From: Sasha Levin Date: Wed, 7 Feb 2024 16:25:06 +0000 (-0500) Subject: Fixes for 6.7 X-Git-Tag: v6.1.78~78 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7a32b9e974f8faf9041ebd8c2231f613e88cfcc9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.7 Signed-off-by: Sasha Levin --- diff --git a/queue-6.7/cifs-avoid-redundant-calls-to-disable-multichannel.patch b/queue-6.7/cifs-avoid-redundant-calls-to-disable-multichannel.patch new file mode 100644 index 00000000000..2f7c813a9f7 --- /dev/null +++ b/queue-6.7/cifs-avoid-redundant-calls-to-disable-multichannel.patch @@ -0,0 +1,42 @@ +From c36ba8b7d99b9b3f19c05348faf1d24058f1116a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 11:15:26 +0000 +Subject: cifs: avoid redundant calls to disable multichannel + +From: Shyam Prasad N + +[ Upstream commit e77e15fa5eb1c830597c5ca53ea7af973bae2f78 ] + +When the server reports query network interface info call +as unsupported following a tree connect, it means that +multichannel is unsupported, even if the server capabilities +report otherwise. + +When this happens, cifs_chan_skip_or_disable is called to +disable multichannel on the client. However, we only need +to call this when multichannel is currently setup. + +Fixes: f591062bdbf4 ("cifs: handle servers that still advertise multichannel after disabling") +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index f5006aa97f5b..5d9c87d2e1e0 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -410,7 +410,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon, + rc = SMB3_request_interfaces(xid, tcon, false); + free_xid(xid); + +- if (rc == -EOPNOTSUPP) { ++ if (rc == -EOPNOTSUPP && ses->chan_count > 1) { + /* + * some servers like Azure SMB server do not advertise + * that multichannel has been disabled with server +-- +2.43.0 + diff --git a/queue-6.7/cifs-failure-to-add-channel-on-iface-should-bump-up-.patch b/queue-6.7/cifs-failure-to-add-channel-on-iface-should-bump-up-.patch new file mode 100644 index 00000000000..bdb3d65dca4 --- /dev/null +++ b/queue-6.7/cifs-failure-to-add-channel-on-iface-should-bump-up-.patch @@ -0,0 +1,51 @@ +From 1c924483f8e6d59b7d3b248c7ffab3e0b50fdab7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 11:15:29 +0000 +Subject: cifs: failure to add channel on iface should bump up weight + +From: Shyam Prasad N + +[ Upstream commit 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 ] + +After the interface selection policy change to do a weighted +round robin, each iface maintains a weight_fulfilled. When the +weight_fulfilled reaches the total weight for the iface, we know +that the weights can be reset and ifaces can be allocated from +scratch again. + +During channel allocation failures on a particular channel, +weight_fulfilled is not incremented. If a few interfaces are +inactive, we could end up in a situation where the active +interfaces are all allocated for the total_weight, and inactive +ones are all that remain. This can cause a situation where +no more channels can be allocated further. + +This change fixes it by increasing weight_fulfilled, even when +channel allocation failure happens. This could mean that if +there are temporary failures in channel allocation, the iface +weights may not strictly be adhered to. But that's still okay. + +Fixes: a6d8fb54a515 ("cifs: distribute channels across interfaces based on speed") +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/sess.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index a16e175731eb..a1b973456471 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -269,6 +269,8 @@ int cifs_try_adding_channels(struct cifs_ses *ses) + &iface->sockaddr, + rc); + kref_put(&iface->refcount, release_iface); ++ /* failure to add chan should increase weight */ ++ iface->weight_fulfilled++; + continue; + } + +-- +2.43.0 + diff --git a/queue-6.7/dmaengine-fix-is_slave_direction-return-false-when-d.patch b/queue-6.7/dmaengine-fix-is_slave_direction-return-false-when-d.patch new file mode 100644 index 00000000000..9a256c0540a --- /dev/null +++ b/queue-6.7/dmaengine-fix-is_slave_direction-return-false-when-d.patch @@ -0,0 +1,37 @@ +From d95f49343097a709c9bcf7a8899e73e5d57e50b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 12:28:41 -0500 +Subject: dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV + +From: Frank Li + +[ Upstream commit a22fe1d6dec7e98535b97249fdc95c2be79120bb ] + +is_slave_direction() should return true when direction is DMA_DEV_TO_DEV. + +Fixes: 49920bc66984 ("dmaengine: add new enum dma_transfer_direction") +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20240123172842.3764529-1-Frank.Li@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/linux/dmaengine.