a0
+[523232.436142]  ? handle_bug+0x3c/0x80
+[523232.436144]  ? exc_invalid_op+0x17/0x70
+[523232.436145]  ? asm_exc_invalid_op+0x1a/0x20
+[523232.436149]  ? nvif_vmm_put+0x72/0x80 [nouveau]
+[523232.436230]  ? nvif_vmm_put+0x64/0x80 [nouveau]
+[523232.436342]  nouveau_vma_del+0x80/0xd0 [nouveau]
+[523232.436506]  nouveau_vma_new+0x1a0/0x210 [nouveau]
+[523232.436671]  nouveau_gem_object_open+0x1d0/0x1f0 [nouveau]
+[523232.436835]  drm_gem_handle_create_tail+0xd1/0x180
+[523232.436840]  drm_prime_fd_to_handle_ioctl+0x12e/0x200
+[523232.436844]  ? __pfx_drm_prime_fd_to_handle_ioctl+0x10/0x10
+[523232.436847]  drm_ioctl_kernel+0xd3/0x180
+[523232.436849]  drm_ioctl+0x26d/0x4b0
+[523232.436851]  ? __pfx_drm_prime_fd_to_handle_ioctl+0x10/0x10
+[523232.436855]  nouveau_drm_ioctl+0x5a/0xb0 [nouveau]
+[523232.437032]  __x64_sys_ioctl+0x94/0xd0
+[523232.437036]  do_syscall_64+0x5d/0x90
+[523232.437040]  ? syscall_exit_to_user_mode+0x2b/0x40
+[523232.437044]  ? do_syscall_64+0x6c/0x90
+[523232.437046]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
+
+Reported-by: Faith Ekstrand <faith.ekstrand@collabora.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240117213852.295565-1-airlied@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_vmm.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_vmm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_vmm.c
+@@ -108,6 +108,9 @@ nouveau_vma_new(struct nouveau_bo *nvbo,
+       } else {
+               ret = nvif_vmm_get(&vmm->vmm, PTES, false, mem->mem.page, 0,
+                                  mem->mem.size, &tmp);
++              if (ret)
++                      goto done;
++
+               vma->addr = tmp.addr;
+       }
index 88fa3ba43d3f1730ea6557854af8a6439e9ad907..a5fff3b7b87685f8b3b4625bd9a92cce6a4cb3c6 100644 (file)
@@ -13,3 +13,8 @@ hwrng-core-fix-page-fault-dead-lock-on-mmap-ed-hwrng.patch
 rpmsg-virtio-free-driver_override-when-rpmsg_remove.patch
 parisc-firmware-fix-f-extend-for-pdc-addresses.patch
 arm64-dts-qcom-sdm845-fix-usb-wakeup-interrupt-types.patch
+arm64-dts-qcom-sdm845-fix-usb-dp-dm-hs-phy-interrupts.patch
+arm64-dts-qcom-sdm845-fix-usb-ss-wakeup.patch
+mmc-core-use-mrq.sbc-in-close-ended-ffu.patch
+nouveau-vmm-don-t-set-addr-on-the-fail-path-to-avoid-warning.patch
+ubifs-ubifs_symlink-fix-memleak-of-inode-i_link-in-error-path.patch
diff --git a/queue-5.4/ubifs-ubifs_symlink-fix-memleak-of-inode-i_link-in-error-path.patch b/queue-5.4/ubifs-ubifs_symlink-fix-memleak-of-inode-i_link-in-error-path.patch
new file mode 100644 (file)
index 0000000..b234a5f
--- /dev/null
@@ -0,0 +1,56 @@
+From 1e022216dcd248326a5bb95609d12a6815bca4e2 Mon Sep 17 00:00:00 2001
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+Date: Fri, 22 Dec 2023 16:54:46 +0800
+Subject: ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+commit 1e022216dcd248326a5bb95609d12a6815bca4e2 upstream.
+
+For error handling path in ubifs_symlink(), inode will be marked as
+bad first, then iput() is invoked. If inode->i_link is initialized by
+fscrypt_encrypt_symlink() in encryption scenario, inode->i_link won't
+be freed by callchain ubifs_free_inode -> fscrypt_free_inode in error
+handling path, because make_bad_inode() has changed 'inode->i_mode' as
+'S_IFREG'.
+Following kmemleak is easy to be reproduced by injecting error in
+ubifs_jnl_update() when doing symlink in encryption scenario:
+ unreferenced object 0xffff888103da3d98 (size 8):
+  comm "ln", pid 1692, jiffies 4294914701 (age 12.045s)
+  backtrace:
+   kmemdup+0x32/0x70
+   __fscrypt_encrypt_symlink+0xed/0x1c0
+   ubifs_symlink+0x210/0x300 [ubifs]
+   vfs_symlink+0x216/0x360
+   do_symlinkat+0x11a/0x190
+   do_syscall_64+0x3b/0xe0
+There are two ways fixing it:
+ 1. Remove make_bad_inode() in error handling path. We can do that
+    because ubifs_evict_inode() will do same processes for good
+    symlink inode and bad symlink inode, for inode->i_nlink checking
+    is before is_bad_inode().
+ 2. Free inode->i_link before marking inode bad.
+Method 2 is picked, it has less influence, personally, I think.
+
+Cc: stable@vger.kernel.org
+Fixes: 2c58d548f570 ("fscrypt: cache decrypted symlink target in ->i_link")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Suggested-by: Eric Biggers <ebiggers@kernel.org>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ubifs/dir.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ubifs/dir.c
++++ b/fs/ubifs/dir.c
+@@ -1206,6 +1206,8 @@ out_cancel:
+       dir_ui->ui_size = dir->i_size;
+       mutex_unlock(&dir_ui->ui_mutex);
+ out_inode:
++      /* Free inode->i_link before inode is marked as bad. */
++      fscrypt_free_inode(inode);
+       make_bad_inode(inode);
+       iput(inode);
+ out_fname: