From: Sasha Levin Date: Wed, 7 Feb 2024 16:25:07 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v6.1.78~76 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7cf3f3db6a1c7bc17eda268be9120ca0b3c58560;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/cifs-failure-to-add-channel-on-iface-should-bump-up-.patch b/queue-6.1/cifs-failure-to-add-channel-on-iface-should-bump-up-.patch new file mode 100644 index 00000000000..b2b76734234 --- /dev/null +++ b/queue-6.1/cifs-failure-to-add-channel-on-iface-should-bump-up-.patch @@ -0,0 +1,51 @@ +From 2e021c8ee43ecdd814ff7509ed18be2981d3430e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Feb 2024 11:15:29 +0000 +Subject: cifs: failure to add channel on iface should bump up weight + +From: Shyam Prasad N + +[ Upstream commit 6aac002bcfd554aff6d3ebb55e1660d078d70ab0 ] + +After the interface selection policy change to do a weighted +round robin, each iface maintains a weight_fulfilled. When the +weight_fulfilled reaches the total weight for the iface, we know +that the weights can be reset and ifaces can be allocated from +scratch again. + +During channel allocation failures on a particular channel, +weight_fulfilled is not incremented. If a few interfaces are +inactive, we could end up in a situation where the active +interfaces are all allocated for the total_weight, and inactive +ones are all that remain. This can cause a situation where +no more channels can be allocated further. + +This change fixes it by increasing weight_fulfilled, even when +channel allocation failure happens. This could mean that if +there are temporary failures in channel allocation, the iface +weights may not strictly be adhered to. But that's still okay. + +Fixes: a6d8fb54a515 ("cifs: distribute channels across interfaces based on speed") +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/sess.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/smb/client/sess.c b/fs/smb/client/sess.c +index 634035bcb934..b8e14bcd2c68 100644 +--- a/fs/smb/client/sess.c ++++ b/fs/smb/client/sess.c +@@ -248,6 +248,8 @@ int cifs_try_adding_channels(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses) + &iface->sockaddr, + rc); + kref_put(&iface->refcount, release_iface); ++ /* failure to add chan should increase weight */ ++ iface->weight_fulfilled++; + continue; + } + +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-fix-is_slave_direction-return-false-when-d.patch b/queue-6.1/dmaengine-fix-is_slave_direction-return-false-when-d.patch new file mode 100644 index 00000000000..6d128c734e6 --- /dev/null +++ b/queue-6.1/dmaengine-fix-is_slave_direction-return-false-when-d.patch @@ -0,0 +1,37 @@ +From 0677d0b3453314b6bb5c0292df828c28a3dc066c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 12:28:41 -0500 +Subject: dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV + +From: Frank Li + +[ Upstream commit a22fe1d6dec7e98535b97249fdc95c2be79120bb ] + +is_slave_direction() should return true when direction is DMA_DEV_TO_DEV. + +Fixes: 49920bc66984 ("dmaengine: add new enum dma_transfer_direction") +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20240123172842.3764529-1-Frank.Li@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/linux/dmaengine.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index c923f4e60f24..3576c6e89fea 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -954,7 +954,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan, + + static inline bool is_slave_direction(enum dma_transfer_direction direction) + { +- return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM); ++ return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) || ++ (direction == DMA_DEV_TO_DEV); + } + + static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single( +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch b/queue-6.1/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch new file mode 100644 index 00000000000..9a3f569d290 --- /dev/null +++ b/queue-6.1/dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch @@ -0,0 +1,54 @@ +From 39478d4c4d0acd5abf022aa10557288edc7a56e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jan 2024 11:29:16 -0500 +Subject: dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools + +From: Guanhua Gao + +[ Upstream commit b73e43dcd7a8be26880ef8ff336053b29e79dbc5 ] + +In case of long format of qDMA command descriptor, there are one frame +descriptor, three entries in the frame list and two data entries. So the +size of dma_pool_create for these three fields should be the same with +the total size of entries respectively, or the contents may be overwritten +by the next allocated descriptor. + +Fixes: 7fdf9b05c73b ("dmaengine: fsl-dpaa2-qdma: Add NXP dpaa2 qDMA controller driver for Layerscape SoCs") +Signed-off-by: Guanhua Gao +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20240118162917.2951450-1-Frank.Li@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c +index 8dd40d00a672..6b829d347417 100644 +--- a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c ++++ b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c +@@ -38,15 +38,17 @@ static int dpaa2_qdma_alloc_chan_resources(struct dma_chan *chan) + if (!dpaa2_chan->fd_pool) + goto err; + +- dpaa2_chan->fl_pool = dma_pool_create("fl_pool", dev, +- sizeof(struct dpaa2_fl_entry), +- sizeof(struct dpaa2_fl_entry), 0); ++ dpaa2_chan->fl_pool = ++ dma_pool_create("fl_pool", dev, ++ sizeof(struct dpaa2_fl_entry) * 3, ++ sizeof(struct dpaa2_fl_entry), 0); ++ + if (!dpaa2_chan->fl_pool) + goto err_fd; + + dpaa2_chan->sdd_pool = + dma_pool_create("sdd_pool", dev, +- sizeof(struct dpaa2_qdma_sd_d), ++ sizeof(struct dpaa2_qdma_sd_d) * 2, + sizeof(struct dpaa2_qdma_sd_d), 0); + if (!dpaa2_chan->sdd_pool) + goto err_fl; +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch b/queue-6.1/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch new file mode 100644 index 00000000000..a541bc05217 --- /dev/null +++ b/queue-6.1/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch @@ -0,0 +1,70 @@ +From 6d3b87b113bbf82398ebd68130f11d36c886e233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 11:02:03 +0100 +Subject: dmaengine: fsl-qdma: Fix a memory leak related to the status queue + DMA + +From: Christophe JAILLET + +[ Upstream commit 968bc1d7203d384e72afe34124a1801b7af76514 ] + +This dma_alloc_coherent() is undone in the remove function, but not in the +error handling path of fsl_qdma_probe(). + +Switch to the managed version to fix the issue in the probe and simplify +the remove function. + +Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/a0ef5d0f5a47381617ef339df776ddc68ce48173.1704621515.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 17 +++++------------ + 1 file changed, 5 insertions(+), 12 deletions(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 045ead46ec8f..5cc887acb05b 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -563,11 +563,11 @@ static struct fsl_qdma_queue + /* + * Buffer for queue command + */ +- status_head->cq = dma_alloc_coherent(&pdev->dev, +- sizeof(struct fsl_qdma_format) * +- status_size, +- &status_head->bus_addr, +- GFP_KERNEL); ++ status_head->cq = dmam_alloc_coherent(&pdev->dev, ++ sizeof(struct fsl_qdma_format) * ++ status_size, ++ &status_head->bus_addr, ++ GFP_KERNEL); + if (!status_head->cq) { + devm_kfree(&pdev->dev, status_head); + return NULL; +@@ -1272,8 +1272,6 @@ static void fsl_qdma_cleanup_vchan(struct dma_device *dmadev) + + static int fsl_qdma_remove(struct platform_device *pdev) + { +- int i; +- struct fsl_qdma_queue *status; + struct device_node *np = pdev->dev.of_node; + struct fsl_qdma_engine *fsl_qdma = platform_get_drvdata(pdev); + +@@ -1282,11 +1280,6 @@ static int fsl_qdma_remove(struct platform_device *pdev) + of_dma_controller_free(np); + dma_async_device_unregister(&fsl_qdma->dma_dev); + +- for (i = 0; i < fsl_qdma->block_number; i++) { +- status = fsl_qdma->status[i]; +- dma_free_coherent(&pdev->dev, sizeof(struct fsl_qdma_format) * +- status->n_cq, status->cq, status->bus_addr); +- } + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-20145 b/queue-6.1/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-20145 new file mode 100644 index 00000000000..9166508858c --- /dev/null +++ b/queue-6.1/dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-20145 @@ -0,0 +1,48 @@ +From e6891cb0c0cc53a8220c23937c82106182ea3d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jan 2024 11:02:04 +0100 +Subject: dmaengine: fsl-qdma: Fix a memory leak related to the queue command + DMA + +From: Christophe JAILLET + +[ Upstream commit 3aa58cb51318e329d203857f7a191678e60bb714 ] + +This dma_alloc_coherent() is undone neither in the remove function, nor in +the error handling path of fsl_qdma_probe(). + +Switch to the managed version to fix both issues. + +Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/7f66aa14f59d32b13672dde28602b47deb294e1f.1704621515.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 5cc887acb05b..69385f32e275 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -514,11 +514,11 @@ static struct fsl_qdma_queue + queue_temp = queue_head + i + (j * queue_num); + + queue_temp->cq = +- dma_alloc_coherent(&pdev->dev, +- sizeof(struct fsl_qdma_format) * +- queue_size[i], +- &queue_temp->bus_addr, +- GFP_KERNEL); ++ dmam_alloc_coherent(&pdev->dev, ++ sizeof(struct fsl_qdma_format) * ++ queue_size[i], ++ &queue_temp->bus_addr, ++ GFP_KERNEL); + if (!queue_temp->cq) + return NULL; + queue_temp->block_base = fsl_qdma->block_base + +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-ti-k3-udma-report-short-packet-errors.patch b/queue-6.1/dmaengine-ti-k3-udma-report-short-packet-errors.patch new file mode 100644 index 00000000000..dd672454e8b --- /dev/null +++ b/queue-6.1/dmaengine-ti-k3-udma-report-short-packet-errors.patch @@ -0,0 +1,67 @@ +From 2cdde173517f17a93309444dadc6972be90dd677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 14:37:55 +0530 +Subject: dmaengine: ti: k3-udma: Report short packet errors + +From: Jai Luthra + +[ Upstream commit bc9847c9ba134cfe3398011e343dcf6588c1c902 ] + +Propagate the TR response status to the device using BCDMA +split-channels. For example CSI-RX driver should be able to check if a +frame was not transferred completely (short packet) and needs to be +discarded. + +Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA") +Signed-off-by: Jai Luthra +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20240103-tr_resp_err-v1-1-2fdf6d48ab92@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-udma.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c +index b86b809eb1f7..82e7acfda6ed 100644 +--- a/drivers/dma/ti/k3-udma.c ++++ b/drivers/dma/ti/k3-udma.c +@@ -3963,6 +3963,7 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + { + struct udma_chan *uc = to_udma_chan(&vc->chan); + struct udma_desc *d; ++ u8 status; + + if (!vd) + return; +@@ -3972,12 +3973,12 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + if (d->metadata_size) + udma_fetch_epib(uc, d); + +- /* Provide residue information for the client */ + if (result) { + void *desc_vaddr = udma_curr_cppi5_desc_vaddr(d, d->desc_idx); + + if (cppi5_desc_get_type(desc_vaddr) == + CPPI5_INFO0_DESC_TYPE_VAL_HOST) { ++ /* Provide residue information for the client */ + result->residue = d->residue - + cppi5_hdesc_get_pktlen(desc_vaddr); + if (result->residue) +@@ -3986,7 +3987,12 @@ static void udma_desc_pre_callback(struct virt_dma_chan *vc, + result->result = DMA_TRANS_NOERROR; + } else { + result->residue = 0; +- result->result = DMA_TRANS_NOERROR; ++ /* Propagate TR Response errors to the client */ ++ status = d->hwdesc[0].tr_resp_base->status; ++ if (status) ++ result->result = DMA_TRANS_ABORTED; ++ else ++ result->result = DMA_TRANS_NOERROR; + } + } + } +-- +2.43.0 + diff --git a/queue-6.1/ext4-regenerate-buddy-after-block-freeing-failed-if-.patch b/queue-6.1/ext4-regenerate-buddy-after-block-freeing-failed-if-.patch new file mode 100644 index 00000000000..ac04dacd5ac --- /dev/null +++ b/queue-6.1/ext4-regenerate-buddy-after-block-freeing-failed-if-.patch @@ -0,0 +1,67 @@ +From 82be09cf878fa3d99b8d37c78933f1b233ba67c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jan 2024 22:20:35 +0800 +Subject: ext4: regenerate buddy after block freeing failed if under fc replay + +From: Baokun Li + +[ Upstream commit c9b528c35795b711331ed36dc3dbee90d5812d4e ] + +This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant +mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on +code in mb_free_blocks(), fast commit replay can end up marking as free +blocks that are already marked as such. This causes corruption of the +buddy bitmap so we need to regenerate it in that case. + +Reported-by: Jan Kara +Fixes: 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20240104142040.2835097-4-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index c1515daf1def..40903c172a34 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1118,6 +1118,24 @@ void ext4_mb_generate_buddy(struct super_block *sb, + atomic64_add(period, &sbi->s_mb_generation_time); + } + ++static void mb_regenerate_buddy(struct ext4_buddy *e4b) ++{ ++ int count; ++ int order = 1; ++ void *buddy; ++ ++ while ((buddy = mb_find_buddy(e4b, order++, &count))) ++ mb_set_bits(buddy, 0, count); ++ ++ e4b->bd_info->bb_fragments = 0; ++ memset(e4b->bd_info->bb_counters, 0, ++ sizeof(*e4b->bd_info->bb_counters) * ++ (e4b->bd_sb->s_blocksize_bits + 2)); ++ ++ ext4_mb_generate_buddy(e4b->bd_sb, e4b->bd_buddy, ++ e4b->bd_bitmap, e4b->bd_group, e4b->bd_info); ++} ++ + /* The buddy information is attached the buddy cache inode + * for convenience. The information regarding each group + * is loaded via ext4_mb_load_buddy. The information involve +@@ -1796,6 +1814,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b, + ext4_mark_group_bitmap_corrupted( + sb, e4b->bd_group, + EXT4_GROUP_INFO_BBITMAP_CORRUPT); ++ } else { ++ mb_regenerate_buddy(e4b); + } + goto done; + } +-- +2.43.0 + diff --git a/queue-6.1/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch b/queue-6.1/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch new file mode 100644 index 00000000000..658e1068eed --- /dev/null +++ b/queue-6.1/phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch @@ -0,0 +1,51 @@ +From 313bedac5977ba81060e8078d21cedd21f20e169 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 18:37:03 +0900 +Subject: phy: renesas: rcar-gen3-usb2: Fix returning wrong error code + +From: Yoshihiro Shimoda + +[ Upstream commit 249abaf3bf0dd07f5ddebbb2fe2e8f4d675f074e ] + +Even if device_create_file() returns error code, +rcar_gen3_phy_usb2_probe() will return zero because the "ret" is +variable shadowing. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/202312161021.gOLDl48K-lkp@intel.com/ +Fixes: 441a681b8843 ("phy: rcar-gen3-usb2: fix implementation for runtime PM") +Signed-off-by: Yoshihiro Shimoda +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240105093703.3359949-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/renesas/phy-rcar-gen3-usb2.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index 9de617ca9daa..7e61c6b278a7 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -675,8 +675,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + channel->irq = platform_get_irq_optional(pdev, 0); + channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node); + if (channel->dr_mode != USB_DR_MODE_UNKNOWN) { +- int ret; +- + channel->is_otg_channel = true; + channel->uses_otg_pins = !of_property_read_bool(dev->of_node, + "renesas,no-otg-pins"); +@@ -740,8 +738,6 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + ret = PTR_ERR(provider); + goto error; + } else if (channel->is_otg_channel) { +- int ret; +- + ret = device_create_file(dev, &dev_attr_role); + if (ret < 0) + goto error; +-- +2.43.0 + diff --git a/queue-6.1/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch b/queue-6.1/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch new file mode 100644 index 00000000000..ed0dbc78497 --- /dev/null +++ b/queue-6.1/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch @@ -0,0 +1,75 @@ +From 73008f24f070791f71b4b7607e53c746ce3129b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 14:05:54 +0200 +Subject: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP + +From: Tony Lindgren + +[ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] + +If the external phy working together with phy-omap-usb2 does not implement +send_srp(), we may still attempt to call it. This can happen on an idle +Ethernet gadget triggering a wakeup for example: + +configfs-gadget.g1 gadget.0: ECM Suspend +configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup +... +Unable to handle kernel NULL pointer dereference at virtual address +00000000 when execute +... +PC is at 0x0 +LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] +... +musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] +usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] +eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c +dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 +sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 +__dev_queue_xmit from arp_solicit+0xf0/0x268 +arp_solicit from neigh_probe+0x54/0x7c +neigh_probe from __neigh_event_send+0x22c/0x47c +__neigh_event_send from neigh_resolve_output+0x14c/0x1c0 +neigh_resolve_output from ip_finish_output2+0x1c8/0x628 +ip_finish_output2 from ip_send_skb+0x40/0xd8 +ip_send_skb from udp_send_skb+0x124/0x340 +udp_send_skb from udp_sendmsg+0x780/0x984 +udp_sendmsg from __sys_sendto+0xd8/0x158 +__sys_sendto from ret_fast_syscall+0x0/0x58 + +Let's fix the issue by checking for send_srp() and set_vbus() before +calling them. For USB peripheral only cases these both could be NULL. + +Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-omap-usb2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c +index 31a775877f6e..63c45809943f 100644 +--- a/drivers/phy/ti/phy-omap-usb2.c ++++ b/drivers/phy/ti/phy-omap-usb2.c +@@ -116,7 +116,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->set_vbus) + return -ENODEV; + + return phy->comparator->set_vbus(phy->comparator, enabled); +@@ -126,7 +126,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->start_srp) + return -ENODEV; + + return phy->comparator->start_srp(phy->comparator); +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..e37109c68bb --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,9 @@ +ext4-regenerate-buddy-after-block-freeing-failed-if-.patch +dmaengine-fsl-dpaa2-qdma-fix-the-size-of-dma-pools.patch +dmaengine-ti-k3-udma-report-short-packet-errors.patch +dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch +dmaengine-fsl-qdma-fix-a-memory-leak-related-to-the-.patch-20145 +phy-renesas-rcar-gen3-usb2-fix-returning-wrong-error.patch +dmaengine-fix-is_slave_direction-return-false-when-d.patch +phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch +cifs-failure-to-add-channel-on-iface-should-bump-up-.patch