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index 3df70d6131c8..752dbde4cec1 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -953,7 +953,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan, + + static inline bool is_slave_direction(enum dma_transfer_direction direction) + { +- return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM); ++ return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) || ++ (direction == DMA_DEV_TO_DEV); + } + + static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single( +-- +2.43.0 + diff --git a/queue-6.7/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch b/queue-6.7/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch new file mode 100644 index 00000000000..9d7f3e7b097 --- /dev/null +++ b/queue-6.7/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch @@ -0,0 +1,54 @@ +From 4667e84e51e45defbd6a9dc5970646d097594a5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 11:29:16 -0500 +Subject: dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools + +From: Guanhua Gao + +[ Upstream commit b73e43dcd7a8be26880ef8ff336053b29e79dbc5 ] + +In case of long format of qDMA command descriptor, there are one frame +descriptor, three entries in the frame list and two data entries. So the +size of dma_pool_create for these three fields should be the same with +the total size of entries respectively, or the contents may be overwritten +by the next allocated descriptor. + +Fixes: 7fdf9b05c73b ("dmaengine: fsl-dpaa2-qdma: Add NXP dpaa2 qDMA controller driver for Layerscape SoCs") +Signed-off-by: Guanhua Gao +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20240118162917.2951450-1-Frank.Li@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c +index 7958ac33e36c..5a8061a307cd 100644 +--- a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c ++++ b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c +@@ -38,15 +38,17 @@ static int dpaa2_qdma_alloc_chan_resources(struct dma_chan *chan) + if (!dpaa2_chan->fd_pool) + goto err; + +- dpaa2_chan->fl_pool = dma_pool_create("fl_pool", dev, +- sizeof(struct dpaa2_fl_entry), +- sizeof(struct dpaa2_fl_entry), 0); ++ dpaa2_chan->fl_pool = ++ dma_pool_create("fl_pool", dev, ++ sizeof(struct dpaa2_fl_entry) * 3, ++ sizeof(struct dpaa2_fl_entry), 0); ++ + if (!dpaa2_chan->fl_pool) + goto err_fd; + + dpaa2_chan->sdd_pool = + dma_pool_create("sdd_pool", dev, +- sizeof(struct dpaa2_qdma_sd_d), ++ sizeof(struct dpaa2_qdma_sd_d) * 2, + sizeof(struct dpaa2_qdma_sd_d), 0); + if (!dpaa2_chan->sdd_pool) + goto err_fl; +-- +2.43.0 + diff --git a/queue-6.7/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch b/queue-6.7/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch new file mode 100644 index 00000000000..4c8968b4d77 --- /dev/null +++ b/queue-6.7/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch @@ -0,0 +1,71 @@ +From 15dbb53da300b9d140cc81a1710dbd7f13ed0c2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 11:02:03 +0100 +Subject: dmaengine: fsl-qdma: Fix a memory leak related to the status queue + DMA + +From: Christophe JAILLET + +[ Upstream commit 968bc1d7203d384e72afe34124a1801b7af76514 ] + +This dma_alloc_coherent() is undone in the remove function, but not in the +error handling path of fsl_qdma_probe(). + +Switch to the managed version to fix the issue in the probe and simplify +the remove function. + +Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/a0ef5d0f5a47381617ef339df776ddc68ce48173.1704621515.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 18 +++++------------- + 1 file changed, 5 insertions(+), 13 deletions(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 47cb28468049..38409e06040a 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -563,11 +563,11 @@ static struct fsl_qdma_queue + /* + * Buffer for queue command + */ +- status_head->cq = dma_alloc_coherent(&pdev->dev, +- sizeof(struct fsl_qdma_format) * +- status_size, +- &status_head->bus_addr, +- GFP_KERNEL); ++ status_head->cq = dmam_alloc_coherent(&pdev->dev, ++ sizeof(struct fsl_qdma_format) * ++ status_size, ++ &status_head->bus_addr, ++ GFP_KERNEL); + if (!status_head->cq) { + devm_kfree(&pdev->dev, status_head); + return NULL; +@@ -1268,8 +1268,6 @@ static void fsl_qdma_cleanup_vchan(struct dma_device *dmadev) + + static void fsl_qdma_remove(struct platform_device *pdev) + { +- int i; +- struct fsl_qdma_queue *status; + struct device_node *np = pdev->dev.of_node; + struct fsl_qdma_engine *fsl_qdma = platform_get_drvdata(pdev); + +@@ -1277,12 +1275,6 @@ static void fsl_qdma_remove(struct platform_device *pdev) + fsl_qdma_cleanup_vchan(&fsl_qdma->dma_dev); + of_dma_controller_free(np); + dma_async_device_unregister(&fsl_qdma->dma_dev); +- +- for (i = 0; i < fsl_qdma->block_number; i++) { +- status = fsl_qdma->status[i]; +- dma_free_coherent(&pdev->dev, sizeof(struct fsl_qdma_format) * +- status->n_cq, status->cq, status->bus_addr); +- } + } + + static const struct of_device_id fsl_qdma_dt_ids[] = { +-- +2.43.0 + diff --git a/queue-6.7/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-8073 b/queue-6.7/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-8073 new file mode 100644 index 00000000000..d167e20c43a --- /dev/null +++ b/queue-6.7/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-8073 @@ -0,0 +1,48 @@ +From 4e58e869434ebc5668e43be8b9c39afc6fc7ec79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 11:02:04 +0100 +Subject: dmaengine: fsl-qdma: Fix a memory leak related to the queue command + DMA + +From: Christophe JAILLET + +[ Upstream commit 3aa58cb51318e329d203857f7a191678e60bb714 ] + +This dma_alloc_coherent() is undone neither in the remove function, nor in +the error handling path of fsl_qdma_probe(). + +Switch to the managed version to fix both issues. + +Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/7f66aa14f59d32b13672dde28602b47deb294e1f.1704621515.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 38409e06040a..3a5595a1d442 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -514,11 +514,11 @@ static struct fsl_qdma_queue + queue_temp = queue_head + i + (j * queue_num); + + queue_temp->cq = +- dma_alloc_coherent(&pdev->dev, +- sizeof(struct fsl_qdma_format) * +- queue_size[i], +- &queue_temp->bus_addr, +- GFP_KERNEL); ++ dmam_alloc_coherent(&pdev->dev, ++ sizeof(struct fsl_qdma_format) * ++ queue_size[i], ++ &queue_temp->bus_addr, ++ GFP_KERNEL); + if (!queue_temp->cq) + return NULL; + queue_temp->block_base = fsl_qdma->block_base + +-- +2.43.0 + diff --git a/queue-6.7/dmaengine-ti-k3-udma-report-short-packet-errors.patch b/queue-6.7/dmaengine-ti-k3-udma-report-short-packet-errors.patch new file mode 100644 index 00000000000..218ab247b68 --- /dev/null +++ b/queue-6.7/dmaengine-ti-k3-udma-report-short-packet-errors.patch @@ -0,0 +1,67 @@ +From 4a1dab9f0f98d7c4da4413528da8eb83bfaa40da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 14:37:55 +0530 +Subject: dmaengine: ti: k3-udma: Report short packet errors + +From: Jai Luthra + +[ Upstream commit bc9847c9ba134cfe3398011e343dcf6588c1c902 ] + +Propagate the TR response status to the device using BCDMA +split-channels. For example CSI-RX driver should be able to check if a +frame was not transferred completely (short packet) and needs to be +discarded. + +Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA") +Signed-off-by: Jai Luthra +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20240103-tr_resp_err-v1-1-2fdf6d48ab92@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c +index 30fd2f386f36..037f1408e798 100644 +--- a/drivers/dma/ti/k3-udma.c ++++ b/drivers/dma/ti/k3-udma.c +@@ -3968,6 +3968,7 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + { + struct udma_chan *uc = to_udma_chan(&vc->chan); + struct udma_desc *d; ++ u8 status; + + if (!vd) + return; +@@ -3977,12 +3978,12 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + if (d->metadata_size) + udma_fetch_epib(uc, d); + +- /* Provide residue information for the client */ + if (result) { + void *desc_vaddr = udma_curr_cppi5_desc_vaddr(d, d->desc_idx); + + if (cppi5_desc_get_type(desc_vaddr) == + CPPI5_INFO0_DESC_TYPE_VAL_HOST) { ++ /* Provide residue information for the client */ + result->residue = d->residue - + cppi5_hdesc_get_pktlen(desc_vaddr); + if (result->residue) +@@ -3991,7 +3992,12 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + result->result = DMA_TRANS_NOERROR; + } else { + result->residue = 0; +- result->result = DMA_TRANS_NOERROR; ++ /* Propagate TR Response errors to the client */ ++ status = d->hwdesc[0].tr_resp_base->status; ++ if (status) ++ result->result = DMA_TRANS_ABORTED; ++ else ++ result->result = DMA_TRANS_NOERROR; + } + } + } +-- +2.43.0 + diff --git