From: Greg Kroah-Hartman Date: Tue, 11 Jul 2023 20:14:16 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.1.39~122 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8f87a439997983a735e412f48616c3c94fe8ee32;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch iio-adc-ad7192-fix-internal-external-clock-selection.patch iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch mm-mmap-fix-vm_locked-check-in-do_vmi_align_munmap.patch phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch revert-drm-amd-display-edp-do-not-add-non-edid-timings.patch usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch usb-serial-option-add-lara-r6-01b-pids.patch --- diff --git a/queue-6.1/iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch b/queue-6.1/iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch new file mode 100644 index 00000000000..560c1d2beaf --- /dev/null +++ b/queue-6.1/iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch @@ -0,0 +1,36 @@ +From b410a9307bc3a7cdee3c930c98f6fc9cf1d2c484 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Mon, 5 Jun 2023 12:32:22 +0200 +Subject: iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF + +From: Sean Nyekjaer + +commit b410a9307bc3a7cdee3c930c98f6fc9cf1d2c484 upstream. + +Remove special errata handling if FXLS8964AF is used. + +Fixes: af959b7b96b8 ("iio: accel: fxls8962af: fix errata bug E3 - I2C burst reads") +Signed-off-by: Sean Nyekjaer +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230605103223.1400980-2-sean@geanix.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/fxls8962af-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/iio/accel/fxls8962af-core.c ++++ b/drivers/iio/accel/fxls8962af-core.c +@@ -905,9 +905,10 @@ static int fxls8962af_fifo_transfer(stru + int total_length = samples * sample_length; + int ret; + +- if (i2c_verify_client(dev)) ++ if (i2c_verify_client(dev) && ++ data->chip_info->chip_id == FXLS8962AF_DEVICE_ID) + /* +- * Due to errata bug: ++ * Due to errata bug (only applicable on fxls8962af): + * E3: FIFO burst read operation error using I2C interface + * We have to avoid burst reads on I2C.. + */ diff --git a/queue-6.1/iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch b/queue-6.1/iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch new file mode 100644 index 00000000000..b21cbbe5e74 --- /dev/null +++ b/queue-6.1/iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch @@ -0,0 +1,35 @@ +From d1cfbd52ede5e5fabc09992894c5733b4057f159 Mon Sep 17 00:00:00 2001 +From: Sean Nyekjaer +Date: Mon, 5 Jun 2023 12:32:21 +0200 +Subject: iio: accel: fxls8962af: fixup buffer scan element type + +From: Sean Nyekjaer + +commit d1cfbd52ede5e5fabc09992894c5733b4057f159 upstream. + +Scan elements for x,y,z channels is little endian and requires no bit shifts. +LE vs. BE is controlled in register SENS_CONFIG2 and bit LE_BE, default +value is LE. + +Fixes: a3e0b51884ee ("iio: accel: add support for FXLS8962AF/FXLS8964AF accelerometers") +Signed-off-by: Sean Nyekjaer +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230605103223.1400980-1-sean@geanix.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/fxls8962af-core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/iio/accel/fxls8962af-core.c ++++ b/drivers/iio/accel/fxls8962af-core.c +@@ -725,8 +725,7 @@ static const struct iio_event_spec fxls8 + .sign = 's', \ + .realbits = 12, \ + .storagebits = 16, \ +- .shift = 4, \ +- .endianness = IIO_BE, \ ++ .endianness = IIO_LE, \ + }, \ + .event_spec = fxls8962af_event, \ + .num_event_specs = ARRAY_SIZE(fxls8962af_event), \ diff --git a/queue-6.1/iio-adc-ad7192-fix-internal-external-clock-selection.patch b/queue-6.1/iio-adc-ad7192-fix-internal-external-clock-selection.patch new file mode 100644 index 00000000000..ef6ec6fae6d --- /dev/null +++ b/queue-6.1/iio-adc-ad7192-fix-internal-external-clock-selection.patch @@ -0,0 +1,35 @@ +From f7d9e21dd274b97dc0a8dbc136a2ea8506063a96 Mon Sep 17 00:00:00 2001 +From: Fabrizio Lamarque +Date: Tue, 30 May 2023 09:53:08 +0200 +Subject: iio: adc: ad7192: Fix internal/external clock selection + +From: Fabrizio Lamarque + +commit f7d9e21dd274b97dc0a8dbc136a2ea8506063a96 upstream. + +Fix wrong selection of internal clock when mclk is defined. + +Resolve a logical inversion introduced in c9ec2cb328e3. + +Fixes: c9ec2cb328e3 ("iio: adc: ad7192: use devm_clk_get_optional() for mclk") +Signed-off-by: Fabrizio Lamarque +Reviewed-by: Nuno Sa +Cc: +Link: https://lore.kernel.org/r/20230530075311.400686-3-fl.scratchpad@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7192.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/ad7192.c ++++ b/drivers/iio/adc/ad7192.c +@@ -368,7 +368,7 @@ static int ad7192_of_clock_select(struct + clock_sel = AD7192_CLK_INT; + + /* use internal clock */ +- if (st->mclk) { ++ if (!st->mclk) { + if (of_property_read_bool(np, "adi,int-clock-output-enable")) + clock_sel = AD7192_CLK_INT_CO; + } else { diff --git a/queue-6.1/iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch b/queue-6.1/iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch new file mode 100644 index 00000000000..8f12d2bc8ea --- /dev/null +++ b/queue-6.1/iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch @@ -0,0 +1,50 @@ +From 9e58e3a6f8e1c483c86a04903b7b7aa0923e4426 Mon Sep 17 00:00:00 2001 +From: Fabrizio Lamarque +Date: Tue, 30 May 2023 09:53:07 +0200 +Subject: iio: adc: ad7192: Fix null ad7192_state pointer access + +From: Fabrizio Lamarque + +commit 9e58e3a6f8e1c483c86a04903b7b7aa0923e4426 upstream. + +Pointer to indio_dev structure is obtained via spi_get_drvdata() at +the beginning of function ad7192_setup(), but the spi->dev->driver_data +member is not initialized, hence a NULL pointer is returned. + +Fix by changing ad7192_setup() signature to take pointer to struct +iio_dev, and get ad7192_state pointer via st = iio_priv(indio_dev); + +Fixes: bd5dcdeb3fd0 ("iio: adc: ad7192: convert to device-managed functions") +Signed-off-by: Fabrizio Lamarque +Reviewed-by: Nuno Sa +Cc: +Link: https://lore.kernel.org/r/20230530075311.400686-2-fl.scratchpad@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7192.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/ad7192.c ++++ b/drivers/iio/adc/ad7192.c +@@ -381,9 +381,9 @@ static int ad7192_of_clock_select(struct + return clock_sel; + } + +-static int ad7192_setup(struct ad7192_state *st, struct device_node *np) ++static int ad7192_setup(struct iio_dev *indio_dev, struct device_node *np) + { +- struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi); ++ struct ad7192_state *st = iio_priv(indio_dev); + bool rej60_en, refin2_en; + bool buf_en, bipolar, burnout_curr_en; + unsigned long long scale_uv; +@@ -1078,7 +1078,7 @@ static int ad7192_probe(struct spi_devic + } + } + +- ret = ad7192_setup(st, spi->dev.of_node); ++ ret = ad7192_setup(indio_dev, spi->dev.of_node); + if (ret) + return ret; + diff --git a/queue-6.1/mm-mmap-fix-vm_locked-check-in-do_vmi_align_munmap.patch b/queue-6.1/mm-mmap-fix-vm_locked-check-in-do_vmi_align_munmap.patch new file mode 100644 index 00000000000..fd4436d2f36 --- /dev/null +++ b/queue-6.1/mm-mmap-fix-vm_locked-check-in-do_vmi_align_munmap.patch @@ -0,0 +1,34 @@ +From surenb@google.com Tue Jul 11 22:12:29 2023 +From: Suren Baghdasaryan +Date: Mon, 10 Jul 2023 17:46:32 -0700 +Subject: mm/mmap: Fix VM_LOCKED check in do_vmi_align_munmap() +To: gregkh@linuxfoundation.org +Cc: Liam.Howlett@oracle.com, torvalds@linux-foundation.org, vegard.nossum@oracle.com, stable@vger.kernel.org, Suren Baghdasaryan +Message-ID: <20230711004632.579668-1-surenb@google.com> + +From: Suren Baghdasaryan + +6.1 backport of the patch [1] uses 'next' vma instead of 'split' vma. +Fix the mistake. + +[1] commit 606c812eb1d5 ("mm/mmap: Fix error path in do_vmi_align_munmap()") + +Fixes: a149174ff8bb ("mm/mmap: Fix error path in do_vmi_align_munmap()") +Signed-off-by: Suren Baghdasaryan +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + mm/mmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2484,7 +2484,7 @@ do_mas_align_munmap(struct ma_state *mas + error = mas_store_gfp(&mas_detach, split, GFP_KERNEL); + if (error) + goto munmap_gather_failed; +- if (next->vm_flags & VM_LOCKED) ++ if (split->vm_flags & VM_LOCKED) + locked_vm += vma_pages(split); + + count++; diff --git a/queue-6.1/phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch b/queue-6.1/phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch new file mode 100644 index 00000000000..530050d69cc --- /dev/null +++ b/queue-6.1/phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch @@ -0,0 +1,40 @@ +From c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d Mon Sep 17 00:00:00 2001 +From: EJ Hsu +Date: Fri, 9 Jun 2023 14:29:32 +0800 +Subject: phy: tegra: xusb: Clear the driver reference in usb-phy dev + +From: EJ Hsu + +commit c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d upstream. + +For the dual-role port, it will assign the phy dev to usb-phy dev and +use the port dev driver as the dev driver of usb-phy. + +When we try to destroy the port dev, it will destroy its dev driver +as well. But we did not remove the reference from usb-phy dev. This +might cause the use-after-free issue in KASAN. + +Fixes: e8f7d2f409a1 ("phy: tegra: xusb: Add usb-phy support") +Cc: stable@vger.kernel.org + +Signed-off-by: EJ Hsu +Signed-off-by: Haotien Hsu +Acked-by: Thierry Reding +Acked-by: Jon Hunter +Link: https://lore.kernel.org/r/20230609062932.3276509-1-haotienh@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -562,6 +562,7 @@ static void tegra_xusb_port_unregister(s + usb_role_switch_unregister(port->usb_role_sw); + cancel_work_sync(&port->usb_phy_work); + usb_remove_phy(&port->usb_phy); ++ port->usb_phy.dev->driver = NULL; + } + + if (port->ops->remove) diff --git a/queue-6.1/revert-drm-amd-display-edp-do-not-add-non-edid-timings.patch b/queue-6.1/revert-drm-amd-display-edp-do-not-add-non-edid-timings.patch new file mode 100644 index 00000000000..d2e4d0e6e87 --- /dev/null +++ b/queue-6.1/revert-drm-amd-display-edp-do-not-add-non-edid-timings.patch @@ -0,0 +1,43 @@ +From d6149086b45e150c170beaa4546495fd1880724c Mon Sep 17 00:00:00 2001 +From: Hersen Wu +Date: Mon, 26 Jun 2023 13:40:58 -0400 +Subject: Revert "drm/amd/display: edp do not add non-edid timings" + +From: Hersen Wu + +commit d6149086b45e150c170beaa4546495fd1880724c upstream. + +This change causes regression when eDP and external display in mirror +mode. When external display supports low resolution than eDP, use eDP +timing to driver external display may cause corruption on external +display. + +This reverts commit e749dd10e5f292061ad63d2b030194bf7d7d452c. + +Cc: stable@vger.kernel.org +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2655 +Signed-off-by: Hersen Wu +Reviewed-by: Mario Limonciello +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -6972,13 +6972,7 @@ static int amdgpu_dm_connector_get_modes + drm_add_modes_noedid(connector, 640, 480); + } else { + amdgpu_dm_connector_ddc_get_modes(connector, edid); +- /* most eDP supports only timings from its edid, +- * usually only detailed timings are available +- * from eDP edid. timings which are not from edid +- * may damage eDP +- */ +- if (connector->connector_type != DRM_MODE_CONNECTOR_eDP) +- amdgpu_dm_connector_add_common_modes(encoder, connector); ++ amdgpu_dm_connector_add_common_modes(encoder, connector); + amdgpu_dm_connector_add_freesync_modes(connector, edid); + } + amdgpu_dm_fbc_init(connector); diff --git a/queue-6.1/series b/queue-6.1/series index 54ee05aaea5..ddc497fff29 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -371,3 +371,12 @@ ksmbd-avoid-field-overflow-warning.patch arm64-sme-use-str-p-to-clear-ffr-context-field-in-st.patch x86-efi-make-efi_set_virtual_address_map-ibt-safe.patch md-raid1-10-fix-casting-from-randomized-structure-in-raid1_submit_write.patch +usb-serial-option-add-lara-r6-01b-pids.patch +usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch +phy-tegra-xusb-clear-the-driver-reference-in-usb-phy-dev.patch +iio-adc-ad7192-fix-null-ad7192_state-pointer-access.patch +iio-adc-ad7192-fix-internal-external-clock-selection.patch +iio-accel-fxls8962af-errata-bug-only-applicable-for-fxls8962af.patch +iio-accel-fxls8962af-fixup-buffer-scan-element-type.patch +revert-drm-amd-display-edp-do-not-add-non-edid-timings.patch +mm-mmap-fix-vm_locked-check-in-do_vmi_align_munmap.patch diff --git a/queue-6.1/usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch b/queue-6.1/usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch new file mode 100644 index 00000000000..c37f46c5460 --- /dev/null +++ b/queue-6.1/usb-dwc3-gadget-propagate-core-init-errors-to-udc-during-pullup.patch @@ -0,0 +1,52 @@ +From c0aabed9cabe057309779a9e26fe86a113d24dad Mon Sep 17 00:00:00 2001 +From: Krishna Kurapati +Date: Sun, 18 Jun 2023 17:39:49 +0530 +Subject: usb: dwc3: gadget: Propagate core init errors to UDC during pullup + +From: Krishna Kurapati + +commit c0aabed9cabe057309779a9e26fe86a113d24dad upstream. + +In scenarios where pullup relies on resume (get sync) to initialize +the controller and set the run stop bit, then core_init is followed by +gadget_resume which will eventually set run stop bit. + +But in cases where the core_init fails, the return value is not sent +back to udc appropriately. So according to UDC the controller has +started but in reality we never set the run stop bit. + +On systems like Android, there are uevents sent to HAL depending on +whether the configfs_bind / configfs_disconnect were invoked. In the +above mentioned scnenario, if the core init fails, the run stop won't +be set and the cable plug-out won't result in generation of any +disconnect event and userspace would never get any uevent regarding +cable plug out and we never call pullup(0) again. Furthermore none of +the next Plug-In/Plug-Out's would be known to configfs. + +Return back the appropriate result to UDC to let the userspace/ +configfs know that the pullup failed so they can take appropriate +action. + +Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") +Cc: stable +Signed-off-by: Krishna Kurapati +Acked-by: Thinh Nguyen +Message-ID: <20230618120949.14868-1-quic_kriskura@quicinc.com> +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2631,7 +2631,9 @@ static int dwc3_gadget_pullup(struct usb + ret = pm_runtime_get_sync(dwc->dev); + if (!ret || ret < 0) { + pm_runtime_put(dwc->dev); +- return 0; ++ if (ret < 0) ++ pm_runtime_set_suspended(dwc->dev); ++ return ret; + } + + if (dwc->pullups_connected == is_on) { diff --git a/queue-6.1/usb-serial-option-add-lara-r6-01b-pids.patch b/queue-6.1/usb-serial-option-add-lara-r6-01b-pids.patch new file mode 100644 index 00000000000..2e014e97597 --- /dev/null +++ b/queue-6.1/usb-serial-option-add-lara-r6-01b-pids.patch @@ -0,0 +1,65 @@ +From ffa5f7a3bf28c1306eef85d4056539c2d4b8eb09 Mon Sep 17 00:00:00 2001 +From: Davide Tronchin +Date: Thu, 22 Jun 2023 11:29:21 +0200 +Subject: USB: serial: option: add LARA-R6 01B PIDs + +From: Davide Tronchin + +commit ffa5f7a3bf28c1306eef85d4056539c2d4b8eb09 upstream. + +The new LARA-R6 product variant identified by the "01B" string can be +configured (by AT interface) in three different USB modes: + +* Default mode (Vendor ID: 0x1546 Product ID: 0x1311) with 4 serial +interfaces + +* RmNet mode (Vendor ID: 0x1546 Product ID: 0x1312) with 4 serial +interfaces and 1 RmNet virtual network interface + +* CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1313) with 4 serial +interface and 1 CDC-ECM virtual network interface +The first 4 interfaces of all the 3 USB configurations (default, RmNet, +CDC-ECM) are the same. + +In default mode LARA-R6 01B exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parser/alternative functions + +In RmNet mode LARA-R6 01B exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parser/alternative functions +If 4: RMNET interface + +In CDC-ECM mode LARA-R6 01B exposes the following interfaces: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: AT parser/alternative functions +If 4: CDC-ECM interface + +Signed-off-by: Davide Tronchin +Link: https://lore.kernel.org/r/20230622092921.12651-1-davide.tronchin.94@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1151,6 +1151,10 @@ static const struct usb_device_id option + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x90fa), + .driver_info = RSVD(3) }, + /* u-blox products */ ++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1311) }, /* u-blox LARA-R6 01B */ ++ { USB_DEVICE(UBLOX_VENDOR_ID, 0x1312), /* u-blox LARA-R6 01B (RMNET) */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(UBLOX_VENDOR_ID, 0x1313, 0xff) }, /* u-blox LARA-R6 01B (ECM) */ + { USB_DEVICE(UBLOX_VENDOR_ID, 0x1341) }, /* u-blox LARA-L6 */ + { USB_DEVICE(UBLOX_VENDOR_ID, 0x1342), /* u-blox LARA-L6 (RMNET) */ + .driver_info = RSVD(4) },