From: Greg Kroah-Hartman Date: Sun, 6 Jul 2025 11:53:59 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.15.187~63 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=31419a85d52b180c050071ca3ac4b6fe0a06ef27;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: mmc-sdhci-add-a-helper-function-for-dump-register-in-dynamic-debug-mode.patch mtk-sd-fix-a-pagefault-in-dma_unmap_sg-for-not-prepared-data.patch revert-mmc-sdhci-disable-sd-card-clock-before-changing-parameters.patch usb-typec-altmodes-displayport-do-not-index-invalid-pin_assignments.patch vsock-vmci-clear-the-vmci-transport-packet-properly-when-initializing-it.patch --- diff --git a/queue-5.4/mmc-sdhci-add-a-helper-function-for-dump-register-in-dynamic-debug-mode.patch b/queue-5.4/mmc-sdhci-add-a-helper-function-for-dump-register-in-dynamic-debug-mode.patch new file mode 100644 index 0000000000..a82b2ae224 --- /dev/null +++ b/queue-5.4/mmc-sdhci-add-a-helper-function-for-dump-register-in-dynamic-debug-mode.patch @@ -0,0 +1,44 @@ +From 2881ba9af073faa8ee7408a8d1e0575e50eb3f6c Mon Sep 17 00:00:00 2001 +From: Victor Shih +Date: Fri, 6 Jun 2025 19:01:20 +0800 +Subject: mmc: sdhci: Add a helper function for dump register in dynamic debug mode + +From: Victor Shih + +commit 2881ba9af073faa8ee7408a8d1e0575e50eb3f6c upstream. + +Add a helper function for dump register in dynamic debug mode. + +Signed-off-by: Victor Shih +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250606110121.96314-3-victorshihgli@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci.h | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/mmc/host/sdhci.h ++++ b/drivers/mmc/host/sdhci.h +@@ -801,4 +801,20 @@ void sdhci_abort_tuning(struct sdhci_hos + void sdhci_set_data_timeout_irq(struct sdhci_host *host, bool enable); + void __sdhci_set_timeout(struct sdhci_host *host, struct mmc_command *cmd); + ++#if defined(CONFIG_DYNAMIC_DEBUG) || \ ++ (defined(CONFIG_DYNAMIC_DEBUG_CORE) && defined(DYNAMIC_DEBUG_MODULE)) ++#define SDHCI_DBG_ANYWAY 0 ++#elif defined(DEBUG) ++#define SDHCI_DBG_ANYWAY 1 ++#else ++#define SDHCI_DBG_ANYWAY 0 ++#endif ++ ++#define sdhci_dbg_dumpregs(host, fmt) \ ++do { \ ++ DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \ ++ if (DYNAMIC_DEBUG_BRANCH(descriptor) || SDHCI_DBG_ANYWAY) \ ++ sdhci_dumpregs(host); \ ++} while (0) ++ + #endif /* __SDHCI_HW_H */ diff --git a/queue-5.4/mtk-sd-fix-a-pagefault-in-dma_unmap_sg-for-not-prepared-data.patch b/queue-5.4/mtk-sd-fix-a-pagefault-in-dma_unmap_sg-for-not-prepared-data.patch new file mode 100644 index 0000000000..bead2365a0 --- /dev/null +++ b/queue-5.4/mtk-sd-fix-a-pagefault-in-dma_unmap_sg-for-not-prepared-data.patch @@ -0,0 +1,54 @@ +From 539d80575b810c7a5987c7ac8915e3bc99c03695 Mon Sep 17 00:00:00 2001 +From: "Masami Hiramatsu (Google)" +Date: Thu, 5 Jun 2025 10:07:38 +0900 +Subject: mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data + +From: Masami Hiramatsu (Google) + +commit 539d80575b810c7a5987c7ac8915e3bc99c03695 upstream. + +When swiotlb buffer is full, the dma_map_sg() returns 0 to +msdc_prepare_data(), but it does not check it and sets the +MSDC_PREPARE_FLAG. + +swiotlb_tbl_map_single() /* prints "swiotlb buffer is full" */ + <-swiotlb_map() + <-dma_direct_map_page() + <-dma_direct_map_sg() + <-__dma_map_sg_attrs() + <-dma_map_sg_attrs() + <-dma_map_sg() /* returns 0 (pages mapped) */ + <-msdc_prepare_data() + +Then, the msdc_unprepare_data() checks MSDC_PREPARE_FLAG and calls +dma_unmap_sg() with unmapped pages. It causes a page fault. + +To fix this problem, Do not set MSDC_PREPARE_FLAG if dma_map_sg() +fails because this is not prepared. + +Fixes: 208489032bdd ("mmc: mediatek: Add Mediatek MMC driver") +Signed-off-by: Masami Hiramatsu (Google) +Tested-by: Sergey Senozhatsky +Reviewed-by: AngeloGioacchino Del Regno +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/174908565814.4056588.769599127120955383.stgit@mhiramat.tok.corp.google.