a/queue-6.7/ext4-regenerate-buddy-after-block-freeing-failed-if-.patch b/queue-6.7/ext4-regenerate-buddy-after-block-freeing-failed-if-.patch new file mode 100644 index 00000000000..3298598e8cd --- /dev/null +++ b/queue-6.7/ext4-regenerate-buddy-after-block-freeing-failed-if-.patch @@ -0,0 +1,67 @@ +From 6b2e9701253ec74b3353a481ed98a14a5c66dbbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 22:20:35 +0800 +Subject: ext4: regenerate buddy after block freeing failed if under fc replay + +From: Baokun Li + +[ Upstream commit c9b528c35795b711331ed36dc3dbee90d5812d4e ] + +This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant +mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on +code in mb_free_blocks(), fast commit replay can end up marking as free +blocks that are already marked as such. This causes corruption of the +buddy bitmap so we need to regenerate it in that case. + +Reported-by: Jan Kara +Fixes: 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240104142040.2835097-4-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 8408318e1d32..3c5786841c6c 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1233,6 +1233,24 @@ void ext4_mb_generate_buddy(struct super_block *sb, + atomic64_add(period, &sbi->s_mb_generation_time); + } + ++static void mb_regenerate_buddy(struct ext4_buddy *e4b) ++{ ++ int count; ++ int order = 1; ++ void *buddy; ++ ++ while ((buddy = mb_find_buddy(e4b, order++, &count))) ++ mb_set_bits(buddy, 0, count); ++ ++ e4b->bd_info->bb_fragments = 0; ++ memset(e4b->bd_info->bb_counters, 0, ++ sizeof(*e4b->bd_info->bb_counters) * ++ (e4b->bd_sb->s_blocksize_bits + 2)); ++ ++ ext4_mb_generate_buddy(e4b->bd_sb, e4b->bd_buddy, ++ e4b->bd_bitmap, e4b->bd_group, e4b->bd_info); ++} ++ + /* The buddy information is attached the buddy cache inode + * for convenience. The information regarding each group + * is loaded via ext4_mb_load_buddy. The information involve +@@ -1921,6 +1939,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b, + ext4_mark_group_bitmap_corrupted( + sb, e4b->bd_group, + EXT4_GROUP_INFO_BBITMAP_CORRUPT); ++ } else { ++ mb_regenerate_buddy(e4b); + } + goto done; + } +-- +2.43.0 + diff --git a/queue-6.7/perf-evlist-fix-evlist__new_default-for-1-core-pmu.patch b/queue-6.7/perf-evlist-fix-evlist__new_default-for-1-core-pmu.patch new file mode 100644 index 00000000000..c0a45e0050a --- /dev/null +++ b/queue-6.7/perf-evlist-fix-evlist__new_default-for-1-core-pmu.patch @@ -0,0 +1,98 @@ +From 15e7f95216e5cd3a018a1bc40b28bc1050c48f37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jan 2024 09:43:57 +0000 +Subject: perf evlist: Fix evlist__new_default() for > 1 core PMU + +From: James Clark + +[ Upstream commit 7814fe24a6211a610db0b408d87420403b5b7a36 ] + +The 'Session topology' test currently fails with this message when +evlist__new_default() opens more than one event: + + 32: Session topology : + --- start --- + templ file: /tmp/perf-test-vv5YzZ + Using CPUID 0x00000000410fd070 + Opening: unknown-hardware:HG + ------------------------------------------------------------ + perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xb00000000 + disabled 1 + ------------------------------------------------------------ + sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 4 + Opening: unknown-hardware:HG + ------------------------------------------------------------ + perf_event_attr: + type 0 (PERF_TYPE_HARDWARE) + config 0xa00000000 + disabled 1 + ------------------------------------------------------------ + sys_perf_event_open: pid 0 cpu -1 group_fd -1 flags 0x8 = 5 + non matching sample_type + FAILED tests/topology.c:73 can't get session + ---- end ---- + Session topology: FAILED! + +This is because when re-opening the file and parsing the header, Perf +expects that any file that has more than one event has the sample ID +flag set. Perf record already sets the flag in a similar way when there +is more than one event, so add the same logic to evlist__new_default(). + +evlist__new_default() is only currently used in tests, so I don't +expect this change to have any other side effects. The other tests that +use it don't save and re-open the file so don't hit this issue. + +The session topology test has been failing on Arm big.LITTLE platforms +since commit 251aa040244a3b17 ("perf parse-events: Wildcard most +"numeric" events") when evlist__new_default() started opening multiple +events for 'cycles'. + +Fixes: 251aa040244a3b17 ("perf parse-events: Wildcard most "numeric" events") +Reviewed-by: Ian Rogers +Signed-off-by: James Clark +[ This was failing as well on a Rocket Lake Refresh/14700k Intel hybrid system - Arnaldo ] +Tested-by: Arnaldo Carvalho de Melo +Tested-by: Ian Rogers +Tested-by: Kan Liang +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Changbin Du +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Yang Jihong +Closes: https://lore.kernel.org/lkml/CAP-5=fWVQ-7ijjK3-w1q+k2WYVNHbAcejb-xY0ptbjRw476VKA@mail.gmail.com/ +Link: https://lore.kernel.org/r/20240124094358.489372-1-james.clark@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evlist.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c +index e36da58522ef..b0ed14a6da9d 100644 +--- a/tools/perf/util/evlist.c ++++ b/tools/perf/util/evlist.c +@@ -103,7 +103,14 @@ struct evlist *evlist__new_default(void) + err = parse_event(evlist, can_profile_kernel ? "cycles:P" : "cycles:Pu"); + if (err) { + evlist__delete(evlist); +- evlist = NULL; ++ return NULL; ++ } ++ ++ if (evlist->core.nr_entries > 1) { ++ struct evsel *evsel; ++ ++ evlist__for_each_entry(evlist, evsel) ++ evsel__set_sample_id(evsel, /*can_sample_identifier=*/false); + } + + return evlist; +-- +2.43.0 + diff --git a/queue-6.7/perf-test-fix-perf-script-tests-on-s390.patch b/queue-6.7/perf-test-fix-perf-script-tests-on-s390.patch new file mode 100644 index 00000000000..ef8c7553e86 --- /dev/null +++ b/queue-6.7/perf-test-fix-perf-script-tests-on-s390.patch @@ -0,0 +1,67 @@ +From 1c04539c63f70dfdcf690df72947c4279d781499 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 11:03:51 +0100 +Subject: perf test: Fix 'perf script' tests on s390 + +From: Thomas Richter + +[ Upstream commit 2dac1f089add90a45d93fe8217938281532b86c7 ] + +In linux next repo, test case 'perf script tests' fails on s390. + +The root case is a command line invocation of 'perf record' with +call-graph information. On s390 only DWARF formatted call-graphs are +supported and only on software events. + +Change the command line parameters for s390. + +Output before: + + # perf test 89 + 89: perf script tests : FAILED! + # + +Output after: + + # perf test 89 + 89: perf script tests : Ok + # + +Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions") +Reviewed-by: Ian Rogers +Signed-off-by: Thomas Richter +Cc: Heiko Carstens +Cc: Namhyung Kim +Cc: Sumanth Korikkar +Cc: Sven Schnelle +Cc: Vasily Gorbik +Link: https://lore.kernel.org/r/20240125100351.936262-1-tmricht@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/script.sh | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/script.sh b/tools/perf/tests/shell/script.sh +index 5ae7bd0031a8..2973adab445d 100755 +--- a/tools/perf/tests/shell/script.sh ++++ b/tools/perf/tests/shell/script.sh +@@ -54,7 +54,14 @@ def sample_table(*args): + def call_path_table(*args): + print(f'call_path_table({args}') + _end_of_file_ +- perf record -g -o "${perfdatafile}" true ++ case $(uname -m) ++ in s390x) ++ cmd_flags="--call-graph dwarf -e cpu-clock";; ++ *) ++ cmd_flags="-g";; ++ esac ++ ++ perf record $cmd_flags -o "${perfdatafile}" true + perf script -i "${perfdatafile}" -s "${db_test}" + echo "DB test [Success]" + } +-- +2.43.0 + diff --git a/queue-6.7/perf-tests-add-perf-script-test.patch b/queue-6.7/perf-tests-add-perf-script-test.patch new file mode 100644 index 00000000000..a82701a807f --- /dev/null +++ b/queue-6.7/perf-tests-add-perf-script-test.patch @@ -0,0 +1,108 @@ +From 410441f34000a784c201708b8d811e633adcee52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 09:40:57 -0800 +Subject: perf tests: Add perf script test + +From: Ian Rogers + +[ Upstream commit bb177a85e82b37d3b76e65f3f773e8502be49d9b ] + +Start a new set of shell tests for testing perf script. The initial +contribution is checking that some perf db-export functionality works +as reported in this regression by Ben Gainey : +https://lore.kernel.org/lkml/20231207140911.3240408-1-ben.gainey@arm.com/ + +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Tested-by: Ben Gainey +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: https://lore.kernel.org/r/20231207174057.1482161-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 2dac1f089add ("perf test: Fix 'perf script' tests on s390") +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/script.sh | 66 ++++++++++++++++++++++++++++++++ + 1 file changed, 66 insertions(+) + create mode 100755 tools/perf/tests/shell/script.sh + +diff --git a/tools/perf/tests/shell/script.sh b/tools/perf/tests/shell/script.sh +new file mode 100755 +index 000000000000..5ae7bd0031a8 +--- /dev/null ++++ b/tools/perf/tests/shell/script.sh +@@ -0,0 +1,66 @@ ++#!