]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 6.10
authorSasha Levin <sashal@kernel.org>
Sat, 5 Oct 2024 18:29:10 +0000 (14:29 -0400)
committerSasha Levin <sashal@kernel.org>
Sat, 5 Oct 2024 18:29:10 +0000 (14:29 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
22 files changed:
queue-6.10/alsa-gus-fix-some-error-handling-paths-related-to-ge.patch [new file with mode: 0644]
queue-6.10/alsa-hda-conexant-fix-conflicting-quirk-for-system76.patch [new file with mode: 0644]
queue-6.10/alsa-hda-generic-unconditionally-prefer-preferred_da.patch [new file with mode: 0644]
queue-6.10/alsa-hda-realtek-fix-the-push-button-function-for-th.patch [new file with mode: 0644]
queue-6.10/alsa-mixer_oss-remove-some-incorrect-kfree_const-usa.patch [new file with mode: 0644]
queue-6.10/asoc-atmel-mchp-pdmc-skip-alsa-restoration-if-substr.patch [new file with mode: 0644]
queue-6.10/asoc-imx-card-set-card.owner-to-avoid-a-warning-call.patch [new file with mode: 0644]
queue-6.10/cifs-do-not-convert-delimiter-when-parsing-nfs-style.patch [new file with mode: 0644]
queue-6.10/cifs-fix-buffer-overflow-when-parsing-nfs-reparse-po.patch [new file with mode: 0644]
queue-6.10/cifs-remove-intermediate-object-of-failed-create-rep.patch [new file with mode: 0644]
queue-6.10/drm-panthor-fix-race-when-converting-group-handle-to.patch [new file with mode: 0644]
queue-6.10/drm-panthor-lock-the-vm-resv-before-calling-drm_gpuv.patch [new file with mode: 0644]
queue-6.10/drm-xe-prevent-null-pointer-access-in-xe_migrate_cop.patch [new file with mode: 0644]
queue-6.10/drm-xe-restore-pci-state-upon-resume.patch [new file with mode: 0644]
queue-6.10/drm-xe-resume-tdr-after-gt-reset.patch [new file with mode: 0644]
queue-6.10/i2c-xiic-improve-error-message-when-transfer-fails-t.patch [new file with mode: 0644]
queue-6.10/i2c-xiic-try-re-initialization-on-bus-busy-timeout.patch [new file with mode: 0644]
queue-6.10/io_uring-fix-memory-leak-when-cache-init-fail.patch [new file with mode: 0644]
queue-6.10/loop-don-t-set-queue_flag_nomerges.patch [new file with mode: 0644]
queue-6.10/selftest-mm-mseal-fix-test_seal_mremap_move_dontunma.patch [new file with mode: 0644]
queue-6.10/series
queue-6.10/tools-rtla-fix-installation-from-out-of-tree-build.patch [new file with mode: 0644]

diff --git a/queue-6.10/alsa-gus-fix-some-error-handling-paths-related-to-ge.patch b/queue-6.10/alsa-gus-fix-some-error-handling-paths-related-to-ge.patch
new file mode 100644 (file)
index 0000000..f7fe8a8
--- /dev/null
@@ -0,0 +1,46 @@
+From 4458dd1226eabe72289611e8b4bc9583bcc6dc5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2024 21:34:01 +0200
+Subject: ALSA: gus: Fix some error handling paths related to get_bpos() usage
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 9df39a872c462ea07a3767ebd0093c42b2ff78a2 ]
+
+If get_bpos() fails, it is likely that the corresponding error code should
+be returned.
+
+Fixes: a6970bb1dd99 ("ALSA: gus: Convert to the new PCM ops")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://patch.msgid.link/d9ca841edad697154afa97c73a5d7a14919330d9.1727984008.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/isa/gus/gus_pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/isa/gus/gus_pcm.c b/sound/isa/gus/gus_pcm.c
+index 850544725da79..d55c3dc229c0e 100644
+--- a/sound/isa/gus/gus_pcm.c
++++ b/sound/isa/gus/gus_pcm.c
+@@ -378,7 +378,7 @@ static int snd_gf1_pcm_playback_copy(struct snd_pcm_substream *substream,
+       bpos = get_bpos(pcmp, voice, pos, len);
+       if (bpos < 0)
+-              return pos;
++              return bpos;
+       if (copy_from_iter(runtime->dma_area + bpos, len, src) != len)
+               return -EFAULT;
+       return playback_copy_ack(substream, bpos, len);
+@@ -395,7 +395,7 @@ static int snd_gf1_pcm_playback_silence(struct snd_pcm_substream *substream,
+       
+       bpos = get_bpos(pcmp, voice, pos, len);
+       if (bpos < 0)
+-              return pos;
++              return bpos;
+       snd_pcm_format_set_silence(runtime->format, runtime->dma_area + bpos,
+                                  bytes_to_samples(runtime, count));
+       return playback_copy_ack(substream, bpos, len);
+-- 
+2.43.0
+
diff --git a/queue-6.10/alsa-hda-conexant-fix-conflicting-quirk-for-system76.patch b/queue-6.10/alsa-hda-conexant-fix-conflicting-quirk-for-system76.patch
new file mode 100644 (file)
index 0000000..42df7a3
--- /dev/null
@@ -0,0 +1,72 @@
+From 3efd86eabda5b3d614c903b65493aae677f3e280 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 10:25:58 +0200
+Subject: ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b3ebb007060f89d5a45c9b99f06a55e36a1945b5 ]
+
+We received a regression report for System76 Pangolin (pang14) due to
+the recent fix for Tuxedo Sirius devices to support the top speaker.
+The reason was the conflicting PCI SSID, as often seen.
+
+As a workaround, now the codec SSID is checked and the quirk is
+applied conditionally only to Sirius devices.
+
+Fixes: 4178d78cd7a8 ("ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices")
+Reported-by: Christian Heusel <christian@heusel.eu>
+Reported-by: Jerry <jerryluo225@gmail.com>
+Closes: https://lore.kernel.org/c930b6a6-64e5-498f-b65a-1cd5e0a1d733@heusel.eu
+Link: https://patch.msgid.link/20241004082602.29016-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index e851785ff0581..4a2c8274c3df7 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -816,6 +816,23 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = {
+       {}
+ };
++/* pincfg quirk for Tuxedo Sirius;
++ * unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14,
++ * which has incompatible pin setup, so we check the codec SSID (luckily
++ * different one!) and conditionally apply the quirk here
++ */
++static void cxt_fixup_sirius_top_speaker(struct hda_codec *codec,
++                                       const struct hda_fixup *fix,
++                                       int action)
++{
++      /* ignore for incorrectly picked-up pang14 */
++      if (codec->core.subsystem_id == 0x278212b3)
++              return;
++      /* set up the top speaker pin */
++      if (action == HDA_FIXUP_ACT_PRE_PROBE)
++              snd_hda_codec_set_pincfg(codec, 0x1d, 0x82170111);
++}
++
+ static const struct hda_fixup cxt_fixups[] = {
+       [CXT_PINCFG_LENOVO_X200] = {
+               .type = HDA_FIXUP_PINS,
+@@ -976,11 +993,8 @@ static const struct hda_fixup cxt_fixups[] = {
+               .v.pins = cxt_pincfg_sws_js201d,
+       },
+       [CXT_PINCFG_TOP_SPEAKER] = {
+-              .type = HDA_FIXUP_PINS,
+-              .v.pins = (const struct hda_pintbl[]) {
+-                      { 0x1d, 0x82170111 },
+-                      { }
+-              },
++              .type = HDA_FIXUP_FUNC,
++              .v.func = cxt_fixup_sirius_top_speaker,
+       },
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.10/alsa-hda-generic-unconditionally-prefer-preferred_da.patch b/queue-6.10/alsa-hda-generic-unconditionally-prefer-preferred_da.patch
new file mode 100644 (file)
index 0000000..d720564
--- /dev/null
@@ -0,0 +1,60 @@
+From 63de7608e2ad7f826fe3f3f7c4e20622e40fe155 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 14:14:36 +0200
+Subject: ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1c801e7f77445bc56e5e1fec6191fd4503534787 ]
+
+Some time ago, we introduced the obey_preferred_dacs flag for choosing
+the DAC/pin pairs specified by the driver instead of parsing the
+paths.  This works as expected, per se, but there have been a few
+cases where we forgot to set this flag while preferred_dacs table is
+already set up.  It ended up with incorrect wiring and made us
+wondering why it doesn't work.
+
+Basically, when the preferred_dacs table is provided, it means that
+the driver really wants to wire up to follow that.  That is, the
+presence of the preferred_dacs table itself is already a "do-it"
+flag.
+
+In this patch, we simply replace the evaluation of obey_preferred_dacs
+flag with the presence of preferred_dacs table for fixing the
+misbehavior.  Another patch to drop of the obsoleted flag will
+follow.
+
+Fixes: 242d990c158d ("ALSA: hda/generic: Add option to enforce preferred_dacs pairs")
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1219803
+Link: https://patch.msgid.link/20241001121439.26060-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_generic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 9cff87dfbecbb..b34d84fedcc8a 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -1383,7 +1383,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
+               struct nid_path *path;
+               hda_nid_t pin = pins[i];
+-              if (!spec->obey_preferred_dacs) {
++              if (!spec->preferred_dacs) {
+                       path = snd_hda_get_path_from_idx(codec, path_idx[i]);
+                       if (path) {
+                               badness += assign_out_path_ctls(codec, path);
+@@ -1395,7 +1395,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
+               if (dacs[i]) {
+                       if (is_dac_already_used(codec, dacs[i]))
+                               badness += bad->shared_primary;
+-              } else if (spec->obey_preferred_dacs) {
++              } else if (spec->preferred_dacs) {
+                       badness += BAD_NO_PRIMARY_DAC;
+               }
+-- 
+2.43.0
+
diff --git a/queue-6.10/alsa-hda-realtek-fix-the-push-button-function-for-th.patch b/queue-6.10/alsa-hda-realtek-fix-the-push-button-function-for-th.patch
new file mode 100644 (file)
index 0000000..e2bc130
--- /dev/null
@@ -0,0 +1,36 @@
+From 2151d9d4e694a6de4b29628752a804a3ab63e8ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 18:50:39 +0800
+Subject: ALSA: hda/realtek: Fix the push button function for the ALC257
+
+From: Oder Chiou <oder_chiou@realtek.com>
+
+[ Upstream commit 05df9732a0894846c46d0062d4af535c5002799d ]
+
+The headset push button cannot work properly in case of the ALC257.
+This patch reverted the previous commit to correct the side effect.
+
+Fixes: ef9718b3d54e ("ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7")
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Link: https://patch.msgid.link/20240930105039.3473266-1-oder_chiou@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2b674691ce4b6..64efa6123d839 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -583,6 +583,7 @@ static void alc_shutup_pins(struct hda_codec *codec)
+       switch (codec->core.vendor_id) {
+       case 0x10ec0236:
+       case 0x10ec0256:
++      case 0x10ec0257:
+       case 0x19e58326:
+       case 0x10ec0283:
+       case 0x10ec0285:
+-- 
+2.43.0
+
diff --git a/queue-6.10/alsa-mixer_oss-remove-some-incorrect-kfree_const-usa.patch b/queue-6.10/alsa-mixer_oss-remove-some-incorrect-kfree_const-usa.patch
new file mode 100644 (file)
index 0000000..0a99a04
--- /dev/null
@@ -0,0 +1,44 @@
+From 9cdae9c3c990bdaa4df56f51a23360c20e60be49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 20:17:36 +0200
+Subject: ALSA: mixer_oss: Remove some incorrect kfree_const() usages
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 368e4663c557de4a33f321b44e7eeec0a21b2e4e ]
+
+"assigned" and "assigned->name" are allocated in snd_mixer_oss_proc_write()
+using kmalloc() and kstrdup(), so there is no point in using kfree_const()
+to free these resources.
+
+Switch to the more standard kfree() to free these resources.
+
+This could avoid a memory leak.
+
+Fixes: 454f5ec1d2b7 ("ALSA: mixer: oss: Constify snd_mixer_oss_assign_table definition")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://patch.msgid.link/63ac20f64234b7c9ea87a7fa9baf41e8255852f7.1727374631.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/mixer_oss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
+index 6a0508093ea68..81af725ea40e5 100644
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -901,8 +901,8 @@ static void snd_mixer_oss_slot_free(struct snd_mixer_oss_slot *chn)
+       struct slot *p = chn->private_data;
+       if (p) {
+               if (p->allocated && p->assigned) {
+-                      kfree_const(p->assigned->name);
+-                      kfree_const(p->assigned);
++                      kfree(p->assigned->name);
++                      kfree(p->assigned);
+               }
+               kfree(p);
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.10/asoc-atmel-mchp-pdmc-skip-alsa-restoration-if-substr.patch b/queue-6.10/asoc-atmel-mchp-pdmc-skip-alsa-restoration-if-substr.patch
new file mode 100644 (file)
index 0000000..aebff0e
--- /dev/null
@@ -0,0 +1,41 @@
+From 8e6d342f0bd20ac97c261f335e0c6b8642c75eca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2024 11:12:38 +0300
+Subject: ASoC: atmel: mchp-pdmc: Skip ALSA restoration if substream runtime is
+ uninitialized
+
+From: Andrei Simion <andrei.simion@microchip.com>
+
+[ Upstream commit 09cfc6a532d249a51d3af5022d37ebbe9c3d31f6 ]
+
+Update the driver to prevent alsa-restore.service from failing when
+reading data from /var/lib/alsa/asound.state at boot. Ensure that the
+restoration of ALSA mixer configurations is skipped if substream->runtime
+is NULL.
+
+Fixes: 50291652af52 ("ASoC: atmel: mchp-pdmc: add PDMC driver")
+Signed-off-by: Andrei Simion <andrei.simion@microchip.com>
+Link: https://patch.msgid.link/20240924081237.50046-1-andrei.simion@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mchp-pdmc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/atmel/mchp-pdmc.c b/sound/soc/atmel/mchp-pdmc.c
+index dcc4e14b3dde2..206bbb5aaab5d 100644
+--- a/sound/soc/atmel/mchp-pdmc.c
++++ b/sound/soc/atmel/mchp-pdmc.c
+@@ -285,6 +285,9 @@ static int mchp_pdmc_chmap_ctl_put(struct snd_kcontrol *kcontrol,
+       if (!substream)
+               return -ENODEV;
++      if (!substream->runtime)
++              return 0; /* just for avoiding error from alsactl restore */
++
+       map = mchp_pdmc_chmap_get(substream, info);
+       if (!map)
+               return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.10/asoc-imx-card-set-card.owner-to-avoid-a-warning-call.patch b/queue-6.10/asoc-imx-card-set-card.owner-to-avoid-a-warning-call.patch
new file mode 100644 (file)
index 0000000..11c082a
--- /dev/null
@@ -0,0 +1,46 @@
+From 5586650c2d3b7e92213b95bab8c6941a9a396987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 10:56:59 +0800
+Subject: ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit 47d7d3fd72afc7dcd548806291793ee6f3848215 ]
+
+In most Linux distribution kernels, the SND is set to m, in such a
+case, when booting the kernel on i.MX8MP EVK board, there is a
+warning calltrace like below:
+ Call trace:
+ snd_card_init+0x484/0x4cc [snd]
+ snd_card_new+0x70/0xa8 [snd]
+ snd_soc_bind_card+0x310/0xbd0 [snd_soc_core]
+ snd_soc_register_card+0xf0/0x108 [snd_soc_core]
+ devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core]
+
+That is because the card.owner is not set, a warning calltrace is
+raised in the snd_card_init() due to it.
+
+Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver")
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://patch.msgid.link/20241002025659.723544-1-hui.wang@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-card.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/imx-card.c b/sound/soc/fsl/imx-card.c
+index 0e18ccabe28c3..ce0d8cec375a8 100644
+--- a/sound/soc/fsl/imx-card.c
++++ b/sound/soc/fsl/imx-card.c
+@@ -713,6 +713,7 @@ static int imx_card_probe(struct platform_device *pdev)
+       data->plat_data = plat_data;
+       data->card.dev = &pdev->dev;
++      data->card.owner = THIS_MODULE;
+       dev_set_drvdata(&pdev->dev, &data->card);
+       snd_soc_card_set_drvdata(&data->card, data);
+-- 
+2.43.0
+
diff --git a/queue-6.10/cifs-do-not-convert-delimiter-when-parsing-nfs-style.patch b/queue-6.10/cifs-do-not-convert-delimiter-when-parsing-nfs-style.patch
new file mode 100644 (file)
index 0000000..749a4cf
--- /dev/null
@@ -0,0 +1,48 @@
+From bd64f297c3907dc41b69f606f7ed62d1a51eec16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Sep 2024 23:59:46 +0200
+Subject: cifs: Do not convert delimiter when parsing NFS-style symlinks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit d3a49f60917323228f8fdeee313260ef14f94df7 ]
+
+NFS-style symlinks have target location always stored in NFS/UNIX form
+where backslash means the real UNIX backslash and not the SMB path
+separator.
+
+So do not mangle slash and backslash content of NFS-style symlink during
+readlink() syscall as it is already in the correct Linux form.
+
+This fixes interoperability of NFS-style symlinks with backslashes created
+by Linux NFS3 client throw Windows NFS server and retrieved by Linux SMB
+client throw Windows SMB server, where both Windows servers exports the
+same directory.
+
+Fixes: d5ecebc4900d ("smb3: Allow query of symlinks stored as reparse points")
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/reparse.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c
+index cfa03c166de8c..ad0e0de9a165d 100644
+--- a/fs/smb/client/reparse.c
++++ b/fs/smb/client/reparse.c
+@@ -335,7 +335,6 @@ static int parse_reparse_posix(struct reparse_posix_data *buf,
+                                                              cifs_sb->local_nls);
+               if (!data->symlink_target)
+                       return -ENOMEM;
+-              convert_delimiter(data->symlink_target, '/');
+               cifs_dbg(FYI, "%s: target path: %s\n",
+                        __func__, data->symlink_target);
+               break;
+-- 
+2.43.0
+
diff --git a/queue-6.10/cifs-fix-buffer-overflow-when-parsing-nfs-reparse-po.patch b/queue-6.10/cifs-fix-buffer-overflow-when-parsing-nfs-reparse-po.patch
new file mode 100644 (file)
index 0000000..4ebdafe
--- /dev/null
@@ -0,0 +1,81 @@
+From 905388dfec62bd6a84d259cd9fbadce7aa83c44c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2024 12:22:40 +0200
+Subject: cifs: Fix buffer overflow when parsing NFS reparse points
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit e2a8910af01653c1c268984855629d71fb81f404 ]
+
+ReparseDataLength is sum of the InodeType size and DataBuffer size.
+So to get DataBuffer size it is needed to subtract InodeType's size from
+ReparseDataLength.
+
+Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer
+at position after the end of the buffer because it does not subtract
+InodeType size from the length. Fix this problem and correctly subtract
+variable len.
+
+Member InodeType is present only when reparse buffer is large enough. Check
+for ReparseDataLength before accessing InodeType to prevent another invalid
+memory access.
+
+Major and minor rdev values are present also only when reparse buffer is
+large enough. Check for reparse buffer size before calling reparse_mkdev().
+
+Fixes: d5ecebc4900d ("smb3: Allow query of symlinks stored as reparse points")
+Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/reparse.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/reparse.c b/fs/smb/client/reparse.c
+index 48c27581ec511..cfa03c166de8c 100644
+--- a/fs/smb/client/reparse.c
++++ b/fs/smb/client/reparse.c
+@@ -320,9 +320,16 @@ static int parse_reparse_posix(struct reparse_posix_data *buf,
+       unsigned int len;
+       u64 type;
++      len = le16_to_cpu(buf->ReparseDataLength);
++      if (len < sizeof(buf->InodeType)) {
++              cifs_dbg(VFS, "srv returned malformed nfs buffer\n");
++              return -EIO;
++      }
++
++      len -= sizeof(buf->InodeType);
++
+       switch ((type = le64_to_cpu(buf->InodeType))) {
+       case NFS_SPECFILE_LNK:
+-              len = le16_to_cpu(buf->ReparseDataLength);
+               data->symlink_target = cifs_strndup_from_utf16(buf->DataBuffer,
+                                                              len, true,
+                                                              cifs_sb->local_nls);
+@@ -482,12 +489,18 @@ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
+       u32 tag = data->reparse.tag;
+       if (tag == IO_REPARSE_TAG_NFS && buf) {
++              if (le16_to_cpu(buf->ReparseDataLength) < sizeof(buf->InodeType))
++                      return false;
+               switch (le64_to_cpu(buf->InodeType)) {
+               case NFS_SPECFILE_CHR:
++                      if (le16_to_cpu(buf->ReparseDataLength) != sizeof(buf->InodeType) + 8)
++                              return false;
+                       fattr->cf_mode |= S_IFCHR;
+                       fattr->cf_rdev = reparse_nfs_mkdev(buf);
+                       break;
+               case NFS_SPECFILE_BLK:
++                      if (le16_to_cpu(buf->ReparseDataLength) != sizeof(buf->InodeType) + 8)
++                              return false;
+                       fattr->cf_mode |= S_IFBLK;
+                       fattr->cf_rdev = reparse_nfs_mkdev(buf);
+                       break;
+-- 
+2.43.0
+
diff --git a/queue-6.10/cifs-remove-intermediate-object-of-failed-create-rep.patch b/queue-6.10/cifs-remove-intermediate-object-of-failed-create-rep.patch
new file mode 100644 (file)
index 0000000..39e0735
--- /dev/null
@@ -0,0 +1,89 @@
+From f0f3217fc11b99b6b3eb0a29a7ca301255451c78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 22:25:10 +0200
+Subject: cifs: Remove intermediate object of failed create reparse call
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit c9432ad5e32f066875b1bf95939c363bc46d6a45 ]
+
+If CREATE was successful but SMB2_OP_SET_REPARSE failed then remove the
+intermediate object created by CREATE. Otherwise empty object stay on the
+server when reparse call failed.
+
+This ensures that if the creating of special files is unsupported by the
+server then no empty file stay on the server as a result of unsupported
+operation.
+
+Fixes: 102466f303ff ("smb: client: allow creating special files via reparse points")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2inode.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
+index 11a1c53c64e0b..a6dab60e2c01e 100644
+--- a/fs/smb/client/smb2inode.c
++++ b/fs/smb/client/smb2inode.c
+@@ -1205,9 +1205,12 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,
+       struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+       struct cifsFileInfo *cfile;
+       struct inode *new = NULL;
++      int out_buftype[4] = {};
++      struct kvec out_iov[4] = {};
+       struct kvec in_iov[2];
+       int cmds[2];
+       int rc;
++      int i;
+       oparms = CIFS_OPARMS(cifs_sb, tcon, full_path,
+                            SYNCHRONIZE | DELETE |
+@@ -1228,7 +1231,7 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,
+               cmds[1] = SMB2_OP_POSIX_QUERY_INFO;
+               cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
+               rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms,
+-                                    in_iov, cmds, 2, cfile, NULL, NULL, NULL);
++                                    in_iov, cmds, 2, cfile, out_iov, out_buftype, NULL);
+               if (!rc) {
+                       rc = smb311_posix_get_inode_info(&new, full_path,
+                                                        data, sb, xid);
+@@ -1237,12 +1240,29 @@ struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,
+               cmds[1] = SMB2_OP_QUERY_INFO;
+               cifs_get_writable_path(tcon, full_path, FIND_WR_ANY, &cfile);
+               rc = smb2_compound_op(xid, tcon, cifs_sb, full_path, &oparms,
+-                                    in_iov, cmds, 2, cfile, NULL, NULL, NULL);
++                                    in_iov, cmds, 2, cfile, out_iov, out_buftype, NULL);
+               if (!rc) {
+                       rc = cifs_get_inode_info(&new, full_path,
+                                                data, sb, xid, NULL);
+               }
+       }
++
++
++      /*
++       * If CREATE was successful but SMB2_OP_SET_REPARSE failed then
++       * remove the intermediate object created by CREATE. Otherwise
++       * empty object stay on the server when reparse call failed.
++       */
++      if (rc &&
++          out_iov[0].iov_base != NULL && out_buftype[0] != CIFS_NO_BUFFER &&
++          ((struct smb2_hdr *)out_iov[0].iov_base)->Status == STATUS_SUCCESS &&
++          (out_iov[1].iov_base == NULL || out_buftype[1] == CIFS_NO_BUFFER ||
++           ((struct smb2_hdr *)out_iov[1].iov_base)->Status != STATUS_SUCCESS))
++              smb2_unlink(xid, tcon, full_path, cifs_sb, NULL);
++
++      for (i = 0; i < ARRAY_SIZE(out_buftype); i++)
++              free_rsp_buf(out_buftype[i], out_iov[i].iov_base);
++
+       return rc ? ERR_PTR(rc) : new;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.10/drm-panthor-fix-race-when-converting-group-handle-to.patch b/queue-6.10/drm-panthor-fix-race-when-converting-group-handle-to.patch
new file mode 100644 (file)
index 0000000..2404437
--- /dev/null
@@ -0,0 +1,72 @@
+From faef47aeb7dd73e1e0eb4ebbbf5442f697f4931d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 11:34:06 +0100
+Subject: drm/panthor: Fix race when converting group handle to group object
+
+From: Steven Price <steven.price@arm.com>
+
+[ Upstream commit cac075706f298948898b1f63e81709df42afa75d ]
+
+XArray provides it's own internal lock which protects the internal array
+when entries are being simultaneously added and removed. However there
+is still a race between retrieving the pointer from the XArray and
+incrementing the reference count.
+
+To avoid this race simply hold the internal XArray lock when
+incrementing the reference count, this ensures there cannot be a racing
+call to xa_erase().
+
+Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240923103406.2509906-1-steven.price@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_sched.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
+index 12b272a912f86..d21fe63ae2281 100644
+--- a/drivers/gpu/drm/panthor/panthor_sched.c
++++ b/drivers/gpu/drm/panthor/panthor_sched.c
+@@ -3242,6 +3242,18 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle)
+       return 0;
+ }
++static struct panthor_group *group_from_handle(struct panthor_group_pool *pool,
++                                             u32 group_handle)
++{
++      struct panthor_group *group;
++
++      xa_lock(&pool->xa);
++      group = group_get(xa_load(&pool->xa, group_handle));
++      xa_unlock(&pool->xa);
++
++      return group;
++}
++
+ int panthor_group_get_state(struct panthor_file *pfile,
+                           struct drm_panthor_group_get_state *get_state)
+ {
+@@ -3253,7 +3265,7 @@ int panthor_group_get_state(struct panthor_file *pfile,
+       if (get_state->pad)
+               return -EINVAL;
+-      group = group_get(xa_load(&gpool->xa, get_state->group_handle));
++      group = group_from_handle(gpool, get_state->group_handle);
+       if (!group)
+               return -EINVAL;
+@@ -3384,7 +3396,7 @@ panthor_job_create(struct panthor_file *pfile,
+       job->call_info.latest_flush = qsubmit->latest_flush;
+       INIT_LIST_HEAD(&job->node);
+-      job->group = group_get(xa_load(&gpool->xa, group_handle));
++      job->group = group_from_handle(gpool, group_handle);
+       if (!job->group) {
+               ret = -EINVAL;
+               goto err_put_job;
+-- 
+2.43.0
+
diff --git a/queue-6.10/drm-panthor-lock-the-vm-resv-before-calling-drm_gpuv.patch b/queue-6.10/drm-panthor-lock-the-vm-resv-before-calling-drm_gpuv.patch
new file mode 100644 (file)
index 0000000..a00257b
--- /dev/null
@@ -0,0 +1,51 @@
+From 85b9d92e651413c81d45ac0f02473e80f2085cbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Sep 2024 13:27:22 +0200
+Subject: drm/panthor: Lock the VM resv before calling
+ drm_gpuvm_bo_obtain_prealloc()
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+[ Upstream commit fa998a9eac8809da4f219aad49836fcad2a9bf5c ]
+
+drm_gpuvm_bo_obtain_prealloc() will call drm_gpuvm_bo_put() on our
+pre-allocated BO if the <BO,VM> association exists. Given we
+only have one ref on preallocated_vm_bo, drm_gpuvm_bo_destroy() will
+be called immediately, and we have to hold the VM resv lock when
+calling this function.
+
+Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block")
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240913112722.492144-1-boris.brezillon@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_mmu.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
+index cc6e13a977835..ce8e8a93d7076 100644
+--- a/drivers/gpu/drm/panthor/panthor_mmu.c
++++ b/drivers/gpu/drm/panthor/panthor_mmu.c
+@@ -1251,9 +1251,17 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
+               goto err_cleanup;
+       }
++      /* drm_gpuvm_bo_obtain_prealloc() will call drm_gpuvm_bo_put() on our
++       * pre-allocated BO if the <BO,VM> association exists. Given we
++       * only have one ref on preallocated_vm_bo, drm_gpuvm_bo_destroy() will
++       * be called immediately, and we have to hold the VM resv lock when
++       * calling this function.
++       */
++      dma_resv_lock(panthor_vm_resv(vm), NULL);
+       mutex_lock(&bo->gpuva_list_lock);
+       op_ctx->map.vm_bo = drm_gpuvm_bo_obtain_prealloc(preallocated_vm_bo);
+       mutex_unlock(&bo->gpuva_list_lock);
++      dma_resv_unlock(panthor_vm_resv(vm));
+       /* If the a vm_bo for this <VM,BO> combination exists, it already
+        * retains a pin ref, and we can release the one we took earlier.
+-- 
+2.43.0
+
diff --git a/queue-6.10/drm-xe-prevent-null-pointer-access-in-xe_migrate_cop.patch b/queue-6.10/drm-xe-prevent-null-pointer-access-in-xe_migrate_cop.patch
new file mode 100644 (file)
index 0000000..50d532d
--- /dev/null
@@ -0,0 +1,129 @@
+From cbeea3779cb42aab0862c9fd8444800eb9fd561f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2024 09:13:08 -0700
+Subject: drm/xe: Prevent null pointer access in xe_migrate_copy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhanjun Dong <zhanjun.dong@intel.com>
+
+[ Upstream commit 7257d9c9a3c6cfe26c428e9b7ae21d61f2f55a79 ]
+
+xe_migrate_copy designed to copy content of TTM resources. When source
+resource is null, it will trigger a NULL pointer dereference in
+xe_migrate_copy. To avoid this situation, update lacks source flag to
+true for this case, the flag will trigger xe_migrate_clear rather than
+xe_migrate_copy.