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/mtk-sd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -681,9 +681,10 @@ static void msdc_prepare_data(struct msd + struct mmc_data *data = mrq->data; + + if (!(data->host_cookie & MSDC_PREPARE_FLAG)) { +- data->host_cookie |= MSDC_PREPARE_FLAG; + data->sg_count = dma_map_sg(host->dev, data->sg, data->sg_len, + mmc_get_dma_dir(data)); ++ if (data->sg_count) ++ data->host_cookie |= MSDC_PREPARE_FLAG; + } + } + diff --git a/queue-5.4/revert-mmc-sdhci-disable-sd-card-clock-before-changing-parameters.patch b/queue-5.4/revert-mmc-sdhci-disable-sd-card-clock-before-changing-parameters.patch new file mode 100644 index 0000000000..748d6f225d --- /dev/null +++ b/queue-5.4/revert-mmc-sdhci-disable-sd-card-clock-before-changing-parameters.patch @@ -0,0 +1,49 @@ +From dcc3bcfc5b50c625b475dcc25d167b6b947a6637 Mon Sep 17 00:00:00 2001 +From: Ulf Hansson +Date: Tue, 24 Jun 2025 13:09:32 +0200 +Subject: Revert "mmc: sdhci: Disable SD card clock before changing parameters" + +From: Ulf Hansson + +commit dcc3bcfc5b50c625b475dcc25d167b6b947a6637 upstream. + +It has turned out the trying to strictly conform to the SDHCI specification +is causing problems. Let's revert and start over. + +This reverts commit fb3bbc46c94f261b6156ee863c1b06c84cf157dc. + +Cc: Erick Shepherd +Cc: stable@vger.kernel.org +Fixes: fb3bbc46c94f ("mmc: sdhci: Disable SD card clock before changing parameters") +Suggested-by: Adrian Hunter +Reported-by: Jonathan Liu +Reported-by: Salvatore Bonaccorso +Closes: https://bugs.debian.org/1108065 +Acked-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Link: https://lore.kernel.org/r/20250624110932.176925-1-ulf.hansson@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1708,15 +1708,10 @@ void sdhci_set_clock(struct sdhci_host * + + host->mmc->actual_clock = 0; + +- clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL); +- if (clk & SDHCI_CLOCK_CARD_EN) +- sdhci_writew(host, clk & ~SDHCI_CLOCK_CARD_EN, +- SDHCI_CLOCK_CONTROL); ++ sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); + +- if (clock == 0) { +- sdhci_writew(host, 0, SDHCI_CLOCK_CONTROL); ++ if (clock == 0) + return; +- } + + clk = sdhci_calc_clk(host, clock, &host->mmc->actual_clock); + sdhci_enable_clk(host, clk); diff --git a/queue-5.4/series b/queue-5.4/series index 838783f57f..198399df4a 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -59,3 +59,8 @@ drm-bridge-cdns-dsi-check-return-value-when-getting-default-phy-config.patch s390-add-std-gnu11-to-decompressor-and-purgatory-cflags.patch arm64-restrict-pagetable-teardown-to-avoid-false-warning.patch btrfs-don-t-abort-filesystem-when-attempting-to-snapshot-deleted-subvolume.patch +vsock-vmci-clear-the-vmci-transport-packet-properly-when-initializing-it.patch +mmc-sdhci-add-a-helper-function-for-dump-register-in-dynamic-debug-mode.patch +revert-mmc-sdhci-disable-sd-card-clock-before-changing-parameters.patch +usb-typec-altmodes-displayport-do-not-index-invalid-pin_assignments.patch +mtk-sd-fix-a-pagefault-in-dma_unmap_sg-for-not-prepared-data.patch diff --git a/queue-5.4/usb-typec-altmodes-displayport-do-not-index-invalid-pin_assignments.patch b/queue-5.4/usb-typec-altmodes-displayport-do-not-index-invalid-pin_assignments.patch new file mode 100644 index 0000000000..323e73b688 --- /dev/null +++ b/queue-5.4/usb-typec-altmodes-displayport-do-not-index-invalid-pin_assignments.patch @@ -0,0 +1,53 @@ +From af4db5a35a4ef7a68046883bfd12468007db38f1 