/bin/sh ++# perf script tests ++# SPDX-License-Identifier: GPL-2.0 ++ ++set -e ++ ++temp_dir=$(mktemp -d /tmp/perf-test-script.XXXXXXXXXX) ++ ++perfdatafile="${temp_dir}/perf.data" ++db_test="${temp_dir}/db_test.py" ++ ++err=0 ++ ++cleanup() ++{ ++ trap - EXIT TERM INT ++ sane=$(echo "${temp_dir}" | cut -b 1-21) ++ if [ "${sane}" = "/tmp/perf-test-script" ] ; then ++ echo "--- Cleaning up ---" ++ rm -f "${temp_dir}/"* ++ rmdir "${temp_dir}" ++ fi ++} ++ ++trap_cleanup() ++{ ++ cleanup ++ exit 1 ++} ++ ++trap trap_cleanup EXIT TERM INT ++ ++ ++test_db() ++{ ++ echo "DB test" ++ ++ # Check if python script is supported ++ libpython=$(perf version --build-options | grep python | grep -cv OFF) ++ if [ "${libpython}" != "1" ] ; then ++ echo "SKIP: python scripting is not supported" ++ err=2 ++ return ++ fi ++ ++ cat << "_end_of_file_" > "${db_test}" ++perf_db_export_mode = True ++perf_db_export_calls = False ++perf_db_export_callchains = True ++ ++def sample_table(*args): ++ print(f'sample_table({args})') ++ ++def call_path_table(*args): ++ print(f'call_path_table({args}') ++_end_of_file_ ++ perf record -g -o "${perfdatafile}" true ++ perf script -i "${perfdatafile}" -s "${db_test}" ++ echo "DB test [Success]" ++} ++ ++test_db ++ ++cleanup ++ ++exit $err +-- +2.43.0 + diff --git a/queue-6.7/phy-qcom-qmp-usb-fix-register-offsets-for-ipq8074-ip.patch b/queue-6.7/phy-qcom-qmp-usb-fix-register-offsets-for-ipq8074-ip.patch new file mode 100644 index 00000000000..186b433e66b --- /dev/null +++ b/queue-6.7/phy-qcom-qmp-usb-fix-register-offsets-for-ipq8074-ip.patch @@ -0,0 +1,69 @@ +From 22e14995d5484ed396ea4792fe8a0fff4cc4653b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 18:09:19 +0200 +Subject: phy: qcom-qmp-usb: fix register offsets for ipq8074/ipq6018 + +From: Mantas Pucka + +[ Upstream commit f74c35b630d40d414ca6b53f7b1b468dd4abf478 ] + +Commit 2be22aae6b18 ("phy: qcom-qmp-usb: populate offsets configuration") +introduced register offsets to the driver but for ipq8074/ipq6018 they do +not match what was in the old style device tree. Example from old +ipq6018.dtsi: + +<0x00078200 0x130>, /* Tx */ +<0x00078400 0x200>, /* Rx */ +<0x00078800 0x1f8>, /* PCS */ +<0x00078600 0x044>; /* PCS misc */ + +which would translate to: +{.., .pcs = 0x800, .pcs_misc = 0x600, .tx = 0x200, .rx = 0x400 } + +but was translated to: +{.., .pcs = 0x600, .tx = 0x200, .rx = 0x400 } + +So split usb_offsets and fix USB initialization for IPQ8074 and IPQ6018. +Tested only on IPQ6018 + +Fixes: 2be22aae6b18 ("phy: qcom-qmp-usb: populate offsets configuration") +Signed-off-by: Mantas Pucka +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/1706026160-17520-2-git-send-email-mantas@8devices.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c +index 02f156298e77..896a37c1e592 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c +@@ -1276,6 +1276,14 @@ static const char * const qmp_phy_vreg_l[] = { + "vdda-phy", "vdda-pll", + }; + ++static const struct qmp_usb_offsets qmp_usb_offsets_ipq8074 = { ++ .serdes = 0, ++ .pcs = 0x800, ++ .pcs_misc = 0x600, ++ .tx = 0x200, ++ .rx = 0x400, ++}; ++ + static const struct qmp_usb_offsets qmp_usb_offsets_ipq9574 = { + .serdes = 0, + .pcs = 0x800, +@@ -1320,7 +1328,7 @@ static const struct qmp_usb_offsets qmp_usb_offsets_v5 = { + static const struct qmp_phy_cfg ipq8074_usb3phy_cfg = { + .lanes = 1, + +- .offsets = &qmp_usb_offsets_v3, ++ .offsets = &qmp_usb_offsets_ipq8074, + + .serdes_tbl = ipq8074_usb3_serdes_tbl, + .serdes_tbl_num = ARRAY_SIZE(ipq8074_usb3_serdes_tbl), +-- +2.43.0 + diff --git a/queue-6.7/phy-qcom-qmp-usb-fix-serdes-init-sequence-for-ipq601.patch b/queue-6.7/phy-qcom-qmp-usb-fix-serdes-init-sequence-for-ipq601.patch new file mode 100644 index 00000000000..2a3857af88f --- /dev/null +++ b/queue-6.7/phy-qcom-qmp-usb-fix-serdes-init-sequence-for-ipq601.patch @@ -0,0 +1,66 @@ +From f69fe81b4beeef8e6bace080b99473509894a2fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 18:09:20 +0200 +Subject: phy: qcom-qmp-usb: fix serdes init sequence for IPQ6018 + +From: Mantas Pucka + +[ Upstream commit 62a5df451ab911421da96655fcc4d1e269ff6e2f ] + +Commit 23fd679249df ("phy: qcom-qmp: add USB3 PHY support for IPQ6018") +noted that IPQ6018 init is identical to IPQ8074. Yet downstream uses +separate serdes init sequence for IPQ6018. Since already existing IPQ9574 +serdes init sequence is identical, just reuse it and fix failing USB3 mode +in IPQ6018. + +Fixes: 23fd679249df ("phy: qcom-qmp: add USB3 PHY support for IPQ6018") +Signed-off-by: Mantas Pucka +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/1706026160-17520-3-git-send-email-mantas@8devices.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-qmp-usb.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c +index 896a37c1e592..a3719719e2e0 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c +@@ -1325,6 +1325,24 @@ static const struct qmp_usb_offsets qmp_usb_offsets_v5 = { + .rx = 0x1000, + }; + ++static const struct qmp_phy_cfg ipq6018_usb3phy_cfg = { ++ .lanes = 1, ++ ++ .offsets = &qmp_usb_offsets_ipq8074, ++ ++ .serdes_tbl = ipq9574_usb3_serdes_tbl, ++ .serdes_tbl_num = ARRAY_SIZE(ipq9574_usb3_serdes_tbl), ++ .tx_tbl = msm8996_usb3_tx_tbl, ++ .tx_tbl_num = ARRAY_SIZE(msm8996_usb3_tx_tbl), ++ .rx_tbl = ipq8074_usb3_rx_tbl, ++ .rx_tbl_num = ARRAY_SIZE(ipq8074_usb3_rx_tbl), ++ .pcs_tbl = ipq8074_usb3_pcs_tbl, ++ .pcs_tbl_num = ARRAY_SIZE(ipq8074_usb3_pcs_tbl), ++ .vreg_list = qmp_phy_vreg_l, ++ .num_vregs = ARRAY_SIZE(qmp_phy_vreg_l), ++ .regs = qmp_v3_usb3phy_regs_layout, ++}; ++ + static const struct qmp_phy_cfg ipq8074_usb3phy_cfg = { + .lanes = 1, + +@@ -2233,7 +2251,7 @@ static int qmp_usb_probe(struct platform_device *pdev) + static const struct of_device_id qmp_usb_of_match_table[] = { + { + .compatible = "qcom,ipq6018-qmp-usb3-phy", +- .data = &ipq8074_usb3phy_cfg, ++ .data = &ipq6018_usb3phy_cfg, + }, { + .compatible = "qcom,ipq8074-qmp-usb3-phy", + .data = &ipq8074_usb3phy_cfg, +-- +2.43.0 + diff --git a/queue-6.7/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch b/queue-6.7/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch new file mode 100644 index 00000000000..5d86337704c --- /dev/null +++ b/queue-6.7/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch @@ -0,0 +1,51 @@ +From 144a1d1818bf5ed4c22b91c78da2855502dc1334 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 18:37:03 +0900 +Subject: phy: renesas: rcar-gen3-usb2: Fix returning wrong error code + +From: Yoshihiro Shimoda + +[ Upstream commit 249abaf3bf0dd07f5ddebbb2fe2e8f4d675f074e ] + +Even if device_create_file() returns error code, +rcar_gen3_phy_usb2_probe() will return zero because the "ret" is +variable shadowing. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202312161021.gOLDl48K-lkp@intel.com/ +Fixes: 441a681b8843 ("phy: rcar-gen3-usb2: fix implementation for runtime PM") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240105093703.3359949-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/renesas/phy-rcar-gen3-usb2.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index e53eace7c91e..6387c0d34c55 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -673,8 +673,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + channel->irq = platform_get_irq_optional(pdev, 0); + channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node); + if (channel->dr_mode != USB_DR_MODE_UNKNOWN) { +- int ret; +- + channel->is_otg_channel = true; + channel->uses_otg_pins = !of_property_read_bool(dev->of_node, + "renesas,no-otg-pins"); +@@ -738,8 +736,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + ret = PTR_ERR(provider); + goto error; + } else if (channel->is_otg_channel) { +- int ret; +- + ret = device_create_file(dev, &dev_attr_role); + if (ret < 0) + goto error; +-- +2.43.0 + diff --git a/queue-6.7/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch b/queue-6.7/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch new file mode 100644 index 00000000000..6f3ff0d7d39 --- /dev/null +++ b/queue-6.7/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch @@ -0,0 +1,75 @@ +From 13b12e0b2a785bfd86d5028b491e57e8784cfd63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 14:05:54 +0200 +Subject: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP + +From: Tony Lindgren + +[ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] + +If the external phy working together with phy-omap-usb2 does not implement +send_srp(), we may still attempt to call it. This can happen on an idle +Ethernet gadget triggering a wakeup for example: + +configfs-gadget.g1 gadget.0: ECM Suspend +configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup +... +Unable to handle kernel NULL pointer dereference at virtual address +00000000 when execute +... +PC is at 0x0 +LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] +... +musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] +usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] +eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c +dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 +sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 +__dev_queue_xmit from arp_solicit+0xf0/0x268 +arp_solicit from neigh_probe+0x54/0x7c +neigh_probe from __neigh_event_send+0x22c/0x47c +__neigh_event_send from neigh_resolve_output+0x14c/0x1c0 +neigh_resolve_output from ip_finish_output2+0x1c8/0x628 +ip_finish_output2 from ip_send_skb+0x40/0xd8 +ip_send_skb from udp_send_skb+0x124/0x340 +udp_send_skb from udp_sendmsg+0x780/0x984 +udp_sendmsg from __sys_sendto+0xd8/0x158 +__sys_sendto from ret_fast_syscall+0x0/0x58 + +Let's fix the issue by checking for send_srp() and set_vbus() before +calling them. For USB peripheral only cases these both could be NULL. + +Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-omap-usb2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c +index dd2913ac0fa2..78e19b128962 100644 +--- a/drivers/phy/ti/phy-omap-usb2.c ++++ b/drivers/phy/ti/phy-omap-usb2.c +@@ -117,7 +117,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->set_vbus) + return -ENODEV; + + return phy->comparator->set_vbus(phy->comparator, enabled); +@@ -127,7 +127,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->start_srp) + return -ENODEV; + + return phy->comparator->start_srp(phy->comparator); +-- +2.43.0 + diff --git a/queue-6.7/series b/queue-6.7/series new file mode 100644 index 00000000000..409b0c67f6e --- /dev/null +++ b/queue-6.7/series @@ -0,0 +1,16 @@ +ext4-regenerate-buddy-after-block-freeing-failed-if-.patch +dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch +dmaengine-ti-k3-udma-report-short-packet-errors.patch +dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch +dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-8073 +phy-qcom-qmp-usb-fix-register-offsets-for-ipq8074-ip.patch +phy-qcom-qmp-usb-fix-serdes-init-sequence-for-ipq601.patch +phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch +perf-tests-add-perf-script-test.patch +perf-test-fix-perf-script-tests-on-s390.patch +xhci-fix-off-by-one-check-when-adding-a-secondary-in.patch +perf-evlist-fix-evlist__new_default-for-1-core-pmu.patch +dmaengine-fix-is_slave_direction-return-false-when-d.patch +phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch +cifs-avoid-redundant-calls-to-disable-multichannel.patch +cifs-failure-to-add-channel-on-iface-should-bump-up-.patch diff --git a/queue-6.7/xhci-fix-off-by-one-check-when-adding-a-secondary-in.patch b/queue-6.7/xhci-fix-off-by-one-check-when-adding-a-secondary-in.patch new file mode 100644 index 00000000000..07fd7705280 --- /dev/null +++ b/queue-6.7/xhci-fix-off-by-one-check-when-adding-a-secondary-in.patch @@ -0,0 +1,47 @@ +From b7b4de7b1fca79555ff324d34ff46257bf2b7b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jan 2024 17:27:35 +0200 +Subject: xhci: fix off by one check when adding a secondary interrupter. + +From: Mathias Nyman + +[ Upstream commit 09f197225cbc35db8ac135659cdd21bc1e29bda0 ] + +The sanity check of interrupter index when adding a new interrupter is +off by one. intr_num needs to be smaller than xhci->max_interrupter to +fit the array of interrupters. + +Luckily this doesn't cause any real word harm as xhci_add_interrupter() +is always called with a intr_num value smaller than xhci->max_interrupters +in any current kernel. + +Should not be needed for stable as 6.7 kernel and older only supports +one interrupter, with intr_num always being zero. + +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/linux-usb/e9771296-586d-456a-ac24-a82de79bb2e6@moroto.mountain/ +Fixes: 4bf398e15aa4 ("xhci: split allocate interrupter into separate alloacte and add parts") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20240125152737.2983959-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-mem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 62116586848b..9f27adb255e8 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -2286,7 +2286,7 @@ xhci_add_interrupter(struct xhci_hcd *xhci, struct xhci_interrupter *ir, + u64 erst_base; + u32 erst_size; + +- if (intr_num > xhci->max_interrupters) { ++ if (intr_num >= xhci->max_interrupters) { + xhci_warn(xhci, "Can't add interrupter %d, max interrupters %d\n", + intr_num, xhci->max_interrupters); + return -EINVAL; +-- +2.43.0 +