+
+Issue trace:
+<7> [317.089847] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 14,
+ sizes: 4194304 & 4194304
+<7> [317.089945] xe 0000:00:02.0: [drm:xe_migrate_copy [xe]] Pass 15,
+ sizes: 4194304 & 4194304
+<1> [317.128055] BUG: kernel NULL pointer dereference, address:
+ 0000000000000010
+<1> [317.128064] #PF: supervisor read access in kernel mode
+<1> [317.128066] #PF: error_code(0x0000) - not-present page
+<6> [317.128069] PGD 0 P4D 0
+<4> [317.128071] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
+<4> [317.128074] CPU: 1 UID: 0 PID: 1440 Comm: kunit_try_catch Tainted:
+ G     U           N 6.11.0-rc7-xe #1
+<4> [317.128078] Tainted: [U]=USER, [N]=TEST
+<4> [317.128080] Hardware name: Intel Corporation Lunar Lake Client
+ Platform/LNL-M LP5 RVP1, BIOS LNLMFWI1.R00.3221.D80.2407291239 07/29/2024
+<4> [317.128082] RIP: 0010:xe_migrate_copy+0x66/0x13e0 [xe]
+<4> [317.128158] Code: 00 00 48 89 8d e0 fe ff ff 48 8b 40 10 4c 89 85 c8
+ fe ff ff 44 88 8d bd fe ff ff 65 48 8b 3c 25 28 00 00 00 48 89 7d d0 31
+ ff <8b> 79 10 48 89 85 a0 fe ff ff 48 8b 00 48 89 b5 d8 fe ff ff 83 ff
+<4> [317.128162] RSP: 0018:ffffc9000167f9f0 EFLAGS: 00010246
+<4> [317.128164] RAX: ffff8881120d8028 RBX: ffff88814d070428 RCX:
+ 0000000000000000
+<4> [317.128166] RDX: ffff88813cb99c00 RSI: 0000000004000000 RDI:
+ 0000000000000000
+<4> [317.128168] RBP: ffffc9000167fbb8 R08: ffff88814e7b1f08 R09:
+ 0000000000000001
+<4> [317.128170] R10: 0000000000000001 R11: 0000000000000001 R12:
+ ffff88814e7b1f08
+<4> [317.128172] R13: ffff88814e7b1f08 R14: ffff88813cb99c00 R15:
+ 0000000000000001
+<4> [317.128174] FS:  0000000000000000(0000) GS:ffff88846f280000(0000)
+ knlGS:0000000000000000
+<4> [317.128176] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+<4> [317.128178] CR2: 0000000000000010 CR3: 000000011f676004 CR4:
+ 0000000000770ef0
+<4> [317.128180] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
+ 0000000000000000
+<4> [317.128182] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7:
+ 0000000000000400
+<4> [317.128184] PKRU: 55555554
+<4> [317.128185] Call Trace:
+<4> [317.128187]  <TASK>
+<4> [317.128189]  ? show_regs+0x67/0x70
+<4> [317.128194]  ? __die_body+0x20/0x70
+<4> [317.128196]  ? __die+0x2b/0x40
+<4> [317.128198]  ? page_fault_oops+0x15f/0x4e0
+<4> [317.128203]  ? do_user_addr_fault+0x3fb/0x970
+<4> [317.128205]  ? lock_acquire+0xc7/0x2e0
+<4> [317.128209]  ? exc_page_fault+0x87/0x2b0
+<4> [317.128212]  ? asm_exc_page_fault+0x27/0x30
+<4> [317.128216]  ? xe_migrate_copy+0x66/0x13e0 [xe]
+<4> [317.128263]  ? __lock_acquire+0xb9d/0x26f0
+<4> [317.128265]  ? __lock_acquire+0xb9d/0x26f0
+<4> [317.128267]  ? sg_free_append_table+0x20/0x80
+<4> [317.128271]  ? lock_acquire+0xc7/0x2e0
+<4> [317.128273]  ? mark_held_locks+0x4d/0x80
+<4> [317.128275]  ? trace_hardirqs_on+0x1e/0xd0
+<4> [317.128278]  ? _raw_spin_unlock_irqrestore+0x31/0x60
+<4> [317.128281]  ? __pm_runtime_resume+0x60/0xa0
+<4> [317.128284]  xe_bo_move+0x682/0xc50 [xe]
+<4> [317.128315]  ? lock_is_held_type+0xaa/0x120
+<4> [317.128318]  ttm_bo_handle_move_mem+0xe5/0x1a0 [ttm]
+<4> [317.128324]  ttm_bo_validate+0xd1/0x1a0 [ttm]
+<4> [317.128328]  shrink_test_run_device+0x721/0xc10 [xe]
+<4> [317.128360]  ? find_held_lock+0x31/0x90
+<4> [317.128363]  ? lock_release+0xd1/0x2a0
+<4> [317.128365]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
+ [kunit]
+<4> [317.128370]  xe_bo_shrink_kunit+0x11/0x20 [xe]
+<4> [317.128397]  kunit_try_run_case+0x6e/0x150 [kunit]
+<4> [317.128400]  ? trace_hardirqs_on+0x1e/0xd0
+<4> [317.128402]  ? _raw_spin_unlock_irqrestore+0x31/0x60
+<4> [317.128404]  kunit_generic_run_threadfn_adapter+0x1e/0x40 [kunit]
+<4> [317.128407]  kthread+0xf5/0x130
+<4> [317.128410]  ? __pfx_kthread+0x10/0x10
+<4> [317.128412]  ret_from_fork+0x39/0x60
+<4> [317.128415]  ? __pfx_kthread+0x10/0x10
+<4> [317.128416]  ret_from_fork_asm+0x1a/0x30
+<4> [317.128420]  </TASK>
+
+Fixes: 266c85885263 ("drm/xe/xe2: Handle flat ccs move for igfx.")
+Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
+Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240927161308.862323-2-zhanjun.dong@intel.com
+(cherry picked from commit 59a1c9c7e1d02b43b415ea92627ce095b7c79e47)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_bo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
+index f5e3012eff20d..97506bf9f5e0c 100644
+--- a/drivers/gpu/drm/xe/xe_bo.c
++++ b/drivers/gpu/drm/xe/xe_bo.c
+@@ -653,8 +653,8 @@ static int xe_bo_move(struct ttm_buffer_object *ttm_bo, bool evict,
+       tt_has_data = ttm && (ttm_tt_is_populated(ttm) ||
+                             (ttm->page_flags & TTM_TT_FLAG_SWAPPED));
+-      move_lacks_source = handle_system_ccs ? (!bo->ccs_cleared)  :
+-                                              (!mem_type_is_vram(old_mem_type) && !tt_has_data);
++      move_lacks_source = !old_mem || (handle_system_ccs ? (!bo->ccs_cleared) :
++                                       (!mem_type_is_vram(old_mem_type) && !tt_has_data));
+       needs_clear = (ttm && ttm->page_flags & TTM_TT_FLAG_ZERO_ALLOC) ||
+               (!ttm && ttm_bo->type == ttm_bo_type_device);
+-- 
+2.43.0
+
diff --git a/queue-6.10/drm-xe-restore-pci-state-upon-resume.patch b/queue-6.10/drm-xe-restore-pci-state-upon-resume.patch
new file mode 100644 (file)
index 0000000..d1ace09
--- /dev/null
@@ -0,0 +1,46 @@
+From 5ecab53bddf348dc103bb548262e9b5815bbd493 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2024 17:45:07 -0400
+Subject: drm/xe: Restore pci state upon resume
+
+From: Rodrigo Vivi <rodrigo.vivi@intel.com>
+
+[ Upstream commit cffa8e83df9fe525afad1e1099097413f9174f57 ]
+
+The pci state was saved, but not restored. Restore
+right after the power state transition request like
+every other driver.
+
+v2: Use right fixes tag, since this was there initialy, but
+    accidentally removed.
+
+Fixes: f6761c68c0ac ("drm/xe/display: Improve s2idle handling.")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240912214507.456897-1-rodrigo.vivi@intel.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+(cherry picked from commit ec2d1539e159f53eae708e194c449cfefa004994)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_pci.c b/drivers/gpu/drm/xe/xe_pci.c
+index f326dbb1cecd9..99824e19a376f 100644
+--- a/drivers/gpu/drm/xe/xe_pci.c
++++ b/drivers/gpu/drm/xe/xe_pci.c
+@@ -868,6 +868,8 @@ static int xe_pci_resume(struct device *dev)
+       if (err)
+               return err;
++      pci_restore_state(pdev);
++
+       err = pci_enable_device(pdev);
+       if (err)
+               return err;
+-- 
+2.43.0
+
diff --git a/queue-6.10/drm-xe-resume-tdr-after-gt-reset.patch b/queue-6.10/drm-xe-resume-tdr-after-gt-reset.patch
new file mode 100644 (file)
index 0000000..7ffc73e
--- /dev/null
@@ -0,0 +1,70 @@
+From db80fe1881813d9b48c2210b8056a76c3d373503 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2024 16:59:19 -0700
+Subject: drm/xe: Resume TDR after GT reset
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit 1b30f87e088b499eb74298db256da5c98e8276e2 ]
+
+Not starting the TDR after GT reset on exec queue which have been
+restarted can lead to jobs being able to be run forever. Fix this by
+restarting the TDR.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240724235919.1917216-1-matthew.brost@intel.com
+(cherry picked from commit 8ec5a4e5ce97d6ee9f5eb5b4ce4cfc831976fdec)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_gpu_scheduler.c | 5 +++++
+ drivers/gpu/drm/xe/xe_gpu_scheduler.h | 2 ++
+ drivers/gpu/drm/xe/xe_guc_submit.c    | 1 +
+ 3 files changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_gpu_scheduler.c b/drivers/gpu/drm/xe/xe_gpu_scheduler.c
+index e4ad1d6ce1d5f..7f24e58cc992f 100644
+--- a/drivers/gpu/drm/xe/xe_gpu_scheduler.c
++++ b/drivers/gpu/drm/xe/xe_gpu_scheduler.c
+@@ -90,6 +90,11 @@ void xe_sched_submission_stop(struct xe_gpu_scheduler *sched)
+       cancel_work_sync(&sched->work_process_msg);
+ }
++void xe_sched_submission_resume_tdr(struct xe_gpu_scheduler *sched)
++{
++      drm_sched_resume_timeout(&sched->base, sched->base.timeout);
++}
++
+ void xe_sched_add_msg(struct xe_gpu_scheduler *sched,
+                     struct xe_sched_msg *msg)
+ {
+diff --git a/drivers/gpu/drm/xe/xe_gpu_scheduler.h b/drivers/gpu/drm/xe/xe_gpu_scheduler.h
+index 10c6bb9c93868..6aac7fe686735 100644
+--- a/drivers/gpu/drm/xe/xe_gpu_scheduler.h
++++ b/drivers/gpu/drm/xe/xe_gpu_scheduler.h
+@@ -22,6 +22,8 @@ void xe_sched_fini(struct xe_gpu_scheduler *sched);
+ void xe_sched_submission_start(struct xe_gpu_scheduler *sched);
+ void xe_sched_submission_stop(struct xe_gpu_scheduler *sched);
++void xe_sched_submission_resume_tdr(struct xe_gpu_scheduler *sched);
++
+ void xe_sched_add_msg(struct xe_gpu_scheduler *sched,
+                     struct xe_sched_msg *msg);
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index 0a496612c810f..958dde8422d7e 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1500,6 +1500,7 @@ static void guc_exec_queue_start(struct xe_exec_queue *q)
+       }
+       xe_sched_submission_start(sched);
++      xe_sched_submission_resume_tdr(sched);
+ }
+ int xe_guc_submit_start(struct xe_guc *guc)
+-- 
+2.43.0
+
diff --git a/queue-6.10/i2c-xiic-improve-error-message-when-transfer-fails-t.patch b/queue-6.10/i2c-xiic-improve-error-message-when-transfer-fails-t.patch
new file mode 100644 (file)
index 0000000..5b6a24b
--- /dev/null
@@ -0,0 +1,72 @@
+From 83a82ba1e8968937b9cc3189d485b864ec3b14bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 May 2024 12:03:24 -0400
+Subject: i2c: xiic: improve error message when transfer fails to start
+
+From: Marc Ferland <marc.ferland@sonatest.com>
+
+[ Upstream commit ee1691d0ae103ba7fd9439800ef454674fadad27 ]
+
+xiic_start_xfer can fail for different reasons:
+
+- EBUSY: bus is busy or i2c messages still in tx_msg or rx_msg
+- ETIMEDOUT: timed-out trying to clear the RX fifo
+- EINVAL: wrong clock settings
+
+Both EINVAL and ETIMEDOUT will currently print a specific error
+message followed by a generic one, for example:
+
+    Failed to clear rx fifo
+    Error xiic_start_xfer
+
+however EBUSY will simply output the generic message:
+
+    Error xiic_start_xfer
+
+which is not really helpful.
+
+This commit adds a new error message when a busy condition is detected
+and also removes the generic message since it does not provide any
+relevant information to the user.
+
+Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 71391b590adae..19468565120e1 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -1105,8 +1105,11 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)
+       mutex_lock(&i2c->lock);
+       ret = xiic_busy(i2c);
+-      if (ret)
++      if (ret) {
++              dev_err(i2c->adap.dev.parent,
++                      "cannot start a transfer while busy\n");
+               goto out;
++      }
+       i2c->tx_msg = msgs;
+       i2c->rx_msg = NULL;
+@@ -1164,10 +1167,8 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+               return err;
+       err = xiic_start_xfer(i2c, msgs, num);
+-      if (err < 0) {
+-              dev_err(adap->dev.parent, "Error xiic_start_xfer\n");
++      if (err < 0)
+               goto out;
+-      }
+       err = wait_for_completion_timeout(&i2c->completion, XIIC_XFER_TIMEOUT);
+       mutex_lock(&i2c->lock);
+-- 
+2.43.0
+
diff --git a/queue-6.10/i2c-xiic-try-re-initialization-on-bus-busy-timeout.patch b/queue-6.10/i2c-xiic-try-re-initialization-on-bus-busy-timeout.patch
new file mode 100644 (file)
index 0000000..e2ff86c
--- /dev/null
@@ -0,0 +1,105 @@
+From 90fa42193213a07f46e7f076ca5127486fae1e20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 22:16:53 +0200
+Subject: i2c: xiic: Try re-initialization on bus busy timeout
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 1d4a1adbed2582444aaf97671858b7d12915bd05 ]
+
+In the event that the I2C bus was powered down when the I2C controller
+driver loads, or some spurious pulses occur on the I2C bus, it's
+possible that the controller detects a spurious I2C "start" condition.
+In this situation it may continue to report the bus is busy indefinitely
+and block the controller from working.
+
+The "single-master" DT flag can be specified to disable bus busy checks
+entirely, but this may not be safe to use in situations where other I2C
+masters may potentially exist.
+
+In the event that the controller reports "bus busy" for too long when
+starting a transaction, we can try reinitializing the controller to see
+if the busy condition clears. This allows recovering from this scenario.
+
+Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Cc: <stable@vger.kernel.org> # v2.6.34+
+Reviewed-by: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 41 ++++++++++++++++++++++-------------
+ 1 file changed, 26 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 19468565120e1..d3ca7d2f81a61 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -844,23 +844,11 @@ static int xiic_bus_busy(struct xiic_i2c *i2c)
+       return (sr & XIIC_SR_BUS_BUSY_MASK) ? -EBUSY : 0;
+ }
+-static int xiic_busy(struct xiic_i2c *i2c)
++static int xiic_wait_not_busy(struct xiic_i2c *i2c)
+ {
+       int tries = 3;
+       int err;
+-      if (i2c->tx_msg || i2c->rx_msg)
+-              return -EBUSY;
+-
+-      /* In single master mode bus can only be busy, when in use by this
+-       * driver. If the register indicates bus being busy for some reason we
+-       * should ignore it, since bus will never be released and i2c will be
+-       * stuck forever.
+-       */
+-      if (i2c->singlemaster) {
+-              return 0;
+-      }
+-
+       /* for instance if previous transfer was terminated due to TX error
+        * it might be that the bus is on it's way to become available
+        * give it at most 3 ms to wake
+@@ -1104,13 +1092,36 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)
+       mutex_lock(&i2c->lock);
+-      ret = xiic_busy(i2c);
+-      if (ret) {
++      if (i2c->tx_msg || i2c->rx_msg) {
+               dev_err(i2c->adap.dev.parent,
+                       "cannot start a transfer while busy\n");
++              ret = -EBUSY;
+               goto out;
+       }
++      /* In single master mode bus can only be busy, when in use by this
++       * driver. If the register indicates bus being busy for some reason we
++       * should ignore it, since bus will never be released and i2c will be
++       * stuck forever.
++       */
++      if (!i2c->singlemaster) {
++              ret = xiic_wait_not_busy(i2c);
++              if (ret) {
++                      /* If the bus is stuck in a busy state, such as due to spurious low
++                       * pulses on the bus causing a false start condition to be detected,
++                       * then try to recover by re-initializing the controller and check
++                       * again if the bus is still busy.
++                       */
++                      dev_warn(i2c->adap.dev.parent, "I2C bus busy timeout, reinitializing\n");
++                      ret = xiic_reinit(i2c);
++                      if (ret)
++                              goto out;
++                      ret = xiic_wait_not_busy(i2c);
++                      if (ret)
++                              goto out;
++              }
++      }
++
+       i2c->tx_msg = msgs;
+       i2c->rx_msg = NULL;
+       i2c->nmsgs = num;
+-- 
+2.43.0
+
diff --git a/queue-6.10/io_uring-fix-memory-leak-when-cache-init-fail.patch b/queue-6.10/io_uring-fix-memory-leak-when-cache-init-fail.patch
new file mode 100644 (file)
index 0000000..62190be
--- /dev/null
@@ -0,0 +1,48 @@
+From 88ae14ef66d1111514aa41fe09c9628f08ee446f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 18:05:12 +0800
+Subject: io_uring: fix memory leak when cache init fail
+
+From: Guixin Liu <kanie@linux.alibaba.com>
+
+[ Upstream commit 3a87e264290d71ec86a210ab3e8d23b715ad266d ]
+
+Exit the percpu ref when cache init fails to free the data memory with
+in struct percpu_ref.
