5.10-stable patches

added patches:
	crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch
	spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch
	spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch

diff --git a/queue-5.10/crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch b/queue-5.10/crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch
new file mode 100644 (file)
index 0000000..c669254
--- /dev/null
+++ b/queue-5.10/crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch
@@ -0,0 +1,77 @@
+From e17ff3d6ff907dc8406261e8fd3e1fc8a908f0f6 Mon Sep 17 00:00:00 2001
+From: Paul Louvel <paul.louvel@bootlin.com>
+Date: Thu, 7 May 2026 16:41:47 +0200
+Subject: crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
+
+From: Paul Louvel <paul.louvel@bootlin.com>
+
+commit e17ff3d6ff907dc8406261e8fd3e1fc8a908f0f6 upstream.
+
+In order to know if a descriptor has been processed by the device,
+the driver polls the FIFO to see if DESC_HDR_DONE is set on a descriptor
+header to confirm completion.
+The current code does not make sure that the CPU gets up to date data
+before reading the descriptor.
+
+Fix this by calling dma_sync_single_for_cpu() before reading memory
+written by the device.
+
+Cc: stable@vger.kernel.org
+Fixes: 58cdbc6d2263 ("crypto: talitos - fix hash on SEC1.")
+Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/talitos.c |   28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -320,19 +320,31 @@ static int talitos_submit(struct device
+       return -EINPROGRESS;
+ }
+ 
+-static __be32 get_request_hdr(struct talitos_request *request, bool is_sec1)
++static __be32 get_request_hdr(struct device *dev,
++                            struct talitos_request *request, bool is_sec1)
+ {
+       struct talitos_edesc *edesc;
+ 
+-      if (!is_sec1)
++      if (!is_sec1) {
++              dma_sync_single_for_cpu(dev, request->dma_desc,
++                                      TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
++
+               return request->desc->hdr;
++      }
+ 
+-      if (!request->desc->next_desc)
++      if (!request->desc->next_desc) {
++              dma_sync_single_for_cpu(dev, request->dma_desc,
++                                      TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+               return request->desc->hdr1;
+-
+-      edesc = container_of(request->desc, struct talitos_edesc, desc);
+-
+-      return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))->hdr1;
++      } else {
++              dma_sync_single_for_cpu(dev,
++                                      be32_to_cpu(request->desc->next_desc),
++                                      TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
++              edesc = container_of(request->desc, struct talitos_edesc, desc);
++
++              return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))
++                      ->hdr1;
++      }
+ }
+ 
+ /*
+@@ -356,7 +368,7 @@ static void flush_channel(struct device
+ 
+               /* descriptors with their done bits set don't get the error */
+               rmb();
+-              hdr = get_request_hdr(request, is_sec1);
++              hdr = get_request_hdr(dev, request, is_sec1);
+ 
+               if ((hdr & DESC_HDR_DONE) == DESC_HDR_DONE)
+                       status = 0;

diff --git a/queue-5.10/series b/queue-5.10/series
index 6eee624abbb8322a526f5be5fbc9a8469c049fa9..687b8ba06e6220f1360dce423ef8f31a0ffb32bb 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -132,3 +132,6 @@ crypto-pcrypt-restore-callback-for-non-parallel-fallback.patch
 crypto-drbg-fix-returning-success-on-failure-in-ctr_drbg.patch
 crypto-drbg-fix-drbg_max_addtl-on-64-bit-kernels.patch
 crypto-drbg-fix-the-fips_enabled-priority-boost.patch
+crypto-talitos-use-dma_sync_single_for_cpu-before-reading-descriptor-header.patch
+spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch
+spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch

diff --git a/queue-5.10/spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch b/queue-5.10/spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch
new file mode 100644 (file)
index 0000000..e4607f9
--- /dev/null
+++ b/queue-5.10/spi-fsl-lpspi-replace-dmaengine_terminate_all-with-dmaengine_terminate_sync.patch
@@ -0,0 +1,77 @@
+From e703ce47691b967fe9b4057fb1d062273211afa9 Mon Sep 17 00:00:00 2001
+From: Carlos Song <carlos.song@nxp.com>
+Date: Mon, 25 May 2026 14:23:56 +0800
+Subject: spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
+
+From: Carlos Song <carlos.song@nxp.com>
+
+commit e703ce47691b967fe9b4057fb1d062273211afa9 upstream.
+
+dmaengine_terminate_all() has been deprecated, so replace it with
+dmaengine_terminate_sync().
+
+Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Link: https://patch.msgid.link/20260525062357.3191349-2-carlos.song@oss.nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-fsl-lpspi.c |   18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -577,7 +577,7 @@ static int fsl_lpspi_dma_transfer(struct
+                               tx->sgl, tx->nents, DMA_MEM_TO_DEV,
+                               DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+       if (!desc_tx) {
+-              dmaengine_terminate_all(controller->dma_tx);
++              dmaengine_terminate_sync(controller->dma_tx);
+               return -EINVAL;
+       }
+ 
+@@ -598,8 +598,8 @@ static int fsl_lpspi_dma_transfer(struct
+                                                     transfer_timeout);
+               if (!timeout) {
+                       dev_err(fsl_lpspi->dev, "I/O Error in DMA TX\n");
+-                      dmaengine_terminate_all(controller->dma_tx);
+-                      dmaengine_terminate_all(controller->dma_rx);
++                      dmaengine_terminate_sync(controller->dma_tx);
++                      dmaengine_terminate_sync(controller->dma_rx);
+                       fsl_lpspi_reset(fsl_lpspi);
+                       return -ETIMEDOUT;
+               }
+@@ -608,8 +608,8 @@ static int fsl_lpspi_dma_transfer(struct
+                                                     transfer_timeout);
+               if (!timeout) {
+                       dev_err(fsl_lpspi->dev, "I/O Error in DMA RX\n");
+-                      dmaengine_terminate_all(controller->dma_tx);
+-                      dmaengine_terminate_all(controller->dma_rx);
++                      dmaengine_terminate_sync(controller->dma_tx);
++                      dmaengine_terminate_sync(controller->dma_rx);
+                       fsl_lpspi_reset(fsl_lpspi);
+                       return -ETIMEDOUT;
+               }
+@@ -618,8 +618,8 @@ static int fsl_lpspi_dma_transfer(struct
+                       fsl_lpspi->slave_aborted) {
+                       dev_dbg(fsl_lpspi->dev,
+                               "I/O Error in DMA TX interrupted\n");
+-                      dmaengine_terminate_all(controller->dma_tx);
+-                      dmaengine_terminate_all(controller->dma_rx);
++                      dmaengine_terminate_sync(controller->dma_tx);
++                      dmaengine_terminate_sync(controller->dma_rx);
+                       fsl_lpspi_reset(fsl_lpspi);
+                       return -EINTR;
+               }
+@@ -628,8 +628,8 @@ static int fsl_lpspi_dma_transfer(struct
+                       fsl_lpspi->slave_aborted) {
+                       dev_dbg(fsl_lpspi->dev,
+                               "I/O Error in DMA RX interrupted\n");
+-                      dmaengine_terminate_all(controller->dma_tx);
+-                      dmaengine_terminate_all(controller->dma_rx);
++                      dmaengine_terminate_sync(controller->dma_tx);
++                      dmaengine_terminate_sync(controller->dma_rx);
+                       fsl_lpspi_reset(fsl_lpspi);
+                       return -EINTR;
+               }

diff --git a/queue-5.10/spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch b/queue-5.10/spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch
new file mode 100644 (file)
index 0000000..0e90b90
--- /dev/null
+++ b/queue-5.10/spi-fsl-lpspi-terminate-the-rx-channel-on-tx-prepare-failure-path.patch
@@ -0,0 +1,39 @@
+From 01980b5da56e573d62798d0ff6c86bcaa2b22cbe Mon Sep 17 00:00:00 2001
+From: Carlos Song <carlos.song@nxp.com>
+Date: Mon, 25 May 2026 14:23:57 +0800
+Subject: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
+
+From: Carlos Song <carlos.song@nxp.com>
+
+commit 01980b5da56e573d62798d0ff6c86bcaa2b22cbe upstream.
+
+When dmaengine_prep_slave_sg() fails for the TX channel, the error path
+terminates the TX DMA channel but leaves the RX channel running. Since
+the RX channel was already submitted and issued prior to preparing
+the TX descriptor, returning -EINVAL causes the SPI core to unmap the
+DMA buffers while the RX DMA engine continues writing to them, leading
+to potential memory corruption or use-after-free.
+
+Terminate the RX channel before returning on the TX prepare failure path.
+
+Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Link: https://patch.msgid.link/20260525062357.3191349-3-carlos.song@oss.nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-fsl-lpspi.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -577,7 +577,7 @@ static int fsl_lpspi_dma_transfer(struct
+                               tx->sgl, tx->nents, DMA_MEM_TO_DEV,
+                               DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+       if (!desc_tx) {
+-              dmaengine_terminate_sync(controller->dma_tx);
++              dmaengine_terminate_sync(controller->dma_rx);
+               return -EINVAL;
+       }
+