Mon Sep 17 00:00:00 2001 +From: RD Babiera +Date: Wed, 18 Jun 2025 22:49:42 +0000 +Subject: usb: typec: altmodes/displayport: do not index invalid pin_assignments + +From: RD Babiera + +commit af4db5a35a4ef7a68046883bfd12468007db38f1 upstream. + +A poorly implemented DisplayPort Alt Mode port partner can indicate +that its pin assignment capabilities are greater than the maximum +value, DP_PIN_ASSIGN_F. In this case, calls to pin_assignment_show +will cause a BRK exception due to an out of bounds array access. + +Prevent for loop in pin_assignment_show from accessing +invalid values in pin_assignments by adding DP_PIN_ASSIGN_MAX +value in typec_dp.h and using i < DP_PIN_ASSIGN_MAX as a loop +condition. + +Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") +Cc: stable +Signed-off-by: RD Babiera +Reviewed-by: Badhri Jagan Sridharan +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250618224943.3263103-2-rdbabiera@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 2 +- + include/linux/usb/typec_dp.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -492,7 +492,7 @@ static ssize_t pin_assignment_show(struc + + assignments = get_current_pin_assignments(dp); + +- for (i = 0; assignments; assignments >>= 1, i++) { ++ for (i = 0; assignments && i < DP_PIN_ASSIGN_MAX; assignments >>= 1, i++) { + if (assignments & 1) { + if (i == cur) + len += sprintf(buf + len, "[%s] ", +--- a/include/linux/usb/typec_dp.h ++++ b/include/linux/usb/typec_dp.h +@@ -56,6 +56,7 @@ enum { + DP_PIN_ASSIGN_D, + DP_PIN_ASSIGN_E, + DP_PIN_ASSIGN_F, /* Not supported after v1.0b */ ++ DP_PIN_ASSIGN_MAX, + }; + + /* DisplayPort alt mode specific commands */ diff --git a/queue-5.4/vsock-vmci-clear-the-vmci-transport-packet-properly-when-initializing-it.patch b/queue-5.4/vsock-vmci-clear-the-vmci-transport-packet-properly-when-initializing-it.patch new file mode 100644 index 0000000000..69da216a5c --- /dev/null +++ b/queue-5.4/vsock-vmci-clear-the-vmci-transport-packet-properly-when-initializing-it.patch @@ -0,0 +1,56 @@ +From 223e2288f4b8c262a864e2c03964ffac91744cd5 Mon Sep 17 00:00:00 2001 +From: HarshaVardhana S A +Date: Tue, 1 Jul 2025 14:22:54 +0200 +Subject: vsock/vmci: Clear the vmci transport packet properly when initializing it + +From: HarshaVardhana S A + +commit 223e2288f4b8c262a864e2c03964ffac91744cd5 upstream. + +In vmci_transport_packet_init memset the vmci_transport_packet before +populating the fields to avoid any uninitialised data being left in the +structure. + +Cc: Bryan Tan +Cc: Vishnu Dasa +Cc: Broadcom internal kernel review list +Cc: Stefano Garzarella +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Simon Horman +Cc: virtualization@lists.linux.dev +Cc: netdev@vger.kernel.org +Cc: stable +Signed-off-by: HarshaVardhana S A +Signed-off-by: Greg Kroah-Hartman +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Acked-by: Stefano Garzarella +Link: https://patch.msgid.link/20250701122254.2397440-1-gregkh@linuxfoundation.org +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/vmw_vsock/vmci_transport.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -125,6 +125,8 @@ vmci_transport_packet_init(struct vmci_t + u16 proto, + struct vmci_handle handle) + { ++ memset(pkt, 0, sizeof(*pkt)); ++ + /* We register the stream control handler as an any cid handle so we + * must always send from a source address of VMADDR_CID_ANY + */ +@@ -137,8 +139,6 @@ vmci_transport_packet_init(struct vmci_t + pkt->type = type; + pkt->src_port = src->svm_port; + pkt->dst_port = dst->svm_port; +- memset(&pkt->proto, 0, sizeof(pkt->proto)); +- memset(&pkt->_reserved2, 0, sizeof(pkt->_reserved2)); + + switch (pkt->type) { + case VMCI_TRANSPORT_PACKET_TYPE_INVALID: