From: Sasha Levin Date: Thu, 15 Dec 2022 17:25:52 +0000 (-0500) Subject: Fixes for 4.19 X-Git-Tag: v5.4.228~11 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8a7cf86680658722663499054a708c1b93833cc7;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/asoc-ops-check-bounds-for-second-channel-in-snd_soc_.patch b/queue-4.19/asoc-ops-check-bounds-for-second-channel-in-snd_soc_.patch new file mode 100644 index 00000000000..8ca05ba4bb7 --- /dev/null +++ b/queue-4.19/asoc-ops-check-bounds-for-second-channel-in-snd_soc_.patch @@ -0,0 +1,41 @@ +From 64fdc6b3d35c794dc7c13167e212e90fd4c998ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 14:41:37 +0100 +Subject: ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() + +From: Mark Brown + +[ Upstream commit 97eea946b93961fffd29448dcda7398d0d51c4b2 ] + +The bounds checks in snd_soc_put_volsw_sx() are only being applied to the +first channel, meaning it is possible to write out of bounds values to the +second channel in stereo controls. Add appropriate checks. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220511134137.169575-2-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-ops.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c +index 2faf95d4bb75..fbd46a737652 100644 +--- a/sound/soc/soc-ops.c ++++ b/sound/soc/soc-ops.c +@@ -460,6 +460,12 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol, + if (snd_soc_volsw_is_stereo(mc)) { + val_mask = mask << rshift; + val2 = (ucontrol->value.integer.value[1] + min) & mask; ++ ++ if (mc->platform_max && val2 > mc->platform_max) ++ return -EINVAL; ++ if (val2 > max) ++ return -EINVAL; ++ + val2 = val2 << rshift; + + err = snd_soc_component_update_bits(component, reg2, val_mask, +-- +2.35.1 + diff --git a/queue-4.19/can-mcba_usb-fix-termination-command-argument.patch b/queue-4.19/can-mcba_usb-fix-termination-command-argument.patch new file mode 100644 index 00000000000..347cddffc13 --- /dev/null +++ b/queue-4.19/can-mcba_usb-fix-termination-command-argument.patch @@ -0,0 +1,82 @@ +From 216210709b1287004a66970804d3cf591c613de9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 00:25:03 +0900 +Subject: can: mcba_usb: Fix termination command argument + +From: Yasushi SHOJI + +[ Upstream commit 1a8e3bd25f1e789c8154e11ea24dc3ec5a4c1da0 ] + +Microchip USB Analyzer can activate the internal termination resistors +by setting the "termination" option ON, or OFF to to deactivate them. +As I've observed, both with my oscilloscope and captured USB packets +below, you must send "0" to turn it ON, and "1" to turn it OFF. + +From the schematics in the user's guide, I can confirm that you must +drive the CAN_RES signal LOW "0" to activate the resistors. + +Reverse the argument value of usb_msg.termination to fix this. + +These are the two commands sequence, ON then OFF. + +> No. Time Source Destination Protocol Length Info +> 1 0.000000 host 1.3.1 USB 46 URB_BULK out +> +> Frame 1: 46 bytes on wire (368 bits), 46 bytes captured (368 bits) +> USB URB +> Leftover Capture Data: a80000000000000000000000000000000000a8 +> +> No. Time Source Destination Protocol Length Info +> 2 4.372547 host 1.3.1 USB 46 URB_BULK out +> +> Frame 2: 46 bytes on wire (368 bits), 46 bytes captured (368 bits) +> USB URB +> Leftover Capture Data: a80100000000000000000000000000000000a9 + +Signed-off-by: Yasushi SHOJI +Link: https://lore.kernel.org/all/20221124152504.125994-1-yashi@spacecubics.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/mcba_usb.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c +index ea1de06009d6..093458fbde68 100644 +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -58,6 +58,10 @@ + #define MCBA_VER_REQ_USB 1 + #define MCBA_VER_REQ_CAN 2 + ++/* Drive the CAN_RES signal LOW "0" to activate R24 and R25 */ ++#define MCBA_VER_TERMINATION_ON 0 ++#define MCBA_VER_TERMINATION_OFF 1 ++ + #define MCBA_SIDL_EXID_MASK 0x8 + #define MCBA_DLC_MASK 0xf + #define MCBA_DLC_RTR_MASK 0x40 +@@ -480,7 +484,7 @@ static void mcba_usb_process_ka_usb(struct mcba_priv *priv, + priv->usb_ka_first_pass = false; + } + +- if (msg->termination_state) ++ if (msg->termination_state == MCBA_VER_TERMINATION_ON) + priv->can.termination = MCBA_TERMINATION_ENABLED; + else + priv->can.termination = MCBA_TERMINATION_DISABLED; +@@ -800,9 +804,9 @@ static int mcba_set_termination(struct net_device *netdev, u16 term) + }; + + if (term == MCBA_TERMINATION_ENABLED) +- usb_msg.termination = 1; ++ usb_msg.termination = MCBA_VER_TERMINATION_ON; + else +- usb_msg.termination = 0; ++ usb_msg.termination = MCBA_VER_TERMINATION_OFF; + + mcba_usb_xmit_cmd(priv, (struct mcba_usb_msg *)&usb_msg); + +-- +2.35.1 + diff --git a/queue-4.19/can-sja1000-fix-size-of-ocr_mode_mask-define.patch b/queue-4.19/can-sja1000-fix-size-of-ocr_mode_mask-define.patch new file mode 100644 index 00000000000..b9d8847b561 --- /dev/null +++ b/queue-4.19/can-sja1000-fix-size-of-ocr_mode_mask-define.patch @@ -0,0 +1,36 @@ +From 5a0b37520cdd09e4b642bb7eb92114736d97ec04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 08:16:36 +0100 +Subject: can: sja1000: fix size of OCR_MODE_MASK define + +From: Heiko Schocher + +[ Upstream commit 26e8f6a75248247982458e8237b98c9fb2ffcf9d ] + +bitfield mode in ocr register has only 2 bits not 3, so correct +the OCR_MODE_MASK define. + +Signed-off-by: Heiko Schocher +Link: https://lore.kernel.org/all/20221123071636.2407823-1-hs@denx.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + include/linux/can/platform/sja1000.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/can/platform/sja1000.h b/include/linux/can/platform/sja1000.h +index 5755ae5a4712..6a869682c120 100644 +--- a/include/linux/can/platform/sja1000.h ++++ b/include/linux/can/platform/sja1000.h +@@ -14,7 +14,7 @@ + #define OCR_MODE_TEST 0x01 + #define OCR_MODE_NORMAL 0x02 + #define OCR_MODE_CLOCK 0x03 +-#define OCR_MODE_MASK 0x07 ++#define OCR_MODE_MASK 0x03 + #define OCR_TX0_INVERT 0x04 + #define OCR_TX0_PULLDOWN 0x08 + #define OCR_TX0_PULLUP 0x10 +-- +2.35.1 + diff --git a/queue-4.19/net-loopback-use-net_name_predictable-for-name_assig.patch b/queue-4.19/net-loopback-use-net_name_predictable-for-name_assig.patch new file mode 100644 index 00000000000..edbb98a00e9 --- /dev/null +++ b/queue-4.19/net-loopback-use-net_name_predictable-for-name_assig.patch @@ -0,0 +1,50 @@ +From 7bb8ba1f4b99cb06a42cba9d4972e877a4adc1e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 15:18:28 +0100 +Subject: net: loopback: use NET_NAME_PREDICTABLE for name_assign_type + +From: Rasmus Villemoes + +[ Upstream commit 31d929de5a112ee1b977a89c57de74710894bbbf ] + +When the name_assign_type attribute was introduced (commit +685343fc3ba6, "net: add name_assign_type netdev attribute"), the +loopback device was explicitly mentioned as one which would make use +of NET_NAME_PREDICTABLE: + + The name_assign_type attribute gives hints where the interface name of a + given net-device comes from. These values are currently defined: +... + NET_NAME_PREDICTABLE: + The ifname has been assigned by the kernel in a predictable way + that is guaranteed to avoid reuse and always be the same for a + given device. Examples include statically created devices like + the loopback device [...] + +Switch to that so that reading /sys/class/net/lo/name_assign_type +produces something sensible instead of returning -EINVAL. + +Signed-off-by: Rasmus Villemoes +Reviewed-by: Jacob Keller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/loopback.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c +index d192936b76cf..7863918592db 100644 +--- a/drivers/net/loopback.c ++++ b/drivers/net/loopback.c +@@ -210,7 +210,7 @@ static __net_init int loopback_net_init(struct net *net) + int err; + + err = -ENOMEM; +- dev = alloc_netdev(0, "lo", NET_NAME_UNKNOWN, loopback_setup); ++ dev = alloc_netdev(0, "lo", NET_NAME_PREDICTABLE, loopback_setup); + if (!dev) + goto out; + +-- +2.35.1 + diff --git a/queue-4.19/pinctrl-meditatek-startup-with-the-irqs-disabled.patch b/queue-4.19/pinctrl-meditatek-startup-with-the-irqs-disabled.patch new file mode 100644 index 00000000000..e32b4eb8f5a --- /dev/null +++ b/queue-4.19/pinctrl-meditatek-startup-with-the-irqs-disabled.patch @@ -0,0 +1,102 @@ +From 7d61cfeb7e44f37e8a480780a1899b165e2c7d5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 00:38:55 +0100 +Subject: pinctrl: meditatek: Startup with the IRQs disabled + +From: Ricardo Ribalda + +[ Upstream commit 11780e37565db4dd064d3243ca68f755c13f65b4 ] + +If the system is restarted via kexec(), the peripherals do not start +with a known state. + +If the previous system had enabled an IRQs we will receive unexected +IRQs that can lock the system. + +[ 28.109251] watchdog: BUG: soft lockup - CPU#0 stuck for 26s! +[swapper/0:0] +[ 28.109263] Modules linked in: +[ 28.109273] CPU: 0 PID: 0 Comm: swapper/0 Not tainted +5.15.79-14458-g4b9edf7b1ac6 #1 9f2e76613148af94acccd64c609a552fb4b4354b +[ 28.109284] Hardware name: Google Elm (DT) +[ 28.109290] pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS + BTYPE=--) +[ 28.109298] pc : __do_softirq+0xa0/0x388 +[ 28.109309] lr : __do_softirq+0x70/0x388 +[ 28.109316] sp : ffffffc008003ee0 +[ 28.109321] x29: ffffffc008003f00 x28: 000000000000000a x27: +0000000000000080 +[ 28.109334] x26: 0000000000000001 x25: ffffffefa7b350c0 x24: +ffffffefa7b47480 +[ 28.109346] x23: ffffffefa7b3d000 x22: 0000000000000000 x21: +ffffffefa7b0fa40 +[ 28.109358] x20: ffffffefa7b005b0 x19: ffffffefa7b47480 x18: +0000000000065b6b +[ 28.109370] x17: ffffffefa749c8b0 x16: 000000000000018c x15: +00000000000001b8 +[ 28.109382] x14: 00000000000d3b6b x13: 0000000000000006 x12: +0000000000057e91 +[ 28.109394] x11: 0000000000000000 x10: 0000000000000000 x9 : +ffffffefa7b47480 +[ 28.109406] x8 : 00000000000000e0 x7 : 000000000f424000 x6 : +0000000000000000 +[ 28.109418] x5 : ffffffefa7dfaca0 x4 : ffffffefa7dfadf0 x3 : +000000000000000f +[ 28.109429] x2 : 0000000000000000 x1 : 0000000000000100 x0 : +0000000001ac65c5 +[ 28.109441] Call trace: +[ 28.109447] __do_softirq+0xa0/0x388 +[ 28.109454] irq_exit+0xc0/0xe0 +[ 28.109464] handle_domain_irq+0x68/0x90 +[ 28.109473] gic_handle_irq+0xac/0xf0 +[ 28.109480] call_on_irq_stack+0x28/0x50 +[ 28.109488] do_interrupt_handler+0x44/0x58 +[ 28.109496] el1_interrupt+0x30/0x58 +[ 28.109506] el1h_64_irq_handler+0x18/0x24 +[ 28.109512] el1h_64_irq+0x7c/0x80 +[ 28.109519] arch_local_irq_enable+0xc/0x18 +[ 28.109529] default_idle_call+0x40/0x140 +[ 28.109539] do_idle+0x108/0x290 +[ 28.109547] cpu_startup_entry+0x2c/0x30 +[ 28.109554] rest_init+0xe8/0xf8 +[ 28.109562] arch_call_rest_init+0x18/0x24 +[ 28.109571] start_kernel+0x338/0x42c +[ 28.109578] __primary_switched+0xbc/0xc4 +[ 28.109588] Kernel panic - not syncing: softlockup: hung tasks + +Signed-off-by: Ricardo Ribalda +Link: https://lore.kernel.org/r/20221122-mtk-pinctrl-v1-1-bedf5655a3d2@chromium.org +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Matthias Brugger +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/mtk-eint.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c +index 564cfaee129d..55e3305ede81 100644 +--- a/drivers/pinctrl/mediatek/mtk-eint.c ++++ b/drivers/pinctrl/mediatek/mtk-eint.c +@@ -277,12 +277,15 @@ static struct irq_chip mtk_eint_irq_chip = { + + static unsigned int mtk_eint_hw_init(struct mtk_eint *eint) + { +- void __iomem *reg = eint->base + eint->regs->dom_en; ++ void __iomem *dom_en = eint->base + eint->regs->dom_en; ++ void __iomem *mask_set = eint->base + eint->regs->mask_set; + unsigned int i; + + for (i = 0; i < eint->hw->ap_num; i += 32) { +- writel(0xffffffff, reg); +- reg += 4; ++ writel(0xffffffff, dom_en); ++ writel(0xffffffff, mask_set); ++ dom_en += 4; ++ mask_set += 4; + } + + return 0; +-- +2.35.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 36ab4e51e8e..874a7c952a9 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -2,3 +2,8 @@ mm-khugepaged-fix-gup-fast-interaction-by-sending-ipi.patch mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-collapse-paths.patch block-unhash-blkdev-part-inode-when-the-part-is-deleted.patch nfp-fix-use-after-free-in-area_cache_get.patch +asoc-ops-check-bounds-for-second-channel-in-snd_soc_.patch +pinctrl-meditatek-startup-with-the-irqs-disabled.patch +can-sja1000-fix-size-of-ocr_mode_mask-define.patch +can-mcba_usb-fix-termination-command-argument.patch +net-loopback-use-net_name_predictable-for-name_assig.patch