--- /dev/null
+From f13a1a90f5db4ee9ca9911d4aa1caac3363c294e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 12:28:41 -0500
+Subject: dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit a22fe1d6dec7e98535b97249fdc95c2be79120bb ]
+
+is_slave_direction() should return true when direction is DMA_DEV_TO_DEV.
+
+Fixes: 49920bc66984 ("dmaengine: add new enum dma_transfer_direction")
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20240123172842.3764529-1-Frank.Li@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dmaengine.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index 8013562751a5..aa8bdc7473ff 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -815,7 +815,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan,
+
+ static inline bool is_slave_direction(enum dma_transfer_direction direction)
+ {
+- return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM);
++ return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) ||
++ (direction == DMA_DEV_TO_DEV);
+ }
+
+ static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single(
+--
+2.43.0
+
--- /dev/null
+From 41adf577050c0f6c7e461efdd418a88c98173f7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 11:02:03 +0100
+Subject: dmaengine: fsl-qdma: Fix a memory leak related to the status queue
+ DMA
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 968bc1d7203d384e72afe34124a1801b7af76514 ]
+
+This dma_alloc_coherent() is undone in the remove function, but not in the
+error handling path of fsl_qdma_probe().
+
+Switch to the managed version to fix the issue in the probe and simplify
+the remove function.
+
+Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/a0ef5d0f5a47381617ef339df776ddc68ce48173.1704621515.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsl-qdma.c | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c
+index f5a1ae164193..e3d07013ae8d 100644
+--- a/drivers/dma/fsl-qdma.c
++++ b/drivers/dma/fsl-qdma.c
+@@ -551,11 +551,11 @@ static struct fsl_qdma_queue
+ /*
+ * Buffer for queue command
+ */
+- status_head->cq = dma_alloc_coherent(&pdev->dev,
+- sizeof(struct fsl_qdma_format) *
+- status_size,
+- &status_head->bus_addr,
+- GFP_KERNEL);
++ status_head->cq = dmam_alloc_coherent(&pdev->dev,
++ sizeof(struct fsl_qdma_format) *
++ status_size,
++ &status_head->bus_addr,
++ GFP_KERNEL);
+ if (!status_head->cq) {
+ devm_kfree(&pdev->dev, status_head);
+ return NULL;
+@@ -1221,8 +1221,6 @@ static void fsl_qdma_cleanup_vchan(struct dma_device *dmadev)
+
+ static int fsl_qdma_remove(struct platform_device *pdev)
+ {
+- int i;
+- struct fsl_qdma_queue *status;
+ struct device_node *np = pdev->dev.of_node;
+ struct fsl_qdma_engine *fsl_qdma = platform_get_drvdata(pdev);
+
+@@ -1231,11 +1229,6 @@ static int fsl_qdma_remove(struct platform_device *pdev)
+ of_dma_controller_free(np);
+ dma_async_device_unregister(&fsl_qdma->dma_dev);
+
+- for (i = 0; i < fsl_qdma->block_number; i++) {
+- status = fsl_qdma->status[i];
+- dma_free_coherent(&pdev->dev, sizeof(struct fsl_qdma_format) *
+- status->n_cq, status->cq, status->bus_addr);
+- }
+ return 0;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 3c2f3bc888923443a146d8cb976636fbb34abad4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 11:02:04 +0100
+Subject: dmaengine: fsl-qdma: Fix a memory leak related to the queue command
+ DMA
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3aa58cb51318e329d203857f7a191678e60bb714 ]
+
+This dma_alloc_coherent() is undone neither in the remove function, nor in
+the error handling path of fsl_qdma_probe().
+
+Switch to the managed version to fix both issues.
+
+Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/7f66aa14f59d32b13672dde28602b47deb294e1f.1704621515.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsl-qdma.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c
+index e3d07013ae8d..ad5818c0ce22 100644
+--- a/drivers/dma/fsl-qdma.c
++++ b/drivers/dma/fsl-qdma.c
+@@ -502,11 +502,11 @@ static struct fsl_qdma_queue
+ queue_temp = queue_head + i + (j * queue_num);
+
+ queue_temp->cq =
+- dma_alloc_coherent(&pdev->dev,
+- sizeof(struct fsl_qdma_format) *
+- queue_size[i],
+- &queue_temp->bus_addr,
+- GFP_KERNEL);
++ dmam_alloc_coherent(&pdev->dev,
++ sizeof(struct fsl_qdma_format) *
++ queue_size[i],
++ &queue_temp->bus_addr,
++ GFP_KERNEL);
+ if (!queue_temp->cq)
+ return NULL;
+ queue_temp->block_base = fsl_qdma->block_base +
+--
+2.43.0
+
--- /dev/null
+From 9d0d76ba5f8eb484a440b2d4e449710789283207 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 18:37:03 +0900
+Subject: phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 249abaf3bf0dd07f5ddebbb2fe2e8f4d675f074e ]
+
+Even if device_create_file() returns error code,
+rcar_gen3_phy_usb2_probe() will return zero because the "ret" is
+variable shadowing.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/r/202312161021.gOLDl48K-lkp@intel.com/
+Fixes: 441a681b8843 ("phy: rcar-gen3-usb2: fix implementation for runtime PM")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20240105093703.3359949-1-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index cfb98bba7715..ddc41db1f65a 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -631,8 +631,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
+ channel->irq = platform_get_irq_optional(pdev, 0);
+ channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node);
+ if (channel->dr_mode != USB_DR_MODE_UNKNOWN) {
+- int ret;
+-
+ channel->is_otg_channel = true;
+ channel->uses_otg_pins = !of_property_read_bool(dev->of_node,
+ "renesas,no-otg-pins");
+@@ -691,8 +689,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
+ ret = PTR_ERR(provider);
+ goto error;
+ } else if (channel->is_otg_channel) {
+- int ret;
+-
+ ret = device_create_file(dev, &dev_attr_role);
+ if (ret < 0)
+ goto error;
+--
+2.43.0
+
--- /dev/null
+From d044386af4051d630ba2f8a55516e591bea011e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 14:05:54 +0200
+Subject: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ]
+
+If the external phy working together with phy-omap-usb2 does not implement
+send_srp(), we may still attempt to call it. This can happen on an idle
+Ethernet gadget triggering a wakeup for example:
+
+configfs-gadget.g1 gadget.0: ECM Suspend
+configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup
+...
+Unable to handle kernel NULL pointer dereference at virtual address
+00000000 when execute
+...
+PC is at 0x0
+LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc]
+...
+musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core]
+usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether]
+eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c
+dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4
+sch_direct_xmit from __dev_queue_xmit+0x334/0xd88
+__dev_queue_xmit from arp_solicit+0xf0/0x268
+arp_solicit from neigh_probe+0x54/0x7c
+neigh_probe from __neigh_event_send+0x22c/0x47c
+__neigh_event_send from neigh_resolve_output+0x14c/0x1c0
+neigh_resolve_output from ip_finish_output2+0x1c8/0x628
+ip_finish_output2 from ip_send_skb+0x40/0xd8
+ip_send_skb from udp_send_skb+0x124/0x340
+udp_send_skb from udp_sendmsg+0x780/0x984
+udp_sendmsg from __sys_sendto+0xd8/0x158
+__sys_sendto from ret_fast_syscall+0x0/0x58
+
+Let's fix the issue by checking for send_srp() and set_vbus() before
+calling them. For USB peripheral only cases these both could be NULL.
+
+Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-omap-usb2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c
+index 471fe2e80f4e..fc2fee6d532d 100644
+--- a/drivers/phy/ti/phy-omap-usb2.c
++++ b/drivers/phy/ti/phy-omap-usb2.c
+@@ -58,7 +58,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled)
+ {
+ struct omap_usb *phy = phy_to_omapusb(otg->usb_phy);
+
+- if (!phy->comparator)
++ if (!phy->comparator || !phy->comparator->set_vbus)
+ return -ENODEV;
+
+ return phy->comparator->set_vbus(phy->comparator, enabled);
+@@ -68,7 +68,7 @@ static int omap_usb_start_srp(struct usb_otg *otg)
+ {
+ struct omap_usb *phy = phy_to_omapusb(otg->usb_phy);
+
+- if (!phy->comparator)
++ if (!phy->comparator || !phy->comparator->start_srp)
+ return -ENODEV;
+
+ return phy->comparator->start_srp(phy->comparator);
+--
+2.43.0
+
hid-apple-swap-the-fn-and-left-control-keys-on-apple-keyboards.patch
hid-apple-add-2021-magic-keyboard-fn-key-mapping.patch
bonding-remove-print-in-bond_verify_device_path.patch
+dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch
+dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-2747
+phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch
+dmaengine-fix-is_slave_direction-return-false-when-d.patch
+phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