+
+Fixes: 206aefde4f88 ("io_uring: reduce/pack size of io_ring_ctx")
+Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
+Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Link: https://lore.kernel.org/r/20240923100512.64638-1-kanie@linux.alibaba.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/io_uring.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
+index c0d8ee0c9786d..ff243f6b51199 100644
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -316,7 +316,7 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
+                           sizeof(struct uring_cache));
+       ret |= io_futex_cache_init(ctx);
+       if (ret)
+-              goto err;
++              goto free_ref;
+       init_completion(&ctx->ref_comp);
+       xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1);
+       mutex_init(&ctx->uring_lock);
+@@ -344,6 +344,9 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
+       io_napi_init(ctx);
+       return ctx;
++
++free_ref:
++      percpu_ref_exit(&ctx->refs);
+ err:
+       io_alloc_cache_free(&ctx->rsrc_node_cache, kfree);
+       io_alloc_cache_free(&ctx->apoll_cache, kfree);
+-- 
+2.43.0
+
diff --git a/queue-6.10/loop-don-t-set-queue_flag_nomerges.patch b/queue-6.10/loop-don-t-set-queue_flag_nomerges.patch
new file mode 100644 (file)
index 0000000..57f18b5
--- /dev/null
@@ -0,0 +1,67 @@
+From de46a2a9af243860631c93fe2e5ce6b9e8ef65ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2024 14:49:11 +0200
+Subject: loop: don't set QUEUE_FLAG_NOMERGES
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 667ea36378cf7f669044b27871c496e1559c872a ]
+
+QUEUE_FLAG_NOMERGES isn't really a driver interface, but a user tunable.
+There also isn't any good reason to set it in the loop driver.
+
+The original commit adding it (5b5e20f421c0b6d "block: loop: set
+QUEUE_FLAG_NOMERGES for request queue of loop") claims that "It doesn't
+make sense to enable merge because the I/O submitted to backing file is
+handled page by page."  which of course isn't true for multi-page bvec
+now, and it never has been for direct I/O, for which commit 40326d8a33d
+("block/loop: allow request merge for directio mode") alredy disabled
+the nomerges flag.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20240627124926.512662-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 15 ++-------------
+ 1 file changed, 2 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 1153721bc7c25..41cfcf9efcfc5 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -211,13 +211,10 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
+       if (lo->lo_state == Lo_bound)
+               blk_mq_freeze_queue(lo->lo_queue);
+       lo->use_dio = use_dio;
+-      if (use_dio) {
+-              blk_queue_flag_clear(QUEUE_FLAG_NOMERGES, lo->lo_queue);
++      if (use_dio)
+               lo->lo_flags |= LO_FLAGS_DIRECT_IO;
+-      } else {
+-              blk_queue_flag_set(QUEUE_FLAG_NOMERGES, lo->lo_queue);
++      else
+               lo->lo_flags &= ~LO_FLAGS_DIRECT_IO;
+-      }
+       if (lo->lo_state == Lo_bound)
+               blk_mq_unfreeze_queue(lo->lo_queue);
+ }
+@@ -2059,14 +2056,6 @@ static int loop_add(int i)
+       }
+       lo->lo_queue = lo->lo_disk->queue;
+-      /*
+-       * By default, we do buffer IO, so it doesn't make sense to enable
+-       * merge because the I/O submitted to backing file is handled page by
+-       * page. For directio mode, merge does help to dispatch bigger request
+-       * to underlayer disk. We will enable merge once directio is enabled.
+-       */
+-      blk_queue_flag_set(QUEUE_FLAG_NOMERGES, lo->lo_queue);
+-
+       /*
+        * Disable partition scanning by default. The in-kernel partition
+        * scanning can be requested individually per-device during its
+-- 
+2.43.0
+
diff --git a/queue-6.10/selftest-mm-mseal-fix-test_seal_mremap_move_dontunma.patch b/queue-6.10/selftest-mm-mseal-fix-test_seal_mremap_move_dontunma.patch
new file mode 100644 (file)
index 0000000..6444a97
--- /dev/null
@@ -0,0 +1,204 @@
+From 68123816ca335da03303dcb94323438432de59bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2024 21:23:20 +0000
+Subject: selftest mm/mseal: fix test_seal_mremap_move_dontunmap_anyaddr
+
+From: Jeff Xu <jeffxu@chromium.org>
+
+[ Upstream commit 072cd213b75eb01fcf40eff898f8d5c008ce1457 ]
+
+the syscall remap accepts following:
+
+mremap(src, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, dst)
+
+when the src is sealed, the call will fail with error code:
+EPERM
+
+Previously, the test uses hard-coded 0xdeaddead as dst, and it
+will fail on the system with newer glibc installed.
+
+This patch removes test's dependency on glibc for mremap(), also
+fix the test and remove the hardcoded address.
+
+Link: https://lkml.kernel.org/r/20240807212320.2831848-1-jeffxu@chromium.org
+Fixes: 4926c7a52de7 ("selftest mm/mseal memory sealing")
+Signed-off-by: Jeff Xu <jeffxu@chromium.org>
+Reported-by: Pedro Falcato <pedro.falcato@gmail.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Liam R. Howlett <Liam.Howlett@oracle.com>
+Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
+Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/mm/mseal_test.c | 57 ++++++++++++++++---------
+ 1 file changed, 36 insertions(+), 21 deletions(-)
+
+diff --git a/tools/testing/selftests/mm/mseal_test.c b/tools/testing/selftests/mm/mseal_test.c
+index 09faffbc3d87c..43e6d0c53fe4c 100644
+--- a/tools/testing/selftests/mm/mseal_test.c
++++ b/tools/testing/selftests/mm/mseal_test.c
+@@ -146,6 +146,16 @@ static int sys_madvise(void *start, size_t len, int types)
+       return sret;
+ }
++static void *sys_mremap(void *addr, size_t old_len, size_t new_len,
++      unsigned long flags, void *new_addr)
++{
++      void *sret;
++
++      errno = 0;
++      sret = (void *) syscall(__NR_mremap, addr, old_len, new_len, flags, new_addr);
++      return sret;
++}
++
+ static int sys_pkey_alloc(unsigned long flags, unsigned long init_val)
+ {
+       int ret = syscall(__NR_pkey_alloc, flags, init_val);
+@@ -1151,12 +1161,12 @@ static void test_seal_mremap_shrink(bool seal)
+       }
+       /* shrink from 4 pages to 2 pages. */
+-      ret2 = mremap(ptr, size, 2 * page_size, 0, 0);
++      ret2 = sys_mremap(ptr, size, 2 * page_size, 0, 0);
+       if (seal) {
+-              FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
++              FAIL_TEST_IF_FALSE(ret2 == (void *) MAP_FAILED);
+               FAIL_TEST_IF_FALSE(errno == EPERM);
+       } else {
+-              FAIL_TEST_IF_FALSE(ret2 != MAP_FAILED);
++              FAIL_TEST_IF_FALSE(ret2 != (void *) MAP_FAILED);
+       }
+@@ -1183,7 +1193,7 @@ static void test_seal_mremap_expand(bool seal)
+       }
+       /* expand from 2 page to 4 pages. */
+-      ret2 = mremap(ptr, 2 * page_size, 4 * page_size, 0, 0);
++      ret2 = sys_mremap(ptr, 2 * page_size, 4 * page_size, 0, 0);
+       if (seal) {
+               FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
+               FAIL_TEST_IF_FALSE(errno == EPERM);
+@@ -1216,7 +1226,7 @@ static void test_seal_mremap_move(bool seal)
+       }
+       /* move from ptr to fixed address. */
+-      ret2 = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newPtr);
++      ret2 = sys_mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newPtr);
+       if (seal) {
+               FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
+               FAIL_TEST_IF_FALSE(errno == EPERM);
+@@ -1335,7 +1345,7 @@ static void test_seal_mremap_shrink_fixed(bool seal)
+       }
+       /* mremap to move and shrink to fixed address */
+-      ret2 = mremap(ptr, size, 2 * page_size, MREMAP_MAYMOVE | MREMAP_FIXED,
++      ret2 = sys_mremap(ptr, size, 2 * page_size, MREMAP_MAYMOVE | MREMAP_FIXED,
+                       newAddr);
+       if (seal) {
+               FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
+@@ -1366,7 +1376,7 @@ static void test_seal_mremap_expand_fixed(bool seal)
+       }
+       /* mremap to move and expand to fixed address */
+-      ret2 = mremap(ptr, page_size, size, MREMAP_MAYMOVE | MREMAP_FIXED,
++      ret2 = sys_mremap(ptr, page_size, size, MREMAP_MAYMOVE | MREMAP_FIXED,
+                       newAddr);
+       if (seal) {
+               FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
+@@ -1397,7 +1407,7 @@ static void test_seal_mremap_move_fixed(bool seal)
+       }
+       /* mremap to move to fixed address */
+-      ret2 = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newAddr);
++      ret2 = sys_mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_FIXED, newAddr);
+       if (seal) {
+               FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
+               FAIL_TEST_IF_FALSE(errno == EPERM);
+@@ -1426,14 +1436,13 @@ static void test_seal_mremap_move_fixed_zero(bool seal)
+       /*
+        * MREMAP_FIXED can move the mapping to zero address
+        */
+-      ret2 = mremap(ptr, size, 2 * page_size, MREMAP_MAYMOVE | MREMAP_FIXED,
++      ret2 = sys_mremap(ptr, size, 2 * page_size, MREMAP_MAYMOVE | MREMAP_FIXED,
+                       0);
+       if (seal) {
+               FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
+               FAIL_TEST_IF_FALSE(errno == EPERM);
+       } else {
+               FAIL_TEST_IF_FALSE(ret2 == 0);
+-
+       }
+       TEST_END_CHECK();
+@@ -1456,13 +1465,13 @@ static void test_seal_mremap_move_dontunmap(bool seal)
+       }
+       /* mremap to move, and don't unmap src addr. */
+-      ret2 = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, 0);
++      ret2 = sys_mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP, 0);
+       if (seal) {
+               FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
+               FAIL_TEST_IF_FALSE(errno == EPERM);
+       } else {
++              /* kernel will allocate a new address */
+               FAIL_TEST_IF_FALSE(ret2 != MAP_FAILED);
+-
+       }
+       TEST_END_CHECK();
+@@ -1470,7 +1479,7 @@ static void test_seal_mremap_move_dontunmap(bool seal)
+ static void test_seal_mremap_move_dontunmap_anyaddr(bool seal)
+ {
+-      void *ptr;
++      void *ptr, *ptr2;
+       unsigned long page_size = getpagesize();
+       unsigned long size = 4 * page_size;
+       int ret;
+@@ -1485,24 +1494,30 @@ static void test_seal_mremap_move_dontunmap_anyaddr(bool seal)
+       }
+       /*
+-       * The 0xdeaddead should not have effect on dest addr
+-       * when MREMAP_DONTUNMAP is set.
++       * The new address is any address that not allocated.
++       * use allocate/free to similate that.
+        */
+-      ret2 = mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP,
+-                      0xdeaddead);
++      setup_single_address(size, &ptr2);
++      FAIL_TEST_IF_FALSE(ptr2 != (void *)-1);
++      ret = sys_munmap(ptr2, size);
++      FAIL_TEST_IF_FALSE(!ret);
++
++      /*
++       * remap to any address.
++       */
++      ret2 = sys_mremap(ptr, size, size, MREMAP_MAYMOVE | MREMAP_DONTUNMAP,
++                      (void *) ptr2);
+       if (seal) {
+               FAIL_TEST_IF_FALSE(ret2 == MAP_FAILED);
+               FAIL_TEST_IF_FALSE(errno == EPERM);
+       } else {
+-              FAIL_TEST_IF_FALSE(ret2 != MAP_FAILED);
+-              FAIL_TEST_IF_FALSE((long)ret2 != 0xdeaddead);
+-
++              /* remap success and return ptr2 */
++              FAIL_TEST_IF_FALSE(ret2 ==  ptr2);
+       }
+       TEST_END_CHECK();
+ }
+-
+ static void test_seal_merge_and_split(void)
+ {
+       void *ptr;
+-- 
+2.43.0
+
index c7f97768eb794b503dba3247237d0c31294eff63..4ce0d1cd5b16e8d1a8b99804700e8308643e01f7 100644 (file)
@@ -47,3 +47,24 @@ net-ncsi-disable-the-ncsi-work-before-freeing-the-as.patch
 iomap-constrain-the-file-range-passed-to-iomap_file_.patch
 dt-bindings-net-xlnx-axi-ethernet-add-missing-reg-mi.patch
 sctp-set-sk_state-back-to-closed-if-autobind-fails-i.patch
+selftest-mm-mseal-fix-test_seal_mremap_move_dontunma.patch
+i2c-xiic-improve-error-message-when-transfer-fails-t.patch
+i2c-xiic-try-re-initialization-on-bus-busy-timeout.patch
+loop-don-t-set-queue_flag_nomerges.patch
+drm-panthor-fix-race-when-converting-group-handle-to.patch
+asoc-atmel-mchp-pdmc-skip-alsa-restoration-if-substr.patch
+io_uring-fix-memory-leak-when-cache-init-fail.patch
+alsa-mixer_oss-remove-some-incorrect-kfree_const-usa.patch
+alsa-hda-realtek-fix-the-push-button-function-for-th.patch
+cifs-remove-intermediate-object-of-failed-create-rep.patch
+drm-panthor-lock-the-vm-resv-before-calling-drm_gpuv.patch
+alsa-hda-generic-unconditionally-prefer-preferred_da.patch
+asoc-imx-card-set-card.owner-to-avoid-a-warning-call.patch
+drm-xe-restore-pci-state-upon-resume.patch
+drm-xe-resume-tdr-after-gt-reset.patch
+drm-xe-prevent-null-pointer-access-in-xe_migrate_cop.patch
+cifs-fix-buffer-overflow-when-parsing-nfs-reparse-po.patch
+cifs-do-not-convert-delimiter-when-parsing-nfs-style.patch
+tools-rtla-fix-installation-from-out-of-tree-build.patch
+alsa-gus-fix-some-error-handling-paths-related-to-ge.patch
+alsa-hda-conexant-fix-conflicting-quirk-for-system76.patch
diff --git a/queue-6.10/tools-rtla-fix-installation-from-out-of-tree-build.patch b/queue-6.10/tools-rtla-fix-installation-from-out-of-tree-build.patch
new file mode 100644 (file)
index 0000000..9e77ed1
--- /dev/null
@@ -0,0 +1,40 @@
+From 26bda69f017b9511c2c50bd0f57d577598f38b39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 01:31:58 +0200
+Subject: tools/rtla: Fix installation from out-of-tree build
+
+From: Ben Hutchings <benh@debian.org>
+
+[ Upstream commit f771d5369f1dbfe32c93bcb4f5d7ca8322b15389 ]
+
+rtla now supports out-of-tree builds, but installation fails as it
+still tries to install the rtla binary from the source tree.  Use the
+existing macro $(RTLA) to refer to the binary.
+
+Link: https://lore.kernel.org/ZudubuoU_JHjPZ7w@decadent.org.uk
+Fixes: 01474dc706ca ("tools/rtla: Use tools/build makefiles to build rtla")
+Reviewed-by: Tomas Glozar <tglozar@redhat.com>
+Tested-by: Tomas Glozar <tglozar@redhat.com>
+Signed-off-by: Ben Hutchings <benh@debian.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/tracing/rtla/Makefile.rtla | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/tracing/rtla/Makefile.rtla b/tools/tracing/rtla/Makefile.rtla
+index 3ff0b8970896f..cc1d6b615475f 100644
+--- a/tools/tracing/rtla/Makefile.rtla
++++ b/tools/tracing/rtla/Makefile.rtla
+@@ -38,7 +38,7 @@ BINDIR               := /usr/bin
+ .PHONY: install
+ install: doc_install
+       @$(MKDIR) -p $(DESTDIR)$(BINDIR)
+-      $(call QUIET_INSTALL,rtla)$(INSTALL) rtla -m 755 $(DESTDIR)$(BINDIR)
++      $(call QUIET_INSTALL,rtla)$(INSTALL) $(RTLA) -m 755 $(DESTDIR)$(BINDIR)
+       @$(STRIP) $(DESTDIR)$(BINDIR)/rtla
+       @test ! -f $(DESTDIR)$(BINDIR)/osnoise || $(RM) $(DESTDIR)$(BINDIR)/osnoise
+       @$(LN) rtla $(DESTDIR)$(BINDIR)/osnoise
+-- 
+2.43.0
+